FinCEN Issues Final Rule Imposing Anti-Money Laundering Obligations on Certain Investment Advisers

Authors: Michael T. Gershberg (Washington, DC), Ashley Rodriguez (Washington, DC), Tyler Kaufman (New York)

On September 4, 2024, the U.S. Department of the Treasury's Financial Crimes Enforcement Network ("FinCEN") published a final rule (the "Final Rule") imposing certain anti-money laundering ("AML") requirements under the Bank Secrecy Act ("BSA") on certain SEC-registered investment advisers and exempt reporting advisers ("Covered Advisers"). Under the Final Rule, Covered Advisers will be required to, among other things: (1) maintain AML and countering the financing of terrorism ("CFT", collectively "AML/CFT") compliance programs designed to meet a set of minimum standards; (2) file reports such as Suspicious Activity Reports ("SARs") and Currency Transaction Reports ("CTRs") with FinCEN; (3) maintain certain records including those relating to the transmittal of funds; and (4) comply with special information-sharing procedures designed to deter money laundering and terrorist activity. The effective date for the Final Rule is January 1, 2026.

The Final Rule largely adopts the content proposed by FinCEN in February 2024 (the "Proposed Rule"). However, FinCEN has made several changes in response to public comments, including:

1. narrowing the definition of "investment advisers" to exclude mid-sized advisers, multi-state advisers, pension consultants, and RIAs that do not report any assets under management on Form ADV;
2. limiting applicability to foreign-located investment advisers to certain services with a U.S. nexus;
3. removing the requirement that the personnel responsible for implementing an AML/CFT program be located in the United States; and
4. permitting investment advisers to exclude from its AML/CFT program certain entities that are subject to the BSA or advised by investment advisers subject to the BSA.

The following is a summary of the Final Rule's requirements that also highlights certain changes from the Proposed Rule. FinCEN has also issued a fact sheet on the Final Rule.

Scope of Covered Advisers: The Final Rule updates the definition of "financial institution" under the BSA regulations to include the following investment advisers:

• SEC-registered investment advisers ("RIAs"), except for the following:
• RIAs who register with the SEC solely because they are (i) mid-sized advisers,[1] (ii) multi-state advisers;[2] or (iii) pension consultants;[3] and
• RIAs that do not report any assets under management ("AUM") on their Form ADV.
• Exempt reporting advisers ("ERAs").

With respect to Covered Advisers whose principal office and place of business is outside of the United States, the Final Rule will only apply to activities that (i) take place within the United States, including through involvement of U.S. personnel of the investment adviser,[4] such as the involvement of an agency, branch, or office within the United States, or (ii) involve the provision of services to a U.S. person (as defined in Regulation S under the Securities Act of 1933) or a foreign-located private fund with an investor that is a U.S. person.

This approach is a departure from the Proposed Rule, which would have included all registered investment advisers and exempt reporting advisers in the definition of "financial institution."

Implementing an AML/CFT Program: Under the Final Rule, Covered Advisers are required to implement an AML/CFT program that is reasonably designed to comply with BSA requirements using a risk-based approach. Such a program should take into account the characteristics of the Covered Adviser, including adviser size, complexity and the relative risk of illegal activity faced by its advisory business. At a minimum, an AML/CFT program must satisfy the following requirements:

1. Establish and implement internal policies, procedures, and controls reasonably designed to prevent the investment adviser from being used for money laundering, terrorist financing, or other illicit finance activities and to achieve compliance with the applicable provisions of the BSA and implementing regulations;
2. Provide for independent testing for compliance to be conducted by the investment adviser's personnel or by a qualified outside party;
3. Designate a person or persons responsible for implementing and monitoring the operations and internal controls of the program;
4. Provide ongoing training for appropriate persons; and
5. Implement appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to:
   
   
   1. Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and
   2. Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

The Final Rule makes several changes from the Proposed Rule. First, FinCEN declined to adopt the requirement that the duty to establish, maintain, and enforce the AML/CFT program remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by U.S. regulators. However, FinCEN stated in the release adopting the Final Rule that it continues to take this provision under advisement and may reconsider in the future. Second, Covered Advisers may exclude from their AML/CFT program mutual funds and collective investment funds sponsored by a bank or trust company subject to the BSA, in order to prevent duplication of efforts. Third, a Covered Adviser's subadvisor, wrap-fee program, separately managed account or other advisory relationships may also be excluded from its AML/CFT program if the customer is another investment adviser and the Covered Adviser does not have a direct contractual relationship with the underlying customer.

Notably, the Final Rule still permits Covered Advisers to contractually delegate the implementation and operation of many AML/CFT program functions to a third-party provider (including a service provider located outside of the United States), though the adviser will remain fully responsible and legally liable for ensuring that delegated functions comply with the Final Rule.

Recordkeeping and Travel Rules and Currency Transaction Reports: Currently, all investment advisers are required to file Form 8300 when transactions in currency and certain negotiable instruments equal or exceed $10,000.[5] The FinalRule will replace this requirement with a requirement for Covered Advisers to file CTRs and retain records for transmittals of currency greater than $10,000 through the Covered Adviser. Furthermore, Covered Advisers will have to comply with the BSA's existing Recordkeeping and Travel Rules,[6] which require financial institutions to retain records for, and ensure the transfer of, information on transmittals of funds equal to or greater than $3,000. Additionally, FinCEN clarified that in circumstances where a Covered Adviser's customer has a direct account relationship with a qualified custodian that is subject to AML/CFT requirements, such as a bank or broker-dealer, and requests that such qualified custodian initiate a funds transfer or transmittal of funds, the Covered Adviser would generally not be required to comply with the requirements of the Recordkeeping and Travel Rules.

Suspicious Activity Reports: Under the Final Rule, Covered Advisers -- like other financial institutions -- will be required to submit an SAR where the Covered Adviser knows, suspects, or has reason to suspect a possible violation of law or regulation. SARs are required to be filed within 30 days of the Covered Adviser detecting suspicious activity occurring by, at, or through the Covered Adviser. Copies of submitted SARs must be maintained by the Covered Adviser for five years and supporting documentation must be made available to (1) FinCEN, (2) any Federal, State, or local law enforcement agency and (3) any Federal regulatory authority, such as the SEC, that examines the Covered Adviser for compliance with the BSA. The Final Rule also provides safe harbor from civil liability relating to the submission of SARs for Covered Advisers and current or former directors of the Covered Adviser.

Information Sharing: The Final Rule will require each Covered Adviser, when requested by FinCEN, to search its records for specified information to determine whether it has maintained any accounts for or conducted any transactions with individuals, entities or organizations included in the request. In a departure from the Proposed Rule, the Final Rule will permit a Covered Adviser to exclude from these requirements customers that are mutual funds, certain collective investment funds and other Covered Advisers.

Compliance Date and Delegation of Examination Authority to the SEC: Covered Advisers have until January 1, 2026 to comply with the Final Rule, which is notably later than the Proposed Rule's compliance window of 12 months. FinCEN's Final Rule will also grant the SEC authority to examine Covered Advisers for compliance with FinCEN's regulations implementing the BSA, noting the prior delegation of such examinations to the SEC and the SEC's expertise in the regulation of investment advisers.

Key Takeaways and Next Steps: All RIAs and ERAs should carefully review the Final Rule to determine whether they will be required to comply. Covered Advisers should coordinate with compliance personnel and counsel to begin developing a risk-based AML/CFT compliance program, including procedures to monitor for and report suspicious activity. It may take significant time and effort to fully implement such a program, including conducting a risk assessment, developing internal policies, procedures and controls reasonably designed to comply with such requirements, assigning relevant personnel, commencing training, delegating and/or coordinating with various service providers, and conducting ongoing customer due diligence. Therefore, Covered Advisers should begin this process soon, and in any event well before the January 1, 2026 compliance date, when FinCEN and the SEC will begin enforcing these requirements. Although the Final Rule does not require maintenance of a customer identification program, that topic is the subject of a separate proposed rule that is likely to take effect around the same time as the Final Rule's compliance date.

This communication is for general information only. It is not intended, nor should it be relied upon, as legal advice. In some jurisdictions, this may be considered attorney advertising. Please refer to the firm's data policy page for further information.