The investment adviser AML rule is FinCEN's final rule of 4 September 2024 that makes SEC-registered investment advisers (RIAs) and exempt reporting advisers (ERAs) "financial institutions" under the Bank Secrecy Act: each must run a written, board-approved AML/CFT program and file suspicious activity reports. It was to apply from 1 January 2026; FinCEN delayed it to 1 January 2028 while it reviews the rule's scope. The cost is uneven because the duties are the same for a dual-registered adviser that already runs a broker-dealer program and for a small venture adviser that has none. Botminds' Investor KYC/AML Onboarding handles the investor files those programs will depend on: collecting, reading, unfolding owners, screening and rating each investor, with people deciding.
The rule's figures below are FinCEN's own estimates from its September 2024 analysis and its January 2026 delay, linked where they appear.
In FinCEN's benchmark, one RIA in four had named an AML officer
When do advisers have to comply with the AML rule?
On 1 January 2028. FinCEN's final rule published on 2 January 2026 states that, "As of December 31, 2025, the effective date of the rule published September 4, 2024, at 89 FR 72156 is delayed until January 1, 2028" (91 FR 36). Until then, a covered adviser has no federal obligation under it, though OFAC sanctions and the SEC's own rules apply as before.
The path to that date had two steps. On 5 August 2025, FinCEN issued an exemptive order relieving covered advisers "from all requirements of the IA AML Rule until January 1, 2028", and announced it would propose a new effective date "no earlier than January 1, 2028" (FinCEN order, August 5, 2025). The proposal followed, and the final delay rule made the new date law.
From proposal to 2028: four years for one rule, and the identification rule still behind it
- Proposal to final rule7 mo
- Final rule, awaiting 2026 start11 mo
- Exemptive order to delay rule5 mo
- Review of scope; new start date24 mo
- Joint SEC–FinCEN proposal, comments to Jul 2024
- No final rule; next proposal listed for Jul 202736 mo
Was the FinCEN investment adviser rule delayed, and what will FinCEN review?
Yes, by two years, and the delay is a review, not only a postponement. FinCEN said the extra time would let it review the rule and, where needed, tailor it to the different business models and risk profiles in the adviser sector (91 FR 36), and the exemptive order tied that review to the Administration's deregulatory policy and to striking "an appropriate balance between cost and benefit" (FinCEN order).
“To avoid regulatory uncertainty and industry incurring potentially unnecessary compliance costs while FinCEN’s review and rulemaking process are under way, FinCEN is issuing this exemptive relief…”
FinCEN, exemptive relief order, August 5, 2025
What has not changed is the risk FinCEN wrote the rule to address. The same order says "the illicit finance risks associated with investment advisers remain." Treasury's 2024 risk assessment found that "the highest illicit finance risk in the investment adviser sector is among ERAs (who advise private funds exempt from SEC registration), followed by RIAs who advise private funds" (Treasury, February 2024). A firm that reads the delay as a sign the rule will disappear is betting against the Treasury's own risk ranking.
FinCEN's broader April 2026 proposal to reform every AML program rule does not touch this one: it "does not propose any amendments to the final rule establishing AML/CFT and suspicious activity report (SAR) filing requirements for registered investment advisers and exempt reporting advisers, which has been delayed until January 1, 2028" (91 FR 18704). Any change to the adviser rule will come in its own rulemaking.
What the rule requires of an adviser from 2028
Five program elements, suspicious activity reporting and the Bank Secrecy Act's recordkeeping and information-sharing duties. Under 31 CFR 1032.210 as adopted, each covered adviser must have a written, risk-based program, approved in writing by its board or, if it has none, by its general partner or equivalent, and available to FinCEN and the SEC for inspection.
The program must at a minimum set internal policies, procedures and controls; provide independent testing by staff or a qualified outside party; designate a person or persons to run it; train appropriate staff; and apply risk-based ongoing customer due diligence, including understanding the nature and purpose of customer relationships and monitoring to report suspicious transactions. A transaction of at least $5,000 that the adviser knows, suspects or has reason to suspect is illicit must be reported to FinCEN.
Two scoping rules matter for funds. An adviser may treat the requirements as met for a mutual fund, a bank collective fund or another adviser it advises that already has its own AML program. And for an adviser based outside the United States, the rule reaches only activities in the United States or services to a US person or to a foreign private fund with a US investor.
Does the rule apply to exempt reporting advisers?
Yes. "No ERAs are exempt from the final rule," FinCEN wrote, and it counted 5,846 ERAs within scope, with $5.2 trillion of gross assets, alongside 14,073 RIAs managing $119 trillion (89 FR 72156). ERAs are the firms that advise only venture capital funds, or only private funds with less than $150 million of US assets under management.
Some RIAs are out. FinCEN narrowed the rule to exclude advisers registered with the SEC only as mid-sized advisers, multi-state advisers or pension consultants, and those that report no assets under management on Form ADV. State-registered advisers, foreign private advisers and family offices are not covered at all.
Who the 2028 rule reaches: most of it is firms with no bank or broker behind them
Does the investment adviser AML rule include a customer identification program?
No. FinCEN said plainly that it "did not propose to include a CIP requirement for investment advisers, nor did it propose to require investment advisers to collect beneficial ownership information for legal entity customers" (89 FR 72156). Identification was left to a separate joint rule with the SEC; in the adopted text, section 1032.220, where an identification program would sit, is simply marked "[Reserved]".
That rule is a proposal of 21 May 2024, with comments closed in July 2024 (89 FR 44571). The SEC's regulatory agenda now lists it as a long-term action, with the next step a proposal dated July 2027 (RIN 3235-AN34). One detail of the 2024 draft is worth knowing for pension investors: unlike the mutual fund rule, it did not exclude accounts opened for ERISA employee benefit plans. What the proposed rule would ask of an adviser when an institution opens an account is covered in the investment adviser CIP rule.
For an adviser planning now, the gap is awkward rather than comforting. From 2028 its program must manage the risk of customers it has no rule-defined duty to verify, and a suspicious activity report about an investor is hard to write about someone the firm never identified. The practical answer for most private fund advisers is to keep verifying investors through the administrator, because the alternative is a program with no evidence under it. Investor KYC by vehicle sets out where each fund's investor file sits under today's rules.
What FinCEN estimated the rule costs
FinCEN put the private sector's cost at about $408 million up front and $278 million a year after that, in information-collection costs alone. In hours, it estimated "a one-time, upfront information collection burden of 6.83 million hours and an average annual information collection burden of 4.86 million hours thereafter" (89 FR 72156).
FinCEN's estimate of what the adviser AML rule costs the industry
$408M
one-time, upfront information collection cost
$278M
average annual recurring cost thereafter
6.83M
hours of one-time information collection burden
$1.45B
net present value of the savings from the two-year delay, at a 7% discount rate
The delay rule adds a second view. FinCEN's original model projected $800 million of expenses in 2026 and $780 million in 2027, in 2022 dollars, and the two-year delay saves about $1.45 billion in present value at a 7% discount rate. FinCEN itself flags the weakness of that figure: a firm that had already reviewed its policies, rewritten disclosures or bought systems has spent money the delay does not return.
What will the investment adviser AML rule cost a small adviser?
No regulator or independent study publishes a per-firm cost a small adviser can rely on, because FinCEN's cost tables report groups, not firms. What FinCEN's analysis does show is which costs scale with size and which do not, and the fixed ones are what make the rule heavy for a small firm.
Costs in FinCEN's model that do not shrink with the firm
| Requirement | FinCEN's working assumption | Why size does not help |
|---|---|---|
| Board approval of the written program | About 4 hours in the first year and 2 hours a year after, priced at $172.42 an hour: about $690, then $345 | Every covered adviser needs an approved program, whatever its client count. |
| Information-sharing requests under section 314(a) | About 4 minutes per request, one a day: about 24 hours a year per adviser | The lists arrive at the same rate for a ten-person firm as for a bank-owned adviser. |
| A designated AML/CFT officer | Time of existing staff; FinCEN did not cost a new hire because the rule does not require one | Someone must own the program; in a small firm it is the chief compliance officer, on top of everything else. |
| Independent testing | By staff not involved in the program, or a qualified outside party | A small firm rarely has independent staff, so it buys the test. |
| Reviewing alerts | About 42% of alerts become reports, so 1.4 alerts reviewed and closed for each report filed | Alert volume follows clients and transactions; the judgment per alert does not get cheaper. |
FinCEN considered and rejected a size exemption. It declined to exempt advisers with fewer than 20 or 100 employees, saying a threshold "based on employee numbers alone would be inconsistent with Treasury's understanding of risk in the investment adviser sector" (89 FR 72156). Its exemptions for mid-sized, multi-state and zero-AUM advisers did cut the number of small RIAs in scope from 573 to 212.
To estimate your own figure, count three things on last year's activity: new investors or clients onboarded, legal-entity investors among them, and accounts or investors that would have produced an alert. Multiply each by the minutes your own staff take today, at your own loaded hourly cost, and add the fixed items in the table. The investor-file line is usually the largest, which is why it is the one worth automating first.
Can an adviser delegate AML to its fund administrator?
Yes, in whole or in part, but it keeps the liability. FinCEN will let an adviser hand the implementation and operation of part or all of its program to a third party, a fund administrator included, and the adviser stays fully responsible and legally liable for the program and must be able to show examiners that it complies (89 FR 72156).
The last clause is the one that costs money. An adviser whose administrator does every investor file must still be able to show the SEC, on request, what was checked, who decided and why. AML outsourcing to a fund administrator compares that duty with the UK and EU rules and lists what a delegation agreement should contain.
The file the adviser must be able to show: every decision, its evidence and who made it
Where Investor KYC/AML Onboarding fits the 2028 rule
The rule asks for a program; the program stands on investor files. Investor KYC/AML Onboarding produces those files: the Collector agent asks for documents, the Reader reads registers and deeds in their own language, the Ownership agent multiplies holdings through each layer, the Screening agent proposes a decision on every hit with its reasons, and the Risk agent rates the investor on the firm's own model. An analyst confirms, a second reviewer re-performs, and the MLRO or AML officer signs every high-risk investor.
It does not write the AML program, approve it, test it independently or file a suspicious activity report: those stay with the adviser's people, and the rule says so. What it changes is the evidence. Every percentage, screening decision and risk factor carries its source page, which is what an adviser needs when the administrator holds the documents and the SEC asks the adviser. To see an investor file end to end, start from Investor KYC/AML Onboarding, or read the go-live plan for a firm targeting January 2028.
Questions people ask
Who is covered by the FinCEN investment adviser AML rule?
SEC-registered investment advisers and exempt reporting advisers, except RIAs registered only as mid-sized, multi-state or pension-consultant advisers and those reporting no assets under management. State-registered advisers, foreign private advisers and family offices are outside it. FinCEN counted 14,073 RIAs and 5,846 ERAs in scope as of July 2023.
Do venture capital fund advisers have to comply?
Yes. Advisers that rely on the venture capital exemption are exempt reporting advisers, and no ERAs are exempt from the rule. Treasury's 2024 assessment specifically named venture funds as a route foreign states have used to reach early-stage technology companies.
Does the rule require advisers to verify investors' beneficial owners?
Not directly. The 2024 rule contains no customer identification or beneficial-ownership requirement; those were left to a joint SEC–FinCEN identification rule that was proposed in May 2024 and has not been finalised. The SEC's agenda lists the next proposal for July 2027.
What is the SAR threshold for investment advisers?
$5,000. From 2028, an adviser must report a transaction conducted or attempted by, at or through it that involves or aggregates at least $5,000 where it knows, suspects or has reason to suspect illicit funds, evasion, no apparent lawful purpose or use of the adviser to facilitate crime.
Do advisers to mutual funds need a separate program for them?
No. An adviser may deem the requirements satisfied for a mutual fund, a bank collective investment fund or another adviser it advises that is already subject to an AML program rule. The mutual fund's own program under 31 CFR 1024.210 continues to apply.
Is the April 2026 FinCEN program proposal part of the adviser rule?
No. FinCEN's April 2026 proposal to reform AML/CFT program rules covers banks, broker-dealers, mutual funds and other institutions, and says it does not amend the adviser rule. Its comment period closed on 9 June 2026, and it remains a proposal.