While state auto-IRA programs have helped to provide access to retirement savings for workers whose employers do not offer a plan, a recent paper published by the Bipartisan Policy Center revealed that federal Customer Identification Program rules are preventing more than two million Americans from enrolling in automatic individual retirement accounts.

With three new state auto-IRA programs launched this year and an additional seven in the process of being implemented for future years, the authors of the paper, Emerson Sprick and Kim Olson, argued that the number of CIP failures—and the workers prevented from accessing the retirement savings tool—will only continue to increase.

The CIP, created in 2001 by the Patriot Act, was designed to prevent money-laundering and the financing of terrorism. The CIP Rule was issued by the Department of the Treasury and multiple agencies to banks, savings associations, credit unions and certain non-federally-regulated banks in 2003. CIPs confirm that a potential account holder exists and is the person they claim to be.

Recognizing that the CIP process can be burdensome for financial institutions, regulators exempt a variety of customers and accounts that present a low risk of illicit activities, which included federally qualified retirement plans like 401(k)s.

However, auto-IRAs are not exempt from CIP rules. Because the first state auto-IRA program launched in 2017, well after the CIP rules were finalized, these programs are subject to the rules, even though their design does not lend itself to illicit activity.

As a result, program administrators for state auto-IRAs must run a CIP check on employees, and those who pass are automatically enrolled for payroll deduction contributions into their own IRA.

Auto-IRA Holders Susceptible to CIP Failures

According to the Bipartisan Policy Center, program data show that 29% to 46% of potential state program participants fail the CIP check and are not automatically enrolled. Among the seven state programs launched prior to 2024, more than 2 million combined people have failed a CIP check.

Approximately one-third of CIP failures are due to the inability to verify a address. According to the paper, four pieces of data are required for a participant to pass the CIP test: name, address, date of birth and either Social Security number or Individual Taxpayer Identification Number.

Sprick, an economist and associate director of economic policy at the Bipartisan Policy Center, says a possible explanation for this failure is that employees have changed addresses and are not updating their employers with this information.

“Federal law requires employers to stay up to date on their employees’ addresses, and it may be that employees are supposed to notify their employer every time they change addresses,” Sprick says. “But … that doesn’t always happen.”

Once the program administrator for the state auto-IRA program receives information from the employer about a worker, the administrator must run the information through an automated CIP verification system. If the employee fails the automated check, the administrator begins a manual search for additional information to verify the person’s identity. If the manual check is unsuccessful, the individual’s account is not opened.

Sprick says a program administrator would then attempt to contact the individual by mail or email for corrected information, but response rates have been “drastically declining” over the last few years.

“These are folks who have not made an active choice to opt into this program. … [They] haven’t actively signed up for this account,” Sprick says. “They’re not directly inputting their information, which is leading to a lot of the errors, and they’re much less likely to be on the lookout for these communications to verify their information.”

Possible Solutions

To address the issue, Sprick argues the easiest solution would be for federal regulators to provide the same exemption to state auto-IRA programs that they do for 401(k) plans. However, Sprick says this is nuanced, because the exemption should not be applied for self-employed people opting into an IRA, since they are directly inputting their information.

Sprick also points out that regulators have a lot on their plates, so addressing this issue may not be high on their priority list. Regulators may also prefer to do a wholesale revision and improvement of the regulations surrounding these laws, but this would take time.

An alternative approach would be to reduce or alter, through either legislation or regulation, the information required to pass the CIP verification. For example, the paper suggested requiring state programs to match only three pieces of information, or match a phone number instead of an address, which could help significantly reduce CIP failures.

Sprick says the issue is particularly important since the Automatic IRA Act of 2024 has been introduced in the House, which would create an auto-IRA program at the federal level and would require employers with more than 10 employees that fail to offer a retirement plan to enroll employees into an IRA—with the exceptions of church and government employers.

“When we think about the fact that, every year, new states are passing these programs and starting to implement these programs, and that there is real momentum on the federal level for the first time to consider something like an automatic IRA program, that number could get very big very quickly because of this seemingly very niche issue,” Sprick says.