Hello!

I'm wondering if someone knows what the CIP requirements are for opening HSAs please. From what I've found online, it depends upon who our true customer will be. If it's a third party (ie. an unaffiliated insurance agency) who is requesting the account on behalf of their customer, the bank needs to ensure that it's in the contract that the unaffiliated insurance agency will CIP their account holder and we'll just have one account to pass the HSA funds through. Otherwise, we'll need to CIP each HSA owner individually. Also, does it matter if the unaffiliated insurance agency has one account or each HSA owner will have their own account?

Any guidance and assistance is greatly appreciated.

There are no CIP requirements unique to HSA's.

If there is a single account in the name of the insurance company; i.e. they are doing the sub accounting and information reporting for the owners, you have no need to verify the identity of the individuals involved. (This would be a "payable through" account that might raise some eyebrows, but the fact that it is operated by an insurance company and its activities are subject to information reporting should make it low risk.)

If you are going to open accounts in the names of individuals and do information reporting on their behalf, then they are your customers. The CIP regulation describes a mechanism where you can enter into a contractual arrangement with another entity with BSA responsibilities to perform CIP according to their program or the insurance company acts as your agent and it performs CIP according to your program.

Figure out where your profits lie before you build your compliance mechanism, then adjust your projected profits downward for the cost of the mechanism.