Purpose The Board of Directors of NorthPark Community Credit Union (hereafter NPCCU) adopted this Customer Identification Program (CIP) policy, as required by Section 326 of the USA Patriot Act. This CIP policy is effective immediately and is incorporated into our overall Bank Secrecy Act policy. This CIP policy will help our credit union detect and prevent money laundering and terrorist financing schemes. The procedures will apply after Board of Directors approval on May 23, 2016 (with future revisions) to a person establishing a new account relationship. Accounts include all formal accounts whether it is a share, share draft, certificate or other savings accounts or loan accounts. NPCCU understands that CIP requires the credit union to follow these basic steps when a member and or an account owner (hereafter known as member ) opens a new account or when a new member is added to an existing account: Provide a CIP disclosure Obtain basic information about the members Verify the identity of the member Check if a member appears on a government terrorist list Retain records for 5 years after the account has been closed. Policy Goal Provide for internal procedures/controls to ensure ongoing CIP compliance by NPCCU staff. General Provisions 1. Applicability This CIP policy applies to: a. Any new member opening an account at NPCCU. b. Any new member added to an existing member s account c. EXCEPTION: This CIP policy does not apply to existing members of NPCCU opening new accounts as long as: Existing member identity was previously verified. Employee of NPCCU has a reasonable belief he or she knows the identity of the member. Page 1
2. Member Notice provided annually, each June. To our account holders and potential account holders: In accordance with Section 326 of the USA Patriot Act of 2001, which requires NPCCU to help the government fight the funding of terrorism and money laundering activities, NPCCU is required to obtain basic identifying information from you and verify that information when you open a new account. This means the NPCCU staff will ask you for some basic information such as your name, address, date of birth, and other information designed to help us identify you NPCCU staff will also ask to see documents identifying you such as a social security card, driver s license, passport, and/or some other government-issued document. In some cases, identification will be requested for those individuals conducting business with NPCCU prior to the effective date of the member identification requirements. This is because original documentation was not obtained with the opening of the account or NPCCU is unable to form a reasonable belief that it knows the true identity of the existing account holder. In all cases, protection of our member s identity and confidentiality is the Credit Union s pledge to you. NPCCU appreciates your patience and understanding as we all do our part in complying with the new account identification procedures required by the federal USA Patriot Act of 2001. Notice shall be given to new account owners in any of the following ways: Oral notice given to new account owners, in person or on the phone Lobby notice (In the NPCCU lobby, or the lobby or office of Indirect Dealers) Brochure/paper notice included in new member packets Signs at Member Service Representative stations Notice posted on new account pages of NPCCU website Procedures 1. Opening a New Account Collecting Basic Information a. Advise Members of CIP Notice prior to opening the account b. Accounts must be checked through Fraud Advisor with I.D. Advisor or Safe Scan on Credit Reports, and OFAC. c. CIP must be checked on all nonmembers for any extension of credit. This Excludes guarantors who will not receive loan proceeds. Page 2
d. When Indirect Members add checking (a transactional account) onto their existing savings account and become a direct member, it is required that a new account card be completed and steps are followed in the same manner as our regular (direct) membership to mitigate additional risk. Any member who wishes to open a new account with NPCCU must provide the following basic information before opening an account: a) Name as it appears on the social security card, passport or other acceptable Form of identification such as unexpired driver s license. b) Date of Birth c) Address, which shall be: 1. For an individual, a residential or business street address; 2. For an individual who does not have a residential or business street address, an Army Post Office (AP0) or Fleet Post Office (FPO) box number, or residential or business street address of next of kin or of another contact individual, or a military ID; or 3. For a person other than an individual (such as a corporation, partnership or trust), a principal place of business, local office or other physical location. 4. In an effort to support participants in an ACP, FinCEN authorized an exception to the CIP requirement that a credit union obtain a member s residential or business street address for participants of an ACP (address confidentiality program) shall be treated as not having a residential or business street address and the state entity serving as a designated agent of the participant will act as another contact individual for the purposes of complying with FinCEN s rules. Therefore the credit union should collect the street address of the ACP sponsoring agency for purposes of meeting CIP address requirements. d) Identification Number 1. US Persons: Social Security Number Employer Identification Number (for business accounts) 2. Non-US Persons (1 or more of these): 9-Digit Individual Tax Identification Number Passport Number & Country of Issuance Alien Identification Card Number (Green Card) Document Number & Country Issuing any other document showing evidencing nationality or residence and bearing a photograph or similar safeguard. If the member is applying for a TIN/SSN or a card is not available, NPCCU will accept a letter from the Social Security Administration documenting that the card has been applied for or reissued. We will require the member to produce the card within three months. In the case of an infant or adopted minor, identification numbers will be required from the parent(s) or guardians on the account. Minors without an identification Page 3
number will be monitored on a monthly basis with Member Service Representatives contacting the parents each month until the card is produced at the credit union. In the event an account being opened is for someone other than an individual (such as a corporation, partnership, or trust), all signers and trustees on the account must provide the necessary identification information listed above (Section 1. a. - d.) and that information must be verified with either document or non-document verification. 2. Verifying Required Information Methods Used When a new member opens an account, NPCCU staff shall use either document or non-document methods to verify the identity of all new account owners. If an account is requested through the mail it may not be opened until document information and a signed account card are received, or may be allowed to open the account pending receipt of identification information. If opened without identification information, the account must be locked-down to allow deposits only. The account cannot be allowed withdrawals until identification verification is satisfied. If not satisfied within 90-days, the account will be closed and the funds returned to the address shown on the account. A Suspicious Activity Report (SAR) will be generated if deemed necessary by the BSA Officer. Only NorthPark members can purchase reloadable or gift cards so CIP policies and procedures will be applied at account opening and identity verified at card purchase. (a) Document Identification includes requiring any of the following. 1. Unexpired Government Issued Identification Card 2. Passport 3. Other National Identification Document except Matriculate Consular Cards (A Secondary Form of Identification must be used.) 4. When an individual does not have one of the identification documents listed above (1 3), a secondary level of identification can be used, such as an Employer Identification Card, Student Identification Card, or Medicare Card. These forms of identification must be used in conjunction with other nondocument identification efforts listed below (c.). If using a secondary form of identification listed above to verify a member s identity all forms of verification used must be documented. (b) For persons/entities other than an individual such as a corporation, partnership or trust documents showing the existence of the entity must be provided. 1. Certified articles of incorporation 2. Government-issued business license 3. Partnership agreement, or 4. Trust instrument. Page 4
(c) Non-Document Identification includes any of the following: 1. Contact new member s employer or place of residence 2. Check references at other financial institutions 3. Contact new member s family member 4. Compare member information against credit report, public database or other Source 5. Obtaining a financial statement 6. Utility bill with current address or lease agreement with current address 7. Letter of employment for all new Dow hires. NPCCU limits what it considers satisfactory documentation to those documents listed above. If the NPCCU employee is not familiar with the documentation provided by the prospective member, the employee should ask the prospective member to provide documentation from the list above, or use non-documentation identification. See the following Risk Management section, Part 1 (a) for further guidance. 3. Account Opened Pending Receipt of Identification Documents When a new account owner opens an account without supplying required identification documentation, NPCCU is to place a system administrative hold on the account ( locked-out). The member will not be able to withdraw funds or enjoy any other credit union loans or other services, but will be allowed to make deposits. Once satisfactory documentation has been received, the hold can be lifted. If the satisfactory identification documents are not received within 90-days, NPCCU s BSA Compliance Officer (or a designee) will contact the account owner stating NPCCU s intent to close the account and return the funds. Risk Management Additional verification for certain customers: Based on the credit union s risk assessment of a new account opened by a customer that is not an individual, the credit union will obtain information about individuals with authority or control over such account, including signatories, in order to verify the customer s identity. This verification method applies only when the credit union cannot verify the customer s true identity using the verification methods described above. 1. Special Circumstances Lack of Verification In situations where NPCCU cannot form a reasonable belief regarding the identity of a new account owner (either due to lack of document identification or non-document verification) the staff at NPCCU will: Page 5
(a) Notify the BSA Compliance Officer or designated member of management of the inability to establish identity. (b) If directed by Management, not open the account. (c) After checking with the BSA Compliance Officer, if NPCCU cannot form a reasonable belief regarding the identity of a new account owner, NPCCU Policy requires management to file a SAR (Suspicious Activity Report). 2. Comparison with Government Lists NPCCU will crosscheck the name(s) of any new member against any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators. This determination will be made at the time the account is opened. NPCCU will follow all Federal directives issued in connection with such lists. Any member whose name appears on any of the above-mentioned lists may not be permitted to open an account at NPCCU. 3. Record Retention Five Years CIP requires NPCCU to make and maintain a record of all identifying information received from new account owners for a period of five years AFTER an account is closed. Record retention shall consist of a description of any document used to establish identity, to include: Type of document (e.g., driver s license, passport, Dow Employee Badge) Any identification number on the document Place document was issued, expiration date of document When using non-documentary methods to verify identity (e.g., credit report, calling employer), and requesting additional verification for certain customers, NPCCU shall: Identify the non-document method used (e.g., called employer) Document results of this verification method (e.g., employment at XXX Corporation confirmed by payroll office. With Privacy Laws you may not receive any information). When any substantive discrepancy is discovered when verifying the identifying information, a description of the resolution will also be maintained. NPCCU will mail an Adverse Action Notice. Page 6
If NPCCU cannot form a reasonable belief regarding the identity of a new account owner, NPCCU Policy requires management to file a SAR (Suspicious Activity Report). RESPONSIBILITY The CEO and Leadership Team will resume responsibility of ongoing compliance of CIP. The Operations Manager can delegate responsibility of account card review to a designated MSR of their choice. TRAINING All credit union personnel who might, in the daily course of business, open new accounts are to be given intensive training in the requirements of the CIP. Additionally, all employees will be given an overview of the CIP on an annual basis. All employees will be trained on a regular basis, receive copies of BSA-related policies annually, and will be required to sign a compliance acknowledgement statement agreeing to comply with federal regulations and NPCCU policies and procedures. ANNUAL REVIEW This policy will be reviewed by NPCCU Management and approved by the Board of Directors on an annual basis. Page 7