Which statement accurately reflects the treatment of existing customers under a risk-based CIP?

• A. All customers must be included in CIP
• B. Existing customers may be excluded from the definition of customer if the institution reasonably believes it knows the true identity
• C. CIP never uses risk-based elements
• D. CIP requires biometric verification for all customers

Answer: (B)

Under the risk-based CIP approach, banks tailor identity verification to the level of risk. For existing customers, if the institution reasonably believes it already knows the customer’s true identity from prior verification or reliable records, those customers may be excluded from the CIP’s formal definition of “customer.” This allows the institution to avoid duplicative verification while still applying ongoing monitoring and due diligence. The key is that the existing relationship and verified identity provide a solid basis for not reopening CIP checks, as long as monitoring remains active and the risk remains manageable.

Biometric verification for all customers isn’t required, and CIP does employ risk-based elements rather than a one-size-fits-all approach. Also, not every customer must be treated as a new CIP candidate under all circumstances.