HELP - lenders are ganging up on me. Record keeping requirements include "A description of any document that was relied on under paragraph (b)(2)(ii)(A) noting the type of document, any identification number contained in the document, the place of issuance and, if any, the date of issuance and expiration date". Our commercial lenders do not want to make such notations on the document that will also contain the 4 pieces of information required from the customer. If the lender uses Articles of Incorporation and a Corporate Resolution as documentary evidence, the lender wants to just check a box that indicates their use. No description, just a check mark. The argument is that, upon further research, one could find the document in a credit file, loan file or collateral file.

Doesn't this seem to complicate the CIP program, for auditing, monitoring, etc? But, does the rule actually prohibit this type of retrieval system, absent the description? From my standpoint, and I would imagine an examiners too, this would be a mess.

The reg says your CIP must includes "procedures for making and maintaining a record " of all specified information, including the document description information that you mentioned in your post. That doesn't mean they would have to make notations on the same document as they use for the other information, but it probably means something more than "we should have a copy of that in a file somewhere". I am absolutely SHOCKED that it was your Commercial lenders that suggested this shortcut!

Thanks Ted. I am adamant that to be effective, the customers 4 pieces of information and the banks documentation/description of documents used to verify identity be stored together.Otherwise, its a hunt and peck to prove to anyone that the required procedures were followed. Storage is a hurdle that I haven't gotten over yet. For deposits, yes we could potentially notate the drivers license #, comments, etc on the back of the signature card. But our existing cards are tiny and have no room left for any additional data. Going to a larger card means changing storage cabinets (sure, all by 10/01). For consumer loans, the identifying information could be added to the back of an application. (Probably no problem.) For commercial loans - as I said they want to check a box, as evidence of receipt of the document, and then file the doc somewhere else.
We discussed using a separate "new account identity" form for all new customers. All pertinent information would be recorded and the doc stored centrally. Now, how do we store upwards of 30,000/yr new account forms centrally? Does anyone have a technological method to do so, quickly and in a manner that it can be retrieved by customer? HELP!!!!!!!!!!

Working on it. Desperately. Hoping to have something out early in August, conformable to customer's policy, FFIEC compliant. If I manage it, it will be shareware, free download, approx $500 per branch if you decide to use it live.

But I'm not going to release it without getting the reporting functions and export/convert functions ready, because I think within a year or two most of the host processing systems will have better provisions for this, and ideally your processor should store all of this information. That would facilitate the tracking/monitoring functions you really should have.

IMO it would be almost futile to lock yourself into a separate system long-term, although I realize some will have no alternative. Also, for those who don't run in-house systems, I'm concerned about the long-term cost for maintaining all these separate CIF records. You can't purge anything for at least five years. Even if you have space currently for the required data fields, the systems as they are now designed don't have a good "history" function to preserve the original identifying data(physical address, etc), which seems to be required under the final rule, stupid as that is.

So I frankly don't know how all this is going to play out in the long run; I only know that sitting there with thousands of pieces of paper and no way to search them is not what I personally would want to do. Even though for many banks their actual identification policies won't change that much, the need to document the procedure to an examiner's satisfaction is new; before all you needed to do was design procedures sufficient to protect yourself from risk.

I did finish the interface portion to the Deluxe One interface, so you could pass the data directly through to cbs/Chexsystems etc.

I hate hate hate this reg. HATE it.

Kathy

I tend to side with your lenders on this one. I think having a copy of the document which was relied on in the loan file is adequate. Not quite as easy to audit, that true, but generally when auditing, I'd want to see the copy of the document relied on anyway, if one was made.

A notation on a separate document is also much more prone to error. I would rather not ask my lenders to change their procedures unless it's really necessary. In fact, to the extent that the 4 required items are already captured on an application form, we won't even have a separate document for those.

But, CIP requires a description of the documents used to verify ID. Yes, a part of me understands what better evidence than the original? But how can a CIP program , be tested, audited, monitored if all information isn't stored together? This is a really poor example - but how would we conduct a review of notices of adverse action under Reg B and FCRA if we separated the application from the declination notice from the credit report? I think I'll give the OCC a call again to see what they are expecting to find.

We've got a compromise. We are developing a check sheet that will include acceptable "forms of identification" and they just check off what they used and put a copy in the file. That way we know what they used, but they don't have to "document" all of the specifics.

Michelle,
So you too believe that a checkbox is fine, with no description - them file a copy of the document in the file?How will you comply with the 5 year retention requirement when loans close?

Yes, because the checkbox told us what the "type" of document was, and we only keep 2 loan files, the credit file and the "other" file. This will be in the "other" file and we don't plan on purging the files, the document will stay with the file until 5 years after loan pay-off.

It's a calculated risk we are willing to take from a record retention liability perspective.

Consider yourself fortunate. Our lenders did not even attend this month's Compliance meeting on CIP issues because no one had the time and the senior loan officer would not respond to my e-mail request for input from their department! Surprise surprise as another poster put it.....

I'm willing to share, but right now it's in very early draft stages - the compromise was worked out last week.

I should have the final form by the of the month. That's when everyone's stuff is due to me.

HI Michelle,
I discussed this with the OCC. They will not "dictate" how we are to record the documentary evidence of ID. (Yeah right, just wait until we are examined!!!) A check box that identifies the type of document would be OK, with the document filed separately.
But then, he went on to comment that an examiner would also want proof that the document had been read, possibly matched up to court house records - that the document was sufficient on its face, to substantiate verification of ID. When I inquired as to what that proof might be, he responded that they would likely discuss it with the lender or account opening employee. He also stated that they do not expect banks to have to re-write or develop new forms.

So, sometimes I think we are over-reacting. Then I swing to the exact opposite side and panic that no matter what we do, it will not be sufficient. My middle ground is to roll out a conservative, but compliant program and be prepared to modify it as more guidance is distributed. Right now, I feel that as a compliance manager, I am jumping without a parachute.

We have always used a Loan Documentation Checklist that tells the lender what documents are needed before documents will be drawn. I do not intend to change many things on the lending side as I believe we do our due diligence quite well when making a loan. One thing that will change is the way we handle consumer loans. We obtain credit report in most cases, but I think I am going to have the lender's verify identification at the time the application is sumbitted.

When are others going to identify the customer? At the time of application or at closing?

>I discussed this with the OCC. <

Thanks for posting their comments. I'm glad to hear that a copy of the document in another file plus a reference to it is sufficient.

>But then, he went on to comment that an examiner would also want proof that the document had been read, possibly matched up to court house records - that the document was sufficient on its face, to substantiate verification of ID.<

But, but -- the rule itself says that banks aren't required to verify the authenticity of documents. It does refer to checking for obvious fakes. The final rule seems to be saying that the bank's responsibility is to verify identity, not documents:
"Thus, a bank need not establish the accuracy of every element of identifying information obtained but must do so for enough information to form a reasonable belief it knows the true identity of the customer." and "A bank generally may rely on government- issued identification as verification of a customer’s identity; however, if a document shows obvious indications of fraud, the bank must consider that factor in determining whether it can form a reasonable belief that it knows the customer’s true identity."

>When I inquired as to what that proof might be, he responded that they would likely discuss it with the lender or account opening employee. He also stated that they do not expect banks to have to re-write or develop new forms.<

This seems almost as if the agencies themselves haven't made up their minds as to what they intend the final rule to require of the banks. What if the document is used as supplemental identification only and the institution uses a credit report and financial statement as "primary" identification? Matching up the information on the two would be a pretty reliable method of forming a reasonable belief that you know the customer's true identity.

Again, thank you for posting, but I didn't find the "matched up to courthouse records" very reassuring.

Kathy

>For example, in Colorado, the Secretary of State puts all articles of incorporation, articles of organization (LLC), certificates of limited partnerships, etc, on line. We can therefore, easily verify the validity of the documents as filed with the Sec of State.<

An excellent point, GreatBlue. Luckily the states are putting more and more information online, which of course makes it easier and easier for the criminally entrepeneurial to commit identity theft.

But corporations may be incorporated in one state and doing business in another, and a lot of companies, not all publicly traded, have offices in several different states. If (as is current practice for many of my guys in high-risk areas), they take a copy of the incorporation papers and a corporate authorization, is a bank in Florida supposed to spend its time trying to locate the online databases in 50 different states? For a checking account?

In practice what they will do is pull a credit report. For a loan they'll verify collateral and take a financial statement. They might look at a business license. They'll call their offices or send thank-you letters. The reason that identity theft is such a huge problem is that there is no good way of verifying identity.

Those bankers in Florida are going to accept the snowbirds' licenses from their home states too. At the minimum they'll use Chexsystems on those people. Everything will be confirmed through at least two measures, but then they'll reserve real investigation for loans that bear the greatest loss risks, for businesses that fit in a high-risk category, and for accounts that show certain patterns of activity on monitoring. And you know, reading the word risk in the final rule over 40 times leads me to believe that's a valid approach.

Realistically, most banks I deal with probably can't do much more than they are doing already. I just don't think that because they keep the incorporation papers on file they should be required to investigate their authenticity, and if the examiners try to require it the banks are going to turn to non-documentary means of verification.