Regulators have long been pressured to avoid stifling innovation. To meet this expectation while also ensuring continued safety and soundness, agencies often turn to an effective solution — the regulatory exemption.
A recent example is the interagency issuance of a Customer Identification Program (CIP) carve-out for credit unions.
This summer, the OCC, FDIC and NCUA collaborated with FinCEN to establish a CIP exemption allowing credit unions to obtain taxpayer identification numbers (TINs) or Social Security numbers (SSNs) from third parties rather than directly from members. A few days later, the Federal Reserve joined the interagency action.
Carve Outs Can Accelerate Digital Experiences
Exemptions like this streamline certain aspects of compliance, making it easier for credit unions to integrate new digital financial services and data personalization solutions without sacrificing essential safeguards. For its part, FinCEN explicitly tied the move back to the 2024 request for comment that explored modernizing CIP requirements for digital delivery channels.
In this specific case, the CIP carve out lets credit unions retrieve and verify a TIN or SSN from a trusted external provider, like a fintech or a credit bureau. This makes possible the digital experiences today’s members expect, such as faster online account opening, pre-filled loan applications and smoother embedded finance features. It may also reduce the time and complexity of account opening, potentially accelerating financial inclusion. And all without compromising the privacy and security of customer data.
In fact, there is an argument to be made that centralizing TIN collection with trusted providers actually reduces risk. By limiting how often a credit union must directly oversee full SSNs, the cooperative’s breach exposure is lowered and its controls tightened. Members benefit, as well, with fewer entities storing their most sensitive identity data.
The Bigger Picture Is Rethinking Customer Identity
On paper, the announcement may seem minor. However, this could be the first domino in a chain that reshapes how our industry thinks about customer identity. Here’s why: The TIN exemption formally recognizes modern identity supply chains. Allowing third-party TIN collection normalizes reliance on specialized providers, as long as credit unions continue to own the risk.
The Federal Reserve joining the party is another signal of an impending sea change. The agency’s support lends a much-needed consistency in digital onboarding models across multi-charter organizations. This step aligns with the broader modernization arc under the AML Act and related initiatives, like risk-based controls and less paper-centric onboarding without sacrificing verification rigor.
It’s important to note that TINs and SSNs are just one element of required identifying information under a credit union’s risk-based CIP. Whether the agencies expand considerations to other identity markers, such as additional forms of personally identifiable information (PII), remains to be seen.
How Credit Unions Can Prepare
Over the coming months, credit union compliance teams may want to consider making a few enhancements to their processes to get into position to take advantage of inter-agency support for digital transformation. Here are just a few ideas.
Update CIP & procedures. Add an “Alternative TIN Collection” section to your CIP policies and procedures. Outline scope, providers, controls, exception handling, and importantly, recordkeeping that proves full TIN was obtained pre-account-opening. Map this to the credit union’s risk tolerance, as well as all the different channels in which third-party TIN collection will be utilized.
Document match logic. Make sure your system knows how to decide whether the TIN you receive from a third party truly belongs to the member you’re onboarding. That means defining your matching logic to be either an exact match (deterministic) or a close enough match (probabilistic). Set clear rules or “pass/fail” thresholds for different member types or risk segments. Periodically test those rules against past fraud cases and Suspicious Activity Reports (SARs) to confirm that your verification process is working.
Tighten third-party governance. Well-managed third-party sourcing can improve detection of synthetic identities through triangulation across multiple authoritative sources. But poor data governance can magnify false positives/negatives. Calibrate governance to your member base and product risk. You may also want to ensure the credit union’s management information systems or those of contracted third parties can report match rates, exceptions and turnaround times.
Train the front line. Your staff, including the team that manages your identity-verification models, must understand that “third-party TIN” does not mean “lighter KYC.” Frequent training is one of the best ways to stay on top of this, consistently reiterating that this exemption is intended to improve the financial lives of members, providing the same (if not better) assurance in the safekeeping of their PII.
Plan for audits and exams. Draw a straight line from your written policy to the real-world evidence that it’s being followed. Regulators will want to see that linkage. Examiners have been known to spot-check accounts, especially those opened digitally or across borders. One effective way to prepare for scrutiny is to build audit readiness into your culture. Organize documentation in a central hub with version control so you’re never scrambling to respond to an examiner’s request.
Modernizing Compliance While Expanding Financial Inclusion
Member identity is increasingly verified through specialized, digital-first systems that keep pace with innovation without sacrificing oversight. This evolution is no doubt precisely what regulators considered when crafting the third-party TIN exemption. After all, modern regulators are facing a significant imperative: To let progress unfold without compromising safety or soundness.
Credit unions that see this exemption as just a tactical tweak may be missing the bigger opportunity. This ruling, and others likely to follow, present milestone moments to reimagine onboarding in a way that brings more people into the financial mainstream, expanding access while maintaining the integrity of the system we all rely on.
© Arc, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to TMSalesOperations@arc-network.com. For more information visit Asset & Logo Licensing.