It just dawned on me that customer is defined in the new CIP rules as anyone seeking to open an account. So if Joe comes in to open a DDA and we turn him down because of whant ChexSystems tells us, we still have to ID him and retain copies of all that stuff for 5 years? Is there anything in the rules that says all the stuff we retain has to be retrievable? Good grief my management wants to keep hard copy records in boxes. It would take five years just to find info on a person we turned down.

Also does it say we have to attempt to verify identity through documentary means first, or is that just common sense talking? Some here have suggested using less intrusive methods with pre-existing customers who want to open a new account.

The issue of collection and retention of identification verification information (whew, that's a lot of "tions") for denials and other types who do not actually follow through with opening an account is one of the issues that ABA has identified as needing clarification in their comment analysis. They are encouraging member institutions to comment requesting that these standards NOT apply to those cases.

The regulations themselves do not stipulate whether documentary or non-documentary means should take priority - it's basically whatever your risk-program says it should be. Of course, nothing is there to stop them from later second-guessing your risk analysis and decisions. But I know several large institutions that are going with strictly non-documentary verification programs to minimize retention issues.

You would not have an "ongoing relationship" with this person. I think the problem lies in the definition of "customer", where the definition of customer uses the phrase "seeking to open an account". In my comment letter I am including this very thing. We should not have to retain info on an individual who never opens an account. They do not have an "ongoing" business relationship with us.

However, if we need to obtain the identification documents of anyone opening a new account, it seems that would apply to existing as well as new customers.

I can see a lot of confusion in the commercial lending area. Does "opening" a new account refer to new note advances under a guidance line? Does "opening" refer to signing renewal papers of an existing credit line? These events happen all the time and some of the organizations involved are quite complex. If we have to stop and obtain Driver's License photos of all of them (We HAVE Articles and other formation documents already as part of our commercial underwriting due dilligence), I can see a huge bottleneck near the end of each month when we seek to get these loans on the books.

A risk-based approach is really needed here. What good will it do to obtain the Driver's Licenses of all members of an LLC or partnership when that entity has been a customer of the bank for years?

Write a comment letter. Maybe our letters will help.

If you don't actually open an account, I'm hoping that there is no documentation storage required, for example, if new accounts takes the name and rans it through check systems, get a turndown, but has not copies the ID at that point the person applying is, in most cases, gone and not about to allow the copying of personal documents.

Bonnie - the introductory materials to the proposed rules state: "For example, a bank need not verify the identifying information of an existing customer seeking to open a new account, if the bank (1) previously verified the customer's identity . . . ."

Steve

However, the rule also states Section 103.121(b)(2)
"While a bank's CIP must contain the identity verification procedures set forth above, these procedures are to be risk-based. For example, a bank need not verify the identifying information of an existing customer seeking to open a new account, or who becomes a signatory on an account, if the bank (1) previously verified the customer's identity in accordance with the procedures consistent with the regulation, and (2) continues to have a reasonable belief that it knows the true identity of the customer."

Tina - thanks! So the $65,000 question remains - will we need to get copies of Drivers Licenses on our existing customers who open a new account? We didn't keep copies of DL's before, so even if we followed all the other ID procedure requirements (and our current procedures pretty much mirror the procedures in the proposal), does it matter that we don't have a copy of the DL on file?

According to an article I received on 7/31/02 from Compliance Headquarters under section Account Coverage it states:

"Finally, the law only applies to new account relationships established on or after October 25, 2002."

However, this seems contradictory to the information indicated in the proposed rules. I would say that if you were aware of your customer, i.e. DL on sig card you will probably not be required to obtain a copy later.

Well - one more request for clarification in my comment letter!

Definitely

Regarding the CIP issues-

The CIP should be risk-based, according to the proposal. So some rural areas will likely not feel the need to request a copy of a DL from someone who has been with their financial institution for many years. Several other "threads" have mentioned the issue of lack of picture ID due to religious reasons. All these exceptions should be part of a bank's CIP, if that represents the situation at their institution.

On the other hand, for a bank situated in a larger metropolitan area, it would probably be more prudent to check a current customer's ID documents on file before opening another account, once the CIP regs are official. You may have business accounts that were opened several years ago when you did not obtain ID on the business principals and probably did not check their names against the OFAC list. It may take a few minutes to obtain this information, but it's better to ask for the ID, then have to face a fine from OFAC.

I believe the CIP program was written for banks that operate in high risk areas and/or for those banks that deal with high risk businesses. The "risk-based" analysis of each bank is that bank's way of avoiding some of the burden of the proposed regulation. Use it to your advantage, if possible, but make sure you put it into your policy.

Regarding the need to obtain ID for every disbursement under a line of credit, my opinion is that is not the intention of the proposed reg. It would be ridiculous to ask for this information for each drawdown on a line. It's another one of those things to include in your comment letters, so the rulemakers understand what bankers are facing.