Outsourcing AML/CFT Functions: What RIAs Can—and Can’t—Outsource

FinCEN recently enacted AML compliance requirements for most registered investment advisors by designating them as Financial Institutions under the Bank Secrecy Act (BSA). By doing so, FinCEN prescribed minimum standards for anti-money laundering/countering the financing of terrorism (AML/CFT) for those investment advisors.

Delegation vs. Responsibility: What the Rule Allows

A question that comes up frequently regarding AML requirements is whether the designated financial institution can delegate required functions to third parties.
In its final rule, as it has with other financial institutions, FinCEN permitted investment advisors to delegate contractually the implementation and operation of certain aspects of its AML/CFT program. However, as with other financial institutions, investment advisors will remain fully responsible and legally liable for their program’s compliance with the proposed rule, regardless of whether they implemented the program themselves or delegated certain functions to third parties.

Investment advisors are also required to ensure that FinCEN and the SEC are able to obtain information and records relating to the AML/CFT program. Because investment advisors operate through a variety of different business models, each firm may decide which aspects (if any) of its AML program are appropriate to delegate.

To the extent that an investment advisor delegates the implementation and operation of any aspect of its AML/CFT program, they would still remain fully responsible and legally liable for their AML program. This would include identifying and documenting their  procedures for addressing the adviser’s vulnerability to money laundering and terrorist financing. They would also need to undertake reasonable steps to assess whether the service provider would carry out such procedures effectively.

 
While not a complete list of steps that can be taken to effectively monitor for compliance, FinCEN provided some considerations:

Third Party Due Diligence

The advisor should conduct third party due diligence on the third party’s AML/CFT policies and determining whether they meet the advisor’s standards.

The Importance of Written Agreements and Oversight

The advisor should have a written agreement with the third party containing appropriate representations and covenants, including that the third party will maintain and adhere to risk-based and reasonably designed AML/CFT policies, procedures and controls, and will update the advisor if there are any deficiencies identified in the third-party’s audit (if any).

Certification Isn’t Enough: Document Your Oversight

Regular documentation and risk-based oversight help demonstrate regulatory compliance. The advisor should periodically monitor compliance with such requirements.

Simply having a written a certification from a service provider that the service provider “has a satisfactory anti-money laundering program” would not be sufficient. That being said, such a certification could be one of several tools that an investment advisor could use to conduct periodic oversight of the provider’s operations with respect to the delegated obligations.

Tailor Your Oversight Based on Risk

FinCEN noted that the appropriate frequency of an advisor’s oversight of third-party efforts would depend on the advisor’s overall risk profile for money laundering, terrorist financing, or other illicit finance activities, as well as the types of AML/CFT responsibilities delegated to the third-party provider.

Best Practices for Managing Third-Party AML/CFT Functions

From initial diligence to ongoing reviews, firms must actively manage their AML partnerships. In order to ensure that your firm is effectively mitigating the risk of using a third-party to conduct some or all of your AML/CFT requirements, ensure your firm is conducting initial and ongoing due diligence of the provider, regularly monitoring the activities of those providers, and documenting all of your efforts.

Oyster Consulting can help your firm navigate the complexities of AML/CFT compliance with confidence. Our team of former regulators and industry experts understands the nuances of FinCEN’s requirements and the operational realities investment advisors face when considering delegation. Whether you’re building your AML program from the ground up, evaluating third-party vendors, or testing your AML program, we provide tailored support to ensure your firm meets regulatory expectations while maintaining operational efficiency.