Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
Banks are not required to use non-documentary methods to
verify a customer’s identity. However, if a bank chooses to
do so, a description of the approved non-documentary
methods must be incorporated in the CIP. Such methods
may include:
• Contacting the customer,
• Checking references with other financial institution,
• Obtaining a financial statement, and
• Independently verifying the customer’s identity
through the comparison of information provided by
the customer with information obtained from
consumer reporting agencies (for example, Experian,
Equifax, TransUnion, Chexsystems), public databases
(for example, Lexis, Dunn and Bradstreet), or other
sources (for example, utility bills, phone books, voter
registration bills).
The bank’s non-documentary procedures must address
situations such as:
• The inability of a customer to present an unexpired
government-issued identification document that bears
a photograph or similar safeguard;
• Unfamiliarity on the bank’s part with the documents
presented;
• Accounts opened without obtaining documents;
• Accounts opened without the customer appearing in
person at the bank (for example, accounts opened
through the mail or over the Internet); and
• Circumstances increasing the risk that the bank will be
unable to verify the true identity of a customer through
documents.
Many of the risks presented by these situations can be
mitigated. A bank that accepts items that are considered
secondary forms of identification, such as utility bills and
college ID cards, is encouraged to review more than a
single document to ensure that it has formed a “reasonable
belief” of the customer’s true identity. Furthermore, in
instances when an account is opened over the Internet, a
bank may be able to obtain an electronic credential, such as
a digital certificate, as one of the methods it uses to verify a
customer’s identity.
Additional Verification Procedures for Customers
(Non-Individuals)
The CIP must address situations where, based on a risk
assessment of a new account that is opened by a customer
that is not an individual, the bank will obtain information
about individuals with authority or control over such
accounts, in order to verify the customer’s identity. These
individuals could include such parties as signatories,
Section 8.1
beneficiaries, principals, and guarantors. As previously
stated, a risk-focused approach should be applied to verify
customer accounts. For example, in the case of a wellknown
firm, company information and verification could
be sufficient without obtaining and verifying identity
information for all signatories. However, in the case of a
relatively new or unknown firm, it would be in the bank’s
best interest to obtain and verify a greater volume of
information on signatories and other individuals with
control or authority over the firm’s account.
Inability to Verify Customer Identity Information
The CIP must include procedures for responding to
circumstances in which the bank cannot form a reasonable
belief that it knows the true identity of a customer. These
procedures should describe, at a minimum, the following:
• Circumstances when the bank should not open an
account;
• The terms or limits under which a customer may use
an account while the bank attempts to verify the
customer’s identity (for example, minimal or no
funding on credit cards, holds on deposits, limits on
wire transfers);
• Situations when an account should be closed after
attempts to verify a customer’s identity have failed;
and
• Conditions for filing a SAR in accordance with
applicable laws and regulations.
Recordkeeping Requirements
The bank’s CIP must include recordkeeping procedures
for:
• Any document that was relied upon to verify identity
noting the type of document, the identification
number, the place of issuance, and, if any, the dates of
issuance and expiration;
• The method and results of any measures undertaken to
perform non-documentary verification procedures; and
• The results of any substantive discrepancy discovered
when verifying the identifying information obtained.
Banks are not required to make and retain photocopies of
any documents used in the verification process. However,
if a bank does choose to do so, it must ensure that these
photocopies are physically secured to adequately protect
against possible identity theft. In addition, such
photocopies should not be maintained with files and
documentation relating to credit decisions in order to avoid
any potential problems with consumer compliance
regulations.
DSC Risk Management Manual of Examination Policies 8.1-11 Bank Secrecy Act (12-04)
Federal Deposit Insurance Corporation