A measured shift in customer identification

In June, U.S. financial regulators issued a carefully considered exemption to the Customer Identification Program Rule, allowing banks to collect Taxpayer Identification Numbers from third-party sources rather than directly from customers. This exemption — granted by the OCC, FDIC, NCUA and, in late July the Federal Reserve with the concurrence of FinCEN — modifies a key requirement under Section 326 of the USA PATRIOT Act and reflects a broader shift toward modernizing compliance in the digital age..The exemption is the result of a formal Request for Information issued by FinCEN in March 2024, which sought public input on the risks, benefits and safeguards associated with alternative Taxpayer Identification Number collection methods. It builds on a long-standing exception for credit card accounts and acknowledges the growing role of digital banking, identity verification technologies, and consumer privacy concerns.Section 326 of the USA PATRIOT Act requires financial institutions to implement procedures for verifying the identity of customers opening accounts. The CIP Rule, adopted in 2003, mandates that banks collect specific identifying information — including a Taxpayer Identification Number — directly from customers prior to account opening.Under the new exemption, banks may now obtain Taxpayer Identification Numbers from third-party sources, provided they continue to meet the CIP Rule’s core requirements:-The Taxpayer Identification Number must still be obtained before account opening.-Banks must maintain written, risk-based procedures tailored to their size, services, and customer base.-Institutions must form a reasonable belief that they know the true identity of each customer.The exemption is optional, and banks may continue collecting Taxpayer Identification Numbers directly from customers if preferred. Regulators emphasize that this flexibility does not reduce oversight: banks must be able to demonstrate that their procedures — whether using direct or third-party Taxpayer Identification Number collection — are effective and compliant.The decision to grant the exemption was informed by a range of data and stakeholder feedback. FinCEN and the agencies found no evidence that third-party Taxpayer Identification Number collection, when properly managed, increases the risk of money laundering, terrorist financing, or other illicit activity.The exemption also reflects:- Two decades of precedent: Credit card accounts have long been exempt from direct Taxpayer Identification Number collection, with no adverse regulatory outcomes.- Consumer privacy concerns: The Social Security Number (SSN) was the second most exposed credential in data breaches in 2023, according to the American Bankers Association. TransUnion reported that data breach severity reached a two-year high in Q1 2024, largely due to SSN exposures.- Digital transformation: A 2022 Forbes survey found that 78 percent of adults preferred online banking over in-person services. The FDIC reported that nearly 50 percent of U.S. households used nonbank online payment services in 2023.Banks that choose to adopt the exemption must integrate third-party Taxpayer Identification Number collection into their existing CIP framework. Acceptable verification methods may include:- Documentary verification (e.g., government-issued IDs)- Non-documentary methods (e.g., data from credit bureaus, public databases, or other reliable sources).Smaller institutions may opt to continue direct collection, particularly if they lack the infrastructure to implement third-party verification. The exemption is designed to be flexible, not prescriptive.This exemption gives banks a carefully considered option to modernize their identity verification processes while maintaining strong compliance standards. It’s an opportunity to align regulatory obligations with the realities of how customers engage with financial services today.The CIP Rule exemption is a thoughtful response to the realities of modern banking. It preserves the integrity of customer due diligence while offering banks the flexibility to adapt to new technologies and customer expectations. For institutions that adopt it with care and rigor, this change supports both regulatory compliance and innovation in a rapidly evolving financial landscape.Mark Miller is Director of Specialized Consulting for Wolters Kluwer Financial & Corporate Compliance and can be reached at Mark.Miller@wolterskluwer.com.