Hey, welcome to VoraPrep Audio. Glad you could tune in.
Let's talk about a situation that feels like it’s from a movie. But it’s a very real scenario you’ll see on your exam. Imagine you're at a brokerage firm. A new client comes in, seems totally normal, and gives you the information to open an account.
But when your system runs a background check, a red flag pops up. Their name matches someone on a U.S. government watchlist. This is the Specially Designated Nationals list, or SDN list.
The client is standing right there. They insist it’s a mistake because they have a common name. And they want their account opened now. What do you do? Do you open it? Do you tell them about the list? This isn't just a customer service issue. It's a major compliance test, and getting it wrong has serious consequences.
This whole scenario boils down to two separate but related rules you have to keep straight. First is the Customer Identification Program, or CIP. Second is OFAC screening.
Think of it like getting into an exclusive club. The first bouncer at the door is CIP. Their job is just to make sure your ID is real and that you are who you say you are. They’re not checking a blacklist, just verifying your identity. That’s the Customer Identification Program.
It’s part of the USA. PATRIOT Act. Its whole purpose is to fight money laundering and terrorism financing. It does this by making sure firms know who they're doing business with.
So for this first check, the CIP check, you need to collect four specific pieces of information. The rule says you must get this information either before or within a reasonable time after opening the account.
You need the customer’s full legal name. Obvious enough. You need their date of birth. You need a physical address—not a PO. Box, a real street address where they live. And finally, you need an identification number. For a U.S. person, that’s usually their Social Security Number. For a non-U.S. person, it could be a taxpayer ID, a passport number, or another government ID with a photo. Name, birthday, address, number. That’s the minimum.
Once you have that info, you have to actually verify it. You can’t just take their word for it. You can use what are called documentary methods, like looking at their driver’s license or passport. Or you can use non-documentary methods, like checking a credit report or other public databases. Often, you’ll use a mix of both. If you can't verify their identity, you can't open the account. Period.
Okay, so that's the first bouncer, CIP. They’ve confirmed the ID is legit. Now, the customer moves to the second bouncer. This bouncer has a clipboard with a specific list of names. This is OFAC.
OFAC stands for the Office of Foreign Assets Control. It’s part of the Treasury Department. Its job is to enforce economic sanctions. That list on the clipboard is the Specially Designated Nationals and Blocked Persons list—the SDN list. It contains names of individuals, groups, and entities that the U.S. government has sanctioned. You are not allowed to do business with them.
So, CIP asks, "Are you who you say you are?" OFAC asks, "Are you on our 'do not do business with' list?" See the difference? One is about identity verification, the other is about sanctions enforcement.
Now let’s walk through the process from start to finish, using that client with the common name. Let’s call him John Smith.
First, John comes in. Step one: you collect his minimum CIP information. You get his full name, date of birth, physical address, and Social Security Number. Check.
This is where it gets tricky. You move to step four: resolve the potential match. Is your John Smith the same John Smith who's on the government's list? A lot of the time, especially with common names, it’s a false positive. So you have to investigate. You might ask your John Smith for more information, like his middle initial or his place of birth, to see if you can differentiate him from the person on the list.
Let's say you do that, and you confirm it’s a false positive. The John Smith on the list was born in a different country and has a different middle name. Great. You document your findings, and you can proceed with opening the account.
But what if it's a true match? What if, after investigating, you confirm your client is, in fact, the person on the SDN list? This brings us to step five, and you have to get this exactly right for the exam.
First, you must immediately block the account and any assets. Freeze everything. Second, you reject any transactions. Nothing goes in, nothing goes out. Third, you have to report the match to OFAC, and you have to do it within 10 business days.
And here’s the most critical part. It feels unnatural, but it's an absolute rule. You do not, under any circumstances, notify the customer. You don't tell them they're on the SDN list. You don't tell them you're filing a report. Nothing. This is called "tipping off," and it's strictly prohibited. You just block, reject, and report.
The exam loves to test this. They'll give you an answer choice that says something like, "Notify the customer of the OFAC match and ask for an explanation." That is a trap. The correct action is to block the funds and report it, silently.
Another trap to watch for is a question that confuses the timing. Remember, the rule allows you to collect the four CIP items either before or within a reasonable time after the account is opened. So, a question suggesting you can never open an account before getting the info would be wrong. The key is that you must have a reasonable belief that you will learn the customer's true identity. And the verification of that identity must also happen within a reasonable period.
Okay, let's do a quick check to see if this is sticking.
If you said C, Occupation, you're exactly right. While you might ask for their occupation for other 'Know Your Customer' reasons, it's not one of the four mandatory CIP items. The big four are Name, Date of Birth, Address, and ID. Number.
The right answer is a three-part process. You immediately block the assets, reject transactions, and then report the match to OFAC within 10 business days. And the crucial fourth part is what you don't do: you don't tell the customer anything about it.
So, to wrap this all up, just remember the core ideas. CIP is the first bouncer, just checking your ID. It requires four things: Name, Date of Birth, Address, and ID. Number. OFAC is the second bouncer, checking a specific 'no-entry' list, the SDN list. If you get a true OFAC match, the process is simple and strict: Block, Reject, Report. And most importantly, do not tip off the customer.
Getting these compliance steps right is non-negotiable in the real world, and it's a source of easy points on the exam if you just memorize the flow. You've got this. Keep up the great work, and I'll catch you on the next one.
VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.