Financial Institutions Permitted Flexibility in Obtaining Taxpayer ID Numbers for Customer Identification Purposes

A federal regulatory order now permits financial institutions to use an alternative collection method to obtain a customer’s taxpayer identification number (“TIN”) information from a third-party source rather than having to obtain the TIN from the customer.

On June 27, 2025, the Federal Deposit Insurance Corporation, the Office of Comptroller of the Currency, and the National Credit Union Administration (collectively, the “Agencies”), with the concurrence of the Financial Crimes Enforcement Network, issued an order granting an exemption from a requirement of the Customer Identification Program (“CIP”) Rule implementing Section 326 of the USA PATRIOT Act (“Exemption Order”). The CIP Rule requires financial institutions[1] to obtain TIN information from its customer before opening an account, and the Exemption Order now allows financial institutions subject to the jurisdiction of the Agencies to use an alternative collection method to obtain TIN information for customer identification purposes.

In issuing the Exemption Order, the Agencies recognize there has been a significant expansion in ways that consumers access financial services since the CIP Rule was first issued in 2003, along with a rise in reported customer reluctance to provide their full TIN due, in part, to data breaches and identity theft concerns. The Exemption Order specifically permits financial institutions subject to the jurisdiction of the Agencies to use an alternative collection method to obtain TIN information from a third-party source rather than from the customer, if the financial institution otherwise complies with the CIP Rule, which requires written procedures that: (1) enable the financial institution to obtain TIN information prior to opening an account; (2) are based on the financial institution’s assessment of the relevant risks; and (3) are risk-based for the purpose of verifying the identity of each customer to the extent reasonable and practicable, enabling the financial institution to form a reasonable belief that it knows the true identity of each customer. These procedures (including use of an alternative collection method) must be based on the financial institution’s assessment of the relevant risks, including those presented by the various types of accounts maintained by the financial institution, the various methods of opening accounts provided by the financial institution, the various types of identifying information available, and the financial institution’s size, location, and customer base. The Agencies have not prescribed specific alternative processes for financial institutions using alternative collection methods, but the Exemption Order sets forth that such processes should take into consideration the foregoing purposes of the CIP Rule.

The Exemption Order reiterates that if an alternative collection method is used, the financial institution must still obtain the full TIN from a third-party source prior to opening an account. In addition, the Exemption Order acknowledges input provided by smaller credit unions and banks that expressed concern around the cost of utilizing third-party TIN verification services and reminds financial institutions that the Exemption Order is optional and financial institutions are not required to use alternative collection methods to obtain TIN information. 

This exemption provides flexibility to those financial institutions supervised by the Agencies that must comply with the CIP Rule. Please note, however, that this exemption does not change the underlying requirement for financial institutions to have risk-based CIP procedures that enable them to form a reasonable belief they know the true identity of each customer. Those requirements exist regardless of whether the financial institution establishes a relationship directly with the customer or through an intermediary.

This advisory is a general overview of the Exemption Order and is not intended as legal advice. If you have any questions about the Exemption Order or the CIP Rule in general, please feel free to contact Joseph D. Simon at (516) 357-3710 or via email at jsimon@cullenllp.com, Elizabeth A. Murphy at (516) 296-9154, or via email at emurphy@cullenllp.com, David Curatolo at (516) 357-3773 or via email at dcuratolo@cullenllp.com, or Gabriela Morales at (516) 357-3850 or via email at gmorales@cullenllp.com.

This advisory provides a brief overview of the most significant changes in the law and does not constitute legal advice. Nothing herein creates an attorney-client relationship between the sender and recipient.

Footnote

[1] The CIP Rule applies to “banks” defined as the following in 31 CFR 1010.100: (1) A commercial bank or trust company organized under the laws of any State or of the United States; (2) A private bank; (3) A savings and loan association or a building and loan association organized under the laws of any State or of the United States; (4) An insured institution as defined in section 401 of the National Housing Act; (5) A savings bank, industrial bank or other thrift institution; (6) A credit union organized under the law of any State or of the United States; (7) Any other organization (except a money services business) chartered under the banking laws of any state and subject to the supervision of the bank supervisory authorities of a State; (8) A bank organized under foreign law; and (9) Any national banking association or corporation acting under the provisions of section 25(a) of the Act of Dec. 23, 1913, as added by the Act of Dec. 24, 1919, ch. 18, 41 Stat. 378, as amended (12 U.S.C. 611-32). For the purposes of this advisory, we are using the term “financial institutions”.