On August 5, the FDIC announced that banks it supervises can comply with Bank Secrecy Act (BSA) requirements to obtain identity information from new customers by using a pre-populated form, provided that the person opening the account verifies the information. This interpretation follows previous exemptive relief permitting all banks to obtain tax identification numbers (TINs) of new customers from third-party sources instead of directly from the customers.
Overall, these actions seek to modernize customer identification requirements in line with widespread use of electronic banking and the availability of new identity-verification tools.
Five Key Takeaways from the FDIC’s Interpretive Letter
1. Pre-Populated Information Permitted for CIP Compliance
The FDIC announced that it interprets the use of a pre-populated form containing customer information during the account opening process to be compliant with Customer Identification Program (CIP) requirements, which require banks to obtain name, TIN, address and, for individuals, date of birth from customers before opening a new account. FDIC-supervised banks may now elect to use information sourced from current or prior accounts or relationships with the institution or its agents, affiliates, vendors or other third parties, subject to conditions set out below.
2. Customer Review and Confirmation Required
The FDIC will consider the use of a form that is pre-populated with customer information to be compliant with CIP requirements only if the customer has the opportunity and ability to review, correct, update and confirm the accuracy of the information before a new account is opened.
3. Reasonable Belief in Customer Identity Remains Essential
Institutions that elect to rely on the FDIC’s interpretive letter must continue to ensure that their account opening processes allow them to form a reasonable belief that they know the true identity of the customer. This requirement includes assessing and mitigating risks such as fraudulent account opening or account takeover. As a result, the FDIC could consider the use of prepopulated customer information problematic when used for high-risk customers, products or services.
4. The Interpretation Applies Only to FDIC-Supervised Banks (For Now)
This interpretation applies to FDIC-supervised financial institutions. Note that the OCC, Federal Reserve and NCUA have not issued similar interpretations. Additionally, both the Financial Crimes Enforcement Network (FinCEN) and federal bank supervisors have the authority to enforce the BSA, and it remains to be seen if FinCEN and the other federal bank supervisors will release similar guidance. It is also unclear whether other regulators with CIP rules, such as the CFTC and SEC, will follow suit with their own analogous guidance.
5. Continuation of BSA Modernization Trends
The FDIC’s interpretive letter closely follows previous exemptive relief from CIP requirements. The FDIC, OCC, NCUA and Federal Reserve, with the concurrence of FinCEN, recently issued orders granting exemptive relief that permits banks to obtain TINs from a third party rather than directly from the customer. As with the FDIC’s interpretive letter, reliance on the exemptive relief is optional.
Next Steps
This series of actions provides relief from regulatory burdens and modernizes BSA account opening requirements to more closely align with the overall shift to electronic banking and remote account opening. Banks receiving customer information, and the third parties providing it, should ensure that all transfers of sensitive customer information comply with applicable privacy and information security requirements.
[View source.]
