Insurance companies have long been required to comply with anti-money laundering (AML) regulations and exposed to risks inherent in their traditional insurance business. However, most large insurance companies also engage in the management of assets/investments and have a registered investment adviser (RIA) within their organizational structure. This existence of an RIA is now a critical fact given that the final rule published by FinCEN in August 2024 and the proposed rule by FinCEN and the SEC published jointly in May 2024 will directly subject RIAs to AML regulations. Those regulations will include requirements to report suspicious activity report (SAR) filing and implement a customer identification program (CIP).
The CIP requirement is particularly interesting since it is a necessary precursor for financial institutions to be covered by FinCEN’s customer due diligence (CDD) Rule. Therefore, these efforts will likely result in an RIA requirement for complete CDD and risk assessment, including the identification of beneficial ownership.
Compliance with FinCEN’s rule for AML obligations is required by January 1, 2026. The Rule will ultimately have important implications for large insurance companies, particularly those that don’t currently incorporate their RIA entity into their AML program.
Several key drivers of the current regulatory attention on investment advisers (IAs) exist. The size, composition, and inherent riskiness of the industry have evolved, the U.S. regulatory gap for the IA industry remains an issue for the Financial Action Task Force (FATF), and the recent tightening of sanctions on Russia has illuminated where Russian oligarchs are parking their assets and why the IA industry is vulnerable to tainted assets.
In just the past decade, the IA industry has changed drastically, doubling in size with a greater proportion of individual investors. Risky high-net-worth individuals dominate those individual investors.
Since 2015, assets under management (AUM) with IAs in the U.S. has doubled, totaling about $130 trillion as of the end of 2023. High-net-worth individuals, typically considered high risk for AML purposes, now account for most AUM within the individual investor category.2
Even given the mammoth size of the industry, U.S. IAs have remained largely unregulated for AML. The FATF has called out this gap in the U.S. AML regime for some time, in its 2016 Mutual Evaluation Report calling out AML coverage of IAs as a priority action.3 The current rules would be a large step toward closing that gap.
Moreover, lack of regulatory coverage was called out as a deficiency/scope issue in nine of FATF’s Recommendations, including R1. applying a risk-based approach; R10. CDD; R12. politically exposed persons (PEPs); R20. reporting of suspicious transactions; and R35. sanctions, three of which the U.S. was rated partially compliant.4
According to the U.S. Treasury’s IA risk assessment, IAs and the private funds they advise have served as an entry point into the U.S. financial system for wealthy Russians seeking to obscure their ownership of U.S. assets.5 U.S. SARs filed between January 2019 and June 2023 identified more than 20 U.S. IAs advising private funds where the adviser was identified as having significant ties to Russian oligarch investors or Russian-linked illicit activities.6 Those SARs identified an additional 60 U.S. IAs who managed private funds in which Russian oligarchs have invested, although there was no indication the IA was engaged in any illicit activity.7
According to the IA risk assessment, often, a member of the Russian elite or their trusted proxy invests in a public or private U.S. company with the assistance of a wealth management firm, which is usually located in an offshore jurisdiction such as Bermuda, the Cayman Islands, or Cyprus, but services primarily Russian customers. Wealth management firms invest that money in dollars through the U.S. financial system, often into U.S. technology companies in fields such as biotechnology and AI. The scale of these investments is significant and may include billions of dollars invested for a single Russian oligarch. These investments are sometimes made directly by the foreign wealth management firm and, in other instances, through a U.S.-based RIA or ERA. In other instances, funds may be routed through a consulting firm or other entity acting as an IA but not registered with or reporting to the SEC or a state regulator.8
Generally, IAs required to register or report to the SEC are covered by the rules. However, the rules do not cover state-registered IAs, but FinCEN intends to continue to monitor the risks in that state-registered sector, so the scope of the rules could change in the future. Specifically, the rules cover:
FinCEN’s rule extends to “foreign located IAs,” whose principal office and place of business is outside the U.S. But the Rule only covers those advisory activities that (i) take place within the U.S., including through involvement of U.S. personnel of the investment adviser, such as the involvement of an agency, branch, or office within the U.S., or are (ii) provided to a U.S. person or a foreign-located private fund with an investor that is a U.S. person.
IAs dually registered as broker-dealers or IAs affiliated with a broker-dealer through the same financial group, where the broker-dealer already has an AML program in place, would not need to establish a separate AML program for the IA if the existing AML program covers the IA’s business. However, this may still require an extension of the existing broker-dealer program to cover the IA’s business.
Under FinCEN’s new rule, IAs would be defined as “financial institutions” under the U.S. Bank Secrecy Act. Specifically, FinCEN’s rule for AML/CFT programs will require IAs to:
The rule permits IAs to contractually delegate the implementation and operation of aspects of their AML/CFT programs to a third party. However, the IA would remain fully responsible and legally liable for, and need to demonstrate, the program’s compliance with regulations. IAs should carefully consider whether and what elements of their program to delegate, as that delagation could create issues around a proper risk-based approach.
The joint FinCEN-SEC proposed rule for a CIP will require IAs to develop a CIP that is appropriate for the size and type of business and sufficient to form a reasonable belief that the IA knows the true identity of each customer. Specifically, the proposed rule requires:
RIAs won’t have long to come into compliance with these new rules. So, it would be wise for insurance companies with RIAs to begin to consider how the changes may affect their programs. Some key considerations include:
Based on the above requirements, RIAs will need the right mix of technology solutions to underpin their AML and CIP/CDD programs. Some of those solutions include:
Given the unique nature of RIA business, the nuances of AML risk in that business, and the intermediated chain of relationships with other financial entities (e.g., prime brokers, custodians, etc.), RIAs will need a solution that is adaptable, configurable, and transparent. The flexibility to create your own rules will be imperative as much is still to be learned about the risk typologies in the RIA space.
Relationships in the highly intermediated RIA business can be complex. At the same time, typologies within the RIA space often involve few transactions. Yet, the path, associated parties, and jurisdictions can be very telling, particularly where a network of funds or funds-of-funds and the potential for “nesting” is involved. Therefore, entity resolution and network visualization are key capabilities RIA’s will need in their technology mix.
Given the current CIP and due diligence requirements and the expectation that the future revised CDD rule could further change requirements, along with the fact that customer information in this space is a critical component to the detection of suspicious activity, a robust due diligence and customer risk rating solution will be critical for effective compliance and risk management.
AI capabilities across monitoring, due diligence, and entity resolution that can emerge trends, patterns, and unknown risks and map tricky relationships will not only be critical for compliance but also for building a better understanding of risk that can lead to better control design and calibration. Moreover, and especially for those IAs who are new to AML obligations, new controls may create a lot of noise, which AI-driven solutions can help mitigate and manage.
Sources:
Elizabeth has spent more than 20 years tackling money laundering (ML) and financial crime. At SymphonyAI she drives the strategy and innovation that delivers transformational compliance solutions. Prior to SymphonyAI she worked within the U.S. intelligence and law enforcement communities. As a Senior Intelligence Analyst with the U.S. Department of the Treasury, she drove U.S. policy and enforcement actions and supported U.S. officials and policymakers, including at OFAC and FinCEN, on ML threats and sanctions initiatives. She also served as Treasury’s first Intelligence Liaison and Senior Advisor to DEA’s Special Operations Division, spearheading large-scale ML investigations and intelligence collection initiatives, training law enforcement agents and analysts, and promoting collaboration between Treasury and U.S. and foreign law enforcement. In the private sector, Elizabeth also worked within financial institutions and consulting managing investigations teams, developing risk management strategies for complex products and services, and designing institutional AML programs and controls. Elizabeth also teaches AML and sanctions courses at the university level.
.svg)