Investor KYC (know your customer) is the due diligence a fund, its manager or its administrator does on each investor before accepting a subscription: identify the investor, verify that identity, trace its owners through holding companies and trusts to the people behind them, screen every party against sanctions lists, politically exposed person (PEP) data and adverse media, and rate the money-laundering risk. It is hard because the same word covers different legal duties: a US mutual fund has run an AML program since 2002, a US private fund adviser has no binding rule until 1 January 2028, and EU and UK funds follow their own thresholds and trust rules. Botminds' Investor KYC/AML Onboarding exists for that work: seven agents collect, read, unfold, screen and rate each investor file under the firm's own rules, and people decide.
The examples come from a fictional sample firm, Quillfield Capital, as its files run through the solution; Quillfield, its funds, its investors and the people named are sample data. The rules and figures come from regulators, linked where they appear.
Investor KYC by vehicle: five rulebooks, three answers to who the customer is
US mutual fund
Rule and dateAML program, 31 CFR 1024.210, since July 2002; identification program, 31 CFR 1024.220; beneficial owners, 31 CFR 1010.230, since May 2018.
Who is the customerThe shareholder who opens the account. A broker regulated by a federal functional regulator is not a customer, so an omnibus account points the duty at the broker.
Owner threshold25% or more of the equity, plus one control person. A trust at 25% means the trustee.
US private fund, SEC-registered or exempt reporting adviser
Rule and dateFinCEN’s adviser AML rule (31 CFR 1032), effective 1 January 2028. No identification program yet: the SEC’s agenda lists the next proposal for July 2027.
Who is the customerTypically the private fund itself, not the investors in it, as FinCEN reads the rule.
Owner thresholdThe 2028 rule carries no beneficial-ownership requirement of its own.
EU fund (UCITS or AIF) and its manager
Rule and dateRegulation (EU) 2024/1624, the AML Regulation, applying from 10 July 2027; national laws under the directives until then.
Who is the customerThe investor, with funds and their managers named as obliged entities.
Owner threshold25% or more of shares, votes or other ownership interest, multiplied through every layer of the chain.
UK fund manager
Rule and dateMoney Laundering Regulations 2017, as amended in 2026.
Who is the customerThe investor, verified under regulation 28.
Owner thresholdMore than 25% of shares or votes; for a trust, settlor, trustees, beneficiaries and anyone who controls it.
Offshore fund with an administrator
Rule and dateThe fund’s home law, usually applied by the administrator, plus every sanctions regime that reaches the parties.
Who is the customerThe investor, as the fund’s home law defines it.
Owner thresholdAs the home law sets it. Treasury warns that reliance on intermediaries’ assurances is routine.
What is investor KYC, and what does a complete file prove?
A complete investor KYC file proves four things: that the investor exists and is who it says, who ultimately owns and controls it, that no party in the chain is sanctioned or unexplained, and that the firm has rated the risk and applied the scrutiny the rating demands. The rest of the file is evidence for those four conclusions.
The US mutual fund rule shows the minimum. Before opening an account, a fund must obtain a name, a date of birth for an individual, an address and an identification number, and then verify identity within a reasonable time, using documents, non-documentary checks or both, so that the fund can form a reasonable belief it knows who the customer truly is (31 CFR 1024.220(a)(2)). For an entity, the documents are the ones that show it exists: certified articles, a business licence, a partnership agreement or a trust instrument.
Owners come next. For a legal entity, the US rule requires each individual who owns 25 percent or more of the equity, directly or indirectly, plus a single person with significant responsibility to control, manage or direct it (31 CFR 1010.230(d)). Up to four owners and one controller; the controller is always required, even when no one reaches 25%. Then come screening, a risk rating, and for higher-risk investors enhanced due diligence and a senior sign-off. The investor due diligence checklist lays out every item a file needs and the evidence that proves it.
Which rulebook applies? Investor KYC depends on the vehicle, not the investor
The vehicle decides the rule, so the first question on any new fund is which regime its investor KYC sits in. The same Danish family holding company subscribing to a US mutual fund, a Cayman feeder and a Luxembourg partnership meets three different sets of questions, because each fund answers to a different regulator.
Mutual funds were brought into the US anti-money-laundering regime early, which is why Treasury describes the roughly $22 trillion they manage as already "subject to AML/CFT obligations under the BSA and its implementing regulations" (Treasury, 2024 Investment Adviser Risk Assessment). Private funds are the gap. The same report counts about 43,500 private funds holding about $20 trillion at the end of 2022, and finds that only half of the private funds US advisers run are domiciled in the United States.
Where the investor money sits, and which of it a US AML rule already reaches
$22T
managed by US mutual funds, already under Bank Secrecy Act obligations
$20T
in about 43,500 private funds at the end of 2022, with no comprehensive AML rule
47%
of private funds advised by RIAs domiciled abroad
32%
domiciled in the Cayman Islands alone
Europe is converging on one text. The EU's AML Regulation names funds and their managers among the obliged entities and, from 10 July 2027, replaces national transpositions with a single rule that applies directly (Regulation (EU) 2024/1624). Its ownership test is 25% or more, and indirect ownership is calculated by multiplying the holdings at each layer of the chain and adding the paths together.
The UK sets its line a step higher. Under regulation 5 of the Money Laundering Regulations, a beneficial owner of a company holds more than 25% of the shares or votes, or exercises ultimate control (MLR 2017, reg. 5). Regulation 28 adds a rule that matters on every cross-border file: a firm does not meet its duty to identify beneficial owners by relying solely on what a company registered with the registrar (reg. 28(9)). A register is a source to check, not a substitute for checking.
Is a hedge fund required to do KYC on its investors?
In the United States, not yet under a federal AML program rule: FinCEN's rule for SEC-registered and exempt reporting advisers was delayed by a final rule of January 2026 and now takes effect on 1 January 2028 (FinCEN, 91 FR 36). In practice hedge funds and private equity funds still run investor KYC, for two reasons that already bind them.
The first is sanctions. OFAC's rules apply to every US person today, with no exemption for a fund that has no AML program. OFAC imposed its statutory maximum, $215,988,868, on GVA Capital, a venture firm that kept managing a sanctioned oligarch's investment after his designation by dealing through a relative it knew acted for him (OFAC, June 12, 2025). How proxy owners hide behind the owner on paper works through that case step by step.
The second is the administrator. Many offshore funds are administered where the fund's home law requires investor due diligence, and the administrator applies it on the fund's behalf. What Treasury found missing is consistency, not activity: private funds "may accept investors without knowing the ultimate beneficial owners or sources of funds," and in many offshore jurisdictions it is "routine practice to rely on representations and warranties from intermediaries who represent investors" (Treasury, 2024).
Is the investor or the fund the customer?
It depends on whose rule is being applied, and the answer decides who must hold the investor file. Under the mutual fund rules, the shareholder who opens the account is the customer. Under FinCEN's adviser rule, the adviser's customer is usually the fund it manages.
“In the private fund context, the adviser’s customer is typically the private fund itself, and not underlying investors in that private fund.”
FinCEN, final adviser AML rule, 89 FR 72156 (September 4, 2024), note 45
FinCEN added that in many cases an adviser has a relationship with the underlying investors, sometimes a contractual one, and access to information about them; the SEC already asks advisers on Form ADV roughly how many beneficial owners each private fund has. Read together, the rule puts the investor file at the fund level, which in a private fund usually means with the administrator, while the adviser answers for the program. That split is the subject of AML outsourcing to a fund administrator.
The mutual fund rules carve the customer more finely. A financial institution regulated by a federal functional regulator is not a customer, so a broker-dealer's omnibus account is the broker's own identification problem, not the fund's (31 CFR 1024.100(c)). An existing shareholder whose identity the fund already reasonably believes it knows needs no new identification, and an account opened to take part in an ERISA employee benefit plan is not an "account" for the identification rule at all.
Do mutual funds have to do KYC?
Yes. A US mutual fund must run a written, board-approved AML program, a customer identification program inside it, beneficial-ownership checks on legal entity shareholders and suspicious activity reporting, all under 31 CFR Part 1024 and 1010.230. The work itself is usually done by the fund's transfer agent.
Two details trip up readers who come to this from banking. First, the 2016 beneficial-ownership rule applies only to accounts opened on or after its May 2018 applicability date, and since FinCEN's February 2026 order a fund may identify a legal entity's owners when it first opens an account rather than at each new one, unless doubts or its own risk-based procedures call for more (what the February 2026 relief changed). Second, many fund shareholders reach the fund through intermediaries, and for those the identification duty sits with the intermediary. Mutual fund AML requirements in plain words takes each part of the rule in turn.
Many searches for "KYC for mutual funds" are about retail fund KYC outside the United States, which follows other national rules. Everything on this page is the US, EU and UK regime for funds and their managers.
What documents are needed for investor KYC?
The documents follow the investor type, and the file should say which rule asked for each one. A list that asks a pension plan for a passport, or a trust for a certificate of incorporation, wastes a week and tells the investor the fund does not understand it.
Investor KYC documents by investor type, and what each one proves
- Individual
Government-issued photo ID; proof of residential address; a tax identification number (or passport number and country for a non-US person). Proves identity and residence.
- Company
Registry extract or certified articles; register of shareholders or a beneficial-owner certification; list of directors and an authorised signatory list. Proves existence, owners and who may act.
- Trust
The trust deed (or the parts naming settlor, trustees, beneficiaries and protector); trustee certificate; IDs of the people the deed names. Under UK rules each of those roles is a beneficial owner.
- Foundation
Charter and by-laws, the founder, council members and beneficiaries or the class of beneficiaries. Treated like a trust under UK and EU rules.
- Pension plan or endowment
Constitution or statute, the regulator’s authorisation, the board resolution approving the investment, authorised signatories. Owners matter less; authority matters more.
- Fund investing in a fund
Evidence of the investing fund’s regulated status, its manager or adviser, and in some regimes a reliance or comfort letter on its own investor checks.
- Every investor
Tax self-certification (W-9, W-8BEN-E or a CRS form), the subscription agreement, source of funds for the subscription and, for higher risk, source of wealth.
Source of wealth is the document set that most often stalls a file, and it has its own logic: where the investor's money came from over a lifetime, as distinct from where this subscription's cash came from. Source of wealth vs source of funds separates the two questions. Pension plans are the opposite case, the low-risk investor whose file still has to prove the plan is real, covered in KYC for pension funds.
Who does the KYC: the fund, the adviser or the administrator?
Usually the administrator or transfer agent does the work, the fund or its manager owns the result, and the legal duty sits with whichever of them a rule names. Treasury describes fund administrators handling subscriptions and redemptions, and notes that many run investor due diligence on the fund's behalf, some because the fund's home law requires it and some voluntarily. How those seats wait on one another before a close is mapped in the investor onboarding process.
Who does investor KYC, and who answers for it
Who does the work: The transfer agent, under contract with the fund; intermediaries for accounts they hold.
Who answers for it: The fund, whose board approves the AML program in writing.
Who does the work: Often the fund administrator, under a delegation the adviser documents.
Who answers for it: The adviser, which FinCEN says remains fully responsible and legally liable.
Who does the work: The manager, or a service provider the manager has notified to its supervisor.
Who answers for it: The obliged entity, which remains fully liable for outsourced tasks.
Who does the work: The manager, or a third party it relies on under regulation 39.
Who answers for it: The manager, which remains liable for any failure to apply the measures.
The pattern is the same in all four regimes: the work can move, the accountability cannot. That is why a manager whose administrator holds every investor document still needs to see each decision, its evidence and who made it. An investor that looks routine to an administrator processing a thousand subscriptions can be the one investor a manager's own MLRO would have stopped.
One investor KYC file, from registry extract to the 31% owner
Take one sample file as it runs through Investor KYC/AML Onboarding. Nordhavn Holding ApS, a Danish family holding company, commits €40,000,000 to Quillfield's fictional infrastructure fund ahead of a first close on 20 November 2026. Its file arrives with 12 documents in four languages: Danish and Luxembourg registry extracts, a Jersey trust deed, IDs and a source-of-wealth letter.
The Reader agent reads the Danish CVR extract beside its English and pins each field to its page. The Ownership agent multiplies through the chain: Nordhavn is wholly owned by a Luxembourg company, which is 62% owned by a Jersey trust and 38% by one individual, and the trust deed gives two beneficiaries fixed halves, so each holds 31%, or 62% × 50%. Nine nodes in all, three owners above 25% and four controllers.
The ownership chain unfolded, every percentage multiplied through each layer
Then the file catches what a register cannot. The Danish beneficial-owner register lists one beneficiary through the trust but leaves the other out, though the trust deed and the Luxembourg register both show her at 31%. She is also the spouse of a Portuguese government official, which makes her a PEP family member and the file high risk. The UK rule against relying solely on the Companies House register exists for exactly this case, and the same caution applies to any national register: the deed is the stronger evidence.
A Danish registry extract, read beside its English, each field pinned to its page
Where Investor KYC/AML Onboarding fits, and where it does not
Investor KYC/AML Onboarding does the reading, unfolding, screening and rating that fill an analyst's week, and keeps the decisions with people: the analyst confirms each owner, a second reviewer re-performs the file, the MLRO signs every high-risk investor, and Investor Operations releases the account. It works under whichever rulebook the fund sits in, because thresholds, document rules and review cycles are the firm's settings, not ours.
It does not replace the sanctions list provider, the registry gateways or the transfer agency system; it reads from them. It does not decide which regime a fund is in; that is a legal judgment the firm makes once and writes into its rules. And it does not make an investor low risk by finishing quickly: the sample high-risk file above still took ten business days from receipt to signature. The investment adviser AML rule explains why 2028 is the date most private fund managers are planning toward. To see the files themselves, start from Investor KYC/AML Onboarding.
Questions people ask
What does investor KYC mean?
It means knowing your investor: identifying and verifying the person or entity subscribing to a fund, finding the individuals who own or control it, screening them for sanctions, PEP status and adverse media, and rating the money-laundering risk. In US mutual funds this is set by 31 CFR 1024.220 and 1010.230; elsewhere by the fund's home regime.
What is KYC for private equity funds?
The same file as for any fund investor, done at subscription and again whenever an interest is transferred or circumstances change. US private equity advisers face FinCEN's AML rule from 1 January 2028, but OFAC sanctions apply now, and most offshore administrators already require investor due diligence under their own law.
Does a fund have to verify the investors of an investing fund?
Not always. Under the US beneficial-ownership rule, an SEC-registered investment company and a pooled vehicle advised by an excluded institution such as an SEC-registered adviser are not "legal entity customers" at all, and a pooled vehicle advised by a non-excluded institution needs only its control person identified. Other regimes ask for a reliance or comfort letter instead.
Is the 25% threshold the same everywhere?
No. The US rule and the EU AML Regulation use 25% or more; the UK regulations use more than 25%. A holding of exactly 25% is therefore a beneficial owner in Washington and Brussels but not in London, which is why the file should show the percentage, not just a yes or no.
When does the EU AML Regulation apply to funds?
From 10 July 2027, directly in every member state, to funds and their managers among other obliged entities. Until then, national laws transposing the AML directives apply. The Regulation also caps how long a file may go without updating: one year for higher-risk customers and five years for the rest.