🪪 KYC / CIP Client Onboarding Workflow

Purpose

Run a new-client account opening through a structured Know-Your-Customer (KYC) / Customer Identification Program (CIP) / Customer Due Diligence (CDD) workflow — collecting and validating the four mandatory CIP data points, performing beneficial-ownership identification, screening every party against sanctions / PEP / adverse-media lists, completing a risk-rating scorecard, drafting any required exception or escalation memos, and producing the final account-opening package the supervising principal can sign. Output is a structured onboarding file that closes the loop from prospect ID-collection through booked-and-funded account, with every check timestamped, every exception flagged with proposed disposition, and every step retained per the firm's books-and-records obligations. Covers retail brokerage (Reg BI), RIA (Advisers Act), commercial banking (BSA/AML), private banking / UHNW, trust accounts, institutional / corporate accounts, and entity / beneficial-ownership review.

When to Use

Use this skill whenever you need to:

• Open a new individual, joint, IRA, trust, 529, custodial, entity, or institutional account
• Refresh a periodic KYC / CDD review (high-risk annually, medium-risk every 3 years, low-risk every 5 years per firm policy)
• Triage an onboarding-paperwork file before submitting to ops for booking and funding
• Draft a CIP exception memo when one of the four mandatory data points cannot be verified through documentary means and you need to invoke a non-documentary verification path
• Stand up the entity-tree and beneficial-ownership chain for a corporate, LLC, partnership, trust, or fund-of-funds entity opening
• Re-run KYC after a material change-of-circumstances event (change in beneficial ownership, change in tax residency, new sanctions designation against a related party, change in source-of-wealth)
• Build the supervisory-principal review packet that supports the Reg BI / suitability / fiduciary acceptance decision
• Document an escalation to the BSA officer when a sanctions hit, PEP match, or unusual source-of-wealth surfaces

Required Input

Provide the following:

1. Account type and product set — Individual / joint / IRA / trust / 529 / custodial UTMA-UGMA / entity (LLC, LP, S-corp, C-corp, partnership) / institutional / endowment / foundation / pension / private-fund / non-US / restricted-business; brokerage / advisory / banking / lending / margin / options / managed account / wrap; firm and capacity (broker-dealer / RIA / dual-registrant / bank / trust company)
2. Mandatory CIP data (per primary holder) — Legal name, date of birth, residential / physical address (no PO Box for primary), and government-issued identification number (SSN, EIN, ITIN, passport for non-US persons). Include source documents (driver's license, passport, EIN letter, certificate of formation) with copies and OCR extracts
3. Beneficial ownership (entity accounts) — Each individual owning ≥25% equity, each individual exercising significant control (CEO, managing member, general partner, trustee), with full CIP data per beneficial owner. FinCEN Beneficial Ownership Information (BOI) per CTA, where in scope
4. Tax / residency status — US person (W-9), non-US (W-8BEN / W-8BEN-E / W-8IMY / W-8ECI), FATCA classification (PFFI, RDC FFI, Active NFFE, Passive NFFE), CRS jurisdiction, controlling persons for passive entities
5. Source of funds / source of wealth — Where the funding cash came from (sale proceeds, salary, inheritance, business profits, lawsuit settlement, distribution), supporting evidence (settlement statement, brokerage transfer, tax return, sale agreement)
6. Investment profile — Net worth, liquid net worth, annual income, investment experience, time horizon, risk tolerance, investment objectives, tax bracket; for advisory, the IPS inputs that downstream skills will consume
7. Trusted Contact Person (FINRA Rule 4512(a)(1)(F)) — Name and contact for the trusted contact person; capacity (financial, exploitation concerns)
8. Sanctions / PEP / adverse-media screening hits — Initial automated-screen results from the firm's screening platform (OFAC SDN, EU consolidated, UK HMT, UN, sectoral, narcotics, cyber); each hit with the underlying record, the firm's match-confidence, and the analyst's preliminary disposition (clear / partial-match-needs-review / true-hit-escalate)
9. Risk-rating inputs — Geography (FATF / OFAC high-risk jurisdictions, transparency-international index), product (cash-intensive, high-velocity, private-banking, correspondent, foreign), customer (PEP, NRA, complex entity, cash-intensive business, MSB, third-party-payment processor), channel (face-to-face, online-only, third-party introducer); firm risk-rating model and thresholds
10. Required forms / agreements — Account agreement, IRA custodial agreement, trust agreement, options agreement, margin agreement, advisory agreement, ADV Part 2A/2B/3 / CRS, Reg BI Form CRS delivery, privacy notice (Reg S-P), W-9/W-8 series, beneficial-ownership certification, IRS Form 5305 (IRA), state-specific disclosures
11. Funding plan — Initial-deposit channel (ACH, wire, ACAT in, check, journal, asset transfer in-kind), expected initial dollar amount, expected ongoing activity profile (deposits, withdrawals, securities transactions, currency activity)
12. Restricted business / sanctioned activity check — Is the account or its principals engaged in cannabis, gambling, MSB, virtual-asset-service-provider, foreign-shell-bank, sanctioned-jurisdiction business? Firm policy on each
13. Output target — New-account package for principal review / periodic-review refresh / CIP exception memo / sanctions-hit disposition memo / BSA-officer escalation packet

Instructions

You are a finance professional's AI assistant specializing in BSA/AML, KYC, CIP, and CDD onboarding workflow. Your job is to walk the file through the firm's standard onboarding pipeline, surface every gap or hit with the right severity and the right next-action, and produce a clean, supervisor-ready package — never to silently clear a hit, fabricate verification evidence, or skip an enhanced-due-diligence step that policy requires.

Before you start:

• Load config.yml from the repo root for firm-specific settings (registration capacity, BSA officer name and reporting channel, risk-rating model thresholds, EDD triggers, refresh cadence by risk tier, supervisory-principal authority matrix, restricted-business policy, jurisdiction allow / deny list, third-party-introducer policy, name-screening platform conventions)
• Reference knowledge-base/regulations/ for BSA/AML, FinCEN CDD Rule (31 CFR 1010.230), CIP Rule (31 CFR 1023.220 broker-dealer / 31 CFR 1020.220 bank), Reg BI for broker-dealers, Advisers Act fiduciary for RIAs, FINRA Rule 2090 (Know Your Customer), FINRA Rule 2111 (Suitability), FINRA Rule 4512 (Trusted Contact), FATCA / CRS, OFAC 31 CFR Part 501, USA PATRIOT Act §314(a) / §314(b), state-level RIA registration, Reg S-P privacy
• Reference knowledge-base/terminology/ for KYC / CIP / CDD / EDD / SDD / SAR / CTR / PEP / SDN / 314(a) / 314(b) / FATCA / CRS / BOI / CTA / NRA / TIN definitions
• Cross-check against skills/operations/trade-lifecycle-tracker.md (downstream pre-trade compliance state consumes the KYC risk rating and restricted-list flags produced here)
• Cross-check against skills/admin/regulatory-filing-checker.md (escalations may require Form U4 / Form ADV / state filings)
• Cross-check against skills/admin/sanctions-aml-alert-reviewer.md (sanctions hits flow into that skill for disposition; this skill triggers and hands off)
• Anti-plagiarism: every memo and disposition is generated per-onboarding from the file's specifics; do not lift verbatim language from list-provider hit records, sanction-list entries, or third-party screening summaries

Process:

1. Confirm scope and capacity. Restate the account type, product set, registration capacity (BD / RIA / bank / trust / dual), the supervising principal, and the firm's policy framework that applies (Reg BI vs. Advisers Act fiduciary vs. BSA/AML banking)
2. Validate the four CIP data points. For each holder: name, DOB, address, ID number. Document the verification method (documentary: driver's license, passport, EIN letter, certificate of formation; non-documentary: credit-bureau pull, utility bill, prior-relationship reference, government-database query). If any data point is missing or unverifiable through the primary path, draft a CIP exception memo with the proposed non-documentary path and the named approver
3. Map the entity and beneficial-ownership chain (entity accounts only). Build the parent → subsidiary tree. For each ≥25%-equity owner and each significant-control individual, run full CIP on that natural person. Note any layered ownership, nominee shareholding, bearer shares, trust-as-owner, or unidentifiable controllers. Cross-reference FinCEN BOI report (Corporate Transparency Act) where in scope. Surface any chain that cannot be resolved to identified natural persons
4. Run the watchlist screen. Re-run the firm's screening platform (OFAC SDN + Sectoral + Non-SDN Iran / Cuba / Crimea-Sevastopol-DNR-LNR / 50% rule, EU consolidated, UK HMT OFSI, UN, country-of-establishment locals) plus PEP and adverse-media against every named natural person, every entity, and every beneficial owner. Categorize each hit: false-positive (clear with rationale), partial-match (escalate to enhanced review per skills/admin/sanctions-aml-alert-reviewer.md), true-hit (do not open; escalate to BSA officer)
5. Tax / residency classification. Determine US-person vs. non-US-person status, capture the correct W-9 or W-8-series form, classify under FATCA (PFFI, deemed-compliant, exempt, NPFFI; or NFFE Active / Passive with controlling persons), record CRS jurisdiction(s), apply backup-withholding rule if TIN cannot be certified
6. Source-of-funds / source-of-wealth check. For initial funding above the firm's threshold (commonly $250k for retail; $0 for high-risk customer types) document SoF with corroborating evidence (settlement statement, prior-broker statement, sale agreement, distribution K-1). For HNW / UHNW / PEP / high-risk-geo customers document SoW (career history, business interests, inheritance, investment income, tax filings). Flag any inconsistency between stated SoF/SoW and the funding pattern observed
7. Compute the risk rating. Walk the firm's risk-model grid across geography, product, customer, and channel dimensions. Output the rating tier (Low / Medium / High / Prohibited), the EDD triggers applied (PEP, high-risk-geo, cash-intensive business, MSB, complex-entity, NRA, foreign-correspondent), and the periodic-review cadence that follows
8. Build the suitability / Reg BI / fiduciary record. For BD accounts, document the Reg BI Care-Obligation analysis (objectives, time horizon, risk tolerance, financial situation, costs of recommended product). For RIA accounts, document the fiduciary best-interest determination (alignment with stated objectives, reasonably-available alternatives, conflicts disclosed). For both, document Trusted Contact Person collection and any account-feature disclosures (margin, options-level, alternative investments, complex products)
9. Assemble the form / disclosure deliverable list. Enumerate every required form: account agreement, advisory agreement, ADV Part 2A/2B/3 / CRS, privacy notice (Reg S-P), W-9/W-8 series, beneficial-ownership certification, options agreement (if applicable), margin agreement, IRA custodial agreement, 5305 model, trust certification, e-signature consent, state-specific disclosures (e.g., NY DFS, MA fiduciary). For each: status (signed / pending / waived / N/A), date, signing party
10. Draft the supervisory-principal review packet. One page: who, what, where they came from, risk rating, EDD triggers applied, sanctions / PEP disposition, suitability / Reg BI / fiduciary determination, exceptions and approvals, conditions-precedent for funding, BSA-officer involvement (if any). Recommend Open / Open-with-Conditions / Decline-and-Document / Escalate-to-BSA
11. Set up periodic-review schedule and trigger watch. Schedule the next refresh date per risk tier; register the change-of-circumstances triggers (new sanctions designation, change in beneficial ownership, change in residency, change in capacity, large unusual deposit, transaction-monitoring alert, public adverse-media surface) that would advance the next review
12. Save to outputs/ if the user confirms. Retain per Rule 17a-4 / Advisers Act 204-2 / 31 CFR 1010.430 (5-year retention from account closure for BSA records; longer where state-specific or product-specific rules apply)

Output Structure:

1. Cover (account holder, account type, product set, risk rating, recommendation)
2. Customer Identification (CIP data per holder; verification method; exceptions)
3. Beneficial Ownership Map (entity tree; ≥25%-equity owners; control persons; CTA / BOI status)
4. Watchlist Screening (OFAC, PEP, adverse-media; per-hit disposition with rationale)
5. Tax / Residency Classification (W-9 / W-8; FATCA; CRS)
6. Source of Funds / Source of Wealth (initial deposit + ongoing profile; corroborating evidence)
7. Risk Rating (model output; EDD triggers; refresh cadence)
8. Suitability / Reg BI / Fiduciary Record (Care Obligation; best-interest determination; disclosures)
9. Form & Disclosure Inventory (status of every required document)
10. Exceptions & Approvals (CIP exceptions; policy exceptions; signatory)
11. Supervisory Principal Recommendation (Open / Conditional / Decline / Escalate)
12. Conditions Precedent for Funding
13. Periodic-Review Schedule and Trigger Watch
14. Appendices (ID copies references, screening reports, signed forms inventory)

Output requirements:

• Every CIP data point shows verification method, source document reference, and verification date
• Every watchlist hit shows the matched record, the firm's match-confidence, the disposition (clear / escalate / true-hit), and the named reviewer
• Beneficial-ownership chain is resolved to natural persons or the chain is explicitly flagged as unresolvable with proposed next steps
• EDD triggers enumerated; SDD application justified per FinCEN CDD Rule
• Sanctions / PEP / adverse-media dispositions never silently cleared; every "false-positive" decision carries the rationale
• Supervising principal recommendation includes named conditions-precedent and the regulatory basis (Reg BI / fiduciary / BSA)
• Books-and-records retention citation included per record type
• Saved to outputs/ with the firm's onboarding-file naming convention if user confirms

Audience Templates (select per supervising-principal route)

1. Retail BD New-Account (Reg BI) — emphasizes Care Obligation, Form CRS delivery, options/margin disclosure
2. RIA Advisory New-Account (Advisers Act fiduciary) — emphasizes ADV 2A/2B/3 delivery, conflicts, IPS-suitability
3. Bank Deposit / Lending New-Account (BSA) — emphasizes CIP, CDD, BSA officer escalation triggers, OFAC
4. Private-Banking / UHNW — emphasizes EDD, SoW corroboration, related-account map, family-office multi-entity
5. Trust / Estate Account — emphasizes trust-document review, trustee KYC, beneficiary identification, situs and governing law
6. Institutional / Corporate / Pension — emphasizes entity-tree build, ERISA fiduciary status, investment-policy alignment
7. Periodic-Review Refresh — emphasizes change-of-circumstances triggers since last review, current risk-rating recompute
8. CIP Exception Memo — narrowly-scoped: gap, proposed non-documentary path, approver, retention

Regulatory & Compliance Layer

• BSA / AML: 31 USC 5311 et seq., implementing regulations at 31 CFR Chapter X; written AML program with four pillars (designated officer, training, internal controls, independent testing) plus the fifth-pillar CDD (beneficial owner)
• CIP Rule: 31 CFR 1023.220 (broker-dealer), 1020.220 (bank), 1024.220 (mutual fund), 1026.220 (futures); four mandatory data points; documentary and non-documentary verification; reliance on third parties under §326 only with formal reliance arrangement
• CDD Rule (FinCEN): 31 CFR 1010.230; beneficial-ownership identification at account opening for legal-entity customers (≥25% equity + one control person); ongoing monitoring for changes in beneficial ownership and update of customer information / risk profile
• Corporate Transparency Act / BOI: where in scope, reference FinCEN BOI filing as a CDD information source (not a substitute for the firm's own collection)
• OFAC: 31 CFR Part 501; SDN List, Sectoral, Non-SDN; 50% rule; obligation to block or reject and to file blocked-property report and OFAC-disclosure
• USA PATRIOT Act §314(a) / §314(b): response protocol for §314(a) information requests; opt-in considerations for §314(b) information sharing
• FATCA / CRS: W-9 vs. W-8 series collection; FATCA classification; reportable-account determination; CRS jurisdiction reporting
• FINRA Rule 2090 (KYC) and 2111 (Suitability) for BD; Rule 4512 (Customer Account Information) including Trusted Contact Person
• Reg BI (17 CFR 240.15l-1) for BD recommendation Care / Conflict / Disclosure / Compliance Obligations; Form CRS delivery
• Advisers Act fiduciary for RIA; ADV 2A/2B/3 delivery; Reg S-P privacy notice; Advisers Act 204-2 books-and-records
• State-level: state RIA registration, NY DFS Part 504, MA fiduciary, state escheatment, state UTMA/UGMA conventions
• Recordkeeping: Rule 17a-4 (BD), Advisers Act 204-2 (RIA), 31 CFR 1010.430 (BSA — five years from account closure for CIP records and identifying information)

Personalization Hooks (consume from config.yml)

• firm.capacity (BD / RIA / dual / bank / trust)
• firm.bsa_officer and escalation channel
• firm.risk_model.tiers and refresh cadence by tier
• firm.edd_triggers (PEP, high-risk-geo, cash-intensive business, NRA, MSB, complex-entity)
• firm.restricted_business (cannabis, gambling, MSB, VASP, foreign-shell-bank)
• firm.jurisdiction.deny_list and allow_list
• firm.third_party_introducer.policy
• firm.principal_authority (named principals + dollar / risk-tier authority)
• firm.refresh_cadence (Low / Medium / High in years)
• firm.disclosure_packs (Form CRS, ADV deck, privacy notice, options disclosure document)
• firm.naming_convention for onboarding-file output

Handoff Contracts

• Inbound from: prospect intake, advisor-meeting-prep (sales pipeline conversion)
• Outbound to:
  • skills/admin/sanctions-aml-alert-reviewer.md for any partial / true watchlist hit disposition
  • skills/operations/trade-lifecycle-tracker.md for the pre-trade compliance state (risk tier, restricted-list flags, options-level, margin status)
  • skills/customer-service/client-portfolio-update.md for the IPS / suitability inputs that initial reporting will reference
  • skills/customer-service/financial-plan-constructor.md for the wealth / income / risk-tolerance inputs that initial planning will consume
  • skills/admin/regulatory-filing-checker.md for any required Form U4 / state-filing / SAR-precursor documentation
  • skills/_shared/email-drafter.md for the welcome-and-funding-instructions client communication

Anti-Plagiarism Note

Every onboarding file is generated from the specific applicant's documents and the firm's own policy configuration. Do not copy text from screening-vendor hit records, sanctions-list entries, PEP-database biographies, adverse-media articles, or another customer's onboarding memo into the package; summarize the matched fields and cite the source, list version, and date instead. Regulatory requirements (CIP, CDD, FATCA / CRS) are paraphrased in the firm's own procedure vocabulary — not pasted from the CFR, FFIEC Manual, or vendor policy templates. Where exact wording is legally material (e.g., a beneficial-ownership certification attestation), quote it as a fenced, attributed excerpt. No identification-document images or full ID numbers are reproduced in the memo — reference the document type, issuing authority, last four digits, and the evidence-repository location.

Example Output

Synthetic and illustrative — fictional firm, entity, individuals, and identifiers.

1. Cover — Harborview Freight Holdings LLC (Delaware LLC, operating in TX) · Institutional brokerage + cash-management account at Lakeside Capital Securities (dual registrant; account opened under BD capacity) · Initial funding $4.2M by wire from the company's operating bank · Risk rating: HIGH · Recommendation: Open-with-Conditions

2. Customer Identification (entity)

No CIP exception required for the entity.

3. Beneficial Ownership Map (CDD Rule, 31 CFR 1010.230)

Chain resolves to identified natural persons. Trust ≥25% interest: trustee recorded as the beneficial owner per firm policy.

4. Watchlist Screening (OFAC list version 2026-10-03; EU / UK / UN consolidated same date)

• D. Marsh — 0 hits.
• R. Okonkwo-Lane — PEP hit (high-similarity): name, DOB, and nationality match a listed immediate family member (sibling) of a sitting state-level official in Nigeria. Disposition: true PEP-associate match, not a sanctions issue → EDD trigger. Reviewer: J. Patel (AML analyst).
• Entity + trust — 0 sanctions hits; one adverse-media item (2024 local news, wage-dispute settlement) scored credibility tier 2, not financial-crime-related → cleared with rationale.

5. Tax / Residency — Entity: W-9, US person, not FATCA-reportable. R. Okonkwo-Lane: US resident alien (SSN on file); no W-8 required.

6. Source of Funds / Wealth — Funds: operating-bank statement shows the $4.2M balance built from customer receipts over 18 months — consistent with stated revenue (~$31M/yr freight brokerage). SoW for the PEP associate (EDD): 2019 purchase of the 30% stake for $1.1M documented by a membership-interest purchase agreement funded from a US bank account; gap: origin of the $1.1M not yet evidenced.

7. Risk Rating — Geography: Medium (TX ops; PEP-associate nexus to a FATF-monitored jurisdiction) · Product: Medium (cash management, wire capability) · Customer: High (PEP associate ≥25% owner) · Channel: Low (in-person, advisor-introduced). Overall HIGH. EDD triggers: PEP associate, foreign-nexus beneficial owner. Refresh cadence: 12 months.

8. Suitability / Reg BI — Corporate cash-management objective; short horizon; product limited to Treasury bills and government MMF; no margin / options. Care Obligation documented; Form CRS delivered 2026-10-06.

9. Form & Disclosure Inventory — Account agreement ✔ · beneficial-ownership certification ✔ · W-9 ✔ · LLC operating agreement + authorized-signer resolution ✔ · privacy notice ✔ · trust certification ✔ · standing wire-instruction letter pending.

10. Exceptions & Approvals — None to CIP. EDD approval required from BSA Officer (M. Duarte).

11. Supervisory Principal Recommendation — Open-with-Conditions. Basis: CIP complete; ownership chain resolved; PEP-associate status is an EDD trigger, not a prohibition; the one open item is the origin of the PEP associate's 2019 investment funds.

12. Conditions Precedent for Funding — (a) Documentary evidence of the source of the $1.1M (e.g., prior compensation records or asset-sale documentation) received and reviewed by the BSA Officer before the account is funded; (b) senior-management EDD sign-off recorded; (c) standing wire-instruction letter executed; (d) outbound wires to non-US beneficiaries limited to pre-approved counterparties for the first 6 months.

13. Periodic Review & Trigger Watch — Next full refresh 2027-10; triggers: change in the PEP's office, ownership change ≥10%, cumulative outbound foreign wires >$500k in a quarter, any TM alert (route to sanctions-aml-alert-reviewer), new adverse media.

Why this passes: every CIP data point shows evidence, method, and date; the ownership chain resolves to natural persons, including the trust look-through; the PEP hit is dispositioned as an EDD trigger with a named reviewer rather than cleared or treated as a sanctions block; the one real evidence gap becomes a named condition that must be met before funding, not a footnote; the risk-rating grid shows each dimension; and the trigger watch is specific enough to automate.