The investment adviser CIP rule is a customer identification program rule that FinCEN and the SEC proposed jointly on 21 May 2024 for SEC-registered investment advisers and exempt reporting advisers. It would make an adviser collect a minimum set of identity data when a customer opens an account, verify it closely enough to know who the customer really is, check the customer against government terrorist lists and keep the records. It is not final. Comments closed in July 2024, and the SEC's regulatory agenda now carries it as a long-term action with the next proposal dated July 2027. Meanwhile the separate adviser AML program rule starts on 1 January 2028 without any identification requirement of its own. For an institutional manager, the practical question is what its onboarding files should hold while the identification rule waits. Botminds' Institutional Client Onboarding builds those files from the client's own documents, with every value cited and every decision signed.
This page explains the proposal and what it means for institutional onboarding; it is not legal advice. The AML program rule itself, its scope and its cost are covered in the guide to the investment adviser AML rule.
The investment adviser CIP rule beside the AML program rule
- Before
- Proposed May 2024; comments to Jul 2024
- No final ruleJul 2024 to Jul 2027
- Next proposal on the SEC agendaJul 2027
- ProposedFeb 2024
- Adopted, due 1 Jan 2026Sep 2024
- DelayedJan 2026
- Review; effective 1 Jan 2028Jan 2026 to Jan 2028
What is the investment adviser CIP rule?
It is the proposed rule that would add advisers to the list of financial institutions that must run a customer identification program under section 326 of the USA PATRIOT Act. Banks, broker-dealers and mutual funds have had such programs for two decades; advisers have not. The proposal would add a new section, 1032.220, to FinCEN's adviser rules, and it was written to sit beside the AML program rule FinCEN had proposed three months earlier (89 FR 44571).
The program it describes has five parts: collect identifying information, verify it, keep the records, compare the customer against government lists of known or suspected terrorists, and give customers notice that their identity is being checked. Each part is written to be risk-based. An adviser would set its procedures by the kinds of accounts it opens, how they are opened, what identifying information is available, and its own size, location and customer base.
Treasury's case for bringing advisers inside the perimeter rests on its 2024 risk assessment of the sector. It found that advisers have been an entry point for illicit proceeds from foreign corruption, fraud and tax evasion, and that 15.4 percent of RIAs and ERAs were associated with or referenced in at least one SAR filed between 2013 and 2021, with such filings rising by about 400 percent over the period (US Treasury, 2024 Investment Adviser Risk Assessment).
When will the CIP rule for investment advisers apply?
Not before a final rule, and the earliest next step is another proposal. The SEC's regulatory agenda lists the rule among its long-term actions, with the May 2024 proposal and the July 2024 close of comments behind it and a further proposal dated July 2027 (SEC regulatory agenda, RIN 3235-AN34). Agenda dates are plans, not commitments, and they move.
The 2024 text also set its own clock. The rule would take effect 60 days after a final rule was published, and an adviser would have six months from then to build its program, but no sooner than the compliance date of the AML program rule (89 FR 44571). With the program rule now starting on 1 January 2028, an identification obligation cannot arrive earlier than that, and on the agenda's timetable it would arrive later.
The investment adviser CIP rule's own clock, as proposed
60days
from publication of a final rule to its effective date
6months
from the effective date to build the program, no sooner than the AML program rule
2027
July: the date the SEC agenda gives for the next proposal
Two other dates sit around it. FinCEN's delay rule of 2 January 2026 moved the AML program rule's start from 1 January 2026 to 1 January 2028, and records that commenters asked FinCEN to reissue the identification and program proposals together; FinCEN said it would weigh timing across its adviser rulemakings (91 FR 36). And FinCEN's April 2026 proposal to rewrite program requirements for banks, broker-dealers and others expressly left the adviser rule unamended (91 FR 18704, 10 April 2026).
What would the CIP rule require when an institution opens an account?
Four data points, verified, screened and kept. For a customer that is not an individual, the proposal names the legal name, the date of formation, an address and an identification number, and it points to the certificate of formation or incorporation and its amendments as the place to find the date. Verification could happen within a reasonable time before or after the account opens, by documents, by other methods, or both, and it must let the adviser form a reasonable belief that it knows the customer's true identity (89 FR 44571).
The proposed adviser CIP, element by element, and what an institutional file already holds
| Proposed element | What the 2024 text would require | Where it sits in an institutional onboarding file |
|---|---|---|
| Identifying information | Name, date of formation, address and identification number for an entity | Registry extract, formation documents and LEI record, with their dates |
| Verification | Risk-based procedures, documentary or not, within a reasonable time of opening | Each value cited to the page it came from, with a second, independent read |
| Records | Identifying data kept while the account is open and five years after it closes; verification records five years after they are made | The file and its audit trail, kept beside the signed IMA |
| Government lists | Check the customer against lists of known or suspected terrorists provided to the adviser | Screening of every party, each match closed by a person with a reason |
| Customer notice | Adequate notice that the adviser is requesting information to verify identity | A line in the onboarding request and the client portal |
| Reliance | Rely on another regulated institution for some or all of the program, under conditions | The custodian's CIP, recorded as relied on, not assumed |
Two choices in the proposal matter more to an institutional manager than to a retail one. The customer would be the named accountholder: an adviser would not have to look through a trust or similar account to its beneficiaries, though its risk assessment could still lead it to learn more about the people behind a non-individual client. And accounts opened to take part in an ERISA employee benefit plan would not be carved out, as they are in the mutual fund rule; the agencies kept them in so that the identification rule would cover the same accounts as the program rule (89 FR 44571). A corporate pension plan that hires a manager would therefore be a customer whose identity the manager verifies. Which owners and controllers to look for at each kind of plan is worked through in who is the beneficial owner of a pension fund.
Who is the customer when one client opens several mandates?
The same client, verified once, as long as the first verification still holds. Under the proposal a person becomes a customer each time it opens a new account, but an adviser would generally not need to verify again where it verified the customer before under procedures consistent with the rule and still has a reasonable belief that it knows who the customer is (89 FR 44571).
That is the right design for institutional books, where a public pension system may award a second mandate two years after the first. It also puts weight on the first file. A second mandate can reuse a verification only if the file shows what was checked, against which document and when, and a refresh has kept it current. A file that says "KYC complete" and nothing else gives the adviser nothing to rely on.
Can an adviser rely on the custodian's identification work?
Under the proposal, yes, with conditions. An adviser's program could say when it will rely on another financial institution, including an affiliate, for some or all of its identification procedures, where the customer has or is opening an account with that institution, the reliance is reasonable, the other institution has its own AML program and a federal functional regulator, and a contract requires it to certify each year that it has implemented that program and will perform the specified procedures. The adviser would still have to monitor how its program works; it would escape blame for the other institution's failure only if it can show its reliance was reasonable and the contract and certifications were in place (89 FR 44571).
The custodian is the obvious candidate. Banks and broker-dealers already apply FinCEN's customer due diligence rule, which requires them to identify and verify the beneficial owners of legal entity customers (31 CFR 1010.230). Since FinCEN's exceptive relief of 13 February 2026 they may collect that information when a legal entity customer first opens an account and update it when something calls it into question or their risk-based procedures call for it, instead of repeating it with each new account (FinCEN, FIN-2026-R001). Reliance only works if the adviser can show, file by file, what it relied on. An adviser that already holds the same evidence can also answer a custodian's questions from its own file instead of asking the client a second time.
How does the CIP proposal relate to the adviser AML rule?
They are two halves that were meant to arrive together and did not. The AML program rule, adopted on 4 September 2024 and now effective on 1 January 2028, requires covered advisers to run a written, risk-based program, report suspicious activity and keep records (89 FR 72156; 91 FR 36). In adopting it FinCEN stated that it had not proposed an identification requirement or a beneficial-ownership requirement for advisers, left the first to the joint rule and the second to a later rulemaking. Who the program rule covers, its exclusions and its cost are set out in the guide to the investment adviser AML rule.
What reaches onboarding in 2028, and what waits for the CIP rule
AML program rule, from 1 Jan 2028: A written, risk-based AML/CFT program approved by the board, with five minimum elements.
Not yet in force, as of October 2026: Any change of scope FinCEN may make after its review.
AML program rule, from 1 Jan 2028: Ongoing customer due diligence: a risk profile and risk-based monitoring and updates.
Not yet in force, as of October 2026: A customer identification program: the joint proposal of May 2024, next proposal dated July 2027.
AML program rule, from 1 Jan 2028: Nothing specific.
Not yet in force, as of October 2026: Beneficial ownership identification for legal entity clients, left to a later rulemaking.
AML program rule, from 1 Jan 2028: Suspicious activity reports; currency transaction reports; recordkeeping and travel rules.
Not yet in force, as of October 2026: The SAR-sharing and other clarifications commenters asked for.
For onboarding, the program rule's customer due diligence element is the one that bites first: an adviser must understand the nature and purpose of each customer relationship to build a risk profile, and keep customer information current on a risk basis. Of the program's five minimum elements, each needs something from the onboarding file, and none of them waits for the identification rule. The board, or persons with similar functions where there is no board, approves the program in writing (31 CFR 1032.210, as adopted).
The five elements of the 2028 adviser AML program, and the onboarding evidence each needs
| Element | What the rule requires | What onboarding contributes |
|---|---|---|
| Internal policies, procedures and controls | Reasonably designed to prevent misuse and achieve compliance with the BSA | A written KYC policy whose checks run the same way on every file |
| Independent testing | By the adviser's own personnel or a qualified outside party | Files a tester can re-run: each value cited, each decision with its reason |
| A designated person | Responsible for implementing and monitoring the program | An approver of risk ratings and policy changes who is not the preparer |
| Ongoing training | For appropriate persons | Plain-language reasons on every held item, so staff learn the policy from the work |
| Ongoing customer due diligence | Understanding the nature and purpose of customer relationships to build a risk profile, and ongoing monitoring that maintains and updates customer information on a risk basis | A risk profile at onboarding, and a refresh cycle by risk level |
What should institutional onboarding hold before a CIP rule applies?
The evidence an identification program would need, collected now, because files opened in 2026 and 2027 are the files a program will inherit. An adviser does not need a final CIP rule to know who its client is, who controls it and who may act for it; it needs a written policy, and files that show the policy was applied the same way each time.
Seven things an institutional onboarding file should hold now
- The client's identity from an independent source
Registry extract, formation documents and LEI record, with their dates: the four data points the 2024 CIP proposal names.
- Control and ownership, or the reason there is none
Which control person or exclusion route your policy applied; for most pension funds and public bodies, no one owns 25%.
- Every signer's authority, traced
The registry or articles, the resolution or power of attorney, and the signatory list, checked against each other.
- Screening with dispositions
Sanctions, PEP and adverse-media results for every party, each match closed by a person with a reason.
- A risk rating and the nature and purpose of the relationship
Prepared by one person and approved by another; this is the risk profile the program's ongoing due diligence starts from.
- What was relied on, and from whom
Where the custodian's checks are used, which ones, on what date, and the basis for relying on them.
- The resolution of every conflict
Where two documents or two readings disagreed, what was decided, by whom and why.
Most of this is what institutional account opening documents already have to prove; the difference a CIP rule would make is that the proof becomes a regulatory record with a retention clock. The signer evidence is the part most often missing, and the authorized signatory list template shows why lists come back.
A risk rating prepared by one person, approved by another, with a reason code
How does an onboarding file stay current until a rule applies, and after?
By refreshing on a schedule set by risk and on events, and by pre-building each refresh from the same sources as the original file. A program's ongoing due diligence obligation is about keeping customer information current on a risk basis, and the proposal's reuse of a past verification depends on the adviser still believing it; a file that was right on the day it was opened and never touched again supports neither.
In the solution's sample book of 1,840 institutional relationships, 214 files were due for refresh within 90 days. The agents had pre-built 188 of them, re-pulling each registry in its own language, rescreening every party and re-checking signers and tax-form expiry; 141 showed no change and wait for the analyst to confirm, with the MLRO sampling 5%, and 47 needed a decision or a document. The refresh cycle itself is the firm's setting: 12 months for high risk, 24 for standard and 36 for low in the sample policy.
KYC refresh: pre-built files, and the ones that changed
The rest of the sample, from the signer conflict to the go-live, is on the Institutional Client Onboarding page, and how the agent that reads a document is kept apart from the one that checks it is in the client onboarding AI agent guide.
Questions people ask
Is there a CIP rule for investment advisers?
Not a final one. FinCEN and the SEC proposed a joint customer identification rule for registered and exempt reporting advisers on 21 May 2024, and comments closed on 22 July 2024. As of 28 October 2026 no final rule has been published, and the SEC's agenda lists the next proposal for July 2027.
What would the adviser CIP rule require an adviser to collect?
At a minimum a customer's name, date of birth or, for an entity, date of formation, an address and an identification number. The adviser would verify them on a risk basis, check the customer against government terrorist lists, give notice and keep the records for five years after the account closes.
Does the investment adviser AML rule include a CIP?
No. The AML program rule that starts on 1 January 2028 requires a program, suspicious activity reporting and records, but FinCEN left identification to the joint rule with the SEC and beneficial ownership to a later rulemaking.
Would ERISA plan accounts be covered by the adviser CIP rule?
Yes, as proposed. Unlike the mutual fund identification rule, the 2024 proposal did not exclude accounts opened to take part in an ERISA employee benefit plan, so that it would cover the same accounts as the AML program rule.
Can an adviser rely on a custodian for customer identification?
The proposal would allow it where reliance is reasonable, the custodian is federally regulated with its own AML program, and it certifies each year under a contract that it performs the specified procedures. The adviser would still monitor its own program, and its file should show what it relied on.
When does the investment adviser AML rule take effect?
On 1 January 2028. FinCEN's final rule of 2 January 2026 delayed it by two years and left its text unchanged; FinCEN said it would use the time to review whether the rule fits the adviser sector.