CIP Reliance Pilot Capstone Report

What's covered in the findings:

• The policy-to-execution gap of CIP reliance as it currently operates in sponsor bank x fintech relationships: sponsor banks' CIP policies were examiner-approved, yet their fintech partners didn't always perform the steps those policies required. The report explains why these gaps are operational rather than flaws in policy design.
• The regulatory stakes for CIP reliance: how that gap relates to the OCC and FDIC's August 2026 final rule defining "unsafe or unsound practice."
• Why attestation of a completed policy alone falls short for true reliance: a relied-upon party saying "CIP was completed" with certificate doesn't tell the relying bank what was done, how, or to what standard.
• Three new network mechanisms to close the existing gaps in reliance policy vs. operational reality: independent verification of furnisher execution, standardized classification of verification provenance, and a network-level audit framework.
• Operational controls a reusable identity network must account for: substep-level furnishing and querying, freshness requirements, integrity and synthetic-identity checks on composite certificates, liability allocation, and independent standards governance.
• The regulatory verdict on a reliance network: why the three prongs set in 2003 are sound, and why no new legislation or rulemaking is required to operationalize reliance at scale.

What the findings mean for the industry:

• Reliance can scale today. The 2003 framework already supports a multilateral network, so institutions don't need to wait for new legislation or rulemaking.
• Credentials issued based on attestations alone is a risk. A stated "CIP complete" doesn't show what was done or how. Relying institutions need evidence of execution at the level of each verification step in order to rely on work they did not complete themselves.
• Sponsor banks face a live exposure without the controls inherent in the reliance network architecture. A gap between an examiner-approved policy and what a fintech partner actually performs can now be treated as an unsafe or unsound practice. An evidence-backed record of each verification step closes that gap.
• Banks keep their own standard. Reliance doesn't require a new industry standard. Each institution's examiner-approved CIP policy stays the benchmark for what it accepts.
• The CIP reliance model reaches beyond banks. FinCEN has carried the same three-prong structure into proposed CIP rules for investment advisers and stablecoin issuers, so the approach applies as those industries come under CIP.
• Verification can be done once and reused across financial services. Verification performed once, with evidence behind it, can serve every institution a customer touches instead of being repeated at each one.

Download the capstone report below to read SOLO's full findings.