Adviser AML Requirements

Why investment advisers face money-laundering risk

Investment advisers sit between clients and the financial system. They may recommend investments, manage pooled vehicles, direct trades, or help move assets among custodians and funds. Criminals can try to use an adviser relationship to place illicit proceeds into securities, conceal who controls assets, or move value across borders. A firm’s customers and transactions can therefore expose it to money-laundering and terrorist-financing risks even when the firm does not handle cash directly.

Anti-money-laundering, or AML, programs aim to identify and reduce those risks. Countering the financing of terrorism, or CFT, addresses financial support for terrorist activity. The systems overlap: firms assess customers, products, geography, intermediaries, transaction patterns, and control structures. A risk-based program directs more attention to higher-risk relationships while allowing controls that fit the firm’s size, services, customer base, and operating model.

A suspicious transaction is not the same as a proven crime. An adviser does not need to decide that a customer is guilty before escalating a concern. The firm should recognize red flags, examine context, preserve relevant records, and follow its legal reporting obligations. A customer may have a legitimate explanation for unusual behavior, but the firm should not ignore warning signs simply because the customer is profitable or well known.

The 2024 FinCEN investment-adviser rule

In 2024, the Financial Crimes Enforcement Network finalized a rule that brings certain investment advisers into the Bank Secrecy Act’s AML/CFT framework. The final rule covers specified investment advisers registered with the SEC and exempt reporting advisers, subject to the rule’s definitions and exclusions. It establishes AML/CFT program and suspicious activity report filing requirements and applies certain related BSA obligations. It does not apply to every person who calls themselves an adviser.

The rule’s effective date was first set for January 1, 2026. On December 31, 2025, FinCEN issued a final rule delaying that date to January 1, 2028. The change applies to the covered advisers’ obligations under the investment-adviser rule, including developing and implementing a compliant AML/CFT program by the revised date. As of October 12, 2026, the January 1, 2028 date is the operative date in the final delay rule.

This date distinction matters. A candidate who memorized the original January 1, 2026 date may incorrectly say the adviser rule is already in force. The final delay was issued before that original date arrived. Conversely, the rule has been finalized, so it should not be described as merely a 2024 proposal. The correct description is a 2024 final rule with an effective date postponed to 2028.

FinCEN has also proposed changes to broader AML/CFT program requirements in a 2026 notice of proposed rulemaking. A proposal does not create an effective obligation by itself. Unless a final rule adopts a change, firms and candidates should distinguish the existing final investment-adviser rule and its delayed effective date from ideas still under consideration. A proposed rule can show regulatory direction, but it is not current binding text.

What a risk-based AML/CFT program is designed to do

The 2024 final rule requires covered advisers to develop and implement a written, risk-based AML/CFT program. Program components include internal policies, procedures, and controls; a designated person responsible for day-to-day compliance; training for appropriate personnel; and independent testing. The program must be designed for the adviser’s business and risks. A small firm with a narrow customer base may use simpler controls than a complex global adviser, but it still needs a functioning program when the rule applies.

Internal controls define how the firm identifies customers, handles information, reviews transactions, documents decisions, and escalates suspicious activity. Risk assessment should consider who the customers are, how accounts are funded, what products the firm recommends or manages, whether intermediaries are involved, and the relevant countries or sectors. If risks change, the controls should be updated. A static document copied from another firm may fail to address the adviser’s actual exposure.

A compliance officer needs enough authority, information, and access to carry out the job. The firm should define who receives alerts, who decides when to investigate, who may file a suspicious activity report, and how records are retained. Responsibilities can be assigned to personnel or supported by service providers as allowed by the final rule, but the adviser remains accountable for its program. Outsourcing a task does not mean the adviser can ignore whether it was done properly.

Independent testing checks whether the program works, not merely whether it exists. A reviewer can examine a sample of customer files, alerts, escalations, training records, and reporting decisions. Testing should identify gaps and track remediation. If one representative repeatedly bypasses customer identification procedures, the firm needs to address the behavior and determine whether related accounts or transactions were affected.

Customer and transaction review

A risk-based approach begins with understanding the customer and the relationship. The adviser should know who the client is, who owns or controls an entity, who has authority to act, what investment service is being provided, and what activity is expected. The exact information and verification standards depend on the rule and firm procedures. A complicated structure is not automatically suspicious, but the adviser should understand its legitimate purpose and controlling persons.

Ongoing review compares actual activity with what the adviser knows about the customer. A client that normally invests through a domestic operating company and suddenly directs unrelated third-party wires through several jurisdictions presents a pattern to examine. A family office restructuring ownership may have a legitimate estate-planning reason. The firm should ask for context, review documents, and determine whether the activity is consistent with the account’s purpose.

Common warning signs can include reluctance to identify beneficial owners, inconsistent source-of-funds explanations, rapid movement of assets with no apparent investment purpose, unusual third-party payments, or pressure to bypass controls. None proves money laundering by itself. Red flags become more meaningful when combined with customer history, transaction frequency, amounts, geography, and responses to reasonable questions.

Advisers should avoid profiling based only on nationality, religion, race, or a customer’s use of a legitimate international business structure. Risk assessments should be tied to objective indicators and the applicable law. A customer’s unfamiliar name or foreign address is not, by itself, evidence of criminal conduct. The purpose of a risk-based program is to identify specific activity that needs review, not to make unsupported assumptions about entire groups.

Suspicious activity reports and confidentiality

The 2024 final adviser rule requires covered advisers to file suspicious activity reports with FinCEN when the applicable reporting standard is met. A report communicates suspicious activity to government authorities; it is not a public accusation or a finding of guilt. The firm must evaluate facts under the rule, use its designated process, and meet applicable filing deadlines. It should not wait for a criminal investigation to conclude before considering whether a report is required.

A SAR process generally includes collecting transaction details, identifying accounts and parties, describing why the activity is suspicious, and preserving supporting records. The narrative should be clear and factual: what happened, when it occurred, who was involved, what was unusual, and what the firm did in response. The filer should distinguish observed facts from conclusions and avoid overstating what the firm knows.

SAR confidentiality is important. A firm generally must not disclose the existence of a SAR to the person involved, except as permitted by law. The adviser should route customer questions through compliance and avoid making statements that could reveal a report or investigation. Confidentiality does not mean that no one may access the records: regulators and law enforcement may have lawful access under applicable procedures.

Suspicious activity reporting also differs from blocking a transaction. A report may be required even if the customer’s transaction was completed or later found to have an innocent explanation. A firm may have separate authority or duties to reject, delay, or restrict activity depending on sanctions, court orders, other law, and account terms. Do not assume that filing a SAR automatically freezes an account or gives the adviser power to confiscate assets.

Recordkeeping and information sharing

The adviser rule includes recordkeeping obligations related to covered transactions, SARs, and AML/CFT program operation. Records allow the firm and regulators to understand how the adviser identified the customer, reviewed activity, reached a reporting decision, and monitored remediation. The firm should use consistent retention practices and restrict access to sensitive reports and investigation material.

Certain information-sharing provisions can help financial institutions and law enforcement identify suspicious networks. They do not authorize unrestricted sharing of client information among employees, vendors, or other firms. A firm must use the applicable legal process and protect confidential information. The client’s privacy rights and the firm’s AML obligations should be handled through the relevant rule rather than improvised in a sales conversation.

FinCEN’s rule also subjects covered advisers to certain BSA tools, including special measures that may be imposed concerning jurisdictions, financial institutions, or transactions of primary money-laundering concern. Those measures are not a routine decision made by an adviser on its own. The adviser must comply with applicable FinCEN regulations and orders when they cover its activity.

An adviser rule does not erase role-specific obligations

A person or affiliated firm may have AML duties because it operates in another regulated capacity, such as a broker-dealer, bank, or covered fund. Analyze the legal entity and service, not only the brand name. An advisory affiliate that also runs a broker-dealer may already be subject to the broker-dealer’s BSA program for that business. The delayed investment-adviser rule does not automatically postpone obligations that arise under a different covered capacity.

Likewise, the 2024 adviser rule is not a universal customer-identification program for every advisory relationship. FinCEN described a separate customer-identification program rulemaking for investment advisers. The final 2024 rule did not itself make every proposed CIP requirement effective. When reviewing a compliance question, distinguish the AML program, SAR, recordkeeping, and CIP topics rather than treating them as one requirement.

A firm may also have obligations under sanctions programs, anti-fraud laws, adviser fiduciary duties, contractual commitments, or state law. Delaying one FinCEN rule does not make fraud or misuse of client assets permissible. An adviser still needs to act consistently with applicable securities laws and its client obligations. The correct point is narrow: the specific 2024 investment-adviser AML rule has the revised 2028 effective date.

A worked case: unexplained third-party funding

A new private-fund client wants to invest $1.2 million. The subscription is signed by a holding company, the wire comes from an unrelated trading business, and the beneficial owner refuses to identify the person who controls the company. The adviser should not treat the size of the investment as proof of wrongdoing, but the mismatch between subscriber, remitter, and beneficial owner warrants review. The firm should apply its customer and source-of-funds procedures and ask for a coherent explanation.

Suppose the client provides corporate records showing that the trading business is a wholly owned subsidiary and that the holding company is the fund investor. The adviser should verify the documents and determine whether the structure is consistent with the client’s stated purpose. If the documentation resolves the apparent mismatch, the firm can record its rationale. If the client continues to refuse information or requests that the firm ignore required checks, the adviser should escalate the matter to the AML officer.

The compliance officer then evaluates whether the rule’s reporting standard is met, whether additional information is needed, and whether the firm should continue the relationship. A SAR is not filed merely because the account is large or complicated. It is also not withheld solely because the client is prestigious or the adviser hopes to preserve a fee. The decision should follow the rule, available evidence, and documented program.

A worked case: rapid transfers after redemption

A customer redeems a portfolio shortly after opening the account and asks the adviser to wire proceeds to several unrelated overseas recipients. The customer says the transfers are for family investments but cannot explain the recipients or provide documentation. The adviser should compare the activity with the expected purpose of the relationship and ask targeted questions. Rapid movement of funds without a clear investment purpose may be a warning sign, especially when combined with unrelated recipients and evasive explanations.

The adviser should preserve account records, wire instructions, communications, and the timeline, then escalate the case under firm procedures. Compliance determines whether to file a SAR under applicable requirements and whether any separate sanctions or legal restriction applies. The adviser should not tell the client that a report is being considered or create an improvised freeze. A SAR filing decision and a transaction restriction are separate legal questions.

If the client later supplies evidence that the recipients are wholly owned affiliates making an ordinary acquisition, the firm can evaluate the explanation and update its record. The new information does not erase the need to consider whether an earlier filing obligation arose, but it may affect the assessment of continuing activity. AML monitoring is an ongoing process, not a one-time onboarding checklist.

A worked case: the compliance calendar

A small SEC-registered adviser reads a compliance alert stating that the new investment-adviser AML rule was supposed to begin January 1, 2026. The firm assumes it is already late and immediately sends every client a new questionnaire. The alert is outdated. FinCEN’s final delay rule moved the effective date to January 1, 2028. The firm should update its calendar and plan implementation against the current rule, while continuing to follow any obligations that apply through another business capacity.

During 2026, FinCEN also publishes a proposed AML/CFT program rule. The adviser should not treat the proposal as a final regulation. Compliance can review the proposal to understand possible future changes, submit comments if appropriate, and track future rulemaking. The firm’s binding implementation date for the 2024 investment-adviser rule remains January 1, 2028 unless a later final rule changes it.

This example illustrates why regulatory facts need status labels: final rule, effective date, delayed date, proposed amendment, and current obligation. The same document can be final but not yet effective. A proposal can discuss requirements in detail without making them binding. A reliable exam answer identifies what has been adopted and when it applies.

Common exam mistakes

One mistake is assuming every investment adviser has always been subject to the same comprehensive AML program rule as a broker-dealer. Coverage depends on the legal entity and its regulated activities. Another mistake is applying the original January 1, 2026 date after FinCEN finalized a two-year delay. Check the current effective date before stating that covered advisers must already be filing under the 2024 rule.

A second mistake is treating a SAR as an accusation or proof of criminal conduct. It is a confidential report to government authorities based on the applicable standard. A third mistake is confusing a SAR with a transaction freeze. Reporting and restricting assets have separate rules and procedures. The adviser should not promise a freeze simply because a SAR is filed.

A final mistake is converting a proposed 2026 AML/CFT amendment into a current obligation. Proposed text may change before it becomes final and effective. Use current regulations for present duties and clearly identify proposed provisions as proposals. The date and status are part of the legal answer, not a minor footnote.

Practice questions with explanations

Question one: what is the current effective date for the 2024 FinCEN AML/CFT and SAR rule for covered investment advisers? January 1, 2028. FinCEN issued a final delay rule on December 31, 2025, moving the date from January 1, 2026. The rule is final, but it is not effective as of October 2026.

Question two: a client’s transactions appear unusual, but the adviser has no proof of a crime. Must the firm wait for a criminal finding before escalating the activity? No. The adviser should follow its risk-based procedures, investigate relevant facts, and determine whether the reporting standard is met. A SAR is not a conviction or finding of guilt.

Question three: an adviser operates an affiliated broker-dealer. Does the postponed adviser rule automatically remove the broker-dealer’s AML duties? No. The broker-dealer’s obligations arise from its own covered status and rules. Analyze each legal entity and capacity separately.

Question four: FinCEN publishes an AML/CFT program NPRM in 2026. Is the proposed text immediately binding? No. A notice of proposed rulemaking invites comment and may change. The final 2024 investment-adviser rule and its delayed effective date remain the applicable source unless another final rule takes effect.

A practical AML analysis sequence

Identify the adviser’s role and legal entity. Determine whether it is an SEC-registered adviser, exempt reporting adviser, broker-dealer affiliate, bank, or another covered institution. Next, identify the rule’s status and effective date. For the 2024 FinCEN adviser rule, distinguish the final requirements from the delayed implementation date and any later proposal. This prevents both under-compliance and claims that an obligation is already effective when it is not.

Then describe the customer, activity, and risk indicators. Identify what is unusual, what explanation the customer offered, what records support the activity, and whether the facts fit the account’s expected purpose. Escalate through the firm’s AML officer or compliance process. Do not make an unsupported accusation, tip off a person about a SAR, or create a transaction restriction without authority.

Finally, keep separate the program, review, reporting, recordkeeping, and transaction-control questions. A strong AML program is risk-based and documented. Suspicious activity reporting follows its own standard and confidentiality rules. Any hold, rejection, or freeze depends on separate authority. When a question gives a date or rule status, treat it as a central fact in the analysis.

Key takeaways

• FinCEN finalized AML/CFT program and SAR requirements for specified investment advisers in 2024.
• FinCEN delayed the rule’s effective date from January 1, 2026, to January 1, 2028; it is not yet effective as of October 2026.
• The final rule requires covered advisers to build a risk-based written program with controls, a compliance officer, training, independent testing, and reporting processes.
• A suspicious activity report is not proof of a crime and does not itself freeze an account.
• A 2026 NPRM is proposed text; obligations from other covered capacities may apply independently.