A couple of years ago there was a lot of scrambling going on as financial institutions figured out how to comply with the customer identification program (CIP) requirements imposed by Section 326 of the USA Patriot Act. In general, the section requires “financial institutions,” at a minimum, to implement reasonable procedures for (1) verifying the identity of any person seeking to open an “account,” to the extent reasonable and practiced; (2) maintaining records of the information used to verify the person’s identity, including name, address and other identifying information; and (3) determining whether the person appears on any lists of known or suspected terrorists or terrorist organizations.

Today, it is primarily banks that are subject to rules under Section 326, requiring them to maintain a CIP. Dealerships, while considered financial institutions for purposes of Section 326, currently are not subject to any agency rules regarding CIPs. Primarily, this is because our friends over at NADA and some of the other trade associations did a great job of educating the Department of Treasury about car buyers not posing a tremendous terrorist threat and that rules requiring dealers to maintain a CIP was not the best use of anyone’s time (I’m paraphrasing here, of course). So the DOT published words to the effect of, “We’re not imposing a CIP rule on dealers at this time.”

Since that time, we’ve not heard much about this. End of story, right? Of course not. Here’s why.

In most dealerships, dealers enter into retail installment sale agreements with customers and immediately sell those agreements to banks or finance companies. The banks and finance companies typically rely on the dealer’s to verify the customer’s identity. Other than that, banks and finance companies have imposed little or no process requirements on dealers with respect to how they verify the identity of their customers.

The reason for this is that banks, which are subject to the CIP requirement, have operated under the assumption that transactions involving the purchase of a retail installment contract from a dealer, are subject to the so called “transfer exception.” Because the transfer of the contract to the bank occurs without the consent of the customer, the bank is exempt from any obligation under Section 326 to verify the identity of the customer. This assumption has been called into question by the Federal Reserve Board.

According to my good friend and law partner Liz Huber, the Fed believes — contrary to the language in the explanatory information in its own CIP rule — that banks are obligated to verify the identities of car buyers named in the retail installment sales contracts they buy from dealers. The smart folks at the Fed realize this is tricky, considering the bank never sees the buyer and never has contact with him or her until after it funds the contract. So, while the Fed’s expectation is that banks perform the customer verification (despite the fact that this is arguably in conflict with their own rules), it feels, from a practical perspective, banks must contract with dealers to perform the customer verification for them. Typically this would include verifying the name, date of birth, address and taxpayer ID number of the customer.

So, what does this mean to you? Well, for starters, I’d hope that all of you read those terms and said, “What’s the big deal? We get all of this anyway!” If you’re not getting this information from your F&I customers, you have other issues and we need to talk. For those of you who do obtain this information, you can expect some amendments to your dealer agreements with the banks obligating you to continue to obtain it. The net result is another contractual obligation placed on you that could trip you up down the road. On the other hand, most dealer agreements I’ve seen already require you to validate the customer’s identity, so any added liability in this regard is probably de minimus.

The bigger picture is the looming customer identification landscape, and you should view the Fed’s position in that context. First, the upcoming mandatory “red flag guidelines” (I’ll discuss in a future column) will require dealers to develop and implement reasonable policies and procedures for verifying the identity of a consumer for whom it has obtained a consumer report and for whom it receives a notice of address discrepancy from a bureau. Second, it’s probably only a matter of time before the DOT decides to come up with a CIP rule for dealers that applies to ALL F&I customers.

And finally, you have the usual concerns about money laundering and fraud.

Given all this and the new contractual obligations you’re sure to face with your bank lenders, my view is that you start thinking about implementing a CIP of your own. A standardized policy and procedure that applies to all F&I customers is easy to implement, and nobody has to stop to wonder who they need to verify. And if you save yourself from one fraudulent customer, you’ve probably paid for your effort.

Thanks to Liz for the intel from the Fed. Just remember, good compliance is just good business.

Michael Benoit is a partner in the Washington, D.C., office of Hudson Cook LLP. He is a frequent speaker and writer on a variety of consumer credit topics. He can be reached at michael.benoit@bobit.com. Nothing in this article is intended to be legal advice and should not be taken as such. All legal questions should be addressed to competent counsel.