New FinCEN ruling requires more firms to implement AML/CFT Program

On August 28, 2024, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a final rule requiring certain investment advisers to establish an Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) Program. Effective January 1, 2026, the rule requires certain exempt reporting advisers (ERAs) and most Registered Investment Advisers (RIAs) to:

• Implement a risk-based and reasonably designed AML/CFT program;

• File certain reports, such as Suspicious Activity Reports (SARs), with FinCEN;

• Keep certain records, such as those relating to the transmittal of funds (i.e., comply with the Recordkeeping and Travel Rules); and

• Fulfill certain other obligations applicable to financial institutions subject to the BSA and FinCEN’s implementing regulations, such as special information-sharing procedures.

The final rule amended the definition of a covered “financial institution” and added “investment adviser” as a new category. This addition means that many previously exempt firms are now subject to more stringent regulations.

The rule also allows the U.S. Securities and Exchange Commission (SEC) to oversee a firm’s compliance with AML/CFT regulations.

Per the final rule, investment advisers are required to develop and implement a written AML/CFT program that is available for inspection by FinCEN and the SEC.

At a minimum, firms must:

• Establish and implement internal policies and procedures to detect and prevent illicit activities, including money laundering and terrorist financing;

• Require independent testing of the compliance program by independent personnel employed within the investment adviser or by a qualified outside party;

• Designate an individual responsible for implementing and monitoring the internal policies, procedures, and controls of the AML/CFT program;

• Provide ongoing training relevant to an employee’s function; and

• Implement appropriate risk-based procedures for conducting ongoing customer due diligence.

Failure to adhere to this ruling can lead to federal enforcement actions that create significant financial, legal, and reputational repercussions.

In a February 2024 risk assessment, the U.S. Department of the Treasury identified vulnerabilities in the investment adviser sector that “sanctioned persons, corrupt officials, fraudsters, and other criminals” could exploit to access the U.S. financial system. The loopholes allowed them to:

• Facilitate money laundering for foreign entities;

• Allows sanctioned entities like Russian oligarchs to obscure their ownership of U.S. assets;

• Help foreign states (especially China and Russia) access U.S. technology with national security implications, including biotechnology and artificial intelligence, through venture capital funds; and

• Engage in fraudulent activities against clients.

While regulations and rules to mitigate these risks have long been typical in the banking sector, there was an identifiable gap amongst RIAs and ERAs that manage private funds, including hedge and venture capital, whose compliance programs tend to be less robust than those of other financial institutions.

To combat these risks, on June 28, 2024, FinCEN announced a proposed rule to "strengthen and modernize financial institutions' anti-money laundering and countering the financing of terrorism (AML/CFT) programs." After an open comment period, the final rule was issued on August 28th, 2024. According to FinCEN, “This rule will help level the regulatory playing field through a consistent application of risk-based AML/CFT requirements… [and] brings the United States into greater compliance with international AML/CFT standards…”

Regardless of how well GPs personally know their current investors, this ruling mandates implementing a formal due diligence process. Adhering to this ruling also requires much more work as new LPs are onboarded, including gathering the necessary information and developing comprehensive processes to detect and report suspicious activity.

While the ruling does allow for some exemptions, the new requirements create ongoing obligations that are best met with long-term solutions instead of one-time fixes. Complying with the ruling, making the information-gathering process smoother during investor onboarding, and ensuring your team has the data and tools they need to comply will require a deeper focus on driving operational efficiency. Technology that excels at data management, data integration, and workflow automation can help deliver needed efficiencies.

As one VC CFO said, the ideal state is one where “data is never written down twice. It's written down once and then sent to the right place, the right person, at the right time.”

Put simply, act now.

Take the next three months to review and understand the delta between what you have been doing and what you are now legally obligated to do.

Investment advisors setting up their AML/CFT programs have until January 1, 2026, to comply. Implementing these programs takes time and executive attention, and waiting until late 2025 to begin puts your ability to comply at risk.

By the end of 2024: Understand the obligations and how they apply to you

The most important (and likely biggest) step is to talk to counsel and other external experts who can help explain exactly what these obligations mean for you and map out what your firm must do to comply.

While external advisors can help provide a comprehensive evaluation, please note that your fund’s management team is responsible for ensuring that your AML/CFT program adequately fits your firm’s risk level and is implemented per the final FinCEN ruling.

By Q1 2025: Identify and appoint a qualified AML/CFT Officer

The final rule requires firms to designate a person (or persons) responsible for implementing and monitoring the internal policies, procedures, and controls of your AML/CFT program. This AML/CFT officer must have the expertise, authority, and resources, including “sufficient technology and systems to support the timely identification, measurement, monitoring, reporting, and management of the investment adviser's illicit finance activity risks” to oversee your firm’s compliance efforts effectively.

There are several ways to choose an AML/CFT Officer:

• Appoint someone internal. This could be your general counsel, CFO, COO, or senior partner.

• Hire a dedicated compliance officer. Good candidates tend to come from financial institutions that have been subject to these types of compliance obligations for decades.

• Outsource to a third-party compliance partner. There are external firms that can provide a compliance officer to guide and oversee your compliance programs.

By Q2 2025: Create your risk assessment framework and develop internal policies, procedures, and controls

Building a “risk-based and reasonably designed AML/CFT program” requires identifying the financial risks your firm is most susceptible to. As Financial Industry Regulatory Authority (FINRA), a not-for-profit self-regulatory organization that oversees U.S. broker-dealers, notes in its template for developing an AML plan, “​​Your firm’s AML program should be…designed to address the risk of money laundering specific to your firm. Your firm can identify that risk by looking at the type of customers it serves, where its customers are located, and the services it offers.”

Create (or update) a risk assessment framework to incorporate emerging threats and vulnerabilities, as highlighted in the final rule. Rather than starting from scratch, the most efficient option is often to work with or hire someone who has an AML/CFT framework for best practices that you can adapt to your firm's needs. The risk assessment framework will be necessary when the time comes to demonstrate to your firm’s independent examiner that you took a “reasonable approach” to designing your AML/CFT Program.

Your formal governance processes should also include implementing ongoing customer due diligence (CDD), which “gathers sufficient information to form an understanding of the nature and purpose of the customer relationship for the purpose of developing a customer risk profile…”

Key risks that an investor risk assessment might evaluate might include:

• The source of funds,

• Country(ies) of citizenship,

• The type of entity,

• Where the entity is domiciled and located

The CDD tends to be the most labor-intensive part of the process, and screening investors against various watchlists is often handled by an external vendor.

Now would also be an excellent time to evaluate your current operational efforts and the delta between what you currently do and the additional burdens that will be placed on your team to comply with the final rule. Investigate potential solutions to improve transaction monitoring, data analytics, and ongoing reporting.

By Q3 2025: Establish an employee training program

Once your program is in place, and as noted in the final rule, employees “…must be trained in AML/CFT requirements relevant to their functions and to recognize possible signs of money laundering, terrorist financing, and other illicit finance activity that could arise in the course of their duties.”

The training program—which can be outside or in-house seminars and may include computer-based or virtual training—should provide all employees with a general awareness of the AML/CFT program’s requirements and finance risks. It should also provide “more job-specific guidance tailored to particular employees' roles and functions” as needed.

By Q4 2025: Plan how to have your AML/CFT program independently tested

The independent testing of the program must be performed by individuals other than those responsible for the implementation and day-to-day execution of the program. In other words, those who are responsible for implementing your AML/CFT program cannot be the ones who test it. Those efforts should be conducted by a third party, and many accounting and advisory firms offer these services. This is a fairly standard process that would include a review of your policies and a sampling of your customer files to ensure they’re consistent with your policies. This review typically happens annually, which likely means the first audit would happen in early 2027, a year after the FinCEN-mandated deadline.

In addition to this ruling, FinCEN is considering a proposed rule on Customer Identification Programs (CIP). Similar to the final AML/CFT ruling, the proposed rule would extend the CIP regulation to other financial institutions and require investment advisers to establish appropriate policies and procedures to verify the identity of their customers.

As a leading fund administrator, Juniper Square is committed to helping our clients navigate regulatory changes effectively and ensure their organizations remain compliant in an evolving environment. Our platform has helped more than 2,000 GPs streamline their investor management operations by ensuring critical information is integrated, transparent, and auditable, all while delivering the best possible experience for every stakeholder.

Our modern approach to administration includes an integrated AML/CFT solution that helps conduct Customer Due Diligence (CDD) and runs your Customer Identification Program (CIP) seamlessly from the first time you onboard investors throughout the entire investment lifecycle. Our platform collects and stores identification documents, verifies identities, and conducts sanctions screening, making compliance with federal regulations more seamless for you, your LPs, and other stakeholders. Learn more about our compliance solution →

Join leaders from Juniper Square, Goodwin Procter LLP, and FS Vector for a live webinar on October 30th at 11 AM PT / 2 PM ET. Our expert panel will summarize the final ruling, explain what is expected from a “risk-based and reasonably designed AML/CFT program,” and delve deeper into the steps your firm can take in the coming months in order to comply.

Register now →

This article and the related webinar include general information about regulatory and legal issues. The information provided does not, and is not intended to, constitute legal advice and does not address the circumstances of any particular individual or entity. While we endeavor to provide accurate and timely information as of the date the information was written, information on this website may not constitute the most up-to-date information as of the date it is received, and there is no guarantee that it will continue to be accurate in the future. Juniper Square is not a law firm and does not provide legal services. You should contact a lawyer licensed in your jurisdiction for advice on how the new FinCEN rule impacts your particular circumstances.