# FDIC FIL-26-2025: Customer Identification Program Rule Exemption from Collecting Taxpayer Identification Number Information from Customers

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/FDIC_FIL25026

## Section

- **Citation:** FDIC FIL-26-2025
- **Heading:** Customer Identification Program Rule Exemption from Collecting Taxpayer Identification Number Information from Customers
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** FDIC Financial Institution Letters / Customer Identification Program Rule Exemption from Collecting Taxpayer Identification Number Information from Customers

## Text

1

ORDER
ORDER granting an exemption for all accounts at all banks subject to the jurisdiction of
the Agencies from a Customer Identification Program (CIP) Rule requirement
implementing section 326 of the USA PATRIOT Act, 31 U.S.C. § 5318(l) related to a bank
obtaining Taxpayer Identification Number (TIN) information from the customer. The
exemption in this ORDER permits a bank to use an alternative collection method to obtain
TIN information from a third-party rather than from the customer, provided that the bank
otherwise complies with the CIP Rule, which requires written procedures that: (1) enable
the bank to obtain TIN information prior to opening an account; (2) are based on the
bank’s assessment of the relevant risks; and (3) are risk-based for the purpose of verifying
the identity of each customer to the extent reasonable and practicable, enabling the bank to
form a reasonable belief that it knows the true identity of each customer.1
Issue Date: June 27, 2025
By ORDER, under the authority set forth in 31 C.F.R. § 1020.220(b) implementing section
326(a) of the USA PATRIOT Act, 31 U.S.C. § 5318(l)(5), the Office of the Comptroller of the
Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the National Credit
Union Administration (NCUA) (each an “Agency” and collectively the “Agencies”), with the
concurrence of the Financial Crimes Enforcement Network (FinCEN), hereby grant an
exemption from a requirement of the CIP Rule implementing section 326 of the USA PATRIOT
Act, 31 U.S.C
ffice of the Comptroller of the
Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the National Credit
Union Administration (NCUA) (each an “Agency” and collectively the “Agencies”), with the
concurrence of the Financial Crimes Enforcement Network (FinCEN), hereby grant an
exemption from a requirement of the CIP Rule implementing section 326 of the USA PATRIOT
Act, 31 U.S.C. § 5318(l), in the circumstances specified below.2 Specifically, this ORDER
provides an exemption from the requirement for banks subject to the jurisdiction of the
Agencies3 to obtain TIN4 information from the customer prior to opening an account in the
situations discussed herein.5 This ORDER permits banks, for all accounts6 at all banks (and their
subsidiaries7) subject to the Agencies’ jurisdiction, to instead use an alternative collection
method to obtain TIN information from a third-party source rather than the customer, provided

1 31 C.F.R. § 1020.220(a)(1) and (2).
2 See 31 C.F.R. § 1020.220 (FinCEN); 12 C.F.R. § 21.21(c)(2) (OCC); 12 C.F.R. § 326.8(b)(2) (FDIC); and 12
C.F.R. § 748.2(b)(2) (NCUA) (collectively, the CIP Rule).
3 This ORDER is applicable to banks, and their subsidiaries, that are subject to the jurisdiction of the OCC, FDIC, or
NCUA. This ORDER does not apply to banks not subject to the jurisdiction of the Agencies. The term “bank” is
defined in regulations implementing the BSA, 31 C.F.R. § 1010.100(d), and includes each agent, agency, branch, or
office within the United States of banks, savings associations, credit unions, and foreign banks.
4 See 31 C.F.R. § 1020.220(a)(2)(i)(A)(4); see also 31 C.F.R. § 1010.100(yy). A TIN is defined by section 6109 of
the Internal Revenue Code of 1986 (26 U.S.C. § 6109) and the Internal Revenue Service regulations implementing
that section (e.g., Social Security Number (SSN), individual taxpayer identification number (ITIN), or employer
identification number (EIN))
unions, and foreign banks.
4 See 31 C.F.R. § 1020.220(a)(2)(i)(A)(4); see also 31 C.F.R. § 1010.100(yy). A TIN is defined by section 6109 of
the Internal Revenue Code of 1986 (26 U.S.C. § 6109) and the Internal Revenue Service regulations implementing
that section (e.g., Social Security Number (SSN), individual taxpayer identification number (ITIN), or employer
identification number (EIN)).
5 Under the CIP Rule, a TIN is the required identification number for a customer that is a U.S. person and one of the
possible identification numbers for a customer that is a non-U.S. person.
6 The terms account and customer are defined at 31 C.F.R. § 1020.100(a) and (b), respectively.
7 See, e.g., 12 C.F.R. §§ 5.34(e)(3) and 5.38(e)(3) (requirements governing operating subsidiaries of national banks
and Federal savings associations); see also Agencies, FinCEN, Board of Governors of the Federal Reserve System
(Federal Reserve), Office of Thrift Supervision, Department of the Treasury, Interagency Interpretive Guidance on
Customer Identification Program Requirements under Section 326 of the USA PATRIOT Act (Apr. 28, 2005),
available at https://www.fincen.gov/resources/statutes-regulations/guidance/interagency-interpretive-guidance-
customer-identification (for interagency FAQs describing the applicability of the CIP Rule to bank subsidiaries).

2

that the bank otherwise complies with the CIP Rule, which requires written procedures that: (1)
enable the bank to obtain TIN information prior to opening an account; (2) are based on the
bank’s assessment of the relevant risks; and (3) are risk-based for the purpose of verifying the
identity of each customer to the extent reasonable and practicable, enabling the bank to form a
reasonable belief that it knows the true identity of each customer. The use of this exemption by
banks is optional; banks are not required to use an alternative collection method for TIN
information
he
bank’s assessment of the relevant risks; and (3) are risk-based for the purpose of verifying the
identity of each customer to the extent reasonable and practicable, enabling the bank to form a
reasonable belief that it knows the true identity of each customer. The use of this exemption by
banks is optional; banks are not required to use an alternative collection method for TIN
information.
Background
FinCEN and the Agencies recognize that considerable changes in the way that customers interact
with banks and receive financial services have occurred since 2001, when section 326 of the
USA PATRIOT Act was enacted into law. The importance of collecting TIN information from
the customer rather than through another method for identification and verification purposes has
lessened since regulations implementing section 326 were adopted in 2003, particularly in light
of the availability of new methods that a bank can use alongside TIN information to form a
reasonable belief that the bank knows the true identity of each customer. As a result, in March
2024, FinCEN, in consultation with staff at the Agencies, issued a CIP Request for Information
(the “CIP RFI”) that sought information from the public to understand the potential risks and
benefits, as well as safeguards that could be established, if banks were permitted to obtain part or
all of a customer’s TIN information from a third-party source prior to opening an account rather
than from the customer.8 FinCEN and the Agencies considered comments received through the
CIP RFI, as well as the significant innovation in identity verification tools available to banks and
other factors as described below, in granting this exemption from one aspect of the CIP TIN
collection requirements
customer’s TIN information from a third-party source prior to opening an account rather
than from the customer.8 FinCEN and the Agencies considered comments received through the
CIP RFI, as well as the significant innovation in identity verification tools available to banks and
other factors as described below, in granting this exemption from one aspect of the CIP TIN
collection requirements.
Regulatory Requirements
The legislative framework generally referred to as the Bank Secrecy Act (BSA), which consists
of the Currency and Foreign Transactions Reporting Act of 1970, as amended by the USA
PATRIOT Act and other legislation, including the Anti-Money Laundering Act of 2020, is
designed to combat money laundering (ML), the financing of terrorism (TF), and other illicit
finance activity.9 One of the main purposes of the BSA enumerated by Congress is to prevent
the laundering of money and the financing of terrorism by requiring financial institutions to
establish reasonably designed, risk-based programs to combat such risks.10 To fulfill the
purposes of the BSA, Congress has authorized the Secretary of the Treasury (Secretary) to
administer the BSA, and the Secretary has delegated the authority to implement, administer, and
enforce compliance with the BSA and its implementing regulations to the Director of FinCEN.11

8 FinCEN, Request for Information and Comment on Customer Identification Program Rule Taxpayer Identification
Number Collection Requirement, 89 FR 22231 (Mar. 29, 2024).
9 USA PATRIOT Act, Public Law 107-56, 115 Stat. 272 (2001). The AML Act was enacted as Division F, sections
6001-6511, of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public
Law 116-283, 134 Stat. 3388.
10 31 U.S.C. § 5311(2).
11 Treasury Order 180-01 (Jan. 14, 2020); see also 31 U.S.C
n
Number Collection Requirement, 89 FR 22231 (Mar. 29, 2024).
9 USA PATRIOT Act, Public Law 107-56, 115 Stat. 272 (2001). The AML Act was enacted as Division F, sections
6001-6511, of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public
Law 116-283, 134 Stat. 3388.
10 31 U.S.C. § 5311(2).
11 Treasury Order 180-01 (Jan. 14, 2020); see also 31 U.S.C. § 310(b)(2)(I) (providing that the FinCEN Director
“[a]dminister the requirements of subchapter II of chapter 53 of this title, chapter 2 of title I of Public Law 91-508,
and section 21 of the Federal Deposit Insurance Act, to the extent delegated such authority by the Secretary”).

3

Section 326 of the USA PATRIOT Act amended the BSA to require, among other things, the
Secretary to prescribe regulations “setting forth the minimum standards for financial institutions
and their customers regarding the identity of the customer that shall apply in connection with the
opening of an account at a financial institution.” These minimum standards include, among
other things, reasonable procedures for: (1) “verifying the identity of any person seeking to open
an account to the extent reasonable and practicable”; and (2) “maintaining records of the
information used to verify a person’s identity, including name, address, and other identifying
information.”12 In prescribing these regulations, the Secretary must “take into consideration the
various types of accounts maintained by various types of financial institutions, the various
methods of opening accounts, and the various types of identifying information available.”13 The
USA PATRIOT Act requires that CIP regulations involving financial institutions under the
jurisdictions of the Agencies shall be jointly issued with each Agency appropriate for such
financial institution.14
In 2003, FinCEN and the Agencies jointly issued regulations implementing section 326 of the
USA PATRIOT Act for banks, i.e., the CIP Rule.15 The CIP Rule sets minimum standards for
The
USA PATRIOT Act requires that CIP regulations involving financial institutions under the
jurisdictions of the Agencies shall be jointly issued with each Agency appropriate for such
financial institution.14
In 2003, FinCEN and the Agencies jointly issued regulations implementing section 326 of the
USA PATRIOT Act for banks, i.e., the CIP Rule.15 The CIP Rule sets minimum standards for
customer identification and verification, as directed by the USA PATRIOT Act, by requiring each
bank to implement written CIP procedures that enable the bank to form a reasonable belief that it
knows the true identity of each customer, which include verifying the identity of the customer to
the extent reasonable and practicable. The procedures must specify the customer identifying
information that a bank will obtain from each customer prior to opening an account, including, at
a minimum, the customer’s name, date of birth (for an individual), address, and identification
number, which is a TIN for U.S. persons.16 Generally, to fulfill the CIP Rule’s identification
number requirement, a bank must obtain TIN information from the customer, except with respect
to credit card accounts.17
The CIP Rule also requires that a bank’s CIP contain procedures to verify customer identity
through documentary methods, non-documentary methods, or a combination of both, within a

12 31 U.S.C. § 5318(l)(2).
13 31 U.S.C. § 5318(l)(3).
14 See 31 U.S.C. § 5318(l)(4).
15 See, e.g., the Agencies, FinCEN, Federal Reserve, and the Office of Thrift Supervision, Customer Identification
Programs for Banks, Savings Associations, Credit Unions and Certain Non-Federally Regulated Banks, 68 FR
25090, 25103 (May 9, 2003) (codified at 31 C.F.R. § 1020.220). Additionally, in 2020, FinCEN issued a final rule
implementing the CIP Rule for banks that lack a Federal functional regulator
the Agencies, FinCEN, Federal Reserve, and the Office of Thrift Supervision, Customer Identification
Programs for Banks, Savings Associations, Credit Unions and Certain Non-Federally Regulated Banks, 68 FR
25090, 25103 (May 9, 2003) (codified at 31 C.F.R. § 1020.220). Additionally, in 2020, FinCEN issued a final rule
implementing the CIP Rule for banks that lack a Federal functional regulator. See FinCEN, Customer Identification
Programs, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal
Functional Regulator, 85 FR 57129 (Nov. 16, 2020) (codified at 31 C.F.R. § 1010 and 31 C.F.R. § 1020).
16 31 C.F.R. § 1020.220(a)(2)(i). For non-U.S. person customers, the required identification number may include, in
addition to a TIN, a passport number and country of issuance, alien identification card number, or number and
country of issuance of any other government-issued document evidencing nationality or residence and bearing a
photograph or similar safeguard. 31 C.F.R. § 1020.220(a)(2)(i)(B). A bank’s CIP may include procedures for
opening an account for a customer that has applied for but has not received a TIN. In this case, the CIP must include
procedures to confirm that the application was filed before the customer opens the account and to obtain the TIN
within a reasonable period of time after the account is opened. This ORDER applies only to TIN information.
17 Regarding credit card accounts, the CIP Rule allows banks to obtain customer identification information from a
third-party source prior to extending credit to the customer. 31 C.F.R. § 1020.220(a)(2)(i)(C).
ion was filed before the customer opens the account and to obtain the TIN
within a reasonable period of time after the account is opened. This ORDER applies only to TIN information.
17 Regarding credit card accounts, the CIP Rule allows banks to obtain customer identification information from a
third-party source prior to extending credit to the customer. 31 C.F.R. § 1020.220(a)(2)(i)(C).

4

reasonable time after the account is opened. Verification methods include checking government-
issued identification documents (documentary means) or the comparison of information provided
by the customer with information obtained from a consumer reporting agency, public database,
or other source; checking references with other financial institutions; and obtaining a financial
statement (non-documentary means).18
The BSA provides the Secretary and the appropriate Agency with the authority to, by regulation
or order, exempt any financial institution or type of account from the requirements of any
regulation prescribed under section 326 of the USA PATRIOT Act.19 Under implementing
regulation 31 C.F.R. § 1020.220(b), the appropriate Agency, with the concurrence of FinCEN,
may by order or regulation exempt any bank or type of account from the requirements of the CIP
Rule. The CIP Rule requires FinCEN and the Agencies to consider whether the exemption is
consistent with the purposes of the BSA and with safe and sound banking and permits
consideration of other appropriate factors.20
Findings Supporting an Exemption
Since the CIP Rule was issued in 2003, FinCEN and the Agencies have observed a significant
expansion in ways that consumers access financial services, along with a rise in reported
customer reluctance to provide their full TIN due, in part, to data breaches and identity theft
concerns
and sound banking and permits
consideration of other appropriate factors.20
Findings Supporting an Exemption
Since the CIP Rule was issued in 2003, FinCEN and the Agencies have observed a significant
expansion in ways that consumers access financial services, along with a rise in reported
customer reluctance to provide their full TIN due, in part, to data breaches and identity theft
concerns. In recent years, FinCEN and the Agencies have received continued public interest
through letters and comments from banks, trade associations, and Members of Congress in
permitting alternative collection methods for products and services beyond credit card
accounts.21 In the CIP RFI, FinCEN acknowledged there are, and will be, other available
customer identifying attributes that banks may obtain, some of which vary in accuracy and
authenticity, that could be used holistically as part of a bank’s risk-based verification procedures
under the CIP Rule.
The comments submitted in response to the CIP RFI provided insight into the benefits of third-
party source TIN collection as well as potential risks. FinCEN received comments from a
variety of stakeholders—banks and bank trade associations, financial technology companies,
community organizations, third-party organizations, and individuals. Those in support of
alternative collection methods commonly referenced the success of the credit card exception and
innovation in customer verification methods. Those opposed, among other concerns, suggested
that alternative collection methods would increase costs on financial institutions that do not
already use third-party verification services. They stated that, in lieu of obtaining TIN
information from the customer, these institutions would instead need to direct limited resources
towards third-party identity verification services for TIN retrieval. Several commenters
questioned the reliability of third-party sources, with one bank trade association cautioning that

18 31 C.F.R. § 1020.220(a)(2)(ii)
d-party verification services. They stated that, in lieu of obtaining TIN
information from the customer, these institutions would instead need to direct limited resources
towards third-party identity verification services for TIN retrieval. Several commenters
questioned the reliability of third-party sources, with one bank trade association cautioning that

18 31 C.F.R. § 1020.220(a)(2)(ii).
19 31 U.S.C. § 5318(l)(5).
20 31 C.F.R. § 1020.220(b).
21 See, e.g., Ranking Member Congresswoman Maxine Waters of the U.S. House Committee on Financial Services
letter to FinCEN and the Agencies (Sept. 7, 2023), available at https://democrats-financialservices.house.gov/news/
documentsingle.aspx?DocumentID=410778.

5

the intended purpose of these types of vendors was not true fraud prevention or customer
verification.
In arriving at their findings, FinCEN and the Agencies considered letters and comments received;
FinCEN’s technical analysis of BSA information; FinCEN’s consultation with law enforcement
agencies; and the Agencies’ examinations of current CIP programs and procedures (which may
have included such processes for credit card accounts at banks with appropriate oversight,
policies, procedures, and identity verification tools). Based on the analysis of this information,
FinCEN has not identified heightened ML/TF or other illicit finance risk solely relating to the
method of collection of TINs, and the Agencies consider an alternative collection method for
TIN information consistent with safe and sound banking. FinCEN and the Agencies therefore
find there is a valid basis for an exemption to allow banks the option to use an alternative
collection method for TIN information.
Evidence from the Credit Card Exception Supports Expansion to Other Types of Accounts
For over 20 years, the CIP Rule has allowed banks to obtain the identifying information required
by the CIP Rule from a third-party source when a customer is opening a credit card account
is a valid basis for an exemption to allow banks the option to use an alternative
collection method for TIN information.
Evidence from the Credit Card Exception Supports Expansion to Other Types of Accounts
For over 20 years, the CIP Rule has allowed banks to obtain the identifying information required
by the CIP Rule from a third-party source when a customer is opening a credit card account. For
these accounts, the bank may obtain the identifying information about a customer, including a
TIN, from a third-party source prior to extending credit to the customer. FinCEN and the
Agencies recognized at the time that without this exception, the CIP Rule would alter a bank’s
business practices by requiring additional information beyond what was already obtained directly
from a customer who opened a credit card account at the point of sale or by telephone.22
Commenters raised concerns during the CIP Rule comment period that customers applying for
credit card accounts were reluctant to give out their complete TIN, especially through non-face-
to-face means, due to consumer privacy and security concerns.23 In the CIP Rule, FinCEN and
the Agencies further acknowledged that imposing a direct collection requirement on banks that
offer credit card accounts would likely alter the manner in which they do business by requiring
them to gather additional information beyond that which they currently obtain directly from a
customer who opens an account at the point of sale or by telephone
rity concerns.23 In the CIP Rule, FinCEN and
the Agencies further acknowledged that imposing a direct collection requirement on banks that
offer credit card accounts would likely alter the manner in which they do business by requiring
them to gather additional information beyond that which they currently obtain directly from a
customer who opens an account at the point of sale or by telephone. FinCEN and the Agencies
referenced the legislative history of section 326, which indicated that Congress expected the
regulations implementing this section to be appropriately tailored for accounts opened in
situations where the account holder is not physically present at the financial institution and that
the regulations should not impose requirements that are burdensome, prohibitively expensive, or
impractical.24
Therefore, FinCEN and the Agencies included an exception in the final CIP Rule for credit card
accounts only that allowed a bank broader latitude to obtain some information from the customer
opening a credit card account and the remaining information from a third-party source, such as a

22 Agencies, FinCEN, Federal Reserve, Office of Thrift Supervision, Customer Identification Programs for Banks,
Savings Associations, Credit Unions and Certain Non-Federally Regulated Banks, 68 FR 25090, 25103 (May 9,
2003) (codified at 31 C.F.R. § 1020.220).
23 Id. at 25098.
24 House Committee on Financial Services, Report on the Financial Anti-Terrorism Act of 2001, H.R. Rep. No. 107-
250, pt. 1, at 63 (2001).
Federal Reserve, Office of Thrift Supervision, Customer Identification Programs for Banks,
Savings Associations, Credit Unions and Certain Non-Federally Regulated Banks, 68 FR 25090, 25103 (May 9,
2003) (codified at 31 C.F.R. § 1020.220).
23 Id. at 25098.
24 House Committee on Financial Services, Report on the Financial Anti-Terrorism Act of 2001, H.R. Rep. No. 107-
250, pt. 1, at 63 (2001).

6

credit reporting agency, prior to extending credit to a customer. In the CIP Rule, FinCEN and the
Agencies recognized this practice as an efficient and effective means of extending credit with
little risk that the lender did not know the identity of the borrower.25 Similar to credit card
accounts, it is now common practice for banks to offer other types of products and services
through non-face-to-face means, such as via a mobile app or website. For example, Forbes’ 2022
Digital Banking Survey found that 78 percent of adults preferred banking over the internet rather
than in person.26 Additionally, customers are obtaining financial services using non-bank
financial institutions at a significant rate. The FDIC’s National Survey of Unbanked and
Underbanked Households found that in 2023, half of all households (49.7 percent) were using
non-bank online payment services, up from 46.4 percent in 2021.27
In light of these changes that have led to an increase in account openings using non-face-to-face
means, FinCEN and the Agencies believe that the rationale relating to consumer privacy and
security concerns provided for the credit card exception in 2003 as well as concerns about
requirements being burdensome, prohibitively expensive, or impractical is applicable to all other
types of accounts that are now easily accessible to customers through non-face-to-face means
using non-face-to-face
means, FinCEN and the Agencies believe that the rationale relating to consumer privacy and
security concerns provided for the credit card exception in 2003 as well as concerns about
requirements being burdensome, prohibitively expensive, or impractical is applicable to all other
types of accounts that are now easily accessible to customers through non-face-to-face means.
Since the adoption of the credit card exception as part of the CIP Rule, FinCEN has not
identified heightened ML/TF or other illicit finance risks associated specifically with the
alternative collection method used by banks when opening credit card accounts where such
methods are appropriately managed.
Consumer Privacy and Security Concerns Regarding TIN Collection
The letters and comments received by FinCEN and the Agencies assert that there is an elevated
risk of identity theft and data breaches occurring when the full TIN is obtained from the
customer through non-face-to-face means. In addition, BSA filings indicate that perpetrators of
fraud, including check fraud, often opened their accounts online with fraudulent or stolen
identification information,28 which could argue for the need for banks to have more rigorous,
rather than less, information collection from the customer when accounts are opened through
non-face-to-face means in order for banks to form a reasonable belief that they know the true
identity of the person opening the account. However, FinCEN’s analysis of BSA filings does not
suggest that the risk of fraud was related to the method for obtaining customer information by a
bank, whether from the customer or from a third party. Additionally, the American Bankers
Association Banking Journal reported in 2023 that the SSN was the second most exposed
individual credential after name.29 During the first quarter of 2024, TransUnion reported that

25 68 FR at 25097.
26 Forbes Advisor, Consumer Banking Trends and Statistics (Jan
or obtaining customer information by a
bank, whether from the customer or from a third party. Additionally, the American Bankers
Association Banking Journal reported in 2023 that the SSN was the second most exposed
individual credential after name.29 During the first quarter of 2024, TransUnion reported that

25 68 FR at 25097.
26 Forbes Advisor, Consumer Banking Trends and Statistics (Jan. 21, 2024), available at
https://www.forbes.com/advisor/banking/banking-trends-and-statistics/.
27 FDIC, National Survey of Unbanked and Underbanked Households (2023), available at
https://www.fdic.gov/household-survey/2023-fdic-national-survey-unbanked-and-underbanked-households-report.
28 FinCEN, Financial Trend Analysis, Mail Theft-Related Check Fraud: Threat Pattern & Trend Information,
February to August 2023 (Sept. 2024), available at https://www.fincen.gov/sites/default/files/shared/FTA-Check-
Fraud-FINAL508.pdf.
29 American Bankers Association Banking Journal, Report: Synthetic identity fraud on rise (Aug. 24, 2023),
available at https://bankingjournal.aba.com/2023/08/report-synthetic-identity-fraud-on-rise/.

7

data breach risks rose significantly due to the high level of SSN exposures.30 These statistics
underscore the consumer hesitancy to provide the consumer’s TIN through non-face-to-face
means, and through this exemption, FinCEN and the Agencies will allow banks the means to
obtain the customer’s TIN through alternative collection methods
2023/08/report-synthetic-identity-fraud-on-rise/.

7

data breach risks rose significantly due to the high level of SSN exposures.30 These statistics
underscore the consumer hesitancy to provide the consumer’s TIN through non-face-to-face
means, and through this exemption, FinCEN and the Agencies will allow banks the means to
obtain the customer’s TIN through alternative collection methods.
Reliable Alternatives Exist for Verification Today that Did Not Exist or Were Not as Prevalent
Twenty Years Ago
Reliable alternative processes for verification—which allow the bank to form a reasonable belief
that it knows the true identity of each customer—are more prevalent today than when the CIP
Rule was issued, meaning there could be circumstances in which such processes produce an
equivalent or more reliable outcome when banks are permitted the flexibility to change their
method of TIN collection based on the bank’s assessment of the relevant risks. The combination
of the increase in vulnerability of TINs to identity theft and the availability of reliable alternative
options for verification lessens the importance of the specific method of TIN collection for
identity verification.
While FinCEN and the Agencies are not prescribing specific alternative processes for banks,
such processes should take into consideration the purpose of the CIP Rule—to ensure a bank is
able to form a reasonable belief that it knows the true identity of each customer—and the bank’s
assessment of the relevant risks, including those presented by the various types of accounts
maintained by the bank, the various methods of opening accounts provided by the bank, the
various types of identifying information available, and the bank’s size, location, product and
service offerings, and customer base.
Potential Risks of Alternative TIN Collection Methods
FinCEN received comments in response to the CIP RFI that raised concerns about increased risk
when TIN information is not obtained from the customer
ous methods of opening accounts provided by the bank, the
various types of identifying information available, and the bank’s size, location, product and
service offerings, and customer base.
Potential Risks of Alternative TIN Collection Methods
FinCEN received comments in response to the CIP RFI that raised concerns about increased risk
when TIN information is not obtained from the customer. A commenter noted that the Internal
Revenue Service (IRS) issued guidance in 2020 that it considers a SSN masked when only the
last four digits are visible, which the commenter noted raises concerns that the last four SSN
digits may be more readily compromised than the full TIN.31 Similarly, one state bank
association said their members stated it is easier for a fraudster to guess the last four digits of a
consumer’s SSN than provide all nine digits accurately. A bank trade association raised that the
SSN continued to be a strong customer identifier in comparison to the other identifying pieces of
information a customer can provide. Individuals may undergo changes to their address, email, or
phone number, but they rarely change their SSN.
With regard to potential increased fraud risk through alternative collection methods, FinCEN and
the Agencies believe this is addressed because a bank’s use of an alternative collection method

30 See, e.g., CUToday, Severity of Data Breach Risks Hit Highest Level in Two Years During Q1, TransUnion
Reports (May 28, 2024), available at https://www.cutoday.info/Fresh-Today/Severity-of-Data-Breach-Risks-Hit-
Highest-Level-in-Two-Years-During-Q1-TransUnion-Reports.
31 IRS, What are we doing to protect taxpayer privacy? (Feb. 7, 2025), available at https://www.irs.gov/privacy-
disclosure/what-are-we-doing-to-protect-taxpayer-
privacy#:~:text=A%20masked%20SSN%20is%20an,*%2D**%2D1234.
nsUnion
Reports (May 28, 2024), available at https://www.cutoday.info/Fresh-Today/Severity-of-Data-Breach-Risks-Hit-
Highest-Level-in-Two-Years-During-Q1-TransUnion-Reports.
31 IRS, What are we doing to protect taxpayer privacy? (Feb. 7, 2025), available at https://www.irs.gov/privacy-
disclosure/what-are-we-doing-to-protect-taxpayer-
privacy#:~:text=A%20masked%20SSN%20is%20an,*%2D**%2D1234.

8

must otherwise comply with the CIP Rule, which requires written procedures that: (1) enable the
bank to obtain TIN information prior to opening an account; (2) are based on the bank’s
assessment of the relevant risks; and (3) are risk-based for the purpose of verifying the identity of
each customer to the extent reasonable and practicable, enabling the bank to form a reasonable
belief that it knows the true identity of each customer Further, these procedures (including use of
an alternative collection method) must be based on the bank’s assessment of the relevant risks,
including those presented by the various types of accounts maintained by the bank, the various
methods of opening accounts provided by the bank, the various types of identifying information
available, and the bank’s size, location, and customer base.
Several commenters raised concerns that community banks and credit unions may not have the
resources to implement the third-party TIN retrieval and verification service needed for an
alternative TIN collection method and that implementing such a service could increase
operational costs associated with account opening, which could negatively impact the unbanked.
Therefore, smaller banks would be at a competitive disadvantage compared to larger banks.
FinCEN and the Agencies emphasize there is no requirement to use this exemptive relief, and if a
bank chooses to continue obtaining the full TIN from the customer, they may do so.
Some commenters raised issues that could occur if a bank only had the last four digits of a TIN
tively impact the unbanked.
Therefore, smaller banks would be at a competitive disadvantage compared to larger banks.
FinCEN and the Agencies emphasize there is no requirement to use this exemptive relief, and if a
bank chooses to continue obtaining the full TIN from the customer, they may do so.
Some commenters raised issues that could occur if a bank only had the last four digits of a TIN.
For example, some commenters stated that many people have the same last four digits. One
stated that out of 119 people, there is a 50 percent chance that two will have the same last four;
of 180 people, there is an 80 percent chance; and out of 300 people, there is more than 99 percent
chance. The commenters stated this commonality could give rise to possible unintended
consequences. For example, one commenter said it would be more complicated to create a
“blacklist” for previously identified bad actors or place limitations on the number of accounts if
only the last four digits are used. In addition, one entity stated this could increase concern for
customers with common names or those using the same name (e.g., Jr., Sr., III). FinCEN and the
Agencies reiterate that if an alternative collection method is used, the bank must still obtain the
full TIN from a third-party source prior to opening an account, and the TIN is one piece of
customer identifying information among others that the bank must obtain and use to verify the
customer’s identity.
CONCLUSION
For the reasons described below, FinCEN and the Agencies find there is a valid basis for an
exemption from the requirement to obtain TIN information from the customer for all accounts at
all banks subject to the jurisdiction of the Agencies in the circumstances discussed herein
identifying information among others that the bank must obtain and use to verify the
customer’s identity.
CONCLUSION
For the reasons described below, FinCEN and the Agencies find there is a valid basis for an
exemption from the requirement to obtain TIN information from the customer for all accounts at
all banks subject to the jurisdiction of the Agencies in the circumstances discussed herein. If
banks use an alternative collection method when obtaining TIN information about a customer,
they must otherwise comply with the CIP Rule, which requires written procedures that: (1)
enable the bank to obtain TIN information prior to opening an account; (2) are based on the
bank’s assessment of the relevant risks; and (3) are risk-based for the purpose of verifying the
identity of each customer to the extent reasonable and practicable, enabling the bank to form a
reasonable belief that it knows the true identity of each customer.

9

First, FinCEN finds this exemption, when used appropriately, is consistent with the purposes of
the BSA. Banks must include an alternative collection method for TIN information in their
existing, reasonably designed, risk-based, and written CIP procedures that combat ML/TF and
other illicit finance activity. This exemption is also consistent with the factors discussed in the
statute, including “the various types of accounts maintained by various types of financial
institutions, the various methods of opening accounts, and the various types of identifying
information available.”32 Furthermore, through an analysis of BSA reporting, FinCEN has not
identified a heightened ML/TF or other illicit finance risk associated with the alternative
collection method for TIN information process used by banks when opening credit card
accounts.
Second, the Agencies find this exemption, when used appropriately, would be consistent with
safe and sound banking
information available.”32 Furthermore, through an analysis of BSA reporting, FinCEN has not
identified a heightened ML/TF or other illicit finance risk associated with the alternative
collection method for TIN information process used by banks when opening credit card
accounts.
Second, the Agencies find this exemption, when used appropriately, would be consistent with
safe and sound banking. The resulting banking practices will not be contrary to generally
accepted standards of prudent banking operation and will not give rise to abnormal risk of loss or
damage to an institution or its shareholders. This exemption does not change the overall purpose
of the existing, general CIP requirement for each bank to have CIP procedures that enable the
bank to form a reasonable belief that it knows the true identity of each customer.
Therefore, FinCEN and the Agencies hereby grant by ORDER an exemption from a requirement
of the CIP Rule implementing section 326 of the USA PATRIOT Act, 31 U.S.C. § 5318(l) in the
circumstances discussed herein. Specifically, this Order provides an exemption from the CIP
Rule that permits a bank to use an alternative collection method to obtain TIN information from
a third-party rather than from the customer, provided that the bank otherwise complies with the
CIP Rule, which requires written procedures that: (1) enable the bank to obtain TIN information
prior to opening an account; (2) are based on the bank’s assessment of the relevant risks; and (3)
are risk-based for the purpose of verifying the identity of each customer to the extent reasonable
and practicable, enabling the bank to form a reasonable belief that it knows the true identity of
each customer
which requires written procedures that: (1) enable the bank to obtain TIN information
prior to opening an account; (2) are based on the bank’s assessment of the relevant risks; and (3)
are risk-based for the purpose of verifying the identity of each customer to the extent reasonable
and practicable, enabling the bank to form a reasonable belief that it knows the true identity of
each customer.
Nothing in this ORDER shall bar, estop, or otherwise prevent the Agencies from taking any
action affecting a bank, including the revocation of this ORDER, if a bank uses an alternative
method for TIN collection but is not able to demonstrate its ability to form a reasonable belief
that it knows the true identity of each customer.
Banks taking advantage of this exemption must continue to comply with all other regulatory
requirements pursuant to the BSA.

32 31 U.S.C. § 5318(l)(3). These factors are mentioned in the statute in the context of what the Secretary should take
into consideration when prescribing regulations.

10

IT IS SO ORDERED, this 27th day of June, 2025

OFFICE OF THE COMPTROLLER OF THE CURRENCY

By: ____/s/_________________________________
Jay Gallagher
Senior Deputy Comptroller for the Office of the Chief National Bank Examiner

FEDERAL DEPOSIT INSURANCE CORPORATION

By: ____/s/________________________________
Ryan Billingsley
Acting Director, Division of Risk Management Supervision

NATIONAL CREDIT UNION ADMINISTRATION

By: ____/s/________________________________
Amanda Parkhill
Acting Director, Office of Examination and Insurance

WITH CONCURRENCE, this 27th day of June, 2025
OF THE FINANCIAL CRIMES ENFORCEMENT NETWORK

By: ____/s/________________________________
Andrea M. Gacki
Director

## Nearby sections

- [FDIC FIL-1-2002 FOREIGN ASSETS CONTROL ACT](https://www.frixlaw.com/law-library/statutes/FDIC_FIL02001.md)
- [FDIC FIL-1-2010 Employee Compensation Advance Notice of Proposed Rulemaking](https://www.frixlaw.com/law-library/statutes/FDIC_FIL10001.md)
- [FDIC FIL-1-2015 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL15001.md)
- [FDIC FIL-1-2018 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL18001.md)
- [FDIC FIL-1-2024 Consolidated Reports of Condition and Income for Fourth Quarter 2023](https://www.frixlaw.com/law-library/statutes/FDIC_FIL24001.md)
- [FDIC FIL-2-2019 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL19002.md)
- [FDIC FIL-2-2020 Consolidated Reports of Condition and Income for Fourth Quarter 2019](https://www.frixlaw.com/law-library/statutes/FDIC_FIL20002.md)
- [FDIC FIL-3-2017 Community Banking Conference 2016 Highlights](https://www.frixlaw.com/law-library/statutes/FDIC_FIL17003.md)
- [FDIC FIL-4-2015 The FDIC Launches Web Page to Support Marketing of Failing Financial Institutions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL15004.md)
- [FDIC FIL-4-2018 Revisions to the Consolidated Reports of Condition and Income (Call Report) for March and June 2018](https://www.frixlaw.com/law-library/statutes/FDIC_FIL18004.md)
- [FDIC FIL-4-2019 Banker Webinar: Update on the Standardized Export of Imaged Loan Documents Initiative](https://www.frixlaw.com/law-library/statutes/FDIC_FIL19004.md)
- [FDIC FIL-4-2021 Revised Guidelines for Appeals of Material Supervisory Determinations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21004.md)
- [FDIC FIL-4-2023 Guidance to Help Financial Institutions and Facilitate Recovery in Areas of California Affected by Severe Winter Storms, Flooding, Landslides and Mudslides](https://www.frixlaw.com/law-library/statutes/FDIC_FIL23004.md)
- [FDIC FIL-4-2025 FDIC Statement of Policy on Bank Merger Transactions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL25004.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FDIC_FIL25026. Check the current official text before relying on it. Not legal advice.