Which financial institutions must have a Customer Identification Program (CIP), and does an MSB need one?

Banks required to have an AML compliance program must have a written CIP. MSBs and loan or finance companies have no CIP rule, so an MSB does not need a standalone CIP, but it still has identity verification duties built into its AML program.

What the rule says:

• Banks: a bank required to have an AML compliance program under the regulations implementing 31 U.S.C. 5318(h) or the related federal banking statutes must implement a written CIP appropriate for its size and type of business. It must include, at a minimum, each of the requirements of paragraphs (a)(1) through (5), and the CIP must be part of the AML compliance program (31 CFR 1020.220(a)(1)).
• MSBs: subpart B of 31 CFR part 1022 (Programs) ends at 31 CFR 1022.210, and part 1022 contains no CIP section. An MSB's AML program must instead include provisions for complying with the chapter X requirements for verifying customer identification, to the extent applicable to that MSB (31 CFR 1022.210(d)(1)(i)(A)).
• Loan or finance companies: part 1029 has no CIP section either (subpart B ends at 31 CFR 1029.210). Their policies, procedures and internal controls must include provisions for obtaining all relevant customer-related information necessary for an effective AML program (31 CFR 1029.210(b)(1)).

In practice, build these checks into your MSB program procedures by product line:

• Funds transfers of $3,000 or more: check an identification document when a transmittor who is not an established customer places the order in person, before you accept it. Also check it when proceeds are delivered in person to a recipient who is not an established customer, or to its representative or agent. For orders not made in person, or proceeds delivered other than in person, the rule requires only the specified records (31 CFR 1010.410(e)(2), (e)(3), (e)(5)).
• Transactions needing a currency transaction report: verify and record the name and address of the individual presenting the transaction before concluding it (31 CFR 1010.312).
• Bank checks or drafts, cashier's checks, money orders or traveler's checks sold for $3,000 to $10,000 in currency: obtain and verify the purchaser information the rule lists (31 CFR 1010.415(a)).
• Prepaid access providers and sellers: have procedures to verify the identity of a person who obtains prepaid access under a prepaid program and to obtain name, date of birth, address and identification number. Sellers must do the same for a person who obtains prepaid access to funds exceeding $10,000 during any one day. Providers must retain access to the information for five years after the last use of the device or vehicle; sellers must retain it for five years from the date of sale (31 CFR 1022.210(d)(1)(iv)).

Which of these apply depends on your activities, such as funds transmission, instrument sales or prepaid access.

Sources

1. 31 CFR § 1020.220(a)(1)-(5): https://www.law.cornell.edu/cfr/text/31/1020.220
2. 31 CFR part 1022, subpart B; 31 CFR § 1022.210(d)(1)(i)(A), (d)(1)(iv); 31 CFR §§ 1010.410(e)(2), (e)(3), (e)(5), 1010.312, 1010.415(a): https://www.law.cornell.edu/cfr/text/31/part-1022
3. 31 CFR part 1029, subpart B; 31 CFR § 1029.210(b)(1); 31 CFR § 1010.330(e)(2): https://www.law.cornell.edu/cfr/text/31/part-1029
4. 31 CFR 1020.220 (eCFR): https://www.ecfr.gov/current/title-31/section-1020.220
5. 31 CFR 1022.210 (eCFR): https://www.ecfr.gov/current/title-31/section-1022.210

This answer is general information, not legal advice. Forteris is not a law firm.