Sweeping AML Requirements for RIAs and ERAs

New Compliance Responsibilities

The final rule imposes new compliance responsibilities on RIAs and ERAs that include a requirement to implement a “risk-based and reasonably designed AML/CFT program.” But the new obligations don’t end there. RIAs and ERAs will also need to:

• File certain reports, such as Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs), with FinCEN
• Comply with the Recordkeeping and Travel Rules by retaining certain records, such as those relating to the transmittal of funds
• Fulfill certain other obligations applicable to financial institutions subject to the BSA and FinCEN’s implementing regulations, such as special information sharing procedures.

The responsibilities are significant because RIAs and ERAs for the first time will have to meet the same AML standards as financial institutions and broker-dealers, and many will need to build AML compliance programs from scratch. Although most investment advisers have not been subject to the BSA AML requirements, many have voluntarily adopted at least some AML programs.

In addition, some investment advisers may perform certain AML/CFT functions if the entity is also a registered broker-dealer, is a bank, or is an operating subsidiary of a bank, according to the U.S. Treasury’s 2024 Investment Adviser Risk Assessment.

Creating an AML/CFT Compliance Program from Scratch

IA firms that do not currently have existing AML/CFT programs will need to dedicate resources to meet the new requirements. Building an AML compliance program from the bottom up will include requirements under five pillars of an effective AML compliance program:

1. Governance
2. Internal Controls
3. Training
4. Independent Testing
5. Customer Due Diligence (CDD)

Firms to whom the new rules apply will have to:

• ✔ Designate a compliance officer
• ✔ Conduct a risk assessment
• ✔ Implement internal controls
• ✔ Conduct training and independent testing
• ✔ Create customer due diligence (CDD), enhanced due diligence (EDD), and know your customer (KYC) processes

Firms will need to understand recordkeeping requirements, the details of what to include in SARs and CTRs, recognize information-sharing requirements and respond to Section 314(a) requests to help law enforcement track and investigate possible criminal financial transactions, and implement internal controls that will ensure their risk-based AML program is effective.

The Details

Financial institutions must appoint a Compliance Officer, responsible for monitoring day-to-day AML compliance with financial crimes laws and regulations and managing all aspects of the firm’s financial crimes compliance program. This individual will have deep familiarity not just with the firm’s products and services, but also with all applicable financial crimes laws and regulations, the firm’s customer base, geographic risks, and other vulnerabilities.

The Risk Assessment will evaluate both inherent risk and residual risk that remains after the AML program is fully implemented. Here are just some of the questions that should be addressed in the risk assessment:

• What are the inherent risks faced by the firm? What products and services offered by the firm are vulnerable to financial crimes? What geographies in which the firm transacts are a high risk for money laundering and other financial crimes?
• What are the firm’s existing AML policies, and how can they be adapted to a formal AML program?
• Who is responsible for the firm’s current AML policies?
• What are the specific requirements of the new FinCEN rule that apply to the firm?
• What will the firm’s AML training program include?
• What resources will be needed to conduct CDD/EDD/KYC?
• What controls can be implemented at the firm to reduce residual risk?

Reporting and Recordkeeping are significant elements of an AML compliance program. IA and ERA firms will need to develop and implement policies to comply with the requirements to file SARs and CTRs, as well as comply with the BSA Travel Rule and requests pursuant to the USA PATRIOT Act Section 314(a).

SARs are documents filed by financial institutions with FinCEN that report activities that may be indicative of money laundering or other financial crimes. A financial institution is required to file a SAR no later than 30 calendar days after the date of initial detection of the suspicious activity. If no suspect was identified on the date of detection of the suspicious incident, a financial institution may delay filing a SAR for an additional 30 calendar days to identify a suspect, but reporting cannot be delayed more than 60 calendar days after the date of the initial detection of the suspicious transaction.

CTRs are not necessarily indicators of suspicious financial activity, but financial institutions must file a CTR for transactions, such as deposits, withdrawals, or exchanges of currency of more than $10,000.

Section 314(a) of the USA PATRIOT Act of 2001 requires the Secretary of the Treasury to adopt regulations to encourage regulatory and law enforcement authorities to share with financial institutions information regarding individuals, entities, and organizations engaged in or reasonably suspected, based on credible evidence, of engaging in terrorist acts or money laundering activities.