Fintech Focus: Investment Advisers Join Ranks of Financial Institutions Subject to the Bank Secrecy Act

Key Expectations:

• • Not only registered investment advisers but also “exempt reporting advisers” (all “Covered Investment Advisers”) will become subject to the BSA through the expediency of an amendment to the definition of included “financial institution.” Starting on January 1, 2026, Covered Investment Advisers will be required to:
    • • Designate an AML/CFT compliance officer;
      • Implement a reasonable, risk-based AML compliance program with corresponding policies, procedures, training, and controls;
      • Implement due-diligence controls for correspondent and private banking accounts and risk-based ongoing customer due diligence;
      • File suspicious activity reports (“SARs”) and currency transaction reports (“CTRs”) with FinCEN;
      • Comply with the Recordkeeping and Travel Rules; and
      • Fulfill § 314(a) and (b) information-sharing obligations.

• • In addition, Covered Investment Advisers can now expect to be subject to the SEC’s oversight and examination, delegated by FinCEN, in connection with these BSA obligations.

Changes to Note from Proposed to Final Rule:

While the final rule was largely adopted as proposed, there are some key differences from the proposal, as outlined below:

• • Definition of “investment adviser”: The final rule narrowed the definition of “investment adviser” from the proposal to exclude both:
    • • RIAs that register with the SEC solely because they are (i) mid-sized advisers, (ii) multi-state advisers, or (iii) pension consultants; and
      • RIAs that are not required to report any assets under management (“AUM”) to the SEC on Form ADV. Note the narrowness of this change, and that it does not eliminate so‑called “exempt reporting advisers,” who remain subject to the rule.

While the final rule maintained the proposed rule’s exclusion of (1) state-registered advisers, (2) foreign private advisers, and (3) family offices, FinCEN noted that these exclusions may not be permanent and that FinCEN will continue to assess and take appropriate measures as needed.

• • Expectations of “foreign-located investment advisers”: For “foreign-located investment advisers,” the final rule continues to apply but more narrowly than as proposed. Under the final rule, the BSA rules apply only to foreign-located advisers’ activities that (i) take place within the United States, including through the involvement of US personnel of the investment adviser, or (ii) provide advisory services to a US person or a foreign-located private fund with an investor that is a US person.
  • Exclusion of Mutual Funds and Certain Other Customers from the AML/CFT Program Requirements: The final rule continues to allow Covered Investment Advisers to exclude from these rules mutual funds advised by that Covered Investment Adviser, and helpfully explained that an investment adviser can “categorically exclude any mutual fund from [its] AML/CFT program requirements without [verifying] that [the] mutual fund has implemented an AML/CFT program.” Adopting Release at 72156. The final rule also expanded this customer exclusion to bank- and trust company-sponsored collective investment funds, and any other investment adviser subject to 12 CFR 9.18 that is advised by the Covered Investment Adviser.

Note that the exclusion of mutual funds and these other specific categories of advisee extends to the requirements of Sections 314(a) (information requests), 314(b) (information sharing), and Sections 311 and 312 (special due diligence and special measures of the Patriot Act).

• • US Oversight and Presence Requirement: The final rule did not ultimately adopt the provision which requires that financial institutions “establish, maintain, and enforce [an] AML/CFT program that is the responsibility of, and must be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator.” Adopting Release at 72156.
  • Amendments to the 2020 AML Act: The final rule does not implement the proposed amendments to the 2020 AML Act announced on June 28, 2024, which, among other things, codified the requirement for financial institutions to establish and enforce a risk-based AML program, including perform periodic risk assessments and reviewing and incorporating government-wide AML/CFT priorities, as appropriate, into their risk-based programs. However, if adopted, investment advisers would be subject to the final rule.

Dual Registrants and Investment Advisers Affiliated with Financial Institutions

FinCEN has expressly stated that Investment advisers that are also dual registrants (broker-dealer or bank) and/or affiliated with financial institutions that have an existing AML/CFT program do not have to establish a separate program. Instead, they can leverage existing programs, provided the program is comprehensive and covers all of the investment adviser’s relevant activities including the different risks posed by the different aspects of the entities business and activities such that the financial institution satisfies its AML/CFT obligations as an investment adviser, as a broker-dealer, and/or as a bank.

Potential Pitfalls for Newly Regulated Entities

As investment advisers start or improve existing BSA compliance programs, the following considerations should be kept in mind, as they are often the subject of AML enforcement actions:

1. 1. Third-party oversight may be harder than you think. To the extent that investment advisers plan to utilize or rely upon affiliates, vendors, or other third-party entities for customer onboarding or transaction monitoring, they should be prepared to build (or reinforce) their own oversight controls. Policies and procedures detailing due-diligence requirements, ongoing information and data sharing, and clearly defined provisions for terminating contractual relationships in the event of non-compliance are the minimum best practices in an area that regulators are keenly focused on.
   2. Integrate compliance systems to recognize shared attributes. A persistent challenge for existing AML programs, across different types of financial institutions, is the ability to recognize shared attributes amongst customer populations. Accordingly, know your customer (“KYC”) and enhanced due diligence (“EDD”) data should not be siloed, but rather integrated into compliance systems that are able to holistically address that data and the associated risk. This specific issue can present challenges where a financial institution has been operating as a dual registrant with a siloed investment advisory arm.
   3. Beneficial ownership requirements are on the way. As we noted in our earlier alert, FinCEN has not yet applied a customer identification program (“CIP”) requirement to collect beneficial ownership information for legal entity customers. FinCEN continues to review that issue and we expect this to be addressed in future rulemaking efforts. Therefore, in building out their compliance systems for the finalized rule investment advisers would do well to design compliance programs that are ready to adapt to CIP requirements in the future.

Addressing these challenges takes planning, a keen awareness of regulator expectations, and familiarity with industry best (and worst) practices. We’re here to help.