FinCEN's Investment Adviser AML Rule: Getting Customer Due Diligence Right
Key takeaways
- Investment advisers need stronger customer due diligence to understand investor relationships and associated risks.
- Centralized customer data and risk-based onboarding processes can help manage complex ownership structures.
- Firms should prepare now for FinCEN’s evolving AML requirements ahead of January 2028.
On 1 January 2028, US investment advisers covered by FinCEN's AML/CFT rule are scheduled to come within its scope. FinCEN has said it will use the extended implementation period to review and potentially tailor the rule, so the details may change [1][2].
For many firms, one of the biggest operational challenges will be knowing their customers and the risks those relationships carry. The rule covers SEC-registered investment advisers and exempt reporting advisers, including advisers to private funds and venture capital funds [3], and for those firms the customer is rarely a single person. It may be a fund investor, a feeder vehicle or a special purpose vehicle, several layers removed from the individuals behind it.
What the rule says about customer due diligence
The program has to be written and risk-based, and it has to include risk-based procedures for customer due diligence. FinCEN has said those procedures will be informed by future rulemaking on customer due diligence [4], and that it intends to deal with the collection of beneficial ownership information for legal entity customers in a later rulemaking [5].
Until then, the expectation is simple enough. Understand your customer relationships, assess the risks they present, and keep relevant customer information, in proportion to the risk.
Who is the customer in a fund?
FinCEN has given a useful steer on private funds. An adviser that is the primary adviser to a private fund or similar unregistered pooled vehicle is expected to make a risk-based assessment of the money laundering, terrorist financing and illicit finance risks the fund's investors present. That may mean obtaining information about the structure and ownership of the fund and relevant information about investors and depending on the adviser's own risk assessment it may extend to source of funds [5].
The reasoning is blunt. FinCEN wants to end the uneven application of AML/CFT requirements across the sector, which lets legitimate and illicit investors alike "shop around" for an adviser that does not need to apply controls, such as asking about the investor's source of wealth [6]. Advisers that already ask good questions at onboarding will find the rule much less disruptive than those that do not.
There is some relief on information sharing. FinCEN does not expect an adviser to treat private fund investors as account holders unless the investor separately has an advisory relationship with it, so a section 314(a) request would generally be answered for the fund, not for the underlying investors [5].
What about Customer Identification Programs?
CIP is a separate track. FinCEN and the SEC jointly proposed a CIP requirement for investment advisers in May 2024, and the final AML/CFT rule does not contain one [4][5].
If the proposal is adopted, it would bring customer identification and verification obligations: collecting identifying information, verifying identity and keeping records. FinCEN has indicated that it intends to revisit the proposal and coordinate it with the wider investment adviser AML framework, and commenters on the delay asked it to reissue the two together [1]. Final requirements and timing remain uncertain.
Complex structures raise the stakes
Feeder funds, special purpose vehicles and layered ownership make this harder. How far do you look through, and how do you evidence it?
The rule's own scoping provisions show how much ownership information can matter. A foreign-located adviser has to look through certain vehicles to work out whether a US person holds an interest in a foreign private fund, because that decides whether the rule applies at all [5]. Even for advisers that are plainly in scope, subscription documents and fund agreements may need updating to capture what the program requires [5].
Know what you can leave out. An adviser may treat the rule's requirements as satisfied for a mutual fund, a bank-maintained collective investment fund or another covered adviser that it advises, where each is already subject to an AML/CFT program requirement. A subadviser may be able to exclude a primary adviser it serves under a direct contract, where it has no direct relationship with the underlying customer [5]. Drawing those boundaries early avoids both gaps and duplicated work.
What to do now
With January 2028 approaching, firms should assess their readiness now.
- Set consistent processes for collecting and validating customer information at onboarding, including ownership and, where risk warrants it, source of funds.
- Centralise customer data, so risk assessments and ongoing reviews draw on one view of each investor and structure.
- Build flexible workflows that can adapt as FinCEN refines the AML/CFT rule and decides the future of CIP.
- Review subscription documents and fund agreements for the information and consents the program will need.
- Decide how risk rating will work for different structures, jurisdictions and investor types, and record why.
The regulatory details may evolve. The value of consistent customer data, risk-based processes and auditable onboarding is already clear.
How is your firm preparing for the changes?
Sources
- Federal Register, 2 January 2026: delaying the effective date of the investment adviser AML/CFT rule
General information only, not legal advice. Facts are current to 3 November 2026. The customer due diligence expectations described here reflect FinCEN's 2024 final rule and its commentary. Beneficial ownership requirements for legal entity customers and the proposed customer identification program (CIP) rule have not been finalised, and FinCEN has said it will revisit the rule before the 1 January 2028 compliance date, so check the current position before relying on any of it.
