joellewis/account-opening-compliance
Embed compliance controls into account opening and verify regulatory readiness. Use when designing CIP/KYC identity verification gates, implementing OFAC and sanctions screening at onboarding, collecting beneficial ownership certification for entity or trust accounts, building risk-based approval tiers that route applications by risk level, defining compliance screening requirements and exception tracking, adding senior investor protections (FINRA Rules 2165/4512) or trusted contact procedures, establishing CDD risk ratings and ongoing monitoring triggers, or preparing account opening procedures for SEC or FINRA examination. For the operational pipeline these controls plug into, see account-opening-workflow.
npx skills add https://github.com/JoelLewis/finance_skills --skill account-opening-complianceThe Customer Identification Program is the first compliance gate in any account opening workflow. Under USA PATRIOT Act Section 326 and its implementing regulations, a firm must verify the identity of each customer before or at the time of account opening. The account opening process must be designed so that no account becomes active until CIP is satisfied.
Verification timing. The regulations permit two approaches: (1) verify identity before the account is opened, which is the most conservative approach and prevents any transactional activity until verification is complete; or (2) verify identity within a reasonable time after the account is opened, provided the firm has procedures to manage the risk of incomplete verification (such as restricting account activity until verification is complete). Most firms implementing digital onboarding choose the first approach — identity verification occurs in real time during the application flow, and the application cannot proceed until verification returns a pass result. The second approach — opening with restricted activity pending verification — is used primarily for paper-based or advisor-assisted workflows where verification cannot occur in real time, and requires the firm to document the risk mitigation procedures (no trading, no disbursements, no margin until verification completes).
Database verification is the primary method for digital account opening. The onboarding system sends applicant data (name, date of birth, address, SSN/TIN) to an identity verification vendor (LexisNexis Risk Solutions, Alloy, Equifax, TransUnion) via API. The vendor cross-references the data against credit bureau records, public records, and government databases and returns a pass, fail, or inconclusive result, typically within seconds. Database verification satisfies CIP's non-documentary verification requirement.
Documentary verification serves as a fallback when database verification is inconclusive or unavailable. The applicant uploads a photo of a government-issued ID (driver's license, passport, state ID). OCR extracts data fields, and the system may compare the document photo to a selfie for liveness detection. Documentary verification is slower and introduces friction but is necessary for applicants who cannot be verified through database methods — non-US persons, thin-file individuals, and cases where database results are ambiguous.
Verification failure handling. The account opening workflow must define clear paths for each verification outcome:
Exception processing for inconclusive results is operationally critical. Common causes of inconclusive results include name mismatches (legal name vs preferred name, hyphenated names, transliteration differences for non-English names), address mismatches (recent moves, PO boxes), and thin credit files (young adults, recent immigrants). The exception processing workflow should collect additional documentation, perform manual database searches, and escalate to compliance when standard exception procedures do not resolve the issue. The firm should track exception rates by cause to identify systemic issues — for example, a high rate of transliteration-related exceptions may indicate a need to improve the verification vendor's handling of non-Latin character sets.
Non-US persons and foreign accounts. CIP verification for non-US persons presents additional complexity. Acceptable identification numbers include a passport number and country of issuance, an alien identification card number, or a number and country of issuance of any other unexpired government-issued document evidencing nationality or residence that bears a photograph. Database verification coverage is weaker for non-US persons, making documentary verification (passport upload with liveness check) the primary method. The account opening workflow should detect non-US applicants early and route them to the documentary verification path without requiring a failed database check first.
Recordkeeping requirements. CIP regulations require retention of identifying information (name, date of birth, address, identification number), a description of the documents or methods used to verify identity, and the resolution of any discrepancies. These records must be retained for 5 years after the account is closed. The account opening system should automatically generate and store a CIP verification record for each application, including the verification method, vendor response, timestamp, and outcome.
OFAC screening is a mandatory compliance gate that must clear before any account is opened. Unlike CIP, which verifies that the applicant is who they claim to be, OFAC screening determines whether the applicant — or any person associated with the account — is a sanctioned individual or entity with whom the firm is prohibited from doing business.
Scope of screening. The firm must screen all individuals associated with the account, not just the primary applicant. This includes:
Lists screened. At minimum, screening must cover the OFAC SDN (Specially Designated Nationals and Blocked Persons) list. Best practice extends screening to the Sectoral Sanctions Identifications (SSI) list, the Non-SDN Menu-Based Sanctions list, the Foreign Sanctions Evaders (FSE) list, and consolidated non-OFAC lists such as the FinCEN 314(a) list and any firm-specific restricted lists. Automated screening platforms typically screen against all OFAC lists simultaneously.
Screening frequency. OFAC screening must occur at account opening and on an ongoing basis thereafter. Ongoing screening is triggered by: (1) OFAC list updates (the SDN list is updated frequently, sometimes multiple times per week), (2) changes to account ownership or authorized parties, and (3) periodic rescreening on a risk-based schedule. At account opening, the screening must occur before the account is activated and before any funds are accepted or transactions are processed.
Potential match handling. When the screening system generates a potential match (also called an alert), the workflow must:
False positive management is an ongoing operational challenge. Common names, transliteration variations, and incomplete identifying data on OFAC lists generate high false positive rates. Firms should tune their screening algorithms to balance detection sensitivity against operational burden. Reducing false positives without degrading detection requires maintaining and updating known false positive records, using multiple data points for matching (not just name), and calibrating fuzzy match thresholds. All tuning decisions must be documented and defensible.
Documentation of screening results. Regardless of outcome, the account opening record must include a log of every screening run: the lists screened, the individuals screened, the screening timestamp, the algorithm version or configuration, the raw results, and the disposition. For no-match results, the system log is sufficient. For potential matches resolved as false positives, the record must include the analyst's comparison of identifying data points and the rationale for the false-positive determination. For true positives, the record must include the blocking report, the notification to OFAC, and any subsequent correspondence. These records must be retained for the life of the account plus 5 years after closure and must be producible for regulatory examination.
The FinCEN CDD Rule (31 CFR 1010.230, effective May 2018) requires covered financial institutions to identify and verify the beneficial owners of legal entity customers at the time of account opening.
Who must be identified. For each legal entity customer, the firm must identify:
A single individual may satisfy both prongs (e.g., a sole owner who is also the manager). The maximum number of beneficial owners reported is typically five (four under the ownership prong plus one under the control prong), though an entity with more than four 25% owners must report all of them.
25% ownership threshold. Ownership is calculated on a direct and indirect basis. If an individual owns 30% of Entity A, and Entity A owns 100% of Entity B (the account applicant), the individual indirectly owns 30% of Entity B and must be identified as a beneficial owner. Multi-layered ownership structures require the firm to trace ownership through intermediate entities to identify the natural persons who ultimately hold 25% or more.
Exempt entity types. Certain entities are exempt from the beneficial ownership requirement because their ownership is already transparent through other regulatory mechanisms:
Certification form management. The firm collects beneficial ownership information on a certification form (based on FinCEN's standard form or the firm's equivalent). The account opening workflow must present this form when the applicant is a legal entity, collect the required information for each beneficial owner, and verify the identity of each identified beneficial owner using the firm's CIP procedures. The form must be signed (physically or electronically) by the individual opening the account on behalf of the entity, certifying the accuracy of the information. The firm must retain the certification form and verification records for 5 years after the account is closed.
Ongoing monitoring for ownership changes. The CDD Rule requires firms to update beneficial ownership information on a risk basis. The account opening process should establish triggers for ownership updates: periodic review (typically annually for high-risk entities, every 3 years for standard risk), event-driven updates (notification of ownership change, corporate restructuring, merger), and customer-initiated updates. The account opening system should flag the next review date and route it to the appropriate review queue.
Corporate Transparency Act interaction. The Corporate Transparency Act (CTA) originally required most companies to report beneficial ownership information directly to FinCEN beginning in 2024. As of FinCEN's March 2025 interim final rule, however, all entities formed in the United States (the former "domestic reporting companies") and their beneficial owners are exempt from CTA reporting; only entities formed under foreign law and registered to do business in the US remain reporting companies, and they need not report US-person beneficial owners. The practical consequence for account opening: CTA-reported data is not a substitute for the firm's own beneficial ownership collection, and the CTA does not relieve financial institutions of their CDD Rule obligations. Firms must continue to collect and verify beneficial ownership independently through the certification form process, and should verify the current state of CTA rulemaking, which remains in flux.
Account opening must collect information to satisfy international tax reporting obligations. These requirements apply regardless of the account holder's citizenship and are triggered by indicators of foreign tax residency.
FATCA (Foreign Account Tax Compliance Act). US financial institutions must determine whether account holders are US persons (requiring W-9 collection) or non-US persons (requiring W-8BEN or W-8BEN-E collection and FATCA classification). For entity accounts such as trusts, the firm must classify the entity under FATCA (e.g., Active NFFE, Passive NFFE, Financial Institution) and, for Passive NFFEs, identify any controlling persons who are US persons. Failure to collect valid W-8/W-9 forms triggers backup withholding at 24% on reportable payments.
CRS (Common Reporting Standard). If any account holder or controlling person is tax-resident in a CRS-participating jurisdiction (most countries outside the US), the firm must collect a self-certification of tax residency, including the foreign taxpayer identification number (TIN). For the family trust scenario with a UK-resident trustee, CRS requires reporting the account to HMRC via the firm's CRS reporting channel. The self-certification must be collected at or before account opening.
Integration with account opening workflow. The tax compliance gate should:
Cross-border complexity. When account holders have tax obligations in multiple jurisdictions (e.g., a US-UK dual national, or a trust with trustees in different countries), the firm may need to report under both FATCA and CRS. The account opening system should identify multi-jurisdictional reporting obligations based on the tax residency declarations collected and route these accounts for compliance review.
Account opening is the primary data collection event for investment suitability. The compliance framework requires that the firm gather sufficient information to evaluate the suitability of any subsequent investment recommendation before or at the time of the first recommendation.
Documenting the investment profile. The account opening process must collect all elements of the customer's investment profile as defined by FINRA Rule 2111 and Regulation Best Interest: investment objectives, risk tolerance, time horizon, liquidity needs, financial situation (income, net worth, liquid net worth), investment experience, tax status, and any other information the customer discloses. The profile must be documented in a durable, retrievable format — not just captured in a questionnaire that is discarded after scoring.
Mapping to appropriate products and models. The suitability data collected at opening drives the mapping of the account to an investment model or strategy. The account opening system should produce a risk score or category from the suitability questionnaire and map that score to a defined range of models or strategies. This mapping must be documented, consistently applied across advisors, and periodically reviewed for reasonableness. Deviations from the mapping (e.g., an advisor selecting a more aggressive model than the client's risk score indicates) should trigger a compliance review.
Reg BI care obligation for account type recommendation. Under Regulation Best Interest, the recommendation of an account type itself (e.g., brokerage vs advisory, IRA vs taxable, fee-based vs commission-based) is subject to the Care Obligation. The account opening process for broker-dealers must document that the recommended account type is in the customer's best interest, considering reasonably available alternatives and the customer's investment profile. This means the compliance controls at account opening must capture not just the account type selected but the rationale for selecting it over alternatives.
Suitability documentation requirements. The firm must retain documentation of the customer's investment profile, the risk assessment or score, the recommended model or strategy, and the basis for the recommendation. For discretionary accounts, the investment policy statement (IPS) should be established at account opening. For Reg BI accounts, Form CRS must be delivered before or at the time of the recommendation, and the basis for the recommendation must be documented.
Investment adviser fiduciary considerations at opening. For RIA accounts, the fiduciary duty of care requires that the adviser understand the client's financial situation and investment objectives before making any recommendation. The account opening suitability questionnaire serves as the foundation for the adviser's duty of care analysis. The adviser must also identify and disclose any material conflicts of interest that may affect the advice provided. The account opening process should include delivery of Form ADV Part 2A and Part 2B (or the brochure supplement), collection of the client's acknowledgment of receipt, and execution of the investment advisory agreement. These disclosure obligations are not just suitability requirements — they are fiduciary obligations that, if not met at account opening, create ongoing compliance risk throughout the advisory relationship.
Enhanced suitability review triggers. Certain conditions detected during the account opening process should trigger an enhanced suitability review before the account is activated:
Not all account applications present the same compliance risk. A risk-based approach assigns each application to a review tier based on risk indicators, ensuring that higher-risk applications receive enhanced scrutiny while standard applications proceed efficiently.
Standard review applies to the majority of account openings: individual or joint taxable accounts, IRAs, and other common account types for US persons with clean CIP verification, clear OFAC screening, and a straightforward investment profile. Standard review may be fully automated — the system verifies that all compliance gates have passed and approves the application without manual intervention. An operations supervisor or compliance designee may review a sample of auto-approved accounts on a post-hoc basis.
Enhanced review triggers. The following indicators should escalate an application from standard to enhanced review, requiring manual compliance review before account activation:
Risk scoring at account opening. Many firms assign a numeric risk score to each account at opening based on a weighted assessment of risk factors. Common scoring dimensions include:
The risk score determines the initial CDD risk rating, which in turn drives the frequency and depth of ongoing monitoring. The scoring model should be documented, validated periodically, and applied consistently. Firms should avoid models that are so coarse that they assign nearly all accounts to the same tier, or so sensitive that they escalate a disproportionate share of routine accounts.
Escalation to compliance. When enhanced review is triggered, the application routes to a compliance analyst or compliance officer for manual review. The reviewer evaluates the risk factors, may request additional documentation from the applicant (source of funds statement, additional identification, purpose of account), and makes an approve/deny/escalate decision. If the reviewer cannot resolve the risk, the application escalates to senior compliance or the Chief Compliance Officer. All review decisions, supporting analysis, and documentation must be retained.
Documentation requirements per tier. Standard review requires retention of the automated compliance check results (CIP, OFAC, suitability score). Enhanced review requires, in addition: the specific risk factor(s) that triggered escalation, the reviewer's analysis, any additional documentation collected, the approval decision and rationale, and the identity of the approver. The documentation standard increases with risk tier — a PEP account, for example, should have a detailed memo explaining the source of wealth analysis and the basis for approval.
Account denial procedures. When compliance determines that an account should not be opened, the denial must be handled carefully. The firm should document the specific reasons for denial, retain the documentation in the compliance file, and communicate the denial to the applicant in a manner that does not reveal OFAC screening results or SAR-related information (to avoid tipping-off violations). The denial letter should state that the firm is unable to open the account at this time without providing the specific compliance reason. If the denial is related to OFAC or AML concerns, the firm should evaluate whether a SAR filing is warranted. Denied applications should be tracked in a centralized log to identify patterns (e.g., repeated attempts by the same individual to open accounts, or a pattern of denials from a particular referral source).
Account opening for senior investors (generally age 65 and older, though some firms use age 60) triggers additional compliance obligations designed to protect against financial exploitation and diminished capacity.
FINRA Rule 4512 — Trusted Contact Person. Effective February 2018, FINRA Rule 4512 requires firms to make reasonable efforts to obtain the name and contact information of a trusted contact person for each customer's account. The trusted contact is not an authorized party — they cannot transact on the account. The purpose is to provide the firm with a resource to contact if the firm suspects financial exploitation, diminished capacity, or has concerns about the customer's welfare. The account opening process must include a trusted contact designation as a standard field, and the firm must make reasonable efforts to obtain this information for all customers, not just seniors. However, the trusted contact is particularly important for senior investors.
FINRA Rule 2165 — Financial Exploitation of Specified Adults. Effective February 2018, this rule provides a safe harbor for firms to place temporary holds on disbursements from the accounts of specified adults (persons age 65 or older, or persons age 18 or older who the firm reasonably believes have a mental or physical impairment that renders them unable to protect their own interests). At account opening, the firm should:
Age-based triggers for enhanced review at opening. When the applicant is 65 or older, the account opening process should trigger:
Diminished capacity indicators that may be observed during the account opening process:
When these indicators are present, the firm should pause the account opening, document the observations, consult with a supervisor and potentially the trusted contact person, and determine whether proceeding is in the customer's interest.
Temporary hold authority. FINRA Rule 2165 authorizes the firm to place a temporary hold on a disbursement of funds or securities from the account of a specified adult if the firm reasonably believes that financial exploitation has occurred, is occurring, has been attempted, or will be attempted. The hold may last up to 15 business days, extendable to 25 business days if the firm has reported the matter to a state regulator or agency or court of competent jurisdiction. While this authority applies post-opening, the account opening process is the point at which the firm establishes the infrastructure — trusted contact, system flags, monitoring triggers — that enables effective use of hold authority when needed.
State-level protections. Many states have adopted their own senior investor protection statutes, often modeled on NASAA's Model Act to Protect Vulnerable Adults from Financial Exploitation. These state laws may impose mandatory reporting obligations (requiring the firm to report suspected exploitation to adult protective services or a state securities regulator), provide additional hold authority beyond FINRA Rule 2165, or create penalties for failure to report. The account opening compliance framework must identify the applicable state law based on the customer's residence and ensure that state-specific obligations are incorporated into the workflow.
Manual compliance processes do not scale. As account volumes grow, firms must automate compliance screening, approval routing, exception tracking, and audit trail generation to maintain both efficiency and control quality.
Automated screening workflows. The core compliance checks at account opening — CIP verification, OFAC screening, PEP screening, negative media screening, and beneficial ownership verification for entities — should execute automatically as the application progresses through the workflow. Each screening step fires via API call, the result is captured in the application record, and the workflow engine advances or halts the application based on the result. No manual intervention is required for applications that pass all screens.
Rules-based approval routing. The workflow engine should evaluate each application against a configurable rules set to determine the approval path:
The rules engine must be configurable by compliance (not hardcoded by IT), auditable (all rule changes logged with effective dates and approver), and testable (new rules can be validated against historical applications before deployment).
Compliance checklist automation. Each account type has a defined set of compliance requirements. The system should generate an automated checklist at the start of each application based on the account type and features, track completion of each item, and prevent submission until all required items are satisfied. The checklist should be visible to the operations team, the advisor, and compliance. Example checklists by account type:
Exception tracking. When an application enters an exception state (inconclusive CIP, OFAC potential match, missing documentation, triggered enhanced review), the system must track the exception from creation through resolution. Exception tracking should include: the exception type, the date raised, the assigned reviewer, the current status, the resolution (approved, denied, pending additional information), the resolution date, and the supporting documentation. Aging exception reports should surface applications that have been in exception status beyond defined thresholds (e.g., 3 business days for CIP exceptions, 1 business day for OFAC alerts).
Audit trail generation. Every compliance action during the account opening process must be logged in an immutable audit trail: who performed the action, what the action was, when it occurred, and the result. This includes automated actions (system ran OFAC screening at 14:23:07 — result: no match) and manual actions (compliance analyst J. Smith reviewed OFAC alert #4521 at 15:10:22 — disposition: false positive — rationale: different date of birth and passport number). The audit trail must be retained for the life of the account plus the applicable regulatory retention period (5-6 years after account closure) and must be producible for regulatory examinations.
Compliance dashboard for the opening pipeline. A real-time dashboard provides compliance and operations management with visibility into the account opening pipeline: total applications in progress, applications by stage, applications in exception status, aging exceptions, approval rates, auto-approval rates, average time-to-open, and NIGO rates. The dashboard enables compliance to identify bottlenecks, staffing needs, and emerging risk patterns (e.g., a spike in OFAC alerts from a particular region).
Vendor management for compliance screening. Most firms rely on third-party vendors for identity verification, OFAC screening, PEP databases, and adverse media feeds. The compliance automation framework must include vendor oversight: initial due diligence on the vendor's data sources and accuracy rates, contractual service-level agreements (SLAs) for response time and uptime, periodic validation testing (running known positives and known negatives through the vendor's system to verify accuracy), and contingency procedures for vendor outages. If the screening vendor is unavailable, the firm must have a fallback process — manual screening against downloadable OFAC lists, for example — to avoid either opening accounts without screening or halting all account openings during the outage.
Regulatory technology (RegTech) considerations. The compliance automation landscape is evolving rapidly. Firms evaluating RegTech solutions for account opening compliance should assess: integration capabilities with existing account opening platforms and custodian APIs; configurability of screening rules and thresholds by compliance (not requiring developer intervention); quality of audit trail and reporting outputs; ability to handle multi-entity, multi-jurisdiction screening in a single workflow; and the vendor's regulatory track record (has the vendor's technology been examined by regulators, and what were the findings?). The firm should retain ownership of the compliance decision — automation assists but does not replace compliance judgment on escalated cases.
The account opening process does not end when the account is activated. The compliance decisions made at opening establish the framework for ongoing monitoring throughout the life of the account.
CDD risk rating assignment. Every account receives a CDD risk rating at opening (e.g., low, medium, high, or a numeric score). The risk rating is derived from the risk factors assessed during the opening process: customer type, geographic exposure, product complexity, source of wealth, PEP status, and any enhanced review findings. The risk rating determines the intensity and frequency of ongoing monitoring — high-risk accounts receive more frequent transaction monitoring, periodic reviews, and closer scrutiny of unusual activity.
Event-driven review triggers. The account opening process should establish the events that will trigger a compliance review during the life of the account:
Periodic review scheduling. Based on the CDD risk rating assigned at opening, the system should schedule the next periodic review: annually for high-risk accounts, every 2-3 years for medium-risk accounts, and every 3-5 years for low-risk accounts. The periodic review confirms that the customer's profile remains current, the risk rating remains appropriate, and no new risk factors have emerged.
Account activity monitoring thresholds. The account opening process should establish baseline expectations for account activity based on the customer's profile, account type, and stated purpose. These baselines feed into the firm's transaction monitoring system, which generates alerts when activity deviates significantly from expectations. For example, an account opened for "long-term retirement savings" that begins executing high-frequency trades should generate an alert for compliance review.
Handoff from opening compliance to ongoing compliance. The transition from account opening to the ongoing compliance lifecycle must be explicit and documented. When the account opening process is complete, the system should transmit the following to the ongoing monitoring infrastructure: the CDD risk rating, the beneficial ownership record (for entities), the next scheduled periodic review date, any conditions of approval imposed during enhanced review (e.g., "monitor for source-of-funds consistency for the first 6 months"), the trusted contact person record, and the suitability profile. This handoff ensures that the compliance decisions made at opening are not lost and that ongoing monitoring reflects the risk assessment established during the opening process. A gap in the handoff — for example, an account approved with conditions but no system to track compliance with those conditions — is a significant control weakness.
Three worked examples — automated compliance screening for a high-volume broker-dealer, beneficial ownership verification for complex entity structures (ownership tracing, trust classification), and a four-tier risk-based review framework (auto-approval through CCO review, with $500K and $2M funding thresholds) — are in references/examples.md; load it when designing a concrete screening, beneficial ownership, or review-tier program.
Take joellewis/account-opening-compliance from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.