We were told by our auditor that we must get a copy of valid Photo ID every time we extend new credit if the ID we have on file is expired. The customer has a history with the bank and CIP/BSA was done when they became a bank customer. Is this a Regulation or best practice?

Honestly, I don't think it's either. Ask your auditor for the citation to go along with this request.

Existing customers are exempt from CIP. Tell your auditor to read the reg first. If the customer has an EXISTING loan, then are exempt. If they had a previous loan (now paid off), they are not exempt and you must re-CIP them.