FinCEN delays investment adviser AML rule to 2028

February 5, 2026

In January 2026, the FinCEN confirmed that the effective date of its long-awaited AML/CFT rule for investment advisers would be pushed back by two years.

The Investment Adviser (IA) AML Rule, which was originally due to come into force in 2026, will now take effect on 1 January 2028, giving covered firms additional time to prepare, said Alessa.

For registered investment advisers (RIAs) and exempt reporting advisers (ERAs), the delay offers short-term breathing room. However, regulators have been clear that this extension does not weaken expectations around AML preparedness. Instead, compliance leaders are being encouraged to use the additional time to design robust, risk-based frameworks that will stand up to supervisory scrutiny once enforcement begins.

The IA AML Rule represents a significant expansion of FinCEN’s regulatory perimeter. Under the Bank Secrecy Act (BSA), certain investment advisers will be formally classified as financial institutions for AML purposes. Once the rule becomes effective, covered firms will be required to maintain a written AML/CFT programme, conduct risk-based customer due diligence, monitor for suspicious activity, submit Suspicious Activity Reports (SARs), retain required records, and support regulatory examinations.

FinCEN has previously highlighted concerns that investment advisers may be vulnerable to misuse by bad actors seeking to access the US financial system. The rule is intended to close perceived gaps in oversight, particularly as advisers increasingly manage complex investment structures, cross-border flows, and private market activity.

According to FinCEN’s final rule published in the Federal Register, the decision to delay implementation was driven by several practical considerations. Industry respondents noted that building a compliant AML/CFT programme is not a short-term exercise, requiring changes to governance models, staffing, training, and technology infrastructure. FinCEN also acknowledged the need to further align the IA AML Rule with other anticipated regulatory initiatives, including potential Customer Identification Program (CIP) requirements for advisers.

Cost considerations also played a role. FinCEN estimates that deferring the rule could postpone more than $1bn in near-term compliance costs across the sector, without removing the obligation altogether. The delay, however, should not be interpreted as a signal that enforcement risk has diminished.

For compliance teams, the message remains consistent. Enforcement has been postponed, not abandoned, and firms that delay preparation until late 2027 may face compressed timelines, higher costs, and operational disruption. The regulatory endpoint is unchanged, even if the path has been extended.

Many advisers are already using the additional time to rethink their approach to AML compliance. Rather than relying on static checklists, regulators continue to emphasise the importance of risk-based programmes that reflect each firm’s clients, products, geographies, and transaction patterns. A well-documented risk assessment can significantly improve a firm’s ability to evidence compliance during future examinations.

Technology decisions are also becoming more strategic. Manual monitoring processes and spreadsheet-driven reviews may struggle to scale once SAR obligations apply. Automated transaction monitoring, consistent client risk scoring, and integrated case management are increasingly seen as foundational capabilities rather than optional enhancements.

Another key lesson from past regulatory rollouts is the risk of fragmented tooling. Firms that adopt isolated point solutions to meet individual requirements often encounter data silos and inconsistent risk views over time. Integrated AML platforms can provide a more sustainable approach, enabling firms to adapt as regulatory expectations evolve.

The FinCEN delay ultimately provides investment advisers with a valuable opportunity. Firms that use this period to invest in scalable controls, modernise their compliance operations, and embed risk awareness across the business will be better positioned when the rule comes into force. Those that wait may find that 2028 arrives faster than expected.