Hey, welcome back to VoraPrep Audio.
Let’s imagine you’re at your desk. A new potential client walks in. They're an international student, and they want to open a cash account. They have a valid foreign passport, which is great. For their address, they show you a utility bill. They don't have a U.S. driver's license yet.
You look at your firm’s policy. It says you need two forms of ID. Your brain starts spinning… is this enough? Can I open this account? The passport is one government ID. But what about the utility bill? What are the actual rules here?
This is exactly the kind of scenario the exam loves to throw at you. It’s not just about memorizing rules. It’s about applying them under pressure.
So let's talk about the Customer Identification Program, or CIP.
Think of the CIP as being the bouncer at a club. Your firm is the club, and the financial system is the party inside. Your job is to check ID.s at the door. This is mandated by the Bank Secrecy Act and enforced by Fin-CEN, the Financial Crimes Enforcement Network. You need to have a reasonable belief that you know the true identity of every single person you let in. It’s all about preventing bad actors, like money launderers, from getting into the party.
Every broker-dealer has to have a written CIP. It's the firm's official rulebook for identity checks, and it must be approved by the board of directors. This rulebook must have a few key components.
First, it lays out procedures for collecting information and verifying a customer's identity.
Second, it explains how the firm will keep records of this verification process.
Third, it includes a process for checking customer names against government lists of known or suspected terrorists.
And fourth, the firm must give customers a notice. This notice clearly states that the firm is requesting information to verify their identity. It's all about transparency and complying with federal law.
So, let's focus on that first component: collecting the key pieces of information. There are four things you must get before opening an account.
First, you need their full legal name. Simple enough.
Second, their date of birth. This helps confirm they are who they say they are. It also confirms they're old enough to be opening an account.
Third, you need an address. And this is a big one. It has to be a physical street address. A PO. Box is okay for mailing statements, but you can't use it as their only address. Why? Because you need to know where the person actually lives. It's much harder to track down someone who only gives you a post office box.
And fourth, an identification number. For a U.S. person, that’s easy. It's their Social Security Number or another Taxpayer ID. Number. For a non-U.S. person, like our student? It could be a taxpayer ID number from their home country. Or a passport number. Or an alien identification card number. Basically, some kind of unique government-issued number.
So, you’ve collected the four pieces: Name, Date of Birth, Address, and ID. Number. Now what? You can’t just take their word for it. The next step is verification. You have to verify that the information is real. And you have to do it within a reasonable time after opening the account.
Your firm's CIP will lay out two ways to do this.
The first way is documentary. This is what you’d expect—looking at documents. For an individual, you’re looking at a driver's license or a passport. For a business, you might look at their articles of incorporation or a business license. You're holding a piece of paper, or a card, and matching it to the person.
But what if they don't have those documents? Or what if you're a little unsure? That brings us to the second method: non-documentary verification. This is where you do a little detective work. You might use a public database to cross-reference their information. You could check their credit report. You might even call a phone number they provided just to see if it connects to them. It’s about using other sources to get comfortable that this person is real.
And your firm has to have a plan for what to do if you can't verify someone's identity. Maybe you don't open the account. Or if it's already open, you close it. And if things seem really off, you might have to file a Suspicious Activity Report, or an SAR.
Now, let's talk about memory. You've done all this work to identify and verify your customer. You can't just toss the records. You have to keep them. And the magic number here to remember for the exam is five. Five years. You have to keep the records of how you verified their identity. And you have to keep them for five years after the account is closed. Think about that. The customer could be gone for years, but you still need that paper trail showing you did your job at the very beginning.
So, let's go back to our international student. They gave you a name, date of birth, a physical address on a utility bill, and a passport number. You’ve collected the four required pieces of information. Now, for verification. The passport is a great documentary method. But the firm's policy says two forms of ID. The utility bill confirms the address, but it's not a government ID.
So what do you do? This is where non-documentary methods come in. The firm could use a commercial database to see if their information checks out. They could cross-reference with another financial institution. The point is, just because the documents don't perfectly match the firm's standard procedure... that doesn't mean it's a dead end. The firm has flexibility to use other methods. They can get to that "reasonable belief" that they know the customer's identity. The key is to follow the firm's written plan for these situations.
One of the big traps on the exam is the PO box. If they give you a scenario where a PO box is the only address, that’s a red flag. You need a physical location. Another one is the five-year rule. They'll try to trip you up with different timeframes. Just burn it in your brain: five years after the account is closed. And don't fall for the idea that if a customer is "well-known," you can skip the process. Nope. You have to follow your CIP for everyone. Every single time.
Alright, let's test this with a quick question. Imagine a new customer gives you their name, date of birth, a valid passport... and a PO. Box as their only address. What's the most immediate problem? Is it that the passport isn't good enough? Or that you need to file an SAR right away?
(slight pause)
No, the immediate problem is the address. The CIP rule requires a physical street address. A PO box alone won't cut it. You'd need to go back to the customer and get that physical address before you can move forward.
Okay, one more. You open an account. You verify the person's identity with their driver's license and a database check. Everything's good. How long do you have to keep the records of that verification?
(slight pause)
You got it. Five years after the account is closed. Not five years from when it was opened. After it's closed. That's a crucial distinction.
So to wrap it all up, remember what CIP is all about: knowing your customer. You start by giving the customer a notice, explaining why you need their information. Then you collect the four key pieces of info: name, date of birth, physical address, and an ID number. Next, you verify that info using either documents or non-documentary methods. You also check their name against government watch lists. And finally, you keep a record of how you did it for five years after the account is closed. That's the core of it. Get that down, and you'll be ready for whatever the exam throws at you.
VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.