What Investment Advisers Need to Know About the New AML/CFT Compliance Rules

On August 28, 2024, the Financial Crimes Enforcement Network (FinCEN), part of the U.S. Department of the Treasury, issued its final rule titled Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers (Final Rule). This rule significantly expands the scope of Anti-Money Laundering (AML) requirements by including most SEC-Registered Investment Advisers (RIAs) and all Exempt Reporting Advisers (ERAs) (jointly referred to as “advisers”) in the broader regulatory framework that was previously limited to more traditional financial institutions like banks, mutual funds and broker-dealers.

The Final Rule will come into effect on January 1, 2026, and mandates that advisers subject to the rule (“covered advisers”) establish a risk-based comprehensive AML compliance program, conduct customer due diligence, and adhere to independent testing and reporting requirements, such as filing Suspicious Activity Reports (SARs) with FinCEN. 

Core legislation guiding these regulations is the Bank Secrecy Act (BSA), which, as amended by the USA PATRIOT Act, requires “financial institutions” to establish AML programs that meet certain standards. Historically, investment advisers were excluded from the BSA’s definition of “financial institutions,” meaning that RIAs and ERAs were not subject to the same AML rules as other financial entities. However, the Final Rule modifies this exclusion, bringing investment advisers under the BSA’s regulatory umbrella. 

The expansion of the definition of financial institutions is meant to close a gap in the AML framework and ensure that the U.S. financial system is protected from abuse by bad actors, including money launderers and those attempting to finance terrorism. As a result, covered advisers will now be subject to the same AML obligations as banks and other financial institutions, with certain modifications. These adopted changes are part of an ongoing effort to strengthen the financial system against money laundering, terrorist financing, and other illicit financial activities. 

The Final Rule specifically excludes certain RIAs from AML obligations. These include:

Investment advisers that are subject to the Final Rule may exclude from the rule’s requirements the following types of clients: 

Additionally, foreign-located RIA and ERAs will only be required to apply the requirements of the rule to their U.S.-based advisory activities, advisory activities provided to U.S.-based persons, and advisory activities provided to a foreign-located private fund that has U.S.-based investors. 

5. What are the primary focus areas for RIAs and ERAs?

Key elements of the Final Rule include the following areas: 

a) Develop and adopt a written AML compliance program that is risk-based and reasonably designed and focus on identifying where the risk of money laundering is highest based on their own operations and business model. 

b) Designated AML Compliance Officer(s): An adviser subject to the Final Rule must designate one or more persons or a committee to be responsible for implementing and monitoring its AML/CFT program. The person(s) designated with this responsibility must be an employee or officer of the covered adviser or its affiliate; an outsourced AML/CFT officer is not permitted. An RIA is permitted, but not required, to designate its AML/CFT officer as the same individual that is designated as its chief compliance officer. 

c) Written Internal Policies and Controls: These policies must be reasonably designed to prevent the investment adviser from being used for money laundering and financial crimes. Internal controls should also outline the procedures for monitoring and reporting suspicious activities in compliance with the applicable provisions of the Bank Secrecy Act. 

d) Ongoing Training: The scope, frequency, and content of the adviser’s AML/CFT training program should align with employees' responsibilities and their exposure to AML/CFT requirements or risks. Employees involved with AML/CFT matters must be trained upon assuming their duties and should receive periodic updates and refreshers to stay informed about the program and evolving risks.

e) Independent Testing: To ensure that the AML program is effective, the firm must arrange for independent testing. This testing can either be done internally by personnel who are not directly involved in the day-to-day operations of the AML program or through external vendors. 

f) Suspicious Activity Reporting (SAR):  SARs must be filed when a transaction meets the following criteria: 

• Involves or aggregates assets of $5,000 or more.
• Indicates that the transaction: 
  • Involves illegal funds or is structured to conceal such funds;
  • Evades Bank Secrecy Act reporting requirements;
  • Has no legitimate purpose or deviates from the typical behavior of a client, without a reasonable explanation; or
  • Facilitates criminal activity.