We currently scan a copy of a customers ID into our Core system at account opening. The scanned copy is available for all employees to view if needed (cashing checks, SARs, CTRs etc). We are going to be starting the process of opening accounts online in the near future. We will require an image of the customers ID be provided, which will then be stored in our Core system, the same as if they opened the account in the bank. Are we allowed to keep these copies scanned into our Core system or do they have to be deleted per "The Regulatory Relief and Protecting Consumer Access to Credit"?

Thanks!

As far as I am aware they has been nary a peep from the regulators on that section of the law and what it actually means.

Just keep in mind that photocopying a military ID (or any official government issued ID) is illegal.
Title 18, US Code Part 1, Chapter 33, Section 701.

Thank you both! Yes burkemi, we do not photocopy any official government issued ID, but I appreciate the reminder!

Thanks again!

SB 2155 (Sec. 213) A financial institution is authorized to record personal information from a scan, copy, or image of an individual's driver's license or personal identification card and store the information electronically when an individual initiates an online request to open an account or obtain a financial product. The financial institution may use the information for the purpose of verifying the authenticity of the driver's license or identification card, verifying the identity of the individual, or complying with legal requirements. The financial institution must delete any copy or image of an individual's driver's license or personal identification card after use.

We take this to mean that the copy must be deleted once we have verified the individual.

Title 18, US Code Part 1, Chapter 33, Section 701
"Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both."

Could this not be interpreted to indicate that financial institutions are authorized under law to make copies of these documents for CIP purposes? We don't currently make copies but wondering what the legal standing would be. I know, I know..... ask your legal council....although this one applies to all banks and CU's so it might be worth addressing if not already addressed.

The USA PATRIOT Act does not authorize the copying of identification for recordkeeping purposes. The regulation requires that we retain a "description of documentary verification" including the type and issuer of the ID, issue date, expiration date, etc.

I have yet to see a legal opinion offered on the law and no regulator has issued formal guidance.

except as authorized under regulations made pursuant to law

There is no law or regulation that says you must keep a copy of any identification document. CIP requires you to document the information, it says nothing about making a copy. We have been down this road before.

So...are we still talking about online account opening only or all account opening? Because now I'm questioning whether we should be scanning ID's (DL and ID Cards) into our Core system at account opening in person.....

The portion of S. 2155 only addresses on-line account opening.

Thanks again Randy! I appreciate all of your help!

I just thought I would add to this post. I asked the lady that does our reviews from an outside company whether this Act refers to the ID's scanned into our online account opening portal or if it also refers to the scanned ID after it has been transferred into our Core system. She stated that it refers to the portal and not our Core system. So once we transfer the image to our Core system and delete it from the online account opening portal we would be compliant.

Hope this helps everyone!

So - she is now the interpreter of a very poorly written piece of legislation? And just how did she come to that conclusion? There is no mention of "portals" or that the requirement goes away just because you transfer the image elsewhere within your organization. While I am sure there are various sources of legislative intent out there prior to passage, how this will be interpreted by any Federal regulatory authority is nothing but a guess.

I totally understand what you are saying Randy and I did reply back to her and ask her if there was something specific that confirmed what she is saying. I let her know my concerns. It seems to me it is going to come down to us making a bank decision and sticking with it until more information is provided or brought up in an exam. The main question I am getting from other employees here at the bank is what difference is there between us scanning the ID an in-person customer into our Core system as opposed to a customer opening an account online. It makes sense to delete it from the online portal and allow it within our Core system along with every other ID we have scanned.

I guess I will wait to hear what she has to say.

I agree - total business decision based on perceived risk. I do not believe that section of the law includes any specific civil or other monetary penalties, so that is a plus. So basically it is a roll of the dice with your regulator and whether they even care.