Hello! I'm concerned about the verification portion of the BO rule (covered in #4 from the FAQ). It says, "The CDD Rule requires covered financial institutions to establish and maintain written procedures that are reasonably designed to identify and verify the beneficial owners of legal entity customers" (emphasis added).

What is everyone here doing to verify? Our regular CIP procedure is to pull a credit report because we have permission from the customer via their signature card. However, since we will potentially not have the beneficial owner or controller/manager in front of us, I don't feel comfortable pulling credit because we won't have permission from the BO/CM. Any thoughts on a way around this?

Since you do not have permissible purpose, you either will need to modify your verification procedures to obtain a signature from the beneficial owners granting consent to pull the credit report or consider alternative verification methods suggested in the final rule such as requesting a photocopy of a drivers license.

Is a photocopy of a DL considered verifying, even though it wouldn't contain their SSN? Don't we have the verify all information given to us?

Viewing a DL or similar photo identification is an acceptable means of verifying a customer's identity.


The standard set forth in the CIP regulation is that you must verify enough information in order to form a reasonable belief that you know the true identity of the customer. How many (and which) pieces of information you verify in order to form this belief should be based on your risk assessment.

Due to the impossibility of verifying a name/TIN combination in this circumstance, you will likely develop a watered down version of your CIP, a "BOIP," where you indicate you will "verify" nothing more than name, address, and DOB from a photocopy of the individual's identification. (As noted, the CIP regulation never required banks to verify all four identifiers, just enough to form a reasonable belief of the person's identity.)

If it sounds like a waste of time, you understand...

This certainly makes me feel better about this part of the reg - thank all of you so much! I think adding a "BOIP" section in our policy is a great idea.

It does sound like a waste of time