Mutual fund AML requirements are the duties FinCEN places on every SEC-registered open-end fund under the Bank Secrecy Act: a written anti-money-laundering program approved by the fund's board (31 CFR 1024.210), a customer identification program that verifies each new shareholder (1024.220), identification of the beneficial owners of legal-entity shareholders at 25% (1010.230), suspicious activity reports on transactions of $5,000 or more (1024.320), and the recordkeeping, currency reporting and information-sharing rules around them. They are hard to run because the fund rarely does the work itself: a transfer agent opens the accounts, intermediaries hold many of them, and the fund's evidence lives in other firms' systems. Botminds' Investor KYC/AML Onboarding does the investor-file part of that work, from identification to the risk rating, with each step cited and each decision made by a person.
The rule text below is the current eCFR text; examples of a working file come from Quillfield Capital, a fictional sample firm, and its fictional investors.
The mutual fund CIP rule as a sequence, and who does each step in Investor KYC/AML Onboarding
A person decides
Give noticeBefore the account opens, tell the customer the fund will ask for identifying information, on the application, the website or orally (1024.220(a)(5)).
Agent
CollectName, date of birth, address and identification number before opening; for an entity, a principal place of business (1024.220(a)(2)(i)).
Never: Never asks for more than the document rules require.
Agent
VerifyDocuments, non-documentary checks or both, within a reasonable time after opening; for an entity, documents showing it exists (1024.220(a)(2)(ii)).
Never: Never accepts a document as verified: a person does.
Agent
Compare with government listsCheck designated lists of known or suspected terrorists within a reasonable time, and follow any directive issued with a list (1024.220(a)(4)).
Agent
Identify ownersFor a legal-entity shareholder, each individual with 25% or more and one control person; verify on a risk basis (1010.230).
A person decides
Decide when identity cannot be verifiedDo not open, restrict use while verifying, file a suspicious activity report or close, as the written procedures say (1024.220(a)(2)(iii)).
A person decides
Keep and monitorKeep the identifying data five years after the account closes; build a risk profile and monitor on a risk basis (1024.220(a)(3), 1024.210(b)(5)).
What are the AML requirements for mutual funds?
Four duties carry most of the weight: the program, identification, beneficial owners and suspicious activity reports. Around them sit currency transaction reports on cash over $10,000 (31 CFR 1010.311), recordkeeping, FinCEN's information-sharing requests and special due diligence on correspondent and private banking accounts, each in its own subpart of Part 1024.
The program is the frame for the rest. Since 24 July 2002 each mutual fund must have a written program "reasonably designed to prevent the mutual fund from being used for money laundering or the financing of terrorist activities," approved in writing by its board of directors or trustees and available to the SEC for inspection (31 CFR 1024.210(a)). Since 2018 the program has had five required elements, the fifth being ongoing customer due diligence.
What 31 CFR 1024.210 requires of every mutual fund's AML program
- Written and board-approved
Approved in writing by the board of directors or trustees, and available to the SEC for inspection.
- Policies, procedures and internal controls
Reasonably designed to prevent the fund being used for money laundering or terrorist financing, and to achieve compliance with the Bank Secrecy Act.
- Independent testing
By the fund’s own personnel or a qualified outside party.
- A designated person
One or more people responsible for implementing and monitoring the program’s operations and internal controls.
- Ongoing training
For appropriate persons, which can include staff at the transfer agent who open and service accounts.
- Ongoing customer due diligence
Understand the nature and purpose of each relationship to build a risk profile; monitor to report suspicious transactions; on a risk basis, keep customer information, including beneficial owners, up to date.
What is 31 CFR 1024?
31 CFR Part 1024 is FinCEN's chapter of rules for mutual funds, one of the industry-specific parts that sit beside the general rules in Part 1010. It has six subparts: definitions (1024.100), programs (1024.200 to 1024.220), reports (1024.300 to 1024.320), records (1024.400 and 1024.410), information sharing (1024.500 to 1024.540) and special due diligence for correspondent and private banking accounts (1024.600 to 1024.630) (eCFR, Part 1024).
Several of its sections do little more than point to Part 1010, which is why searchers land on numbers such as 1024.311 or 1024.520 and find a one-line cross-reference. The beneficial-ownership rule that governs legal-entity shareholders is not in Part 1024 at all: it is 31 CFR 1010.230, shared with banks and broker-dealers.
What is the mutual fund CIP rule?
It is the requirement in 31 CFR 1024.220 that every mutual fund run a written customer identification program, appropriate to its size and business, that lets it form a reasonable belief it knows the true identity of each customer. The procedures must be risk-based: they must reflect how accounts are opened, how shares are distributed, how purchases, sales and exchanges are effected, and who the fund's customers are.
The rule allows three methods of verification and says when to use which. Documents, such as an unexpired government photo ID for an individual or certified articles, a licence, a partnership agreement or a trust instrument for an entity; non-documentary methods, such as comparing what the customer gave with a consumer reporting agency or public database; or both. The non-documentary procedures must cover the hard cases: an individual without photo ID, a document the fund does not recognise, an account opened without documents or without the customer appearing in person (31 CFR 1024.220(a)(2)(ii)).
For an entity the fund cannot verify by those means, the rule adds one more step: obtain information about the individuals with authority or control over the account, including those who may transact in it. That is not the beneficial-ownership rule; it is a fallback inside identification, and it applies only when documents and non-documentary checks have not been enough.
Who is the customer in an omnibus account?
The intermediary is, and only if it is not itself a regulated financial institution. Under 31 CFR 1024.100(c), a "customer" is a person who opens a new account, or an individual who opens one for someone who lacks legal capacity or for an entity that is not a legal person; it excludes a financial institution regulated by a federal functional regulator and a state-regulated bank. A broker-dealer's omnibus account therefore falls outside the fund's identification program, and the broker's own rules govern its customers.
Who the mutual fund rules treat as the customer, case by case
| Who opens the account | Customer for CIP? | What it means for the file |
|---|---|---|
| An individual shareholder | Yes | Full identification and verification under 1024.220. |
| An adult for a minor, or for a club with no legal personality | Yes, the adult | Identify the individual opening it; the minor or the club is not the customer. |
| A broker-dealer or bank, for an omnibus account | No, if regulated by a federal functional regulator or a state bank regulator | The intermediary verifies its own customers; the fund manages the intermediary relationship and its risk. |
| An existing shareholder | No, if the fund reasonably believes it knows the person | No new identification for a further account; keep the earlier evidence. |
| An account acquired in a merger or asset purchase | Not an "account" for CIP | No identification at the acquisition; ongoing due diligence still applies. |
| An account opened to take part in an ERISA employee benefit plan | Not an "account" for CIP | Accounts opened for plan participation are outside the identification rule; the program and reporting duties still apply. |
| A company, partnership or LLC | Yes, plus its beneficial owners unless excluded | Identify each 25% owner and one control person under 1010.230. |
The omnibus exclusion moves the identification duty, not the risk. A fund whose shareholders mostly arrive through intermediaries still has to understand those relationships, monitor them and report suspicious activity it sees. That is where the ongoing due diligence element of 1024.210 does its work.
When must a mutual fund identify beneficial owners?
When a legal-entity customer first opens an account, and again when facts call the earlier answer into question or the fund's risk-based procedures require it. That is the position since FinCEN's exceptive relief of 13 February 2026, which lets covered financial institutions, a group that includes mutual funds, stop re-identifying owners at every new account (FinCEN, FIN-2026-R001). Before the relief, the 2016 rule required it whenever a new account was opened, account by account.
The test itself has not changed. Each individual who, directly or indirectly, owns 25 percent or more of the equity is a beneficial owner, up to four of them, plus one individual with significant responsibility to control, manage or direct the entity; where a trust holds 25%, the trustee is the owner (31 CFR 1010.230(d)). Verification of the owners is risk-based and must include at least the same elements as identity verification for individuals under the fund's identification program.
Many fund investors are not "legal entity customers" at all. The rule excludes registered investment companies, SEC-registered advisers, listed issuers, state-regulated insurers, regulated banks and some others, and pooled vehicles advised by an excluded institution. A pooled vehicle advised by a non-excluded institution, and a filed nonprofit, need only the control person. The February 2026 relief, scenario by scenario is worked through on the bank side, where the rule's text is the same.
A document checklist built from the rules for one investor type, and a reminder waiting for approval
When does a mutual fund file a SAR?
Within 30 calendar days of first detecting facts that may require one, for any transaction conducted or attempted by, at or through the fund that involves or aggregates at least $5,000 and that the fund knows, suspects or has reason to suspect involves illicit funds, is designed to evade reporting, has no apparent lawful purpose, or uses the fund to facilitate crime. If no suspect has been identified, the fund may take 30 more days to find one, but never more than 60 in all (31 CFR 1024.320(b)(3)).
The mutual fund SAR clock: 30 days, or 60 when the suspect is unknown
- Investigate and write the report30 d
- Find the suspect30 d
- Then file30 d
Three details shape how a fund group works. More than one fund, or a fund and its broker, may share a reportable transaction; one joint report is enough if it names each institution and says "joint filing" in the narrative. A SAR and anything that would reveal one are confidential, though sharing within the fund's own organisational structure is permitted for BSA purposes. And the fund keeps each report and its supporting documents for five years from filing, deemed filed with the report.
The numbers a mutual fund AML program is built around
$5,000
suspicious activity reporting threshold, per transaction or in aggregate
$10,000
cash transaction reporting threshold
25%
beneficial ownership threshold, plus one control person
5years
identifying data kept after an account closes; reports and verification evidence kept from when made
Can a mutual fund rely on another financial institution for CIP?
Yes, under three conditions in 31 CFR 1024.220(a)(6): the reliance is reasonable in the circumstances, the other institution is subject to an AML program rule under 31 U.S.C. 5318(h) and regulated by a federal functional regulator, and it signs a contract requiring it to certify every year that it has implemented its AML program and will perform the specified parts of the fund's procedures. The beneficial-ownership rule has a matching reliance clause (1010.230(j)).
A transfer agent usually does not meet the second condition, because transfer agents are not among the institutions FinCEN lists as having AML program rules of their own (FinCEN, 91 FR 18704). On the rule's text, then, a fund that has its transfer agent run identification is using an agent, not relying on another institution, and stays responsible for how the work is done. The SEC describes transfer agents acting as administrators and service providers for funds and calculating the prices at which investors buy and sell (SEC transfer agent proposal, September 2026), which is why a fund's AML evidence so often sits in the transfer agent's systems.
The practical test is whether the fund can produce, for any shareholder, what was collected, how it was verified, how any discrepancy was resolved and who decided. The identification rule spells out those four items as the minimum to keep: the identifying information, a description of each document relied on, the methods and results of non-documentary checks, and the resolution of each substantive discrepancy (1024.220(a)(3)). AML outsourcing to an administrator covers the same question for private funds and for the UK and EU rules.
What FinCEN's 2026 program proposal would change for mutual funds
It is a proposal, published on 10 April 2026 with comments closed on 9 June 2026, and it would rewrite 1024.210 in the same shape as every other program rule (91 FR 18704). Three changes matter most for a fund's investor files.
First, a documented risk assessment that evaluates products, services, distribution channels, customers and geography, incorporates FinCEN's national AML/CFT priorities and is updated promptly when risks change. Second, an explicit instruction to direct more attention and resources to higher-risk customers and activities, and less to lower-risk ones. Third, the designated AML/CFT individual would have to be located in the United States and accessible to FinCEN. Until a final rule is published, the current 1024.210 applies.
The second change is the one investor KYC teams should plan for. A program that spends the same hours on a state pension plan as on a family holding company with a foreign trust in its chain would be harder to defend under the proposed text than under today's, and the risk rating becomes the document that justifies where the time went.
Where Investor KYC/AML Onboarding fits a mutual fund's program
The program, its board approval, its independent test and every suspicious activity report stay with the fund and its people. Investor KYC/AML Onboarding takes the file work beneath them: the Collector agent builds the document list for each investor type from the fund's rules and drafts reminders for a person to approve, the Reader agent reads registry extracts and deeds and pins each field to its page, the Ownership agent applies the 25% test through every layer, the Screening agent screens every party, and the Risk agent proposes a rating that a person confirms.
Because each step carries its evidence, a fund can answer the identification rule's four record-keeping questions for any shareholder, and the Refresh agent keeps legal-entity files current on trigger events rather than at every new account, which is what the February 2026 relief now permits. The same files work for the sample firm's private funds. Investor KYC by vehicle shows how the rules differ, and the solution page shows one file end to end.
Ongoing due diligence on trigger events, with only the change re-collected
Questions people ask
Do mutual funds have to verify every shareholder?
Every customer who opens a new account, yes, but the definition excludes regulated financial institutions, so shareholders who hold through a broker's omnibus account are verified by the broker, not the fund. Accounts acquired in a merger and accounts opened to participate in an ERISA plan are also outside the identification rule.
Is a mutual fund's AML program approved by the board?
Yes. 31 CFR 1024.210(a) requires the program to be approved in writing by the fund's board of directors or trustees and made available to the SEC for inspection. The board approves the program; day-to-day operation sits with the designated person or persons.
How long must a mutual fund keep CIP records?
Five years after the account closes for the identifying information, and five years from when they are made for the description of documents relied on, the verification methods and results, and the resolution of discrepancies. SARs and their supporting documents are kept five years from filing.
Does a mutual fund have to check OFAC lists?
The identification rule requires a check against government lists of known or suspected terrorists designated by Treasury, within a reasonable time after opening. OFAC sanctions apply separately to every US person, including funds and transfer agents, so a fund's screening needs to cover OFAC's lists as well.
Can a mutual fund open an account before verification is complete?
Yes, if its procedures allow. Identifying information must be obtained before opening, but verification may follow within a reasonable time, and the procedures must say on what terms the customer may use the account meanwhile and when to close it if verification fails.