KYC and Customer Identification Program (CIP)

What it is

The regulatory floor (US):

• Banks: 31 CFR 1020.220.
• Broker-dealers: 31 CFR 1023.220, which closely mirrors the bank rule but references SEC oversight and SEC recordkeeping (17 CFR 240.17a-4).

Both require a written, risk-based CIP within the AML program that:

• Collects, before account opening, at minimum: name, date of birth (individuals), address (residential or business street address for individuals), and an identification number. For US persons this is a TIN. Non-US persons can provide a passport number with country of issuance, an alien ID number, or another government-issued ID number.
• Verifies identity within a reasonable time before or after opening, using documentary methods (an unexpired government photo ID), non-documentary methods (comparing data against consumer reporting agencies or public databases, contacting the customer, checking references), or both. Non-documentary procedures must address customers without photo ID, unfamiliar documents, and accounts opened without face-to-face contact, which covers every digital onboarding.
• Sets procedures for verification failure: when not to open the account, what the customer may do while verification is pending, when to close, and when to file a SAR.
• Keeps records: identifying information for five years after account closure; records of documents relied on, verification methods and results, and how discrepancies were resolved for five years after the record is made.
• Gives customers notice that information is being requested to verify identity.
• Allows reliance on another regulated financial institution, under conditions including an annual certification contract.

KYC more broadly also includes customer due diligence (CDD), beneficial ownership for legal entities, sanctions screening, and ongoing monitoring. Fintechs operating through sponsor banks inherit the bank's CIP obligations by contract.

What it stops (and what it doesn't)

CIP sets a compliance floor, and on its own it does little against fraud. It verifies that an identity exists and is consistent. It doesn't establish that the applicant is that person, intends to use the account in good faith, or will keep control of it.

Design considerations

• Tie verification strength to transaction exposure. The payoff from better KYC is that you can safely grant higher limits sooner. Design tiers: lightly verified accounts get low funding limits, extended holds and no instant credit; strongly verified accounts get instant funding and larger withdrawals. This is where KYC connects to Velocity and Exposure Limits and Funds Availability Holds.
• Use a verification waterfall. Start with cheap data checks, then add documentary or biometric steps for the gray zone. Record every step's outcome as structured data (Identity Verification Outcomes); those outcomes are strong features later.
• Use "pending verification" restrictions. The rule lets you define what a customer can do before verification completes. Use it to block payouts and instant funding until verification clears.
• Watch for drift after onboarding. A verified identity whose contact points, devices and payout destinations all change later is a takeover, sale or mule-recruitment signal. Carry onboarding attributes forward and compare.
• Use the name-match chain. The verified legal name is the anchor for Bank Account Ownership Verification. A payout account in a different name is a top mule and farming indicator.
• Re-run KYC on events after onboarding. Large outbound transfers, sudden balance spikes, dormancy followed by activity, or a contact-change wave on a high-value account can all justify re-verification.
• In retail and rewards, cashback apps and marketplaces usually have no CIP mandate, but lightweight KYC at the payout moment (name, DOB, last four of SSN or TIN for 1099 thresholds, plus phone and email risk) is a strong anti-farming control, and tax-reporting obligations may already require it.

Implementation path

Customer friction and trade-offs

• Every additional step costs conversion. Document capture is usually the largest drop-off. The waterfall exists so most applicants never see it.
• Thin-file applicants (young people, immigrants, people who have recently moved) fail data checks more often. A documentary alternative is required to avoid unfair exclusion. Monitor outcomes for disparate impact (Privacy and Data Use in Fraud Prevention).
• Holding an account in pending status hurts activation. Restricting payouts and instant credit, rather than the whole account, keeps most of the value of being cautious.

Measuring effectiveness

• Fraud rate by KYC tier and verification path, measured at 30, 90 and 180 days, split by mechanism (synthetic, mule, first-party, ATO). It shows where KYC is and isn't working.
• Auto-verification rate, manual review rate and abandonment at each waterfall step.
• Synthetic leakage: accounts later classified synthetic that passed onboarding, and which step they passed.
• Mule leakage: accounts later offboarded for mule activity, by onboarding signals. Mostly a downstream problem, but some onboarding features do predict it.
• Loss avoided by tier-based limits: exposure on accounts that went bad before reaching full limits.

Common failure modes

• Treating "KYC passed" as a trust signal that suppresses later monitoring.
• No link between KYC and limits, so lightly verified accounts get instant funding and full payout capacity.
• Storing only pass/fail and discarding granular match results.
• Ignoring identity drift once the account is open.
• A sponsor-bank mismatch, where the program's operational practice diverges from the bank's written CIP.
• A documentary fallback that injection or deepfakes can beat, with no liveness or injection detection.

Regulatory and policy notes

• CIP rules:
  • Banks: 31 CFR 1020.220. Broker-dealers: 31 CFR 1023.220.
  • Both require name, DOB, address and ID number; risk-based verification within a reasonable time; failure procedures; five-year recordkeeping; customer notice; and conditions on reliance.
  • The FFIEC BSA/AML manual notes there are currently no designated government lists for CIP purposes. OFAC and 314(a) checks are separate obligations.
• CDD and beneficial ownership for legal-entity customers (31 CFR 1010.230). Ongoing monitoring obligations feed into Transaction Monitoring and BSA-AML and SAR Filing.
• Broker-dealers: FINRA Rule 4512 (customer account information, including trusted contact). See Broker-Dealer Obligations (FINRA and SEC).
• NIST SP 800-63A-4 (2025) is voluntary for private firms and a useful benchmark: a fraud-management program, a death-records check, SIM-swap and device-tenure checks, and injection and forged-media controls for remote proofing.

Mechanisms addressed

• Synthetic Identity Fraud (partially)
• Money Mules (weakly at onboarding; mostly downstream)
• Account Farming and Resale, Multi-Accounting, Fake Account Creation (Bots)
• Sign-Up Bonus Abuse
• ACH Funding Fraud and Bust-Out Fraud, through tiered limits
• ACATS Transfer Fraud (inbound transfers under stolen identities)

Related controls

• Document Verification and Liveness
• Bank Account Ownership Verification
• Velocity and Exposure Limits
• Funds Availability Holds
• Transaction Monitoring
• Consortium and Data Sharing
• Playbooks: Playbook - Synthetic Identity Detection Members, Playbook - Money Mule Detection Members, Playbook - Multi-Accounting and Linkage Members

Sources and further reading

• 31 CFR 1020.220: CIP for banks (Cornell LII): minimum data, verification methods, failure procedures, recordkeeping, notice, reliance.
• 31 CFR 1023.220: CIP for broker-dealers (Cornell LII): broker-dealer equivalent; SEC 17a-4 recordkeeping tie-in.
• eCFR: 31 CFR 1020.220: official current text.
• FFIEC BSA/AML Manual: Customer Identification Program: examiner expectations; no designated CIP government lists currently.
• NIST SP 800-63A-4: fraud management and remote proofing controls as a benchmark.