FinCEN Delayed the Investment Adviser AML Rule to January 2028. Here's What Changes — and What Doesn't.

TL;DR

• FinCEN delayed the investment adviser AML/CFT rule effective date from January 1, 2026 to January 1, 2028 via a final rule issued December 31, 2025 and published in the Federal Register January 2, 2026
• FinCEN confirmed intent to revise and tailor the rule’s scope before the 2028 date — some aspects may change, but the obligation will not be withdrawn
• Bank partners, prime brokers, and custodians are already requiring AML documentation as a condition of service, regardless of where FinCEN’s regulatory timeline sits
• January 2028 is 18 months away — advisers that use the delay as permission to defer have a compressed compliance sprint ahead

FinCEN gave investment advisers an extra two years. Most are treating it like a free pass. That’s a mistake.

On December 31, 2025 — the last business day of the year — FinCEN issued a final rule postponing the effective date of its investment adviser AML/CFT rule from January 1, 2026 to January 1, 2028 (published in the Federal Register on January 2, 2026). The underlying rule isn’t a proposal: FinCEN finalized it in August 2024 (published September 4, 2024), after a February 2024 proposal. It covers approximately 19,900 SEC-registered investment advisers (RIAs) and exempt reporting advisers (ERAs), by FinCEN’s estimate, and brings them under Bank Secrecy Act obligations that have applied to banks, broker-dealers, and money services businesses for decades.

The postponement was widely welcomed. The two-year extension felt like room to breathe. But the text of the delay rule, and the context around why FinCEN issued it, makes plain why treating this as a 24-month vacation is a strategic miscalculation.

What the Postponement Actually Says

The delay rule does three things.

It moves the deadline. The compliance date shifts from January 1, 2026 to January 1, 2028. Investment advisers that had been building programs under the original timeline — and there were advisers who had already started — now have additional runway. But the new date is hard: FinCEN did not propose a further delay.

It explains why. FinCEN proposed the delay in September 2025, received 22 comments, and said the extra time gives it an opportunity to review the rule and, as applicable, make sure it is effectively tailored — including reducing duplication and burden where possible.

It signals revision, not withdrawal. This is the part most advisers underweight. The postponement rule frames the delay as time to review the rule and make sure it is effectively tailored. The 2028 rule may look different in scope, in how requirements are calibrated to the AML/CFT risk profile of investment adviser business models, and in how ERAs are treated relative to fully registered RIAs. What FinCEN did not say — and shows no sign of intending — is that it plans to drop the rule entirely. Investment advisers have been on the agency’s AML coverage gap list since the early 2000s. The policy direction has been settled for over two decades.

Why the Clock Is Still Running

The regulatory compliance deadline moved. The counterparty expectations did not.

Sponsor banks, prime brokers, and custodians operating under their own BSA/AML programs have third-party risk obligations that require them to assess the AML/CFT controls of their business partners. As FinCEN’s rulemaking made the investment adviser AML gap more visible — a gap FinCEN’s own final rule notes was flagged in the 2016 FATF evaluation of the United States — those counterparties began incorporating documented AML program requirements into their due diligence and onboarding processes.

This trend has been accelerating. Prime brokers that provide services to hedge funds are asking for written AML policies. Custodians that hold assets for RIA clients are asking about SAR escalation processes and customer screening procedures. Sponsor banks evaluating new adviser relationships are adding AML documentation to their standard due diligence checklists — the same way they do for fintech partners.

The March 2026 FinCEN enforcement action against Canaccord Genuity, which resulted in a then-record AML penalty against a broker-dealer, sent a secondary signal to every firm in the securities sector: documented AML programs are not optional for the industry’s institutions, and the gap between what’s technically required of investment advisers and what counterparties expect is shrinking. The full enforcement analysis at the Canaccord Genuity AML enforcement post covers what the documentation failures looked like.

What the Rule Will Require

While FinCEN may revise specifics before January 2028, the core structure of the rule follows the standard BSA/AML program framework applied to other financial institutions:

Written program. A documented AML/CFT program tailored to the adviser’s business model, client base, and risk profile. Generic boilerplate doesn’t satisfy this — the program needs to reflect actual exposure: where clients come from, what their source of wealth looks like, what products and transactions the adviser handles.

Customer due diligence. The rule requires risk-based ongoing CDD: understanding the nature and purpose of client relationships to build a customer risk profile, and ongoing monitoring to spot and report suspicious activity. Two pieces are handled elsewhere: customer identification is in a separate FinCEN/SEC proposal (May 2024), and advisers don’t have to identify and verify beneficial owners of entity clients until FinCEN’s revised CDD rule takes effect. High-risk clients — politically exposed persons, opaque ownership structures — still deserve closer scrutiny under a risk-based program.

Suspicious activity reporting. Advisers would need to file SARs with FinCEN when they identify transactions or patterns suggesting money laundering, fraud, or other financial crimes. This requires a defined internal escalation path — someone needs to be responsible for identifying red flags, making filing decisions, and maintaining documentation that supports each filing decision.

BSA recordkeeping and reporting. Alongside SARs, the rule extends other BSA reporting requirements: 314(a) information sharing responses (requiring institutions to search records for FinCEN-named subjects and respond within two weeks), currency transaction reporting obligations, and the record-retention requirements that underpin everything.

Compliance officer and training. Someone needs to own the program. The rule requires designation of a responsible compliance officer and an ongoing training program for relevant staff.

The FinCEN AML/CFT program modernization NPRM — a separate, parallel rulemaking — would update the underlying minimum requirements for AML programs across all institution types. Following both tracks simultaneously is important: the modernization rule may shape what “adequate” looks like for the investment adviser program when the 2028 deadline arrives.

What to Build in the Next 18 Months

January 2028 is 18 months from today. That’s enough runway to build well — and not enough to waste.

Start with the customer risk assessment. Before you can write a defensible AML program, you need to know your client base: who they are, where they come from, how their assets were generated, and what the ownership structures of any fund or entity clients look like. Advisers who haven’t done this systematically discover, when they start, that client data is incomplete in ways that take months to resolve. Starting now creates time to address those gaps.

Map your transaction patterns. Investment advisers managing separately managed accounts (SMAs) or accepting external fund transfers have a different monitoring challenge than advisers who only take ACH subscriptions from domestic custodians. Mapping actual cash flow patterns — and identifying which ones could theoretically be used for layering — lets you design proportionate controls rather than importing a bank’s transaction monitoring framework wholesale.

Build and test your SAR escalation path. The most common AML program weakness, across all institution types, is a SAR process that exists on paper but has never been tested: no one knows who makes the filing decision, no one has been trained on red flags, the documentation infrastructure isn’t in place. A tabletop exercise before you’re under examination pressure costs an afternoon. Doing it for the first time during an examination costs far more.

Audit your service provider relationships. Portfolio management software, CRM systems, and document management platforms that hold client information will intersect with AML program requirements — particularly the BSA’s information-sharing provisions and record-retention requirements. Review what data your vendors hold and whether you’d be able to respond to a 314(a) request with the information you actually have.

The underlying risk-control mapping for an AML program — documenting which controls address which risks, how they’re tested, and what the residual exposure looks like — is exactly what a BSA/AML risk assessment documents. Heads up: the AML/BSA Risk Assessment Template is built for fintechs, so its 32 example risk factors and 10 customer types are payments and lending flavored, not private-fund flavored. What carries over is the structure — inherent-to-residual scoring across product, customer, geography, and delivery channel categories, plus a 30-control inventory mapped to the BSA program pillars — which you’d re-populate with adviser-specific risks. For the monitoring side, the BSA/AML KRI metrics framework covers what a well-structured monitoring program looks like once the policy foundation is in place.

The ERA Question

One calibration question commenters keep raising: whether exempt reporting advisers should face the same requirements as fully registered RIAs.

ERAs — advisers to private funds that file reports with the SEC rather than fully registering — are covered by the final rule. The private fund sector raises distinct AML/CFT concerns: beneficial ownership opacity, complex fund structures, offshore investor bases, and the potential for layering through fund subscriptions and redemptions.

Whether FinCEN carves out a lighter-touch approach for smaller or simpler ERAs is genuinely uncertain. What’s not uncertain: ERAs managing funds with complex ownership structures or international investor bases are the segment with the highest risk profile — and are therefore the least likely to benefit from any scope carve-out that does emerge. If your ERA manages a fund with politically exposed persons, offshore investors, or layered ownership structures, waiting to see what FinCEN does before starting program development is the highest-risk path available to you.

So What?

FinCEN’s postponement is a useful development for investment advisers that needed more time to build thoughtfully. It’s not a signal that the rule is going away, that the political appetite for investment adviser AML coverage has softened, or that counterparties will wait for a regulatory deadline before asking for documentation.

The advisers that will handle January 2028 cleanly are the ones treating the next 18 months as an implementation runway: customer risk assessment now, SAR escalation path built and tested before 2027, bank partner documentation ready regardless of how FinCEN retails the final scope.

The ones that won’t are the ones reading “2028 deadline” and scheduling their first program meeting for Q4 2027.

Sources:

• FinCEN: Final Rule Postponing Effective Date of Investment Adviser AML/CFT Rule (December 31, 2025)
• Federal Register: AML/CFT Programs — Investment Advisers — Postponement of Effective Date (Document 2025-24184)
• Federal Register: Investment Adviser AML/CFT Final Rule (September 4, 2024, Document 2024-19260)
• FinCEN: Proposed Rule to Establish AML/CFT Requirements for Investment Advisers (February 2024)