---
name: Account Opening Compliance
slug: account-opening-compliance
category: Automation
description: Account Opening Compliance embeds CIP, KYC, OFAC, and beneficial ownership checks into onboarding workflows. Use it when designing account-opening approval gates, exception handling, and recordkeeping for regulated financial accounts.
github: "https://github.com/JoelLewis/finance_skills/tree/main/plugins/client-operations/skills/account-opening-compliance"
language: Python
stars: 184
forks: 35
install: "npx degit https://github.com/JoelLewis/finance_skills/tree/main/plugins/client-operations/skills/account-opening-compliance ~/.claude/skills/account-opening-compliance"
installs_to: ~/.claude/skills/account-opening-compliance
source_path: plugins/client-operations/skills/account-opening-compliance/SKILL.md
collection_size: 25
category_size: 2109
collection_url: "https://dirskills.com/collections/JoelLewis/finance_skills"
added: 2026-09-07T05:19:58.216Z
last_synced: 2026-09-07T05:19:58.216Z
canonical_url: "https://dirskills.com/skills/account-opening-compliance"
---

# Account Opening Compliance

Account Opening Compliance embeds CIP, KYC, OFAC, and beneficial ownership checks into onboarding workflows. Use it when designing account-opening approval gates, exception handling, and recordkeeping for regulated financial accounts.

**Install:**

```bash
npx degit https://github.com/JoelLewis/finance_skills/tree/main/plugins/client-operations/skills/account-opening-compliance ~/.claude/skills/account-opening-compliance
```

## README

# Account Opening Compliance

## Core Concepts

### CIP Integration in Account Opening
The Customer Identification Program is the first compliance gate in any account opening workflow. Under USA PATRIOT Act Section 326 and its implementing regulations, a firm must verify the identity of each customer before or at the time of account opening. The account opening process must be designed so that no account becomes active until CIP is satisfied.

**Verification timing.** The regulations permit two approaches: (1) verify identity before the account is opened, which is the most conservative approach and prevents any transactional activity until verification is complete; or (2) verify identity within a reasonable time after the account is opened, provided the firm has procedures to manage the risk of incomplete verification (such as restricting account activity until verification is complete). Most firms implementing digital onboarding choose the first approach — identity verification occurs in real time during the application flow, and the application cannot proceed until verification returns a pass result. The second approach — opening with restricted activity pending verification — is used primarily for paper-based or advisor-assisted workflows where verification cannot occur in real time, and requires the firm to document the risk mitigation procedures (no trading, no disbursements, no margin until verification completes).

**Database verification** is the primary method for digital account opening. The onboarding system sends applicant data (name, date of birth, address, SSN/TIN) to an identity verification vendor (LexisNexis Risk Solutions, Alloy, Equifax, TransUnion) via API. The vendor cross-references the data against credit bureau records, public records, and government databases and returns a pass, fail, or inconclusive result, typically within seconds. Database verification satisfies CIP's non-documentary verification requirement.

**Documentary verification** serves as a fallback when database verification is inconclusive or unavailable. The applicant uploads a photo of a government-issued ID (driver's license, passport, state ID). OCR extracts data fields, and the system may compare the document photo to a selfie for liveness detection. Documentary verification is slower and introduces friction but is necessary for applicants who cannot be verified through database methods — non-US persons, thin-file individuals, and cases where database results are ambiguous.

**Verification failure handling.** The account opening workflow must define clear paths for each verification outcome:
- **Pass** — proceed to the next compliance gate
- **Fail** — halt the application; notify the applicant that the account cannot be opened; document the reason; retain records per CIP recordkeeping requirements
- **Inconclusive** — route to an exception queue for manual review; request additional identifying information or documentary verification; set a time limit for resolution (e.g., 5 business days) after which the application is closed

**Exception processing for inconclusive results** is operationally critical. Common causes of inconclusive results include name mismatches (legal name vs preferred name, hyphenated names, transliteration differences for non-English names), address mismatches (recent moves, PO boxes), and thin credit files (young adults, recent immigrants). The exception processing workflow should collect additional documentation, perform manual database searches, and escalate to compliance when standard exception procedures do not resolve the issue. The firm should track exception rates by cause to identify systemic issues — for example, a high rate of transliteration-related exceptions may indicate a need to improve the verification vendor's handling of non-Latin character sets.

**Non-US persons and foreign accounts.** CIP verification for non-US persons presents additional complexity. Acceptable identification numbers include a passport number and country of issuance, an alien identification card number, or a number and country of issuance of any other unexpired government-issued document evidencing nationality or residence that bears a photograph. Database verification coverage is weaker for non-US persons, making documentary verification (passport upload with liveness check) the primary method. The account opening workflow should detect non-US applicants early and route them to the documentary verification path without requiring a failed database check first.

**Recordkeeping requirements.** CIP regulations require retention of identifying information (name, date of birth, address, identification number), a description of the documents or methods used to verify identity, and the resolution of any discrepancies. These records must be retained for 5 years after the account is closed. The account opening system should automatically generate and store a CIP verification record for each application, including the verification method, vendor response, timestamp, and outcome.

### OFAC and Sanctions Screening
OFAC screening is a mandatory compliance gate that must clear before any account is opened. Unlike CIP, which verifies that the applicant is who they claim to be, OFAC screening determines whether the applicant — or any person associated with the account — is a sanctioned individual or entity with whom the firm is prohibited from doing business.

**Scope of screening.** The firm must screen all individuals associated with the account, not just the primary applicant. This includes:
- Account holders (all owners for joint accounts)
- Beneficial owners (25% equity holders and control persons for entity accounts)
- Authorized signers and persons with trading authority
- Trustees (for trust accounts)
- Custodians under UTMA/UGMA accounts
- Any other person with authority over or beneficial interest in the account

**Lists screened.** At minimum, screening must cover the OFAC SDN (Specially Designated Nationals and Blocked Persons) list. Best practice extends screening to the Sectoral Sanctions Identifications (SSI) list, the Non-SDN Menu-Based Sanctions list, the Foreign Sanctions Evaders (FSE) list, and consolidated non-OFAC lists such as the FinCEN 314(a) list and any firm-specific restricted lists. Automated screening platforms typically screen against all OFAC lists simultaneously.

**Screening frequency.** OFAC screening must occur at account opening and on an ongoing basis thereafter. Ongoing screening is triggered by: (1) OFAC list updates (the SDN list is updated frequently, sometimes multiple times per week), (2) changes to account ownership or authorized parties, and (3) periodic rescreening on a risk-based schedule. At account opening, the screening must occur before the account is activated and before any funds are accepted or transactions are processed.

**Potential match handling.** When the screening system generates a potential match (also called an alert), the workflow must:
1. Halt the account opening process — no account activation until the alert is resolved
2. Route the alert to a trained compliance analyst for manual review
3. Compare all available identifying information (full name, aliases, date of birth, nationality, address, passport number) between the applicant and the list entry
4. Determine whether the match is a true positive (the applicant is the listed person) or a false positive (a different person with similar identifying information)
5. Document the analysis, the data points compared, and the disposition decision
6. For true positives: block the account application, block any associated property, and file a blocked property report with OFAC within 10 business days
7. For false positives: document the basis for the determination, retain the record, and allow the application to proceed

**False positive management** is an ongoing operational challenge. Common names, transliteration variations, and incomplete identifying data on OFAC lists generate high false positive rates. Firms should tune their screening algorithms to balance detection sensitivity against operational burden. Reducing false positives without degrading detection requires maintaining and updating known false positive records, using multiple data points for matching (not just name), and calibrating fuzzy match thresholds. All tuning decisions must be documented and defensible.

**Documentation of screening results.** Regardless of outcome, the account opening record must include a log of every screening run: the lists screened, the individuals screened, the screening timestamp, the algorithm version or configuration, the raw results, and the disposition. For no-match results, the system log is sufficient. For potential matches resolved as false positives, the record must include the analyst's comparison of identifying data points and the rationale for the false-positive determination. For true positives, the record must include the blocking report, the notification to OFAC, and any subsequent correspondence. These records must be retained for the life of the account plus 5 years after closure and must be producible for regulatory examination.

### Beneficial Ownership Certification
The FinCEN CDD Rule (31 CFR 1010.230, effective May 2018) requires covered financial institutions to identify and verify the beneficial owners of legal entity customers at the time of account opening.

**Who must be identified.** For each legal entity customer, the firm must identify:
- Every individual who directly or indirectly owns 25% or more of the equity interests in the entity (the ownership prong)
- At least one individual who has significant responsibility for controlling, managing, or directing the entity — such as a CEO, CFO, COO, managing member, general partner, president, vice president, or treasurer (the control prong)

A single individual may satisfy both prongs (e.g., a sole owner who is also the manager). The maximum number of beneficial owners reported is typically five (four under the ownership prong plus one under the control prong), though an entity with more than four 25% owners must report all of them.

**25% ownership threshold.** Ownership is calculated on a direct and indirect basis. If an individual owns 30% of Entity A, and Entity A owns 100% of Entity B (the account applicant), the individual indirectly owns 30% of Entity B and must be identified as a beneficial owner. Multi-layered ownership structures require the firm to trace ownership through intermediate entities to identify the natural persons who ultimately hold 25% or more.

**Exempt entity types.** Certain entities are exempt from the beneficial ownership requirement because their ownership is already transparent through other regulatory mechanisms:
- Publicly traded companies listed on a US stock exchange (or a foreign exchange meeting equivalent standards)
- SEC-registered investment companies and investment advisers
- Insurance companies regulated by a state
- Banks, credit unions, and other depository institutions regulated by a federal banking agency
- Broker-dealers registered with the SEC
- Entities established by federal or state government
- Pooled investment vehicles operated by a financial institution (but not the underlying investors)

**Certification form management.** The firm collects beneficial ownership information on a certification form (based on FinCEN's standard form or the firm's equivalent). The account opening workflow must present this form when the applicant is a legal entity, collect the required information for each beneficial owner, and verify the identity of each identified beneficial owner using the firm's CIP procedures. The form must be signed (physically or electronically) by the individual opening the account on behalf of the entity, certifying the accuracy of the information. The firm must retain the certification form and verification records for 5 years after the account is closed.

**Ongoing monitoring for ownership changes.** The CDD Rule requires firms to update beneficial ownership information on a risk basis. The account opening process should establish triggers for ownership updates: periodic review (typically annually for high-risk entities, every 3 years for standard risk), event-driven updates (notification of ownership change, corporate restructuring, merger), and customer-initiated updates. The account opening system should flag the next review date and route it to the appropriate review queue.

**Corporate Transparency Act interaction.** The Corporate Transparency Act (CTA) originally required most companies to report beneficial ownership information directly to FinCEN beginning in 2024. As of FinCEN's March 2025 interim final rule, however, all entities formed in the United States (the former "domestic reporting companies") and their beneficial owners are exempt from CTA reporting; only entities formed under foreign law and registered to do business in the US remain reporting companies, and they need not report US-person beneficial owners. The practical consequence for account opening: CTA-reported data is not a substitute for the firm's own beneficial ownership collection, and the CTA does not relieve financial institutions of their CDD Rule obligations. Firms must continue to collect and verify beneficial ownership independently through the certification form process, and should verify the current state of CTA rulemaking, which remains in flux.

### Tax Compliance: FATCA and CRS
Account opening must collect information to satisfy international tax reporting obligations. These requirements apply regardless of the account holder's citizenship and are triggered by indicators of foreign tax residency.

**FATCA (Foreign Account Tax Compliance Act).** US financial institutions must determine whether account holders are US persons (requiring W-9 collection) or non-US persons (requiring W-8BEN or W-8BEN-E collection and FATCA classification). For entity accounts such as trusts, the firm must classify the entity under FATCA (e.g., Active NFFE, Passive NFFE, Financial Institution) and, for Passive NFFEs, identify any controlling persons who are US persons. Failure to collect valid W-8/W-9 forms triggers backup withholding at 24% on reportable payments.

**CRS (Common Reporting Standard).** If any account holder or controlling person is tax-resident in a CRS-participating jurisdiction (most countries outside the US), the firm must collect a self-certification of tax residency, including the foreign taxpayer identification number (TIN). For the family trust scenario with a UK-resident trustee, CRS requires reporting the account to HMRC via the firm's CRS reporting channel. The self-certification must be collected at or before account opening.

**Integration with account opening workflow.** The tax compliance gate should:
- Collect W-9 from all US persons and W-8BEN from all non-US persons at account opening
- Classify entity accounts under FATCA (Active/Passive NFFE, Financial Institution, etc.)
- Collect CRS self-certification forms from any person with foreign tax residency indicators
- Validate TIN format against the issuing country's known format (e.g., UK NI number format: 2 letters + 6 digits + 1 letter)
- Flag accounts with missing or expired tax forms for remediation before activation
- Set renewal triggers for W-8 forms (expire every 3 years unless a change of circumstances occurs)

**Cross-border complexity.** When account holders have tax obligations in multiple jurisdictions (e.g., a US-UK dual national, or a trust with trustees in different countries), the firm may need to report under both FATCA and CRS. The account opening system should identify multi-jurisdictional reporting obligations based on the tax residency declarations collected and route these accounts for compliance review.

### Suitability Assessment at Opening
Account opening is the primary data collection event for investment suitability. The compliance framework requires that the firm gather sufficient information to evaluate the suitability of any subsequent investment recommendation before or at the time of the first recommendation.

**Documenting the investment profile.** The account opening process must collect all elements of the customer's investment profile as defined by FINRA Rule 2111 and Regulation Best Interest: investment objectives, risk tolerance, time horizon, liquidity needs, financial situation (income, net worth, liquid net worth), investment experience, tax status, and any other information the customer discloses. The profile must be documented in a durable, retrievable format — not just captured in a questionnaire that is discarded after scoring.

**Mapping to appropriate products and models.** The suitability data collected at opening drives the mapping of the account to an investment model or strategy. The account opening system should produce a risk score or category from the suitability questionnaire and map that score to a defined range of models or strategies. This mapping must be documented, consistently applied across advisors, and periodically reviewed for reasonableness. Deviations from the mapping (e.g., an advisor selecting a more aggressive model than the client's risk score indicates) should trigger a compliance review.

**Reg BI care obligation for account type recommendation.** Under Regulation Best Interest, the recommendation of an account type itself (e.g., brokerage vs advisory, IRA vs taxable, fee-based vs commission-based) is subject to the Care Obligation. The account opening process for broker-dealers must document that the recommended account type is in the customer's best interest, considering reasonably available alternatives and the customer's investment profile. This means the compliance controls at account opening must capture not just the account type selected but the rationale for selecting it over alternatives.

**Suitability documentation requirements.** The firm must retain documentation of the customer's investment profile, the risk assessment or score, the recommended model or strategy, and the basis for the recommendation. For discretionary accounts, the investment policy statement (IPS) should be established at account opening. For Reg BI accounts, Form CRS must be delivered before or at the time of the recommendation, and the basis for the recommendation must be documented.

**Investment adviser fiduciary considerations at opening.** For RIA accounts, the fiduciary duty of care requires that the adviser understand the client's financial situation and investment objectives before making any recommendation. The account opening suitability questionnaire serves as the foundation for the adviser's duty of care analysis. The adviser must also identify and disclose any material conflicts of interest that may affect the advice provided. The account opening process should include delivery of Form ADV Part 2A and Part 2B (or the brochure supplement), collection of the client's acknowledgment of receipt, and execution of the investment advisory agreement. These disclosure obligations are not just suitability requirements — they are fiduciary obligations that, if not met at account opening, create ongoing compliance risk throughout the advisory relationship.

**Enhanced suitability review triggers.** Certain conditions detected during the account opening process should trigger an enhanced suitability review before the account is activated:
- The client selects an investment objective or risk tolerance inconsistent with their financial situation (e.g., aggressive growth with limited liquid net worth)
- The client requests products or features not typically consistent with their profile (e.g., options trading for a conservative investor)
- The client is a senior investor (age 65 or older)
- The client has limited investment experience and selects a complex strategy
- The client's stat