Do You Know Your Customer? FinCEN & SEC Propose New Investment Adviser KYC Obligations

On May 21, 2024, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) and the U.S. Securities and Exchange Commission (the SEC) published a joint notice of proposed rulemaking (the Proposed Rule) in the Federal Register. If adopted, the Proposed Rule would impose Customer Identification Program (CIP) requirements on both:

1. 1. Investment advisers registered or required to be registered with the SEC under the Investment Advisers Act of 1940 (registered investment advisers, or RIAs); and
   2. investment advisers exempt from registration under sections 203(l) or 203(m) of the Investment Advisers Act of 1940 (exempt reporting advisers, or ERAs).^[1]

The Proposed Rule complements FinCEN’s February 15, 2024 proposed rule (the Previous RuleProposed ), which would include RIAs and ERAs in the definition of “investment advisers” and subject them to anti-money laundering and countering the financing of terrorism (AML/CFT) program and other Bank Secrecy Act (BSA)-related obligations. For further information on the Previous Proposed Rule, please click here.

Currently, financial institutions (as defined by the BSA) are subject to CIP requirements as part of their broader AML/CFT programs.^[2]RIAs and ERAs would be required to comply on or before six months from the effective date of the Proposed Rule, but before the compliance date of the Previous Proposed Rule, if adopted.^[3]

CIP Scope and Exceptions

The SEC would codify the Proposed Rule as part of other BSA regulations at 31 C.F.R. Part 1032.^[4]The Proposed Rule would cover:

1. 1. any contractual or other business relationship between a person and an investment adviser under which the investment adviser provides investment advisory services (“Accounts”);^[5]and
   2. a natural person or legal entity who opens a new Account with an investment adviser—either the accountholder or, in the case of an individual who lacks legal capacity, such as a minor, and non-legal entities, the individual who opens the new Account for a minor or non-legal entity (“Customers”).^[6]

However, the Proposed Rule would exclude from the definition of Accounts an account derived from an acquisition, merger, purchase of assets, or assumption of liabilities.^[7]Such accounts would not be excluded from other potential AML/CFT requirements applicable to advisory activities within the scope of the Previous Proposed Rule.^[8]

Further, the definition of Customers would not include institutions regulated by a federal functional regulator, banks regulated by a state bank regulator, certain government entities, certain persons that are publicly listed on U.S. securities exchanges, certain subsidiaries of persons listed on U.S. securities exchanges, or persons with existing accounts with the investment adviser.^[9]

These exclusions to the definitions of Accounts and Customers mirror the CIP rule applicable to banks, securities broker-dealers, and mutual funds.

The Proposed Rule would only require investment advisers to collect and verify the identity of Customers who directly open and hold Accounts. In the case of a private fund Customer, the investment adviser would have to collect the fund’s identifying information (and, in some cases, the information of individuals with control over such fund), but not the information of those invested in such fund.^[10]

CIP Minimum Requirements

CIP obligations must be documented in writing^[11]and, at a minimum, include:

1. risk-based procedures to verify Customers’ identities within a reasonable time before or after their Account is opened;^[12]
2. certain Customer identifying information;^[13]
3. records of Customers’ identifying information and descriptions of any document relied on for verification, the methods and results of any identity verification measures, and any resolution of discrepancies discovered;^[14]
4. reasonable procedures to consult, and evaluate Customers against, government agency lists of known or suspected terrorists or terrorist organizations;^[15]and
5. adequate notices to consumers about the investment adviser’s Customer identification and recordkeeping activities.^[16]

Additional Information

• RIAs and ERAs would be required to retain Customer identification information while the Account remains open and for five years after the Account is closed. Certain other records regarding the verification of a Customer’s identity would only have to be retained for five years after the record is made.^[17]
• The SEC, with the concurrence of the Secretary of the Treasury, would be able to exempt certain investment advisers from the Proposed Rule by order or regulation.^[18]
• FinCEN and the SEC are seeking comments as to whether certain types of Accounts—for example, Accounts opened for the propose of participating in an ERISA employee benefit plan—should be exempt from the Proposed Rule.^[19]
• Comments to the Proposed Rule are due on or before July 22, 2024.^[20]

---

^{[1] Customer Identification Programs for Registered Investment Advisers and Exempt Reporting Advisers, 89 Fed. Reg. 44571 (May 21, 2024), https://www.federalregister.gov/documents/2024/05/21/2024-10738/customer-identification-programs-for-registered-investment-advisers-and-exempt-reporting-advisers (Section I).}

^{[2] Id.}

^{[3] 31 C.F.R. §1032.220(c) (proposed); see 89 Fed. Reg. 44571 (Section II).}

^{[4] 89 Fed. Reg. 44571 (Section I).}

^{[5] 31 C.F.R. §1032.100(a) (proposed); see 89 Fed. Reg. 44571 (Section II).}

^{[6] 31 C.F.R. § 1032.100(c) (proposed); see 89 Fed. Reg. 44571 (Section II).}

^{[7] 31 C.F.R. § 1032.100(a)(2)(i) (proposed).}

^{[8] 89 Fed. Reg. 44571 (Section II).}

^{[9] Id. The investment adviser must have a reasonable belief that he or she knows the identity of the pre-existing customer.}

^{[10] 89 Fed. Reg. 44571 (Section IV).}

^{[11] Id. (Section II).}

^{[12] 31 C.F.R. § 1032.220(a) (proposed).}

^{[13] 31 C.F.R. § 1032.220(a)(2)(i)(A) (proposed). Specifically, (1) name; (2) date of birth for an individual or date of formation for entities; (3) address; and (4) identification number, such as a TIN or passport number.}

^{[14] 31 C.F.R. § 1032.220(a)(3)(i)(A)-(D) (proposed).}

^{[15] 31 C.F.R. § 1032.220(a)(4) (proposed).}

^{[16] 31 C.F.R. § 1032.220(a)(5) (proposed). Adequate notice would depend on how the Account is opened. For instance, an investment adviser would be able to post a notice on its website, on its account applications, or use any other form of written or oral notice.}

^{[17] 89 Fed. Reg. 44571 (Section II).}

^{[18] Id.}

^{[19] Id. (Section III).}

^{[20] Id. (Dates).}