Our CIP program includes documentary an no documentary methods of identification. We also have special instructions for elderly and minors. There are a couple managers that feel the Execs can make exceptions because they have management discretion. I don’t understand how this can be written into the policy. CIP is board approved and is different than other bank policies such as loan policy. Can anyone help back me up.

This excerpt from the FFIEC BSA Exam Procedures / CIP Section may help:

Evaluate the level of CIP exceptions to determine whether the bank is effectively implementing its CIP. A bank’s policy may not allow staff to make or approve CIP exceptions. However, a bank may exclude isolated, nonsystemic errors (such as an insignificant number of data entry errors) from CIP requirements without compromising the effectiveness of its CIP ( 31 CFR 1020.220(a)(1)).

Thanks, So no exceptions other than those that are accidental and it should be infrequent and insignificant , Correct?

The language Brian cited pertains to the pieces of information that must be collected for CIP (name, DOB, TIN, ID). Is your question related to missing documentation at account opening?

We have a CIP Exception form and the BSA Officer or Asst BSA Officer must approve all exceptions, which are typically related to a missing document that is usually obtained within 30 days. We have one or two insignificant exceptions per year. You need to be able to track them as auditors and examiners will ask if there have been any exceptions. You don't want them to find them during transaction testing without you already knowing about them.

When we do our annual and new hire training, we emphasize that our CIP procedure is board approved and that no manager, etc. has authority to approve an exception. I included a quiz question on it when I created our custom online training course to emphasize this point.

We spell it out in our procedures as well.

The annual online training is a continual reminder.

We do allow exceptions but not for the CIP information that has to be obtained for consumers and business customers. A Technical Exception list is produced weekly and anything that has to do with CIP has to be addressed within 30 days or the account is closed. Any other exceptions besides CIP are based on risk.

In the recent situations it's exceptions to what we allow for ID. On one case it was a family member.