CIP Record Retention

Question: We know that records must be maintained for our Customer Identification Program. We are debating how to do this. Do you have any advice?

Answer: When it comes to CIP record retention, it is easier to tell you what to avoid than to give suggestions that will work for everyone. However, there are several important considerations you should take into account. Chuck Lewis, who heads up UMB's compliance consulting affiliate, says you should ask yourself whether four years from now you will be able to produce it. This is a very important point.

Record storage for CIP is different from the record retention of most other regulations. It differs by the probable need to produce it and to re-use or re-evaluate it. For example, if a customer name appears on the OFAC list or the 314(a) list, you may need this information collected at account opening to evaluate the degree of match. This means that your CIP records should not be kept in boxes in a warehouse. Unlike the Regulation B requirement to maintain denied applications for 25 months, CIP records are to be kept not simply for proof of compliance, but for future use.

With this in mind, look at your existing information and technology resources. CIP records need to be maintained as you would a file for a loan kept in portfolio - anticipating regular use. The storage or retention plan also must maintain safeguards for all applicable privacy laws and fiduciary issues.

In short, the answer to your question really depends on what you have available and how you presently use and store information. Keep in mind the principles and requirements that go with CIP and build on what you already have.

Copyright © 2004 Compliance Action. Originally appeared in Compliance Action, Vol. 9, No. 5, 3/04