/know-your-customer

name: know-your-customer
description: "Guide customer onboarding identification, due diligence, and profile maintenance under FINRA Rule 2090, the CIP rules, and the FinCEN CDD Rule. Use when the user asks about onboarding identity verification, beneficial ownership collection for entity accounts, enhanced due diligence for PEPs or high-risk customers at account opening, assigning the initial customer risk rating, KYC refresh triggers, or documentary vs non-documentary verification. Also trigger when users mention 'account opening requirements', 'who is the beneficial owner', 'new client identity check', 'how often to update KYC', 'essential facts for the account', 'foreign customer onboarding', or ask what information must be gathered before opening an account. (For ongoing transaction monitoring, SAR filing, and surveillance-driven risk re-rating, use anti-money-laundering.)"

Know Your Customer

Regulatory status current as of June 2026 — verify effective dates, dollar thresholds, and pending rulemakings against current SEC/FINRA/FinCEN sources before advising.

Core Concepts

FINRA Rule 2090 — Know Your Customer

Every FINRA member must use reasonable diligence, with regard to the opening and maintenance of every account, to know and retain the essential facts concerning every customer and concerning the authority of each person acting on behalf of the customer. "Essential facts" are those required to: (a) effectively service the account, (b) act in accordance with any special handling instructions, (c) understand the authority of each person acting on behalf of the customer, and (d) comply with applicable laws, regulations, and rules.

Customer Identification Program (CIP)

Required under USA PATRIOT Act Section 326 and implementing regulations. The broker-dealer CIP rule is **31 CFR 1023.220**; the bank CIP rule is 31 CFR 1020.220. (SEC Rule 17a-8 separately requires broker-dealers to comply with BSA recordkeeping and reporting.) The CIP must include:

• **Identity verification** for each customer opening an account: name, date of birth (for individuals), address, and identification number (SSN for US persons; passport number/country or other government ID for non-US persons)
• **Verification procedures** using documentary methods (government-issued ID), non-documentary methods (credit bureau checks, public database searches, financial statement review), or a combination
• **Recordkeeping** — retain identifying information and verification methods for 5 years after account closure
• **Comparison with government lists** — check customer names against OFAC and other government terrorist/sanctions lists
• **Customer notice** — inform customers that information is being collected to verify identity

Customer Due Diligence (CDD) Rule

FinCEN's CDD Rule (31 CFR 1010.230, effective May 2018) requires covered financial institutions to:

1. **Identify and verify the identity of customers** (overlaps with CIP) 2. **Identify and verify the identity of beneficial owners of legal entity customers** — any individual who owns 25% or more of the equity interests, plus one individual with significant responsibility for managing the entity (a control person) 3. **Understand the nature and purpose of customer relationships** to develop a customer risk profile 4. **Conduct ongoing monitoring** to identify suspicious transactions and, on a risk basis, maintain and update customer information

The 25% beneficial ownership threshold applies to legal entities (corporations, LLCs, partnerships). Certain entities are exempt: publicly traded companies, regulated financial institutions, government entities, and others listed in the rule.

Enhanced Due Diligence (EDD)

Higher-risk customers require additional scrutiny beyond standard CDD:

• **Politically Exposed Persons (PEPs)** — senior foreign political figures and their families/associates. No US regulatory definition mandates PEP screening for domestic customers, but FinCEN guidance and FATF standards expect it for foreign PEPs. Firms should understand the source of wealth and funds.
• **Foreign correspondent accounts** — BSA Section 312 requires EDD for correspondent accounts maintained for foreign financial institutions, with heightened requirements for institutions in jurisdictions of concern
• **High-risk jurisdictions** — countries identified by FATF, FinCEN advisories, or firm risk assessments as presenting elevated ML/TF risk
• **Complex ownership structures** — multi-layered entities, trusts with opaque beneficiary structures, nominee arrangements
• **Unusual account activity** — customers whose transaction patterns deviate significantly from expected activity based on their profile

EDD measures include: senior management approval for account opening, source of wealth/funds verification, more frequent account reviews, enhanced transaction monitoring, and ongoing negative media screening.

Documentary vs Non-Documentary Verification

**Documentary methods:** Unexpired government-issued photo ID (driver's license, passport, state ID), documents showing formation of a legal entity (articles of incorporation, partnership agreement, trust instrument).

**Non-documentary methods:** Credit bureau inquiries, public database verification (Lexis-Nexis, etc.), financial statement verification, references from other financial institutions. Required as a backup when documentary verification is unavailable, inconclusive, or the customer is not physically present (e.g., online account opening).

Firms must use non-documentary methods in at least the following situations: (1) the customer opens an account without appearing in person, (2) the firm is not familiar with the documents presented, (3) other circumstances that increase risk.

Ongoing Monitoring and Profile Updates

KYC is not a one-time event. Customer profiles must be updated when:

• **Material life events** occur (retirement, marriage/divorce, inheritance, job loss, si