The final rule, p. 29408 linked here provides a good discussion of the expectations: https://www.gpo.gov/fdsys/pkg/FR-2016-05-11/pdf/2016-10567.pdf.
1. The final rule allows you to rely on your existing CIP procedures and also allows you to accept photocopies of ID’s because the BO may not be present. Based on that and reasonable risk management analysis that what you have is still valid I agree with your analysis.
2. I think it will depend on the circumstances. Again, you may rely on CIP procedures and reasonable risk based analysis to verify idenity. The final rule says the following: Under the CIP rules, a financial institution’s CIP must include procedures for responding to circumstances in which the financial institution
cannot form a reasonable belief that it knows the true identity of a customer. These procedures should describe: (A) When the institution should not open an account; (B) The terms under which a customer may use an account while the institution
attempts to verify the customer’s identity; (C) When it should close an account, after attempts to verify a customer’s identity have failed; and (D) When it should file a Suspicious Activity Report in accordance with applicable law and regulation.