FinCEN’s AML Rule Raises the Bar for Investment Advisers
Reviewed by: Tom Devlin, Managing Director at KYC360
Last Updated 12/10/26
US investment advisers are facing a significant shift in their AML obligations. FinCEN’s new rule brings certain registered investment advisers and exempt reporting advisers within the Bank Secrecy Act framework, introducing formal AML/CFT programme, reporting and recordkeeping requirements.
Its effective date has been pushed back to January 1, 2028, giving firms more time to prepare. For investment advisers potentially within scope, that additional runway is an opportunity to strengthen the data, controls and monitoring needed to understand investor risk and support effective compliance.
What Changes for Investment Advisers
For covered advisers, this means establishing a risk-based AML/CFT programme. Among other measures, firms will be expected to:
-
Implement appropriate internal controls
-
Designate a person or persons responsible for the AML/CFT programme
-
Provide ongoing training
-
Independently test their programmes
-
Meet suspicious activity reporting, information-sharing and applicable transaction reporting and recordkeeping requirements
The rule reflects longstanding regulatory concerns that investment advisers can provide access to US markets and financial infrastructure without historically being subject to the same comprehensive AML requirements as banks, broker-dealers and other financial institutions.
Enforcement Raises the Stakes
The new obligations will also be subject to regulatory scrutiny. FinCEN has delegated examination authority to the SEC, while retaining overall authority for BSA compliance and enforcement. Non-compliance can result in civil monetary penalties for BSA violations, including failures relating to reporting, recordkeeping and AML/CFT controls. Willful violations of the BSA can also carry criminal penalties, including fines and imprisonment.
The Real Challenge is Visibility
Investment firms already collect substantial amounts of information on clients and investors. The challenge is making that information current, connected and usable. Customer records may sit in disparate systems with risk assessments stored in spreadsheets. Traditional periodic-review models can also mean that reassessment is driven by the calendar rather than by a meaningful change in risk. That can create a significant gap between having information and understanding the risk it represents.
An investor may pass onboarding checks today, only for its ownership structure to change six months later. A connected individual could become politically exposed. A sanctions designation, adverse media story or higher-risk jurisdiction could alter the risk profile of the relationship. The important question is not simply whether due diligence was completed. It is whether the firm would know when something material changed.
From Onboarding to Ongoing Risk Management
Covered advisers will need risk-based ongoing monitoring to identify suspicious activity and, on a risk basis, maintain and update customer information. A strong control environment needs to support the full customer lifecycle. That means maintaining an up-to-date view of the customer, monitoring relevant changes and ensuring that risk assessments evolve when the underlying facts do. For investment advisers, this is particularly important because investor structures can be complex.
A fund subscription might involve trusts, holding companies, offshore vehicles, intermediaries and multiple layers of ownership. Establishing the immediate investor may be straightforward. Understanding the individuals or entities ultimately behind that structure can be considerably harder. Where those relationships span jurisdictions, the challenge becomes even greater. Technology can help by bringing onboarding, ownership information, screening, risk scoring and ongoing monitoring into a single workflow.
Effective Compliance Needs Context
Alert volume without sufficient context can be a significant weakness in AML environments. A sanctions, PEP or adverse media alert is far more useful when a compliance team can quickly understand how it relates to the customer, what has changed and whether the change is material. This is where integrated customer data becomes valuable. If screening results are connected to ownership information, customer risk ratings and previous due diligence, investigators can make faster and better-informed decisions.
They can also build a clearer audit trail. That matters because FinCEN’s framework is not just about having policies. It is about being able to demonstrate that controls are operating effectively. When a high-risk event occurs, firms should be able to show what was identified, how it was assessed, who reviewed it and why a particular decision was made. A fragmented process makes that difficult, but a connected one makes it part of the normal compliance workflow.
Preparing for What Comes Next
There is still uncertainty around the final shape of the US regime. FinCEN proposed broader reforms to AML/CFT programme requirements in April 2026, although that proposal did not itself address investment advisers. FinCEN’s 2026 regulatory agenda separately indicates that it intends to revise the investment adviser AML framework, while Customer Identification Program requirements for advisers also remain unresolved and are expected to be addressed through a new joint proposal with the SEC.
That uncertainty is precisely why firms should focus on capabilities rather than trying to hard-code every expected regulatory requirement today. Better customer data, stronger risk models, more effective screening and clearer audit trails will remain valuable regardless of how individual provisions evolve. The postponed deadline presents an opportunity to move from fragmented, periodic compliance towards a more dynamic model built around continuous risk awareness.
For firms with a U.S. presence, that means asking some key questions:
-
Do we have a reliable view of our investors?
-
Do we understand complex ownership structures where they materially affect risk?
-
Do our monitoring controls identify relevant changes in sanctions, PEP or adverse media exposure on a risk-based basis?
-
Do material changes trigger an appropriate risk review?
-
Can we explain and evidence the decisions we make?
Conclusion
For investment advisers, there is a real opportunity to move beyond fragmented, periodic compliance towards a more connected and continuous view of risk. Better data, stronger controls and clearer audit trails do more than support regulatory readiness. They help firms understand who they are dealing with, identify changes in risk sooner and make more informed, defensible decisions.
For US investment advisers navigating evolving AML expectations, KYC360 brings KYC Onboarding, AML Screening and ongoing Customer Lifecycle Management together in one platform, helping teams maintain a clearer, more current view of investor risk.
The KYC360 platform is an end-to-end solution offering slicker business processes with a streamlined, automated approach to Know Your Customer (KYC) compliance. This enables our customers to outperform commercially through operational efficiency gains whilst delivering improved customer experience and KYC data quality.
Consolidate your system stack and data vendor relationships with one platform to cover all Onboarding, Screening, Perpetual KYC (pKYC) and CLM tasks, with market-leading data sources pre-integrated under a single license agreement. Live risk scoring and automated data collection enables a shift from periodic to event-driven review, while providing a single actionable picture of real-time risk with all documents and data in one place.
