Source: https://www.fdic.gov/news/news/financial/2005/fil3405a.html
Timestamp: 2019-04-23 07:56:54+00:00

Document:
The staff of the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Financial Crimes Enforcement Network, National Credit Union Administration, Office of the Comptroller of the Currency, Office of Thrift Supervision, and the United States Department of the Treasury (Agencies) are issuing these frequently asked questions (FAQs) regarding the application of 31 C.F.R. § 103.121. This joint regulation implements section 3261 of the USA PATRIOT Act and requires banks, savings associations, credit unions and certain non-federally regulated banks (bank) to have a Customer Identification Program (CIP).
While the purpose of the FAQs document is to provide interpretive guidance with respect to the CIP rule, the Agencies recognize that this document does not answer every question that may arise in connection with the rule. The Agencies encourage banks to use the basic principles set forth in the CIP rule, as articulated in these answers, to address variations on these questions that may arise, and expect banks to design their own programs in accordance with the nature of their business.
The Agencies wish to emphasize that a banks CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. It is critical that each bank develop procedures to account for all relevant risks including those presented by the types of accounts maintained by the bank, the various methods of opening accounts provided, the type of identifying information available, and the banks size, location, and type of business or customer base. Thus, specific minimum requirements in the rule, such as the four basic types of information to be obtained from each customer, should be supplemented by risk-based verification procedures, where appropriate, to ensure that the bank has a reasonable belief that it knows each customers identity.
The Agencies note that the CIP, while important, is only one part of a banks BSA/AML compliance program. Adequate implementation of a CIP, standing alone, will not be sufficient to meet a banks other obligations under the BSA, regulations promulgated by its primary Federal regulator, such as Suspicious Activity Reporting requirements, or regulations promulgated by the Office of Foreign Assets Control.
Finally, these FAQs have been designed to help banks comply with the requirements of the CIP rule. They do not address the applicability of any other Federal or state laws.
The CIP rule applies to a customer, which is generally a person that opens a new account. (Emphasis added.) At what point does the CIP rule apply when the account is a loan? When is the account opened?
Are loan participations purchased from third parties and loans purchased from a car dealer or mortgage broker within the exclusion from the definition of account for loans acquired through an acquisition, merger, purchase of assets, or assumption of liabilities?
Is the CIP rule applicable to a banks foreign subsidiaries?
Is the CIP rule applicable to bank holding companies and their non-bank subsidiaries, or to savings and loan holding companies and their non-savings association subsidiaries?
No, the CIP rule in 31 C.F.R. § 103.121 applies only to a bank. A bank holding company is not subject to the rule solely because it owns a bank. However, a bank holding company may be subject to another CIP rule. For example, if the company is a broker-dealer in securities, it would be subject to 31 C.F.R. §103.122.
Similarly, a non-bank subsidiary of a bank holding company is not subject to the CIP rule for banks solely as a result of being affiliated with a bank in a holding company structure. However, a non-bank subsidiary may be subject to one of the other CIP rules.
Even if a bank holding company is not itself subject to the CIP rule under 31 C.F.R. § 103.121, it should, as a matter of safety and soundness, take appropriate measures throughout its organization to ensure that each entity is in compliance with any applicable CIP rule, to ensure that new accounts receive appropriate due diligence, and generally to protect the consolidated organization from risks associated with money laundering and financial crime.
Should subsidiaries of a bank implement a customer identification program?
Yes. The Federal banking agencies take the position that implementation of customer identification programs by subsidiaries of banks is appropriate as a matter of safety and soundness and protection from reputational risks. Subsidiaries (other than functionally regulated subsidiaries) of banks should comply with the customer identification program rule that applies to the parent bank when opening an account within the meaning of 31 C.F.R. § 103.121. In addition, a number of the Federal banking agencies have separately issued rules that require certain subsidiaries of banks to conduct their activities pursuant to the same terms and conditions that apply to the conduct of such activities by the parent bank. See, e.g., 12 C.F.R. § 5.34 (OCC); 12 C.F.R. § 559.3(h) (OTS).
Some functionally regulated subsidiaries of banks are already subject to a customer identification program rule issued jointly by their functional regulator and FinCEN (i.e., 31 C.F.R. § 103.122 (broker-dealers); 31 C.F.R. § 103.131 (mutual funds); and 31 C.F.R. § 103.123 (futures commission merchants and introducing brokers)). For purposes of the requirements imposed under section 326 of the USA PATRIOT Act, functionally regulated subsidiaries are: broker-dealers, investment companies, investment advisers registered with the SEC, persons licensed to provide insurance, and any entity with respect to a financial activity that is subject to the jurisdiction of the CFTC (such as futures commission merchants, introducing brokers, commodity trading advisors, commodity pools, and commodity pool operators). See 31 U.S.C. § 5318(l)(4); 15 U.S.C. §§ 6805, 6809. Subsidiaries of banks that are functionally regulated by the SEC or the CFTC are required to comply with the applicable CIP rules issued by the SEC or CFTC, respectively, and FinCEN.
Who is the customer when an account is opened by an individual who has power-of- attorney for a competent person who is the named owner of the account?
Is a person who becomes co-owner of an existing deposit account a customer to whom the CIP rule applies?
Is a new borrower who is substituted for an existing borrower through an assumption of a loan a customer to whom the CIP rule applies?
The CIP rule requires a bank to verify the identity of each customer. Under the CIP rule, a customer generally is defined as a person that opens a new account. If a pension plan administrator chooses to remove a former employee from the plan pursuant to section 657(c) of the Economic Growth and Tax Relief Reconciliation Act of 2001 (EGTRRA), it is required by law to transfer these funds to a financial institution. In addition, an administrator of a terminated plan may remove former employees that it is unable to locate, by transferring their benefits to a financial institution. Would a plan administrator or the former employee be a bank customer where funds are transferred to a bank and an account established in the name of the former employee, in either of these situations?
In either situation, the administrator has no ownership interest in or other right to the funds, and therefore, is not the banks customer. Nor would we view the administrator as acting as the customers agent when the administrator transfers the funds of former employees in these situations. A customer relationship arises and the requirements of the rule are implicated when the former employee opens an account. While the former employee has a legally enforceable right to the funds that are transferred to the bank, the employee has not exercised that right until he or she contacts the bank to assert an ownership interest. Thus, in light of the requirements imposed on the plan administrator under EGTRRA, as well as the requirements in connection with plan terminations, the former employee will not be deemed to have opened a new account for purposes of the CIP rule until he or she contacts the bank to assert an ownership interest over the funds, at which time a bank will be required to implement its CIP with respect to the former employee.
A bank is an agent for a (bank) credit card issuer. The cards are co-branded, the two banks share in the revenue from the cards issued. However, the issuer approves the credit card applications and handles collections. Is a person who obtains a credit card a customer of the agent bank or the card issuer?
Does the CIP rule prohibit a minor from opening an account?
In the case of these accounts (including, for example, accounts established by governmental entities to administer retirement or benefit plans or by employers to administer stock option or restricted stock plans) that are established as trusts, the banks customer will be the trust established by the employer to maintain the assets. If the account is not a trust, the banks customer will be the employer that contracts with the bank to establish the account.* Based on the bank's risk assessment of any new account opened by a customer that is not an individual, the bank may need "to obtain information about" individuals with authority or control over such an account, including signatories, in order to verify the customer's identity. See 31 C.F.R. § 103.121(b)(2)(ii)(C).
* Note, however, that the CIP rule will not apply if the employer is exempt from the definition of customer under 31 C.F.R. § 103.121(a)(3)(ii).
Does the definition of "customer" include the relationship with an investor that is established when a bank acts as a registered transfer agent for an issuer, for example, when it effects transactions for the investor in the securities of an issuer as part of the issuer's dividend reinvestment plan or as part of the plan or program for the purchase or sale of that issuer's shares in a manner that does not cause the bank to be a broker under the Securities Exchange Act of 1934?
Who is the customer for purposes of trust accounts? Does it make a difference whether the bank or a third party is trustee for the trust?
Who is the customer for purposes of escrow accounts?
A loan and a time deposit are each an account for purposes of the CIP rule. How do the requirements of the CIP rule apply to a loan that is renewed, or a certificate of deposit that is rolled over?
Does the exclusion from the definition of customer in 31 C.F.R. § 103.121(a)(3)(ii)(C) for a person with an existing account extend to a person who has had an account with the bank in the last twelve months but who no longer has an account?
How can a bank demonstrate that it has a reasonable belief that it knows the true identity of a person with an existing account with respect to persons that had accounts with the bank as of October 1, 2003?
Can a bank exclude from the definition of customer a person that has an existing account with its affiliate?
Can a bank open an account for a U.S. person that does not have a taxpayer identification number?
The CIP rule requires a bank to obtain a taxpayer identification number from the customer prior to opening an account from a customer that is a U.S. person. When the banks customer is a trust, what taxpayer identification number should the bank obtain?
Must a bank verify the accuracy of all of the identifying information it collects in connection with 31 C.F.R. § 103.121(b)(2)(i)?
Can a bank use an employee identification card as the sole means to verify a customers identity?
Can a bank use an electronic credential, such as a digital certificate, as a non-documentary means to verify the identity of a customer that opens an account over the Internet or through some other purely electronic channel?
How should a bank verify the identity of a partnership that opens a new account when there are no documents or non-documentary methods that will establish the identity of the partnership?
How should a bank verify the identity of a sole proprietorship that opens a new account, (such as an account titled in the name of an individual doing business as a sole proprietorship) when there are no documents or non-documentary methods that will establish the identity of the sole proprietorship?
Would it be acceptable to retain a description of the non-documentary customer verification method used (such as a consumer credit report or an inquiry to a fraud detection system) in a general policy or procedure instead of recording the fact that a particular method was used on each individual customer's record?
Can a bank keep copies of documents provided to verify a customers identity, in addition to the description required under 31 C.F.R. § 103.121(b)(3)(i)(B), even if it is not required to do so?
Does the original information obtained during account opening have to be retained or can the bank satisfy the recordkeeping requirement by just keeping updated information about the customer, i.e., the customers current address?
If the bank requires a customer to provide more identifying information than the minimum during the account opening process, does it have to keep this information for more than five years?
How does the record retention period apply to a customer who simultaneously opens multiple accounts in the bank?
How does the record retention period apply to a situation where a bank sells a loan but retains the servicing rights to the loan?
Has a list of known or suspected terrorists or terrorist organizations been designated for purposes of the CIP rule?
Does a bank have to provide notice to all owners of a joint account?
How should a bank provide notice to its customer when it engages in indirect lending through a third party such as a mortgage broker or car dealer?
Where a bank is entitled to rely on another financial institution to perform its CIP, whose CIP must the relied-upon financial institution implement?
The reliance provision does not impose on the other financial institution the obligation to duplicate the procedures in the banks CIP. The reliance provision permits a bank to rely on another financial institution to perform any of the procedures of the banks CIP, meaning, any of the elements that the CIP rule requires to be in a banks CIP: (1) identity verification procedures, which include collecting the required information from customers and using some or all of that information to verify the customers identities; (2) keeping records related to the CIP; (3) determining whether a customer appears on a designated list of known or suspected terrorists or terrorist organizations; and (4) providing customers with adequate notice that information is being requested to verify their identities.
When a longstanding customer of another financial institution (including an affiliate) opens a new account at the bank, can a bank rely on the other financial institutions verification of the identity of the customer performed before a CIP procedure was required?
A bank that is subject to the CIP rule may rely on another financial institutions verification of the identity of the customer if the requirements of the reliance provision are satisfied. The bank would have to be able to demonstrate that such reliance upon the other financial institutions verification of the identity of the customer is reasonable under the circumstances. For example, the bank could do so by reviewing the relied-upon institutions procedures to ensure that they were adequate although the institution was not yet subject to a CIP rule when it verified the customers identity.
1 Section 326 of the Act adds a new subsection (l) to 31 U.S.C. § 5318 of the Bank Secrecy Act (BSA).

References: § 103
 § 103
 §103
 § 103
 § 103
 § 5
 § 559
 § 103
 § 103
 § 103
 § 5318
 § 103
 § 103
 § 103
 § 103
 § 103
 § 5318