boltKey takeaways
- KYC is how a fund identifies and verifies its investors. AML is the broader program that uses that information to detect, prevent and report illicit funds.
- FinCEN's rule requiring RIAs and exempt reporting advisers to run AML programs is postponed to January 1, 2028, but OFAC sanctions apply to every U.S. person today.
- In practice, LPs, administrators, banks, placement agents and offshore jurisdictions such as the Cayman Islands already expect a documented, risk-based program.
- Risk-score each investor on type, geography, ownership opacity, PEP exposure and source of funds, and scale the depth of diligence to match.
- Screen at onboarding and again whenever sanctions lists change or the investor's profile changes. Re-review periodically based on risk tier.
KYC (know your customer) is the process of identifying and verifying who an investor is, who owns and controls it, and where its money comes from. AML (anti-money laundering) is the wider program built on that information: policies, screening, monitoring, escalation and reporting designed to keep illicit funds out. For U.S. private fund managers, a formal federal AML program mandate has been delayed to 2028. Sanctions compliance, offshore fund rules and LP expectations already require most of the same work.
This guide explains what is legally required as of late 2026, what the market expects anyway, and how to build an onboarding process that holds up under diligence.
Where the legal obligations come from#
U.S. federal law#
The Bank Secrecy Act (BSA) requires "financial institutions" to maintain AML programs, file suspicious activity reports (SARs) and keep records. Banks and broker-dealers have long been covered. Investment advisers and private funds have not.
That was set to change. In August 2024, FinCEN finalized a rule adding SEC-registered investment advisers and exempt reporting advisers to the BSA definition of financial institution. The rule would require written AML programs, SAR filing and recordkeeping. Its original effective date was January 1, 2026. On December 31, 2025, FinCEN issued a final rule postponing the effective date to January 1, 2028, and has said it intends to revisit the rule's scope. A related SEC/FinCEN proposal from May 2024 would impose customer identification program requirements on advisers. That proposal was not finalized, and FinCEN said in 2025 that it would be revisited along with the AML rule.
The upshot for late 2026: most advisers are not yet under a federal AML program mandate, but that is not a reason to skip the work.
Obligations that already apply#
- OFAC sanctions. Every U.S. person, including fund managers and funds, is prohibited from dealing with sanctioned persons and blocked property. Liability is strict. A fund that accepts a subscription from a blocked person, or pays a distribution to one, has a problem regardless of intent.
- Offshore fund regimes. Funds formed in the Cayman Islands, Luxembourg, Ireland and similar jurisdictions are subject to local AML laws that require customer due diligence and named AML officers. See Cayman Islands KYC/AML requirements.
- Counterparty requirements. Fund banks, subscription line lenders, administrators and placement agents are themselves regulated. They will ask how you onboard investors and will often contractually require a program.
- LP diligence. Institutional LPs ask about AML policies in DDQs as a matter of course.
KYC versus AML: the moving parts#
| Component | What it is | Typical owner |
|---|---|---|
| Customer identification | Collect name, address, date of birth or formation, tax ID, and verify against documents or data sources | Administrator or IR / onboarding |
| Beneficial ownership | Identify individuals owning 25% or more, and at least one controller, for entity investors | Onboarding |
| Sanctions and PEP screening | Check investors, beneficial owners and controllers against sanctions lists and politically exposed person databases | Administrator or compliance |
| Risk assessment | Assign a risk tier that drives the depth of diligence | Compliance |
| Enhanced due diligence | Source of wealth and source of funds evidence, senior approval, deeper review for high-risk investors | Compliance |
| Ongoing monitoring | Re-screen on list updates, review on trigger events, refresh files periodically | Compliance or administrator |
| Escalation and reporting | Investigate red flags, freeze or reject, report where required | AML officer |
| Records and training | Retain files and evidence, and train staff | Compliance |
The 25% ownership threshold mirrors the CDD standard used for banks and broker-dealers. Many fund programs use 25%, while some offshore regimes and higher-risk cases call for a lower threshold, often 10%.
Building a risk-based onboarding process#
A risk-based approach means the depth of diligence depends on the investor. A state pension plan and a newly formed BVI company with nominee directors should not receive the same review.
Step 1: Classify the investor#
Common categories: natural person, trust, operating company, investment fund, pension or endowment, government entity, regulated financial institution, listed company. Some types, such as regulated institutions in equivalent jurisdictions, listed companies and government bodies, may qualify for simplified diligence under your policy.
Step 2: Collect and verify#
Gather identity documents or registry extracts, ownership charts down to individuals, and lists of controllers and authorized signatories. Verify against independent sources.
Step 3: Screen#
Run the investor, every beneficial owner, every controller and every signatory against sanctions lists (OFAC SDN and other applicable lists), PEP databases and adverse media.
Step 4: Score#
A simple additive model works for most funds. Here is a hypothetical example:
| Factor | Low (1) | Medium (2) | High (3) |
|---|---|---|---|
| Investor type | Regulated institution or public pension | Operating company or family office | Personal investment company or complex trust |
| Jurisdiction | FATF member with equivalent AML regime | Other | FATF "increased monitoring" or high-risk jurisdiction |
| Ownership transparency | Simple, fully identified | Multi-layer but documented | Nominees, bearer shares, or unexplained layers |
| PEP exposure | None | Domestic PEP or close associate | Foreign PEP |
| Source of funds | Clearly evidenced | Partially evidenced | Unclear or inconsistent |
Use bands such as: a score of 5–7 is low risk, 8–10 is medium, and 11 or more, or any single automatic trigger like a sanctions hit or a foreign PEP, is high risk with enhanced due diligence and senior sign-off.
Example: A family office in a FATF member state (1) with a documented two-layer structure (2), no PEP exposure (1) and audited source of funds (1) scores 2 + 1 + 2 + 1 + 1 = 7, which is low risk. Add a foreign PEP as a 30% owner and the investor becomes high risk automatically, whatever the total.
Step 5: Decide and document#
Approve, approve with conditions, or decline. Record who decided and why. Do not accept capital until the file is complete. Admitting an investor and "cleaning up later" is the most common finding in fund AML reviews.
Ongoing monitoring#
KYC is not a one-time event. Build triggers for:
- Sanctions list updates. Re-screen the full investor base when lists change. Daily automated screening is common.
- Transfers and secondaries. A new transferee needs full onboarding before the GP consents.
- Changes in ownership or control reported by the investor or found in screening.
- Unusual payment activity, such as capital call payments from a third-party account, or a request to send distributions to an account in a different name or country. Treat both as red flags until explained.
- Periodic refresh. For example, every year for high-risk investors, every two to three years for medium risk, and longer for low risk, as set by your policy.
Capital calls and distributions are the points where money actually moves. Matching the remitting and receiving accounts to the verified investor is one of the strongest controls a fund can have. See capital calls.
Who does the work#
Many managers delegate KYC execution to their fund administrator. Delegating the work does not delegate responsibility. The manager, or for offshore funds the board or general partner, remains accountable. A sound arrangement includes:
- a written agreement setting out what the administrator does and to what standard
- access to the underlying files, not just a "cleared" status
- periodic testing or reporting on the administrator's performance
- a named internal owner who reviews escalations
If you are choosing a provider, AML capability belongs on the fund administration evaluation checklist.
Preparing for 2028#
Even with the postponement, advisers covered by the FinCEN rule as it currently stands should expect to need, by January 1, 2028:
- A written, risk-based AML/CFT program approved by senior management or the board
- A designated AML compliance officer
- Ongoing employee training
- Independent testing
- SAR filing and BSA recordkeeping, including the travel rule for certain fund transfers
FinCEN may narrow the scope before then. Building the investor-level components now, including the risk assessment, screening and documentation, prepares the adviser for whatever version takes effect and satisfies LPs today. For a wider view of how this fits with other programs, see private fund compliance.
How Privatis helps#
Privatis includes KYC/AML onboarding for LPs. It collects documents and beneficial ownership information, applies configurable risk scoring, and records approvals. Each investor's file sits alongside their subscription documents in the LP portal and data room. Every status change is logged in the audit trail, which gives auditors, administrators and LP diligence teams a clear record of who was reviewed, when and on what basis.
AML requirements depend on your adviser status and fund jurisdictions. Confirm your obligations with counsel.