What Is a Customer Identification Program (CIP)?
What a CIP is under 31 CFR 1020.220: the 4 required data points, verification, 5-year records, list checks, notice, CIP vs CDD vs KYC, and who needs one.
Article summary
TL;DR
A Customer Identification Program (CIP) is the written procedure a US bank or other covered financial institution must follow to identify each new customer. Before opening an account, it collects at least name, date of birth, address and an ID number, then verifies them, checks government terrorist lists, keeps records and tells customers why it asks.
- The bank CIP rule is 31 CFR 1020.220. The CIP must be part of the bank's anti-money laundering program.
- Four data points are the minimum: name, date of birth, address and an identification number (a taxpayer ID for US persons).
- Identity can be verified with documents, non-documentary methods such as database checks, or both.
- Identifying information is kept for five years after the account is closed.
- eCFR has CIP sections for banks, broker-dealers, mutual funds, futures commission merchants and introducing brokers, but none for money services businesses.
ChatGPT
Claude
Perplexity
GrokOn this page
Open a US bank account and you will be asked for your name, date of birth, address and Social Security number before anything else. That is the Customer Identification Program at work. Here is what the rule requires, how it differs from KYC, and who must have one.
What is a Customer Identification Program?
A CIP is a written procedure that a bank must have as part of its anti-money laundering program. It must let the bank "form a reasonable belief that it knows the true identity of each customer".131 CFR 1020.220, Customer identification program requirements for banks (eCFR, up to date as of October 9, 2026) The rule, 31 CFR 1020.220, sets five parts:
| Part | What the rule requires |
|---|---|
| Collect | Before opening the account: name, date of birth, address, and an ID number. For a US person, a taxpayer ID. For a non-US person, a passport number and country, alien ID card number or similar document |
| Verify | Within a reasonable time, using documents (unexpired photo ID such as a passport), non-documentary methods (consumer reporting agency, public database, references), or both |
| Keep records | Identifying information for 5 years after the account closes; document and verification records for 5 years after they are made |
| Check lists | Whether the customer is on a federal list of known or suspected terrorists designated by Treasury |
| Give notice | Tell customers, before the account opens, that the bank asks for this to verify identity |
Source: 31 CFR 1020.220(a)(2) to (a)(5).131 CFR 1020.220, Customer identification program requirements for banks (eCFR, up to date as of October 9, 2026) If the bank cannot verify a customer, its CIP must say when it refuses or closes the account and when it files a Suspicious Activity Report.
Inside Tagada
See every payment's route, processor by processor
Set the order your processors are tried in, per store, per country or per product.
CIP vs CDD vs KYC
People often use these terms as if they meant the same thing. In US rules they are separate pieces.
| CIP | CDD | KYC | |
|---|---|---|---|
| Question | Is this person who they say they are? | What is this relationship for, and does activity fit? | All of the above |
| When | At account opening | At opening and ongoing | Whole relationship |
| US rule | 31 CFR 1020.220 | 31 CFR 1020.210 and 1010.230 | Common name, not a rule |
Customer due diligence (CDD) adds understanding "the nature and purpose of customer relationships" and ongoing monitoring.231 CFR 1020.210, Anti-money laundering program requirements for banks (eCFR, up to date as of October 9, 2026) For companies, the beneficial ownership rule adds the people who own or control the business.431 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, up to date as of October 9, 2026) The full picture, including EU rules, is in know your customer. Later checks are covered in ongoing monitoring and name screening.
Who needs a CIP, and what it means for merchants
The eCFR has separate CIP sections for banks (1020.220), broker-dealers (1023.220), mutual funds (1024.220), and futures commission merchants and introducing brokers (1026.220). Money services businesses have an AML program rule (1022.210) but no CIP section.331 CFR Chapter X, sections 1023.220, 1024.220, 1026.220 and 1022.210 (eCFR, up to date as of October 9, 2026) Some guides list MSBs and insurers as CIP-covered. The eCFR has no CIP section for either.
An online store is not on that list. You meet the CIP idea from the other side: your bank and your payment provider verify you before they open your account. For card processing, that check is part of underwriting. For how providers keep watching risk after onboarding, see our guide to payment risk management.
How Tagada helps
Verified before the first payment
Each file is still underwritten, with enhanced review on regulated verticals.
Frequently asked questions
What does a CIP verify, and how long are records kept?
Does a fintech or payment app need a CIP?
Is CIP a US-only rule?
Sources
Checked October 15, 2026- 31 CFR 1020.220, Customer identification program requirements for banks (eCFR, up to date as of October 9, 2026)
- 31 CFR 1020.210, Anti-money laundering program requirements for banks (eCFR, up to date as of October 9, 2026)
- 31 CFR Chapter X, sections 1023.220, 1024.220, 1026.220 and 1022.210 (eCFR, up to date as of October 9, 2026)
- 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, up to date as of October 9, 2026)
TagadaPay
Get underwritten once, process across several providers
Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.
- 01Tell us what you sell and how
- 02Underwriting reviews your business
- 03Process through TagadaPay alongside your other processors