CIP - Address Verification

Just wanting to get a feel for how other banks are handling address discrepancies for new customers. Please chime in and let me know what you do at your institution.

At ours, if a new customer provides an address that is different from the address listed on the documentary ID (DL, State ID Card, Corp Docs, etc.), we require the frontline to obtain proof of the address they provided (copy of utility bill, piece of mail, etc.). This is tracked as CIP exception and must be cleared within 30 days.

Is your CIP this stringent on address verification at account opening? I wonder if other banks do this but consider it an ID Theft Red Flag process instead of CIP address verification.

Thanks for your help!

It is a combination of both and that is pretty much an idustry practice.

We used to allow 30 days to clear the exception, now we require the address verification at account opening.

Our account opening procedures require a Red Flag Detection form that includes in its resolution, "the method used to verify the address" for all new customers.

Not opening the account until verified saves a lot of tracking and followup, closing accounts, etc.

What do you require when an existing customer comes in and says they want to change their address because they have moved but they have not changed the address on their ID?

Not a whole lot as you have already identified them and as long as you know it is them, there is no ID theft potential.

If a customer "comes in and says they want to change their address because they have moved," my only concern would be verifying that you're talking with the actual customer instead of an ID thief. So if you know the customer, you're all set. If you don't, you can compare his/her signature with what you have on file. Whether the change has been made with the Motor Vehicle Bureau (or your state's parallel bureaucracy for such things) is irrelevant and frankly not your concern.

What do you do if it is a loan and they already have the loan proceeds? How successful are you in following up with the address change on the ID and verification?

How about just calling them and confirming? This all should be address in your Red Flag program.

Followup Question: When opening an account online, a Chexsystem report is pulled. If there is an address mismatch, how do we go about getting to customer to verify the discrepancy? In person accounts, we ask them to bring in a utility bill, or tax form, etc. What procedure should we follow for an online account opening?

That's totally up to you. Additional out of wallet questions, come into the branch to complete the application, deny the application, etc.

Along the lines of Address Verification, we too obtain something from the customer if the address differs from their ID. However, what do other banks do when the customer requests mail be send to a PO Box? Do you require verification of the PO Box as well, or only concentrate on the physical street address for verification?

P.O. Box information is irrelevant to CIP. You need a physical address.

Yes, got it. I'm asking if banks verify PO Boxes (as part of additional bank procedures) whether relevant or not.

What exactly would you be verifying? That the PO Box exists? That they have a rental agreement for the PO Box?

Why would you? When the first statement goes out, you'll have negative verification of sorts if the statement is returned.

At new account opening, if I give you my license that says 123 Main Street, but I verbally tell you I live at 456 Main Street, you're likely to ask me to provide something that verifies 456 Main Street. If I also verbally tell you I want my 456 Main Street correspondence to be sent to Post Office Box 789, will you require me to give you something to verify Post Office Box 789 is mine.

For CIP purpose, the physical address is the piece that we would verify.

If you instruct me to mail your correspondence to your PO Box, my concern, from an information security perspective, is verifying the instruction, not verifying the box. Your verbal request is not sufficient- instead I will ask you to sign a maintenance form or similar document in order to authenticate the request.

If there is a discrepancy in the address that is resolved by viewing another document, such as a recent utility bill, how is this resolution of discrepancy being documented and retained? As part of your CIP form, as a free form field on your core system, or as a secondary ID documented similar to a primary ID? Or some other method?

There must be a reason for you asking this question. Why don't you tell us what it is?

The only address that is important for CIP is the physical address. If you can verify the physical address, why would you care if the customer wants their mail sent to a PO Box? Many people do this for all sorts of reasons. The most common reason is that they have had their mail stolen.