USA PATRIOT Act and the Customer Identification Program

The USA PATRIOT Act was signed into law on 26 October 2001. Although widely associated with counterterrorism, Title III, the International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001, made consequential changes to US anti-money laundering law.

A core Title III provision is Section 326, which directed the Treasury Department to establish Customer Identification Program, or CIP, requirements. CIP rules form a baseline for how covered financial institutions identify customers opening accounts and help prevent accounts from being used for money laundering, terrorist financing, fraud, and other illicit activity.

Section 326 and the Customer Identification Program

Section 326 amended the Bank Secrecy Act, or BSA, the foundational US anti-money laundering framework. The BSA requires financial institutions to maintain certain records and report specified transactions and suspicious activity. Treasury regulations implementing Section 326 set detailed CIP obligations for different types of institutions, including banks, broker-dealers, mutual funds, and futures commission merchants.

In practical terms, a CIP requires a covered institution to maintain reasonable procedures to form a reasonable belief that it knows the true identity of each customer. For an individual, the core information generally includes:

• Name
• Date of birth
• Residential or business address
• An identification number, such as a US taxpayer identification number, or for certain non-US persons, a passport number and country of issuance or another government-issued document number

Institutions must verify identity using documentary methods, non-documentary methods, or a combination. Documentary verification can include reviewing an unexpired government-issued photo identification document. Non-documentary approaches can include checking information against consumer reporting agencies, public records, databases, or other reliable sources. The appropriate approach is risk-based: a firm should use procedures suited to the customer, account, product, and relevant fraud or money-laundering risks.

CIP rules also require recordkeeping, notice to customers that identity information will be requested, and procedures for handling cases where identity cannot be verified. Institutions must compare customer information against applicable government lists of known or suspected terrorists or terrorist organizations, when required by a federal agency.

Other important Title III authorities

Title III did more than establish CIP. Its other provisions gave US authorities and financial institutions additional tools to address higher-risk cross-border relationships and share relevant intelligence.

• Section 312 requires enhanced due diligence and, in some circumstances, additional scrutiny for correspondent accounts and private banking accounts involving non-US persons. A correspondent account is an account one financial institution maintains for another, often to support cross-border payments.
• Section 314 supports information sharing. Section 314(a) enables FinCEN, the Financial Crimes Enforcement Network, to request that financial institutions search records for links to suspected money laundering or terrorist activity. Section 314(b) offers a safe harbor, subject to conditions, for voluntary information sharing among participating financial institutions.
• Section 311 authorizes Treasury to designate a foreign jurisdiction, financial institution, class of transaction, or type of account as a primary money laundering concern and impose one or more special measures. These can range from additional recordkeeping to restrictions on correspondent accounts.

CIP in remote and digital onboarding

The statute predates smartphones, selfie checks, and most digital-first banking. Yet its principles apply directly to remote account opening. A bank or other covered firm may use digital identity verification tools to collect CIP data and assess whether identity evidence is authentic and belongs to the applicant.

Modern onboarding commonly combines document capture, automated document-authenticity checks, database and credit-bureau queries, device and behavioral signals, biometric comparison between a selfie and an identity document, and sanctions or watchlist screening. These methods can support a CIP, but technology alone does not determine compliance. Institutions remain responsible for procedures, risk assessments, exception handling, record retention, and escalation where verification is incomplete or suspicious.

Scope and continuing relevance

CIP is one element of a wider BSA and anti-money laundering compliance program. It is distinct from, but often operationally connected to, customer due diligence, beneficial ownership identification, sanctions compliance, transaction monitoring, and suspicious activity reporting. Requirements vary by institution type, customer category, product, and regulator.

This explainer is for general information and is not legal advice. Organizations should consult qualified counsel and applicable Treasury, FinCEN, and prudential-regulator guidance when designing or reviewing compliance programs.