When does a CIP exception become an exception? Our policy allows a CSR or lender to provide the CIP collected to the BSA department within 30 days. That isn't an allowance to collect items after closing,

My interpretation was that if the account is open or loan is funded and the BSA department doesn't have all CIP, anything missing is an exception until everything is received. Management argues that they believe the Bank has possession of CIP when the account is opened or loan is funded and therefore is not an exception, unless the BSA department doesn't have it after the 30 days have passed. What's causing this question is that in too many cases CIP is still outstanding after 30 days.

CIP is collected by the CSR or Lender, scanned and then placed in a network folder where it can be retrieved by the BSA department for review. Are missing items of CIP not placed in the folder within a short time, say a day after account opening considered exceptions, or are they not considered to be exceptions until 30 days have passed?

Sounds like you are mixing up internal control procedures with the law. If you don't meet your board approved CIP - whatever that might entail - prior to the customer relationship being established - you have a violation of the law. There are no provisions for any exceptions under the law. What you deem an internal control policy violation is for your institution to determine.

There are two things to consider here.

1. What is required by regulation.
2. What is required by bank procedures.

You auditor/examiner will criticize the program for violations of either. The USA PATRIOT Act requires that the bank collect name, address, TIN & birthdate and have procedures to verify enough of this information to form a reasonable belief that we identify the customer.

It sounds like the BSA Department is performing the quality assurance process to verify that the front lines have followed procedures. If I have a document and forget to put it in the correct folder, that is a clerical error. If I failed to obtain the document in accordance with policy and procedures, that is an exception. Management should consider this language from the exam manual.

"Evaluate the level of CIP exceptions to determine whether the bank is effectively implementing its CIP. A bank’s policy may not allow staff to make or approve CIP exceptions. However, a bank may exclude isolated, nonsystemic errors (such as an insignificant number of data entry errors) from CIP requirements without compromising the effectiveness of its CIP"

Personal opinion (not a regulatory comment) if the frontlines have the documentation, why are we allowing 30 days to perform the quality assurance? It's sure a lot more difficult to go back to a customer more than a month after an account is opened to obtain additional documentation. Also, I sense some potential friction between departments here (e.g. BSA is tired of chasing after missing documents.) This is not unusual in the institutions I provide BSA Audit services to. One possible solution is to make the business line more responsible for its own documentation.

Line of Defense 1: Branch manager or department head is responsible for reviewing work of their own employees to verify that all information is collected and uploads to applicable folder.

Line of Defense 2: BSA Department reviews a sample of branch work for completeness. Business unit manager is responsible performance of their department.

Line of Defense 3: Annual BSA/AML Audit reviews effectiveness of process, number of exceptions identified at each level as well as samples some accounts of its own.

Business lines are more likely to perform when they are accountable for their own work rather than relying on the BSA Department to do it for them.

Thanks both of you.

Brian, you hit on the head with the friction...add in frustration as well.

Thank you again!

Should we close the account if the customer is unwilling to provide documents to clear CIP exceptions?

Why would you open accounts that had CIP exceptions? Exceptions from your board approved CIP policy constitute regulatory violations.

Exceptions suggest that you are allowing people to open accounts without providing information about themselves or documentation that you require in order to verify identity (such as a photo-bearing driver's license). What sorts of exceptions are you seeing?

This was an isolated issue where one was opened without an active drivers license.

We are still waiting on the customer to renew the license but eventually I assume we should close the account but was not sure.

Your CIP procedures should dictate how long you give a customer to provide documentary verification and what steps you will take if a customer is unable/unwilling to provide verification. See the CIP section of the Exam Manuel.

Lack of Verification
The CIP must also have procedures for circumstances in which the bank cannot form a reasonable belief that it knows the true identity of the customer. These procedures should describe:

Circumstances in which the bank should not open an account.
The terms under which a customer may use an account while the bank attempts to verify the customer’s identity.
When the bank should close an account, after attempts to verify a customer’s identity have failed.
When the bank should file a SAR in accordance with applicable law and regulation.

Reviving this thread to take this question in a little different direction as this is the most relevant thread I've found in regard to my question. Our BSA officer insists we should not consider a loan application compete without proof of ID, and should not move forward to pull credit, provide an LE, etc. I do not believe proof of ID is one of the six pieces for a request to be considered an application, but from a safety and fraud standpoint I see her point. Thoughts?

My recommendation:

1. Issue the LE so that you don't violate Reg Z.
2. Wait to obtain credit until you verivy ID to avoid performing an inquiry in the case of ID theft.
3. If the customer failed to provide ID, deny the loan citing "Unable to verify customer identity" on the adverse action notice.

I think our issue is that once we put the information for a consumer app in our LOS it automatically pulls their credit.

Then all you can do is document in your FACT Act ID Theft procedures that there is potential risk of obtaining credit in the case of identity theft. Following our current practice, how many indirect or direct disputes have we havd from consumers claiming we obtained credit for an application they did not submit?

Step 3 of my recommendation still applies.

Thank you for the help!