Occasionally we will open and activate an account before all required CIP information is obtained for both parties of a joint account. This primarily occurs when only one of the joint owners is present at account opening.

Is there regulatory guidance or an industry best practice regarding the length of time permitted for the above described condition to exist before we should close the account due the CIP information deficiency?

It is my understanding that ALL CIP information MUST be obtained PRIOR to account opening, but you may exercise a reasonable amount of time to verify that info (i.e. a reasonable belief in the customer's true identity).

CIP info MUST include: name, physical address, TIN (if US - or proof of application of TIN), DOB (if individual) & government issued ID w/photo or other similiar biometric).

Prior to account opening the Name, Date of Birth, Address and Identification Number (TIN for a US Person) must be obtained.

Verification of this is required within a reasonable time after the account is opened.

We routinely open certain types of accounts with the minimum information and compelete our verification through documents after the fact. We have a tracking system and a strict limit of 30 days. We close the account if this deadline is not met. The regulators and auditors have not had a problem with this approach.

Fo our documentary verification we require an unexpired government issued ID.

This does not apply to all account types. It is only for selected product types.

The CIP regulation allows a bank to open an account without an identifying number (TIN) if the bank knows that the appropriate number is being applied for. It does not make an allowance for other delays in obtaining the requisite ID information. You can verify information before or promptly after opening the account.

My read of the FinCEN regulation is that if you don't receive all four items of CIP-required information (name, DOB, TIN and street address) for each owner, you cannot open the account. If one of the owners actually does not have a TIN and applies for one, you can open the account pending receipt of that TIN. I can't think of a situation in which that would happen, when you're dealing with individuals.

The required information is obtained in these cases. The photo ID is the piece of information that is typically missing.

OK. That's acceptable, but you have to verify the customer's identity to the bank's satisfaction within a reasonable time after the account is opened. 31 CFR 1020.220(a)(2)(ii)


And there is the rub. Your CIP policies should say how quickly the verification should be completed, and your procedures should indicate how the verification will be accomplished, and what documents, if any, will be used. You can also use non-documentary sources to verify identity, if your CIP permits it. Most banks that I'm familiar with have given themselves up to 30 days from account opening to complete the verification. From my perspective, that seems completely reasonable. Some have a shorter verification period.

I often hear from banks who open joint accounts when only one of the joint owners is present, with the intent that the other owner will sign and return signature cards quickly. Of course, follow-up is the problem. The bank is left with an account that appears to be joint but no contract with one of the individuals, and almost always no verification of an ID. That can create problems if the signature and ID are never obtained, since ownership can be challenged and CIP processes can be criticized. There's also a problem if the bank fails and the FDIC finds that the "joint" account isn't really joint under their rules.

My suggestion is usually to hold account opening in suspense until the second signer visits, and set a firm one-week deadline for the account to be opened, or the account will be refused and any checks for the deposit will have to be returned unprocessed. Of course that only works in an "in-person" opening environment with customer contact people who can enforce the requirements.

Thanks John.

Just another thought - if you are running that individual through a consumer reporting agency (e.g. ChexSystems) without having his/her signature/authorization to do so, you may have additional issues to contend with.