Address Verification for Fintech KYC: What the CIP Rule Asks

An address verification API for fintech KYC checks that the address an applicant types is a known US delivery point, returns it in standard form, and flags private mailboxes and the kind of address (street, building with units, rural route or PO box). The Customer Identification Program rule, 31 CFR 1020.220, asks for a residential or business street address for an individual. The API does not prove the applicant lives there. That is identity verification, a separate step.

What the CIP rule says about the address

The rule for banks, 31 CFR 1020.220, says the bank "must obtain, at a minimum, the following information from the customer prior to opening an account": name, date of birth for an individual, address and an identification number. The address part, word for word:

"Address, which shall be: (i) For an individual, a residential or business street address; (ii) For an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or of another contact individual; or (iii) For a person other than an individual (such as a corporation, partnership, or trust), a principal place of business, local office, or other physical location"

We read this text on eCFR on October 16, 2026. eCFR's version history shows the section was last amended on November 16, 2020, and the title was marked up to date as of October 14, 2026.

The agencies' CIP FAQs (January 2004) cite the rule by its number at the time, 31 C.F.R. 103.121. A 2010 Federal Register reorganization moved paragraphs 103.121(b) to (d) to 1020.220. The FAQs add the rural case: "Yes, the number on the roadside mailbox on a rural route is acceptable as an address. A rural route number, unlike a post office box number, is a description of the approximate area where the customer can be located." Where there is no such number, "a description of the customer's physical location will suffice."

The same FAQs say how far verification must go: "A bank need not establish the accuracy of every element of identifying information obtained but must do so for enough information to form a reasonable belief it knows the true identity of the customer." Bank examiners test the address step as well. The FFIEC BSA/AML examination procedures ask whether the bank "Obtained from each customer, before opening the account, the identifying information required by the CIP: name, date of birth (for an individual), address, and identification number."

The rule text is written for banks ("A bank required to have an anti-money laundering compliance program"). Whether and how it reaches a fintech is a question for your compliance team and your bank partner. The address fields below are useful either way.

How the rule's address cases map to verification results

The last row is the one a street-address check alone misses. The USPS Domestic Mail Manual defines a commercial mail receiving agency (CMRA) as "a business that, in whole or in part, accepts the delivery of U.S. Mail on behalf of another person or entity as a business service." The manual adds that a CMRA address shows the box as PMB (private mailbox) and a number, or as # and a number. So "2443 Fillmore St # 380" in our test is box 380 at a store. Its street address came back deliverable. A private-mailbox flag can identify a CMRA even when its street address is postal-confirmed.

What an address check proves, and what it does not

The CIP rule asks for procedures that let the bank "form a reasonable belief that it knows the true identity of each customer". Its non-documentary methods include "independently verifying the customer's identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source." An address verification API answers a narrower question.

Run the address check first. A standardized address makes the identity match cleaner. On October 16, 2026, "1355 Markett St Ste 900" and "1355 Market St Suite 900" (San Francisco, CA 94103, an office building) came back as the same standardized address, so spelling no longer splits them.

Address red flags named in federal guidelines

The Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation appear in 16 CFR part 681, Appendix A, which covers institutions "subject to administrative enforcement of the FCRA by the Federal Trade Commission", and in the bank regulators' rules, for example 12 CFR part 41, Appendix J, for national banks and Federal savings associations. Supplement A lists "illustrative examples" of red flags that an institution "may consider incorporating into its Program". Four are about the address an applicant gives:

• "The address does not match any address in the consumer report" (an identity verification check).
• "The address on an application is the same as the address provided on a fraudulent application".
• "The address on an application is fictitious, a mail drop, or a prison".
• "The address or telephone number provided is the same as or similar to the address or telephone number submitted by an unusually large number of other persons opening accounts or by other customers."

The guidelines do not define "mail drop" and do not mention private mailboxes. An address verification API helps with the last three in a practical way. A not-found result deserves a second look as a possible fictitious address. The private mailbox flag points at an address that receives mail for others. A standardized address lets you count how many applications share one address, or match it against past fraud, without spelling differences splitting the count.

Five onboarding addresses, checked live

We sent these to the sthan.io verification API on October 16, 2026. The first three are a business address in an office building with suites.

Keep the typed address, the standardized address and the result fields together. The CIP rule's records include "All identifying information about a customer obtained", "A description of the methods and the results of any measures undertaken to verify the identity of the customer" and "A description of the resolution of any substantive discrepancy discovered when verifying the identifying information obtained." The identifying information is kept "for five years after the date the account is closed or, in the case of credit card accounts, five years after the account is closed or becomes dormant"; the other records "for five years after the record is made."

Sources

All read October 16, 2026:

• 31 CFR 1020.220, Customer identification program requirements for banks (eCFR, text up to date as of October 14, 2026)
• Version history of 31 CFR 1020.220 (eCFR)
• FAQs: Final CIP Rule, issued by the staff of the Federal Reserve, FDIC, FinCEN, NCUA, OCC, OTS and Treasury (FinCEN)
• Transfer and Reorganization of Bank Secrecy Act Regulations, 75 FR 65806, October 26, 2010 (Federal Register)
• FFIEC BSA/AML Manual, Customer Identification Program examination and testing procedures
• 16 CFR part 681 with Appendix A and its Supplement A, Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation (eCFR)
• 12 CFR part 41 with Appendix J, the same guidelines for national banks and Federal savings associations (eCFR)
• USPS Domestic Mail Manual 508, section 1.8, Commercial Mail Receiving Agencies
• sthan.io API docs
• What an Address Verification API Returns (sthan.io)
• sthan.io US Address Verification product page
• sthan.io pricing
• Seven live calls to the sthan.io US Address Verification API on October 16, 2026 (times in UTC where shown)

This page explains address data and quotes the rules; it is not legal or compliance advice.