On August 28, 2024, FinCEN issued a final rule adding certain investment advisers to the definition of “financial institution” under the Bank Secrecy Act. It is the largest expansion of AML obligations into the advisory industry to date — and after a postponement announced in 2025, the compliance date is now January 1, 2028. That date is further away than it feels, because the rule asks advisers to build programs most have never had to run.
Who is covered
The rule covers SEC-registered investment advisers (RIAs) and exempt reporting advisers (ERAs) — the latter meaning advisers to only private funds with under $150 million in assets under management, or advisers to only venture capital funds. It carves out RIAs registered solely as mid-sized advisers, multi-state advisers, or pension consultants, along with firms not required to report AUM on Form ADV. If your firm reports to the SEC as an RIA or files as an ERA, the working assumption should be that you are in scope until your counsel tells you otherwise.
Who may be covered?
- 1
Is the firm an SEC-registered investment adviser (RIA) or an exempt reporting adviser (ERA)?
Yes — Continue — potentially in scope.
No — The rule’s adviser definition does not reach the firm.
- 2
Is it registered solely as a mid-sized, multi-state, or pension-consultant adviser — or not required to report AUM on Form ADV?
Yes — Carved out of the rule.
No — Working assumption: in scope until counsel says otherwise.
Illustrative, not legal advice — the rule includes carve-outs and definitions this diagram simplifies. Confirm your firm’s status with counsel.
What the rule requires
- A written, risk-based AML/CFT program approved by the board (or equivalent general partner or trustee): internal policies and controls, a designated AML compliance officer, ongoing employee training, and independent testing of the program.
- Suspicious activity reporting — filing SARs with FinCEN within 30 days for suspicious transactions involving or aggregating $5,000 or more.
- Recordkeeping obligations, including the BSA Recordkeeping and Travel Rules for transmittals of funds of $3,000 or more.
- Responding to FinCEN Section 314(a) information-sharing requests, plus enhanced due diligence under Section 312 for foreign correspondent and private banking accounts.
Just as important is what the final rule does not include. Customer identification program (CIP) requirements were proposed separately — a joint FinCEN–SEC rulemaking from May 2024 — and, as of this writing, that companion rule has not been finalized. Beneficial-ownership customer due diligence was likewise deferred to future rulemaking. Advisers should build the program the final rule actually requires, while designing it so CIP can be bolted on rather than retrofitted.
Why the date moved to 2028
The FinCEN investment-adviser AML rule — key dates
- Aug 28, 2024
FinCEN issues the final rule adding RIAs and ERAs to the Bank Secrecy Act.
Source: FinCEN
- Jan 1, 2026
Original compliance date — postponed in 2025 before it took effect.
Source: FinCEN
- 2026Current state
Where firms stand now — a two-year runway to build an examinable program.
- Jan 1, 2028Effective date
New compliance date — a real, examinable AML program must be operating.
Source: FinCEN
The rule’s original compliance date was January 1, 2026. In July 2025, FinCEN announced a postponement, formalized it in an exemptive relief order that August, and confirmed it by final rule in December 2025 — moving the compliance date two full years to January 1, 2028. The stated reasons: tailoring the rule to the varied business models and risk profiles of private fund and venture advisers, and synchronizing the timeline with the pending CIP rulemaking. Two things can be true at once: the substance may still shift at the margins, and the core obligation — a real, examinable AML program — is coming. Firms that treat the postponement as a cancellation will be the ones scrambling in late 2027.
The SEC will be your examiner
FinCEN delegated examination authority for the rule to the SEC. Practically, that means AML program adequacy becomes part of the SEC examination you already prepare for — the same exam team, the same document request lists, one more program area where “we have a policy” is not the same as “we can evidence the program operating.”
How to use the runway
- Map the obligations now: which of the rule’s requirements apply to your firm’s business model, and who owns each one.
- Designate the AML officer early — the program design decisions cascade from that role.
- Assess your data: SAR readiness depends on being able to see and reconstruct transaction activity, which is a systems question, not a policy question.
- Put independent testing on the calendar before the deadline year, so the first test happens with time to remediate.
- Track the open rulemakings — the CIP proposal and FinCEN’s stated intent to revisit scope — so changes land as program updates, not surprises.
Sources
This article is general information for compliance professionals, not legal, audit, or regulatory advice. Confirm requirements that apply to your firm with counsel or your examiner.