Why CIP matters
CIP is the minimum required identity-verification procedure at account opening for any institution regulated under the BSA. It defines the four data elements that must be collected (name, date of birth, residential address, taxpayer ID or other government identifier) and requires the institution to verify the identity within a reasonable time after account opening.
For a fintech, CIP is the floor. KYC, risk scoring, and EDD sit on top.
When CIP discipline shows up
It shows up in: (a) bank exams that sample your onboarding files, (b) regulator focus during enforcement cycles (CIP gaps are a frequent finding in consent orders), (c) fraud incidents that get traced back to weak identity verification, and (d) sponsor bank audits that periodically pull onboarding samples for review.
Common pitfalls
- Documentary vs non-documentary verification. The rule permits either, but the institution's CIP procedures must specify how each is used. Programs that switch implicitly create exam findings.
- Address verification thin spots. PO boxes and recently-changed addresses are flagged categories. Track address-change patterns.
- Verification windows. CIP must be completed within a reasonable time \u2014 typically interpreted as within days, not weeks. Programs that batch verification overnight or longer drift into exam exposure.
CIP is the cheapest place in a fintech program to be sloppy and the most expensive place to get caught.