know-your-customer

What this skill does

# Know Your Customer

## Purpose
Guide the implementation of customer identification, due diligence, and ongoing monitoring requirements under federal and FINRA rules. This skill covers CIP, CDD, beneficial ownership, enhanced due diligence, and profile maintenance — enabling a user or agent to design compliant onboarding and customer monitoring processes.

## Layer
9 — Compliance & Regulatory Guidance

## Direction
prospective

## When to Use
- Designing customer onboarding or account opening workflows
- Implementing Customer Identification Programs (CIP)
- Collecting beneficial ownership information for legal entity accounts
- Determining when enhanced due diligence (EDD) is required
- Building customer risk rating and profiling systems
- Establishing triggers for KYC refresh and ongoing monitoring
- Understanding what "essential facts" must be gathered under FINRA Rule 2090
- Evaluating documentary vs non-documentary identity verification methods
- Designing systems that feed KYC data into suitability and AML processes

## Core Concepts

### FINRA Rule 2090 — Know Your Customer
Every FINRA member must use reasonable diligence, with regard to the opening and maintenance of every account, to know and retain the essential facts concerning every customer and concerning the authority of each person acting on behalf of the customer. "Essential facts" are those required to: (a) effectively service the account, (b) act in accordance with any special handling instructions, (c) understand the authority of each person acting on behalf of the customer, and (d) comply with applicable laws, regulations, and rules.

### Customer Identification Program (CIP)
Required under USA PATRIOT Act Section 326 and implementing regulations (31 CFR 1020.220 for banks; similar requirements apply to broker-dealers under SEC Rule 17a-8 and FINRA rules). The CIP must include:

- **Identity verification** for each customer opening an account: name, date of birth (for individuals), address, and identification number (SSN for US persons; passport number/country or other government ID for non-US persons)
- **Verification procedures** using documentary methods (government-issued ID), non-documentary methods (credit bureau checks, public database searches, financial statement review), or a combination
- **Recordkeeping** — retain identifying information and verification methods for 5 years after account closure
- **Comparison with government lists** — check customer names against OFAC and other government terrorist/sanctions lists
- **Customer notice** — inform customers that information is being collected to verify identity

### Customer Due Diligence (CDD) Rule
FinCEN's CDD Rule (31 CFR 1010.230, effective May 2018) requires covered financial institutions to:

1. **Identify and verify the identity of customers** (overlaps with CIP)
2. **Identify and verify the identity of beneficial owners of legal entity customers** — any individual who owns 25% or more of the equity interests, plus one individual with significant responsibility for managing the entity (a control person)
3. **Understand the nature and purpose of customer relationships** to develop a customer risk profile
4. **Conduct ongoing monitoring** to identify suspicious transactions and, on a risk basis, maintain and update customer information

The 25% beneficial ownership threshold applies to legal entities (corporations, LLCs, partnerships). Certain entities are exempt: publicly traded companies, regulated financial institutions, government entities, and others listed in the rule.

### Enhanced Due Diligence (EDD)
Higher-risk customers require additional scrutiny beyond standard CDD:

- **Politically Exposed Persons (PEPs)** — senior foreign political figures and their families/associates. No US regulatory definition mandates PEP screening for domestic customers, but FinCEN guidance and FATF standards expect it for foreign PEPs. Firms should understand the source of wealth and funds.
- **Foreign correspondent accounts** — BSA Section 312 requires EDD for correspondent accounts maintained for foreign financial institutions, with heightened requirements for institutions in jurisdictions of concern
- **High-risk jurisdictions** — countries identified by FATF, FinCEN advisories, or firm risk assessments as presenting elevated ML/TF risk
- **Complex ownership structures** — multi-layered entities, trusts with opaque beneficiary structures, nominee arrangements
- **Unusual account activity** — customers whose transaction patterns deviate significantly from expected activity based on their profile

EDD measures include: senior management approval for account opening, source of wealth/funds verification, more frequent account reviews, enhanced transaction monitoring, and ongoing negative media screening.

### Documentary vs Non-Documentary Verification
**Documentary methods:** Unexpired government-issued photo ID (driver's license, passport, state ID), documents showing formation of a legal entity (articles of incorporation, partnership agreement, trust instrument).

**Non-documentary methods:** Credit bureau inquiries, public database verification (Lexis-Nexis, etc.), financial statement verification, references from other financial institutions. Required as a backup when documentary verification is unavailable, inconclusive, or the customer is not physically present (e.g., online account opening).

Firms must use non-documentary methods in at least the following situations: (1) the customer opens an account without appearing in person, (2) the firm is not familiar with the documents presented, (3) other circumstances that increase risk.

### Ongoing Monitoring and Profile Updates
KYC is not a one-time event. Customer profiles must be updated when:

- **Material life events** occur (retirement, marriage/divorce, inheritance, job loss, significant health changes)
- **Account review triggers** fire (periodic reviews, risk-based reviews, transaction-triggered reviews)
- **Transaction patterns** deviate significantly from the established profile
- **The customer provides new information** that changes their investment profile
- **Regulatory changes** require additional information (e.g., new beneficial ownership requirements)

FINRA does not mandate a specific refresh cycle, but firms typically establish risk-based review schedules (e.g., annual review for high-risk accounts, every 3 years for standard risk).

### SEC Requirements for Investment Advisers
Investment advisers have a fiduciary duty to understand their clients, which creates KYC-like obligations independent of FINRA rules. Form ADV Part 2A describes the adviser's services and client relationships. The SEC expects advisers to gather sufficient information to fulfill their fiduciary duty of care — including financial situation, investment objectives, risk tolerance, and any constraints. FinCEN's 2024 final rule (31 CFR Part 1032, effective January 1, 2026) extends BSA/AML requirements — including CIP and CDD — to SEC-registered investment advisers.

### Recordkeeping Requirements
- **CIP records:** Identifying information, verification documents/methods, and resolution of discrepancies must be retained for 5 years after account closure
- **CDD/beneficial ownership:** Copies of beneficial ownership certification forms and verification records retained for 5 years after account closure
- **Account records:** FINRA Rule 4512 requires maintenance of customer name, tax ID, address, date of birth, employment status, associated person relationship, trusted contact person, and other information specified in the rule
- **Reliance on other institutions:** Under Section 326 reliance provisions, a firm may rely on another financial institution's CIP if: (a) the relying firm's CIP incorporates this reliance, (b) the other institution is subject to an AML program rule, and (c) the other institution enters into a written contract for this purpose

## Worked Examples

### Example 1: O