Summary
During business onboarding, the details on an application often don't quite match what the bank finds in an independent source. The application says LLC and the state record says Inc., the address is a registered agent's office, or the registry lookup times out. The customer identification program (CIP) rule doesn't require every field to match. It requires the bank to verify enough to form "a reasonable belief" that it knows the customer's true identity, and to record how it resolved any substantive discrepancy (31 CFR 1020.220). This guide covers how to document each mismatch so a reviewer can resolve it and an examiner can follow the decision later.
For onboarding, KYC and BSA/AML teams at U.S. banks verifying business customers under CIP.
What the rule requires and what's bank practice
Know your business (KYB) is the broader diligence on a business customer. This guide covers the identity part of it. Beneficial ownership, sanctions screening and enhanced due diligence have their own requirements.
| Topic |
What applies |
Source |
| Verification standard |
Risk-based procedures that let the bank form a reasonable belief it knows the customer's true identity |
31 CFR 1020.220(a)(2) |
| Address for a business |
A principal place of business, local office or other physical location |
1020.220(a)(2)(i) |
| Verification methods |
Documents showing the entity exists, such as certified articles of incorporation or a government-issued business license, or non-documentary methods such as checking a public database |
1020.220(a)(2)(ii) |
| Timing |
Within a reasonable time after the account is opened; the rule sets no fixed number of days |
1020.220(a)(2)(ii) |
| Records |
The documents relied on, the non-documentary methods and results, and how each substantive discrepancy was resolved |
1020.220(a)(3)(i) |
| When verification fails |
Written procedures for when not to open an account, when to close one, and when to file a SAR |
1020.220(a)(2)(iii) |
| Referral format, request templates, return rates |
Not required by any rule; this is how the bank organizes its review |
Bank procedures |
The FFIEC manual adds that a bank "need not establish the accuracy of every element of identifying information," but must verify enough of it to reach that reasonable belief (FFIEC CIP overview).
Resolve a discrepancy in five steps
1. Keep the original value next to the source value
Record what the applicant submitted and what the source returned, along with the source name, what it covers and when it was retrieved. If an analyst cleans up a name or address for matching, keep the original too. Overwriting the application with the registry value removes the evidence the reviewer needs to explain the difference.
2. Write down the question the mismatch raises
Each mismatch should lead to one plain question. An LLC on the application and an Inc. in the state record raises whether these are the same entity, perhaps after a conversion, or two different ones. An operating address that differs from the registered agent's address raises which one is the physical location the rule asks for. A registry lookup that times out leaves the question open, since it returned no result either way.
Keep the applicant's explanation separate from what the sources show. "We converted from an LLC last year" is a claim to check against the state record, not the answer.
3. Ask for the evidence that answers that question
Send one targeted request rather than a general document list. A suffix difference calls for the conversion or name-change filing. An address question calls for support for the principal place of business, such as a lease or utility bill, depending on your procedures. A timeout calls for a retry or another source your CIP allows. Set the due date by your procedures.
4. Route open items to the CIP reviewer
Send the referral with both values, the question, the request and any failed attempts, so the reviewer can see what's still unverified. Your CIP's response procedures decide what happens next, including whether the account can be used while verification continues. A suffix difference, a second address or a timeout doesn't by itself decide the account or trigger a SAR.
5. Record the resolution and label the retention clock
Record what the reviewer decided, the evidence they considered and why. The CIP rule uses two retention clocks, so label each record:
| Record |
Keep for at least |
| Identifying information collected from the customer |
Five years after the account is closed (for credit cards, after it closes or becomes dormant) |
| Documents relied on, non-documentary methods and results, and discrepancy resolutions |
Five years after the record is made |
Both come from 1020.220(a)(3)(ii). Putting the whole customer file on one clock means some records are kept too briefly or tracked against the wrong date.
Worked example
Illustrative example. All names and details are fictional.
Harbor Field Supply applies for a business checking account. The bank's checks turn up three mismatches.
| Mismatch |
What the file keeps |
Request and outcome |
| "Harbor Field Supply LLC" on the application, "Harbor Field Supply, Inc." in the state record |
Both names, the state record and its retrieval date |
Asks for the conversion filing; the state's certificate of conversion confirms one entity, and the reviewer records the resolution |
| Application address is a registered agent's office |
Both addresses and what each is used for |
Asks for the warehouse lease; the lease supports the warehouse as the principal place of business |
| Business license lookup timed out |
The failed attempt and its time |
Retries the next day and gets a match, recorded with the new retrieval time |
The file now shows each difference, the evidence that resolved it and who decided. Two records are now on separate retention clocks: the identifying information runs until five years after the account closes, and the three resolution records run until five years after they were written.
Where discrepancy reviews go wrong
The most common problem is a file that shows the answer but not how the bank got there: the registry value has replaced the original, and nothing explains why. Another is treating a failed lookup as a negative result, which can hold up or decline a legitimate business on the basis of evidence that doesn't exist. Teams also tend to send applicants the same full document list for every mismatch, which slows the customer down without answering the question. And when every field is required to match exactly, analysts spend time on differences that have nothing to do with identity, which runs against the risk-based standard in the rule.
To see whether referrals are working, track how often reviewers send one back for missing evidence or an unclear question. A rising rate usually means step 2 or 3 is being skipped.
How Bretton fits in
Bretton has ready-made KYB workflows in which agents gather the evidence, apply your bank's policy and draft the case for your team to approve, working on top of the systems you already use (Bretton platform). Through Bretton's partnership with Middesk, business registration, licensing and ownership data comes straight into the review (Middesk partnership). Every agent action is logged and cited, so a reviewer can see which source each finding came from, and the identity decision stays with your team.
Common questions
Does every field on a business application have to match the independent source?
No. The CIP rule asks for enough verification to form a reasonable belief about the customer's identity, and the FFIEC says a bank need not verify every element. Substantive discrepancies still need a recorded resolution.
Does a failed registry lookup mean the business doesn't exist?
No. It means no result came back. Record the attempt, then retry or use another source your CIP allows.
How long does a bank keep CIP discrepancy records?
At least five years after the record is made. The customer's identifying information is kept for five years after the account closes.
Sources
Book a demo to see how Bretton prepares KYB reviews for your onboarding team.
