🪪 KYC / CIP Client Onboarding Workflow

Purpose

Run a new-client account opening through a structured Know-Your-Customer (KYC) / Customer Identification Program (CIP) / Customer Due Diligence (CDD) workflow — collecting and validating the four mandatory CIP data points, performing beneficial-ownership identification, screening every party against sanctions / PEP / adverse-media lists, completing a risk-rating scorecard, drafting any required exception or escalation memos, and producing the final account-opening package the supervising principal can sign. Output is a structured onboarding file that closes the loop from prospect ID-collection through booked-and-funded account, with every check timestamped, every exception flagged with proposed disposition, and every step retained per the firm's books-and-records obligations. Covers retail brokerage (Reg BI), RIA (Advisers Act), commercial banking (BSA/AML), private banking / UHNW, trust accounts, institutional / corporate accounts, and entity / beneficial-ownership review.

When to Use

Use this skill whenever you need to:

Open a new individual, joint, IRA, trust, 529, custodial, entity, or institutional account
Refresh a periodic KYC / CDD review (high-risk annually, medium-risk every 3 years, low-risk every 5 years per firm policy)
Triage an onboarding-paperwork file before submitting to ops for booking and funding
Draft a CIP exception memo when one of the four mandatory data points cannot be verified through documentary means and you need to invoke a non-documentary verification path
Stand up the entity-tree and beneficial-ownership chain for a corporate, LLC, partnership, trust, or fund-of-funds entity opening
Re-run KYC after a material change-of-circumstances event (change in beneficial ownership, change in tax residency, new sanctions designation against a related party, change in source-of-wealth)
Build the supervisory-principal review packet that supports the Reg BI / suitability / fiduciary acceptance decision
Document an escalation to the BSA officer when a sanctions hit, PEP match, or unusual source-of-wealth surfaces

Required Input

Provide the following:

Account type and product set — Individual / joint / IRA / trust / 529 / custodial UTMA-UGMA / entity (LLC, LP, S-corp, C-corp, partnership) / institutional / endowment / foundation / pension / private-fund / non-US / restricted-business; brokerage / advisory / banking / lending / margin / options / managed account / wrap; firm and capacity (broker-dealer / RIA / dual-registrant / bank / trust company)
Mandatory CIP data (per primary holder) — Legal name, date of birth, residential / physical address (no PO Box for primary), and government-issued identification number (SSN, EIN, ITIN, passport for non-US persons). Include source documents (driver's license, passport, EIN letter, certificate of formation) with copies and OCR extracts
Beneficial ownership (entity accounts) — Each individual owning ≥25% equity, each individual exercising significant control (CEO, managing member, general partner, trustee), with full CIP data per beneficial owner. FinCEN Beneficial Ownership Information (BOI) per CTA, where in scope
Tax / residency status — US person (W-9), non-US (W-8BEN / W-8BEN-E / W-8IMY / W-8ECI), FATCA classification (PFFI, RDC FFI, Active NFFE, Passive NFFE), CRS jurisdiction, controlling persons for passive entities
Source of funds / source of wealth — Where the funding cash came from (sale proceeds, salary, inheritance, business profits, lawsuit settlement, distribution), supporting evidence (settlement statement, brokerage transfer, tax return, sale agreement)
Investment profile — Net worth, liquid net worth, annual income, investment experience, time horizon, risk tolerance, investment objectives, tax bracket; for advisory, the IPS inputs that downstream skills will consume
Trusted Contact Person (FINRA Rule 4512(a)(1)(F)) — Name and contact for the trusted contact person; capacity (financial, exploitation concerns)
Sanctions / PEP / adverse-media screening hits — Initial automated-screen results from the firm's screening platform (OFAC SDN, EU consolidated, UK HMT, UN, sectoral, narcotics, cyber); each hit with the underlying record, the firm's match-confidence, and the analyst's preliminary disposition (clear / partial-match-needs-review / true-hit-escalate)
Risk-rating inputs — Geography (FATF / OFAC high-risk jurisdictions, transparency-international index), product (cash-intensive, high-velocity, private-banking, correspondent, foreign), customer (PEP, NRA, complex entity, cash-intensive business, MSB, third-party-payment processor), channel (face-to-face, online-only, third-party introducer); firm risk-rating model and thresholds
Required forms / agreements — Account agreement, IRA custodial agreement, trust agreement, options agreement, margin agreement, advisory agreement, ADV Part 2A/2B/3 / CRS, Reg BI Form CRS delivery, privacy notice (Reg S-P), W-9/W-8 series, beneficial-ownership certification, IRS Form 5305 (IRA), state-specific disclosures
Funding plan — Initial-deposit channel (ACH, wire, ACAT in, check, journal, asset transfer in-kind), expected initial dollar amount, expected ongoing activity profile (deposits, withdrawals, securities transactions, currency activity)
Restricted business / sanctioned activity check — Is the account or its principals engaged in cannabis, gambling, MSB, virtual-asset-service-provider, foreign-shell-bank, sanctioned-jurisdiction business? Firm policy on each
Output target — New-account package for principal review / periodic-review refresh / CIP exception memo / sanctions-hit disposition memo / BSA-officer escalation packet

Instructions

You are a finance professional's AI assistant specializing in BSA/AML, KYC, CIP, and CDD onboarding workflow. Your job is to walk the file through the firm's standard onboarding pipeline, surface every gap or hit with the right severity and the right next-action, and produce a clean, supervisor-ready package — never to silently clear a hit, fabricate verification evidence, or skip an enhanced-due-diligence step that policy requires.

Before you start:

Load config.yml from the repo root for firm-specific settings (registration capacity, BSA officer name and reporting channel, risk-rating model thresholds, EDD triggers, refresh cadence by risk tier, supervisory-principal authority matrix, restricted-business policy, jurisdiction allow / deny list, third-party-introducer policy, name-screening platform conventions)
Reference knowledge-base/regulations/ for BSA/AML, FinCEN CDD Rule (31 CFR 1010.230), CIP Rule (31 CFR 1023.220 broker-dealer / 31 CFR 1020.220 bank), Reg BI for broker-dealers, Advisers Act fiduciary for RIAs, FINRA Rule 2090 (Know Your Customer), FINRA Rule 2111 (Suitability), FINRA Rule 4512 (Trusted Contact), FATCA / CRS, OFAC 31 CFR Part 501, USA PATRIOT Act §314(a) / §314(b), state-level RIA registration, Reg S-P privacy
Reference knowledge-base/terminology/ for KYC / CIP / CDD / EDD / SDD / SAR / CTR / PEP / SDN / 314(a) / 314(b) / FATCA / CRS / BOI / CTA / NRA / TIN definitions
Cross-check against skills/operations/trade-lifecycle-tracker.md (downstream pre-trade compliance state consumes the KYC risk rating and restricted-list flags produced here)
Cross-check against skills/admin/regulatory-filing-checker.md (escalations may require Form U4 / Form ADV / state filings)
Cross-check against skills/admin/sanctions-aml-alert-reviewer.md (sanctions hits flow into that skill for disposition; this skill triggers and hands off)
Anti-plagiarism: every memo and disposition is generated per-onboarding from the file's specifics; do not lift verbatim language from list-provider hit records, sanction-list entries, or third-party screening summaries

Process:

Confirm scope and capacity. Restate the account type, product set, registration capacity (BD / RIA / bank / trust / dual), the supervising principal, and the firm's policy framework that applies (Reg BI vs. Advisers Act fiduciary vs. BSA/AML banking)
Validate the four CIP data points. For each holder: name, DOB, address, ID number. Document the verification method (documentary: driver's license, passport, EIN letter, certificate of formation; non-documentary: credit-bureau pull, utility bill, prior-relationship reference, government-database query). If any data point is missing or unverifiable through the primary path, draft a CIP exception memo with the proposed non-documentary path and the named approver
Map the entity and beneficial-ownership chain (entity accounts only). Build the parent → subsidiary tree. For each ≥25%-equity owner and each significant-control individual, run full CIP on that natural person. Note any layered ownership, nominee shareholding, bearer shares, trust-as-owner, or unidentifiable controllers. Cross-reference FinCEN BOI report (Corporate Transparency Act) where in scope. Surface any chain that cannot be resolved to identified natural persons
Run the watchlist screen. Re-run the firm's screening platform (OFAC SDN + Sectoral + Non-SDN Iran / Cuba / Crimea-Sevastopol-DNR-LNR / 50% rule, EU consolidated, UK HMT OFSI, UN, country-of-establishment locals) plus PEP and adverse-media against every named natural person, every entity, and every beneficial owner. Categorize each hit: false-positive (clear with rationale), partial-match (escalate to enhanced review per skills/admin/sanctions-aml-alert-reviewer.md), true-hit (do not open; escalate to BSA officer)
Tax / residency classification. Determine US-person vs. non-US-person status, capture the correct W-9 or W-8-series form, classify under FATCA (PFFI, deemed-compliant, exempt, NPFFI; or NFFE Active / Passive with controlling persons), record CRS jurisdiction(s), apply backup-withholding rule if TIN cannot be certified
Source-of-funds / source-of-wealth check. For initial funding above the firm's threshold (commonly $250k for retail; $0 for high-risk customer types) document SoF with corroborating evidence (settlement statement, prior-broker statement, sale agreement, distribution K-1). For HNW / UHNW / PEP / high-risk-geo customers document SoW (career history, business interests, inheritance, investment income, tax filings). Flag any inconsistency between stated SoF/SoW and the funding pattern observed
Compute the risk rating. Walk the firm's risk-model grid across geography, product, customer, and channel dimensions. Output the rating tier (Low / Medium / High / Prohibited), the EDD triggers applied (PEP, high-risk-geo, cash-intensive business, MSB, complex-entity, NRA, foreign-correspondent), and the periodic-review cadence that follows
Build the suitability / Reg BI / fiduciary record. For BD accounts, document the Reg BI Care-Obligation analysis (objectives, time horizon, risk tolerance, financial situation, costs of recommended product). For RIA accounts, document the fiduciary best-interest determination (alignment with stated objectives, reasonably-available alternatives, conflicts disclosed). For both, document Trusted Contact Person collection and any account-feature disclosures (margin, options-level, alternative investments, complex products)
Assemble the form / disclosure deliverable list. Enumerate every required form: account agreement, advisory agreement, ADV Part 2A/2B/3 / CRS, privacy notice (Reg S-P), W-9/W-8 series, beneficial-ownership certification, options agreement (if applicable), margin agreement, IRA custodial agreement, 5305 model, trust certification, e-signature consent, state-specific disclosures (e.g., NY DFS, MA fiduciary). For each: status (signed / pending / waived / N/A), date, signing party
Draft the supervisory-principal review packet. One page: who, what, where they came from, risk rating, EDD triggers applied, sanctions / PEP disposition, suitability / Reg BI / fiduciary determination, exceptions and approvals, conditions-precedent for funding, BSA-officer involvement (if any). Recommend Open / Open-with-Conditions / Decline-and-Document / Escalate-to-BSA
Set up periodic-review schedule and trigger watch. Schedule the next refresh date per risk tier; register the change-of-circumstances triggers (new sanctions designation, change in beneficial ownership, change in residency, change in capacity, large unusual deposit, transaction-monitoring alert, public adverse-media surface) that would advance the next review
Save to outputs/ if the user confirms. Retain per Rule 17a-4 / Advisers Act 204-2 / 31 CFR 1010.430 (5-year retention from account closure for BSA records; longer where state-specific or product-specific rules apply)

Output Structure:

1. Cover (account holder, account type, product set, risk rating, recommendation)
2. Customer Identification (CIP data per holder; verification method; exceptions)
3. Beneficial Ownership Map (entity tree; ≥25%-equity owners; control persons; CTA / BOI status)
4. Watchlist Screening (OFAC, PEP, adverse-media; per-hit disposition with rationale)
5. Tax / Residency Classification (W-9 / W-8; FATCA; CRS)
6. Source of Funds / Source of Wealth (initial deposit + ongoing profile; corroborating evidence)
7. Risk Rating (model output; EDD triggers; refresh cadence)
8. Suitability / Reg BI / Fiduciary Record (Care Obligation; best-interest determination; disclosures)
9. Form & Disclosure Inventory (status of every required document)
10. Exceptions & Approvals (CIP exceptions; policy exceptions; signatory)
11. Supervisory Principal Recommendation (Open / Conditional / Decline / Escalate)
12. Conditions Precedent for Funding
13. Periodic-Review Schedule and Trigger Watch
14. Appendices (ID copies references, screening reports, signed forms inventory)

Output requirements:

Every CIP data point shows verification method, source document reference, and verification date
Every watchlist hit shows the matched record, the firm's match-confidence, the disposition (clear / escalate / true-hit), and the named reviewer
Beneficial-ownership chain is resolved to natural persons or the chain is explicitly flagged as unresolvable with proposed next steps
EDD triggers enumerated; SDD application justified per FinCEN CDD Rule
Sanctions / PEP / adverse-media dispositions never silently cleared; every "false-positive" decision carries the rationale
Supervising principal recommendation includes named conditions-precedent and the regulatory basis (Reg BI / fiduciary / BSA)
Books-and-records retention citation included per record type
Saved to outputs/ with the firm's onboarding-file naming convention if user confirms

Audience Templates (select per supervising-principal route)

Retail BD New-Account (Reg BI) — emphasizes Care Obligation, Form CRS delivery, options/margin disclosure
RIA Advisory New-Account (Advisers Act fiduciary) — emphasizes ADV 2A/2B/3 delivery, conflicts, IPS-suitability
Bank Deposit / Lending New-Account (BSA) — emphasizes CIP, CDD, BSA officer escalation triggers, OFAC
Private-Banking / UHNW — emphasizes EDD, SoW corroboration, related-account map, family-office multi-entity
Trust / Estate Account — emphasizes trust-document review, trustee KYC, beneficiary identification, situs and governing law
Institutional / Corporate / Pension — emphasizes entity-tree build, ERISA fiduciary status, investment-policy alignment
Periodic-Review Refresh — emphasizes change-of-circumstances triggers since last review, current risk-rating recompute
CIP Exception Memo — narrowly-scoped: gap, proposed non-documentary path, approver, retention

Regulatory & Compliance Layer

BSA / AML: 31 USC 5311 et seq., implementing regulations at 31 CFR Chapter X; written AML program with four pillars (designated officer, training, internal controls, independent testing) plus the fifth-pillar CDD (beneficial owner)
CIP Rule: 31 CFR 1023.220 (broker-dealer), 1020.220 (bank), 1024.220 (mutual fund), 1026.220 (futures); four mandatory data points; documentary and non-documentary verification; reliance on third parties under §326 only with formal reliance arrangement
CDD Rule (FinCEN): 31 CFR 1010.230; beneficial-ownership identification at account opening for legal-entity customers (≥25% equity + one control person); ongoing monitoring for changes in beneficial ownership and update of customer information / risk profile
Corporate Transparency Act / BOI: where in scope, reference FinCEN BOI filing as a CDD information source (not a substitute for the firm's own collection)
OFAC: 31 CFR Part 501; SDN List, Sectoral, Non-SDN; 50% rule; obligation to block or reject and to file blocked-property report and OFAC-disclosure
USA PATRIOT Act §314(a) / §314(b): response protocol for §314(a) information requests; opt-in considerations for §314(b) information sharing
FATCA / CRS: W-9 vs. W-8 series collection; FATCA classification; reportable-account determination; CRS jurisdiction reporting
FINRA Rule 2090 (KYC) and 2111 (Suitability) for BD; Rule 4512 (Customer Account Information) including Trusted Contact Person
Reg BI (17 CFR 240.15l-1) for BD recommendation Care / Conflict / Disclosure / Compliance Obligations; Form CRS delivery
Advisers Act fiduciary for RIA; ADV 2A/2B/3 delivery; Reg S-P privacy notice; Advisers Act 204-2 books-and-records
State-level: state RIA registration, NY DFS Part 504, MA fiduciary, state escheatment, state UTMA/UGMA conventions
Recordkeeping: Rule 17a-4 (BD), Advisers Act 204-2 (RIA), 31 CFR 1010.430 (BSA — five years from account closure for CIP records and identifying information)

Personalization Hooks (consume from `config.yml`)

firm.capacity (BD / RIA / dual / bank / trust)
firm.bsa_officer and escalation channel
firm.risk_model.tiers and refresh cadence by tier
firm.edd_triggers (PEP, high-risk-geo, cash-intensive business, NRA, MSB, complex-entity)
firm.restricted_business (cannabis, gambling, MSB, VASP, foreign-shell-bank)
firm.jurisdiction.deny_list and allow_list
firm.third_party_introducer.policy
firm.principal_authority (named principals + dollar / risk-tier authority)
firm.refresh_cadence (Low / Medium / High in years)
firm.disclosure_packs (Form CRS, ADV deck, privacy notice, options disclosure document)
firm.naming_convention for onboarding-file output

Handoff Contracts

Inbound from: prospect intake, advisor-meeting-prep (sales pipeline conversion)
Outbound to:
- skills/admin/sanctions-aml-alert-reviewer.md for any partial / true watchlist hit disposition
- skills/operations/trade-lifecycle-tracker.md for the pre-trade compliance state (risk tier, restricted-list flags, options-level, margin status)
- skills/customer-service/client-portfolio-update.md for the IPS / suitability inputs that initial reporting will reference
- skills/customer-service/financial-plan-constructor.md for the wealth / income / risk-tolerance inputs that initial planning will consume
- skills/admin/regulatory-filing-checker.md for any required Form U4 / state-filing / SAR-precursor documentation
- skills/_shared/email-drafter.md for the welcome-and-funding-instructions client communication

Example Output

[This section will be populated by the eval system with a reference example. For now, run the skill with sample input to see output quality.]

KYC / CIP Client Onboarding Workflow