FinCEN finalized its investment adviser AML rule in 2024, but the effective date has been postponed from January 1, 2026 to January 1, 2028. The rule is not withdrawn, only delayed. Here is what SEC-registered investment advisers and exempt reporting advisers should do now to be ready when the deadline arrives, and what a practical AML program looks like for an RIA.
FinCEN finalized its rule extending BSA/AML obligations to SEC-registered investment advisers and exempt reporting advisers in 2024, but postponed the effective date to January 1, 2028
FinCEN's investment adviser AML rule is not yet in effect. FinCEN finalized the rule in 2024, but the agency postponed its effective date from January 1, 2026 to January 1, 2028. For SEC-registered investment advisers and exempt reporting advisers, the practical takeaway is that the obligation is real, the deadline has moved, and the firms that use the extra time to prepare will be better positioned than those that wait until 2028 approaches.
The five required program elements are: written AML policies and internal controls, a designated AML compliance officer, annual employee training, customer due diligence with beneficial ownership procedures, and SAR filing capability
It is worth understanding that postponement clearly, because the wrong mental model leads to the wrong action. The rule was not withdrawn. It was finalized and remains on the books with an effective date of January 1, 2028. A significant number of advisory firms watched the rule closely and expected relief; they got a delay, not an exemption. Firms that read the delay as "this no longer applies to us" risk repeating in 2028 the same scramble they narrowly avoided in 2026. The window to prepare calmly, before an examination and before a banking partner asks for evidence of your program, is wide open right now - and that is exactly what makes it easy to waste.
The written AML program must be risk-based, calibrated to your firm's specific client base, investment strategies, and geographic footprint, not a generic template
The rule has a specific scope. It applies to investment advisers registered with the Securities and Exchange Commission under the Investment Advisers Act of 1940, and to exempt reporting advisers that report to the SEC. State-registered advisers are not currently covered by the federal rule, though the direction of regulatory travel suggests that may change. If you are an SEC-registered investment adviser or an exempt reporting adviser, the rule is expected to apply to you when it takes effect, regardless of the size of your firm or whether you have ever previously had AML obligations, unless an exclusion applies. The final rule excludes RIAs registered with the SEC solely as mid-sized advisers, multi-state advisers, or pension consultants, and RIAs that do not report any assets under management on Form ADV. For foreign-located advisers, it reaches only advisory activities in the United States or services to U.S. persons and certain foreign private funds with U.S. investors. Confirm your registration basis before deciding whether you are covered.
Entity clients require beneficial ownership identification: any LLC, LP, trust, or other legal entity onboarded as a client requires identification of the individuals who ultimately own or control it
What does the rule actually require? The structure maps directly onto the five-pillar BSA framework that applies to other covered financial institutions, which means RIAs would be expected to build programs to the same structural standard as banks, money services businesses, and broker-dealers. The five core elements are a written AML program covering internal controls, a designated AML compliance officer, ongoing training for appropriate personnel, a customer due diligence program including beneficial ownership procedures, and a suspicious activity reporting capability. Each of these elements has specific content requirements, and the absence of any one of them would be a program deficiency.
SAR filing is a new obligation for most RIAs, firms must have documented procedures for identifying suspicious patterns, escalating internally, and filing within the required timeline
The written AML program is the starting point. It must be risk-based, meaning it must be calibrated to the specific money laundering risks your firm faces, not modeled on a generic template. The risk profile of an RIA is genuinely different from that of a bank or a money transmitter. Your AML program must reflect your specific client base, your investment strategies, the jurisdictions where your clients are located, and the transaction types your firm facilitates. A policy that describes generic AML procedures without grounding them in your firm's actual risk profile is not a risk-based program. It is a document that would not hold up when an examiner asks specific questions about why your controls are calibrated the way they are.
Examination risk is real and accelerating, FinCEN coordinates with the SEC, which already has established examination authority over registered investment advisers
The designated AML compliance officer requirement is not a formality. The officer must have actual authority to implement and enforce the program, actual knowledge of the BSA requirements applicable to investment advisers, and actual time allocated to compliance responsibilities. For small RIAs with lean staffing, this is often the element that requires the most honest internal conversation. The CCO of a two-person advisory firm who is also responsible for investment management, client relations, and operations does not have the capacity to meaningfully manage an AML program on top of those responsibilities. That does not mean the role cannot be satisfied at a small firm, it means the firm needs to be honest about whether the person designated has genuine capacity, and if not, whether outside compliance support is appropriate.
The compliance infrastructure investment for a small to mid-sized RIA is modest relative to the regulatory risk of non-compliance
Annual training for appropriate personnel is another element that is frequently underestimated. The BSA's training requirement is not satisfied by distributing a document and asking staff to acknowledge receipt. Training must be instruction, content that is appropriate for the specific responsibilities of each employee category, delivered through a medium that actually conveys the material, and documented in a way that demonstrates it occurred. For RIAs, this means training that covers the money laundering risks specific to investment advisory activity: red flags in client onboarding, source-of-funds indicators, beneficial ownership verification, and SAR filing triggers in the context of investment management. Generic AML training content designed for bank tellers is not appropriate for advisory firm staff.
The time to prepare proactively is now - the window is open, and firms that build their programs ahead of the January 1, 2028 effective date will be far better positioned
Customer due diligence is the element that will require the most operational change for firms that are starting from scratch. The rule's CDD requirements for investment advisers would include establishing and maintaining procedures to verify the identity of clients, to understand the nature and purpose of client relationships, to conduct ongoing monitoring of client activity for suspicious patterns, and, for entity clients, to identify and verify the beneficial owners of those entities. This last requirement is where advisory firms frequently underestimate the scope of their obligation. If your client base includes LLCs, limited partnerships, trusts, or other legal entities, you would be required to identify the individuals who ultimately own or control those entities. Accepting an entity name on an account without understanding who is behind it is not adequate CDD.
The SAR filing requirement is new for most investment advisers, and it is the element that most directly implicates the firm's ongoing monitoring practices. Under the rule, RIAs would be required to file Suspicious Activity Reports with FinCEN when they detect transactions that involve the proceeds of crime, are designed to evade reporting requirements, or have no lawful purpose. The $5,000 threshold that applies to many other covered institutions applies to investment advisers as well. For an advisory firm, SAR-triggering activity might include a client's sudden unexplained transfer of large amounts into or out of managed accounts, unusual cash-equivalent activity inconsistent with the client's stated investment objectives, or attempts by a client to structure transactions in patterns that suggest awareness of reporting thresholds. The firm must have documented procedures for identifying these patterns, escalating internally, and making filing decisions within the required timeline.
One of the practical realities of implementing an AML program for an RIA is that the compliance infrastructure investment is modest relative to the regulatory risk of non-compliance. A well-designed AML program for a small to mid-sized advisory firm does not require a dedicated compliance department. It calls for a risk assessment that accurately documents your firm's exposure, a written policy that maps to that assessment, a compliance officer designation with genuine authority and adequate time, training that covers your specific risk environment, CDD procedures that are actually followed at onboarding, and a documented process for SAR evaluation. These elements are achievable for firms of any size. The cost of building them properly is a fraction of the cost of remediation after an examination finding.
The examination risk for RIAs is real and will accelerate once the rule takes effect. FinCEN coordinates closely with the SEC, and the SEC has existing examination authority over registered investment advisers. Once RIAs have explicit AML obligations under the BSA, examination teams will have a clear regulatory basis for evaluating AML program quality alongside their existing investment adviser examination procedures. The firms most at risk are not the ones that build a program and come up short - they are the ones that make no genuine effort to prepare before the January 1, 2028 effective date. Firms that prepare now enter the first examination cycle under the rule in a far stronger position.
The firms we see preparing early are the ones taking the 2028 deadline seriously and moving to close their compliance gap well before the first examination cycle under the rule. The conversation at those firms typically starts with an honest assessment of where they stand: do they have a written AML policy that is specific to their business? Have they designated a compliance officer with real capacity? Have they trained their staff? Have they updated their client onboarding procedures to collect and document beneficial ownership information for entity clients? For most firms that have not previously had AML obligations, the answer to most of these questions is no. That is not a catastrophe, it is a starting point.
The practical path forward for an advisory firm that needs to get compliant is sequential. Start with the risk assessment. Document your client base, your investment strategies, the jurisdictions where you operate, and the specific money laundering risks that apply to your firm's activity. Use that assessment to build a written policy that reflects your actual risks and your actual controls. Designate a compliance officer with documented authority and a realistic time allocation. Build a training program that covers the BSA requirements applicable to investment advisers, train your staff before the next examination cycle, and document the training. Update your client onboarding procedures to include the CDD and beneficial ownership verification steps the rule requires. Implement a documented process for SAR evaluation. And schedule an independent review of your program within the next 12 months to confirm that what you built is examination-ready.
The question we hear most often from advisory firms is whether the rule will be delayed again or modified before the 2028 effective date. The honest answer is that this is not a productive posture. The rule is finalized with a scheduled effective date, and FinCEN has said it will revisit the scope of the rule during the extension, so some details may change. The core obligation, however, is unlikely to disappear. The firms that build their programs now will be positioned well regardless of what happens next in the regulatory environment. The firms that continue to wait are taking on compounding risk with no corresponding upside.
If your advisory firm wants to build a compliant AML program without waiting until the deadline, this is solvable. The time to do it quietly, on your own schedule, is now. Waiting until the effective date approaches, or until an examination or a banking partner forces the issue, makes the work harder and more expensive than it needs to be.
Further Reading
What Is an AML Program and Who Needs It in 2026?
The foundational overview of BSA AML program requirements, which would apply to investment advisers when the rule takes effect.
How to Perform an AML Risk Assessment in 2026
The risk assessment is the expected starting point for any compliant AML program. Here is the step-by-step framework.
What Is Customer Due Diligence (CDD)?
Beneficial ownership identification, expected to be required for entity clients under the rule when it takes effect, is explained in full here.
Tags
Investment Adviser AMLRIA ComplianceFinCEN Investment Adviser RuleSEC-Registered Adviser BSAAML Program RIAExempt Reporting AdviserInvestment Adviser BSA 2028AML Compliance 2028
SC
Soflo Consulting Team
AML/BSA Compliance Insights Team · Soflo Consulting
114 more articles
Soflo Consulting
Soflo Consulting Team publishes BSA/AML compliance analysis for regulated businesses across the United States. The team covers regulatory enforcement actions, FinCEN guidance, risk assessment, and emerging compliance obligations for banks, money services businesses, mortgage lenders, fintechs, and other covered institutions.
BSA/AML ProgramsRegulatory Enforcement AnalysisRisk AssessmentCompliance Training
View author profile & all articlesFinCEN & Regulation
In This Article
8 sections
Key Takeaways
- 1FinCEN finalized its rule extending BSA/AML obligations to SEC-registered investment advisers and exempt reporting advisers in 2024, but postponed the effective date to January 1, 2028
- 2The five required program elements are: written AML policies and internal controls, a designated AML compliance officer, annual employee training, customer due diligence with beneficial ownership procedures, and SAR filing capability
- 3The written AML program must be risk-based, calibrated to your firm's specific client base, investment strategies, and geographic footprint, not a generic template
- 4Entity clients require beneficial ownership identification: any LLC, LP, trust, or other legal entity onboarded as a client requires identification of the individuals who ultimately own or control it
- 5SAR filing is a new obligation for most RIAs, firms must have documented procedures for identifying suspicious patterns, escalating internally, and filing within the required timeline
- 6Examination risk is real and accelerating, FinCEN coordinates with the SEC, which already has established examination authority over registered investment advisers
- 7The compliance infrastructure investment for a small to mid-sized RIA is modest relative to the regulatory risk of non-compliance
- 8The time to prepare proactively is now - the window is open, and firms that build their programs ahead of the January 1, 2028 effective date will be far better positioned
Need Expert Guidance?
Put these insights into action. Talk to a compliance professional at Soflo Consulting compliance specialist.
Stay Ahead of Compliance
Get FinCEN updates, BSA/AML guidance, and federal compliance news delivered to your inbox - no fluff.
