What Is a Customer Identification Program (CIP)? Requirements (2026)

Quick answer: A Customer Identification Program (CIP) is the written program US banks and other covered financial institutions must have for verifying the identity of each customer who opens an account. It requires collecting the customer's name, date of birth, address, and an identification number, verifying them with documents or other reliable sources, checking government lists, keeping records, and telling customers why the information is needed.

CIP comes from Section 326 of the USA PATRIOT Act and sits within the Bank Secrecy Act framework. It is the first step of Know Your Customer (KYC) and helps prevent identity theft, fraud, money laundering, and terrorist financing.

Customer Identification Program (CIP)

CIP rules apply when a customer opens a new account. The institution must form a reasonable belief that it knows the customer's true identity, verifying it before the account is opened or within a reasonable time afterward.

CIP is also a building block of the institution's broader AML program. Without reliable identity data at the start, sanctions screening, customer due diligence, and transaction monitoring all become less effective.

Related Solutions

PEP Screening APIKnow Your CustomerAML

Understanding Customer Identification Programs (CIP): The Basics

Financial and banking operations are becoming more computerized, making it difficult for them to keep an eye on.

More people are engaging in digital finance because of the advantages offered by it. However, the anonymity offered by digital-only banking increases the potential for fraud and other illegal activities.

And here comes the role of CIP.

CIP is an important security measure that helps financial institutions and consumers alike find a balance between ease and security. It is composed of a few procedures and guidelines that a company must set up and follow, with the main goal being to verify the legitimacy of its customers or users.

Ensuring the veracity of consumers’ identification assertions is the fundamental goal of putting CIP procedures into place. This is more than just a pointless obstacle for clients to cross.

Because of the complexity of today’s financial environment, businesses need to have a thorough grasp of the people they are doing business with in order to verify an individual’s identification and decide whether or not the firm wants to work with them.

CIPs play an important role in identifying and deterring illicit financial activities.

How do they address this critical need?

By developing a methodical strategy to verify the identities of those conducting financial transactions.

Adopting and implementing CIP requirements enable digital companies:

-To establish the true identity of their customers

-To establish confidence in online interactions

Each institution designs its own CIP based on its size, products, and customer base, but every CIP must collect at least four pieces of information before opening an account:

• Full name
• Date of birth, for individuals
• Address: a residential or business street address for individuals, or a principal place of business for companies
• Identification number: for US persons, a taxpayer identification number such as an SSN or EIN; for non-US persons, a TIN, passport number, alien identification card number, or another government-issued document number

The institution then verifies this information through documentary methods, such as an unexpired driver's license or passport, non-documentary methods, such as checks with consumer reporting agencies, public databases, or other financial institutions, or a combination of both.

CIPs have a significant influence on security, but they do more than merely shield banks from financial crimes.

By making the identification process more efficient, they may also improve client experiences.

By streamlining the onboarding process for new clients, they may lessen the friction for financial organisations that frequently accompanies conventional verification techniques.

A CIP is not just a regulatory obligation but also a strategic enabler for companies dealing in online transactions.

How is CIP different from KYC?

Understanding a customer’s identification and the type of commercial activity they engage in is all included in KYC.

CIP, on the other hand, is concerned with confirming the data that a client has submitted.

In other words, CIP is a minor component of a bigger KYC operation. Determining the degree of risk a consumer provides to the company is the aim of both CIP and KYC, in any case.

This is accomplished through procedures like customer due diligence (CDD), which aren’t covered by the CIP framework. Through the CDD process, companies and financial institutions obtain data to better understand their clients, assess any possible risks, and make sure they are not involved in any illegal activities.

💡 Related Blog:

What’s the difference between CDD and KYC?

Clients deemed to pose a greater risk are required to do further due diligence.

Through this procedure, the bank can confirm the authenticity of the company, evaluate any possible risks related to the client, and guarantee that KYC and AML requirements are being followed.

Who Falls Under the Umbrella of the CIP Rule?

The CIP rule applies to specific types of financial institutions under the Bank Secrecy Act:

• Banks, savings associations, and credit unions
• Brokers and dealers in securities
• Mutual funds
• Futures commission merchants and introducing brokers in commodities

Fintechs that offer accounts through a partner bank usually follow the bank's CIP, because the bank remains responsible for compliance. Other businesses covered by the Bank Secrecy Act, such as money services businesses and casinos, have their own customer identification and AML program requirements.

Many companies that aren't legally required to run a CIP choose to verify identity anyway. Why?

CIP Programs help their clients and the bottom line.

To foster trust and give their consumers a safer, more secure platform, social media and online dating sites, for instance, may deploy CIP programs.

CIP Requirements

Under the CIP rule (31 CFR 1020.220 for banks), a compliant program must:

• Collect identifying information: name, date of birth, address, and identification number before opening the account.
• Verify identity: use documentary methods, non-documentary methods, or both, within a reasonable time, with procedures for cases where identity can't be verified.
• Keep records: retain identifying information for five years after the account is closed, and verification records for five years after they are made.
• Check government lists: compare customers against any lists of known or suspected terrorists or terrorist organizations designated by the federal government.
• Give notice: tell customers that the institution is requesting information to verify their identity.

Digital IDs are now an accepted option. In September 2026, FinCEN and the federal banking agencies confirmed that banks and credit unions may accept state-issued mobile driver's licenses and other government-issued verifiable digital credentials for documentary verification under the CIP Rule, including for accounts opened remotely. The credential must be unexpired, evidence nationality or residence, and bear a photograph or similar safeguard. The institution needs systems that can extract its information, and its CIP must permit it. Accepting digital IDs is optional, and any signs of fraud still count when forming a reasonable belief about the customer's identity.

Taxpayer numbers from third parties. A June 2025 order from the OCC, FDIC, and NCUA, issued with FinCEN's agreement, lets the banks they supervise obtain a customer's full TIN from a third-party source instead of directly from the customer. The Federal Reserve issued a similar order for its banks in July 2025. The TIN must still be obtained before the account is opened, and all other CIP requirements still apply.

By examining the many account kinds offered, the procedures for creating an account, the kinds of information that may be found, and the different company characteristics (size, location, customer base), businesses should also take into account the risks associated with their client base and product offers.

Having a strong and comprehensive CIP – that complies with the CIP Rule – is essential if your company works in the financial sector.

However, even if it is not necessary for your company to verify the identity of your customers, doing so might have several advantages, such as boosting community or platform trust.

Signzy's identity verification APIs automate the collection and verification steps of a CIP, including document checks, database verification, and watchlist screening, with an audit trail for examiners. For the steps that follow CIP, see our guides to customer due diligence and customer reverification.