A US KYC backlog can contain bank customers, brokerage accounts and private fund investors. Those files do not all sit under the same AML rules. Before asking for more documents, establish which entity holds the obligation and what its policy requires.
This guide focuses on BSA/AML compliance and customer due diligence for US financial services teams. It separates current requirements from the delayed investment adviser rule and gives practical recommendations for file reviews. For help completing the work, see our US KYC services and remediation support.
Identify which US AML rules apply to your business
The Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act and other legislation, underpins US anti-money laundering regulation. FinCEN administers the BSA framework, with implementing rules in 31 CFR Chapter X. Supervision also involves the relevant banking agencies, the SEC and other sector regulators. FINRA reviews member broker-dealers against its AML rules.
For the sectors covered here:
- Banks have BSA/AML program, customer identification, due diligence, recordkeeping and reporting obligations. Read the bank-specific rules in Part 1020 with the general rules in Part 1010.
- Broker-dealers have obligations under Part 1023. FINRA members must also meet Rule 3310, including written senior-management approval of the AML program.
- Mutual funds have their own requirements under Part 1024. A private fund is not a mutual fund merely because both pool investors’ money.
- Investment advisers and private funds need a separate scope assessment. The adviser’s registration, activities and exclusions matter; the adviser, fund, administrator and custodian are distinct parties.
Money services businesses and other covered sectors have different rules. State requirements and activity-specific measures may also apply. This guide is a starting point for financial services KYC work, not a complete checklist for every US business.
Check the investment adviser deadline before setting a project
FinCEN’s final delay rule moved the effective date of the investment adviser AML/CFT program and Suspicious Activity Report (SAR) rule from January 1, 2026 to January 1, 2028. It applies to covered SEC-registered investment advisers and exempt reporting advisers, subject to the rule’s scope and exclusions. The final delay rule also says FinCEN intends to review the rule.
As of October 7, 2026, firms should not describe those delayed obligations as already in force. The separate investment adviser Customer Identification Program rulemaking must also be checked on its own terms; the AML rule does not make a proposed CIP requirement effective.
The delay does not suspend obligations a firm already has in another capacity, such as a broker-dealer, or remove applicable sanctions obligations. Private fund investor checks may also follow fund documents, contractual arrangements, another jurisdiction’s rules or a voluntarily adopted policy. Record that basis instead of labeling every request a current FinCEN requirement.
For a readiness project, we recommend separating work required today from preparation for the scheduled 2028 rule. Check for amendments before treating the current scope as fixed.
Build a BSA/AML program around the institution’s risks
For banks and broker-dealers, the program framework includes internal controls, a designated compliance officer, training and independent testing, with risk-based customer due diligence requirements. The firm must also address the applicable reporting and recordkeeping rules. Completing customer files covers only part of that program.
FINRA Rule 3310 generally requires independent testing annually on a calendar-year basis. It permits testing every two years for specified firms that do not execute customer transactions, hold customer accounts or act as introducing brokers for customer accounts. The tester cannot perform the functions being tested, be the designated AML compliance person, or report to either. Do not apply that two-year exception without checking eligibility.
Our scoping recommendation is to give each control an owner and identify where file work connects to monitoring, investigation and reporting. A completed KYC checklist cannot demonstrate that the wider program detects suspicious activity.
Separate customer identification from ongoing due diligence
A Customer Identification Program, or CIP, sets procedures for forming a reasonable belief that the institution knows the customer’s true identity. For banks, the required identifying information generally includes name, date of birth for an individual, address and identification number, subject to the rule’s exceptions. Verification can use documentary or non-documentary methods under risk-based procedures. The bank CIP rule, 31 CFR 1020.220, also addresses customer notice, discrepancies and records.
Customer due diligence, or CDD, goes further. Covered institutions must understand the nature and purpose of the relationship to develop a customer risk profile, monitor for suspicious transactions and maintain or update customer information on a risk basis. A passport does not explain why a company opened an account or whether its activity fits that purpose.
For remediation, record the missing fact and the action needed to resolve it. Distinguish an expired document from an unexplained ownership change or activity inconsistent with the customer profile. Each calls for a different response.
Apply the beneficial ownership rule and the 2026 relief
The CDD Rule applies to covered banks, mutual funds, securities brokers or dealers, futures commission merchants and introducing brokers in commodities. Under 31 CFR 1010.230, the standard definition generally combines each individual owning 25% or more of a legal entity customer with one individual with significant responsibility to control, manage or direct it. The same person may satisfy both tests.
Check the rule’s exclusions and exemptions before applying those tests. Certain customers are excluded, while some pooled investment vehicles and nonprofit entities are subject only to the control requirement. A fund structure therefore needs an eligibility assessment before a blanket request for every underlying investor’s documents.
FinCEN’s February 13, 2026 order, FIN-2026-R001, permits covered institutions to limit beneficial-owner identification and verification to:
- The legal entity customer’s first account opening with the institution.
- Later knowledge of facts that reasonably call the reliability of previously obtained information into question.
- Checks needed under the institution’s risk-based ongoing CDD procedures.
For the third scenario, the order permits use of previously obtained information if the customer confirms it is current and accurate and the institution records that confirmation. If the customer cannot confirm it, or reliability is in doubt, the institution must identify and verify the beneficial owners under the rule.
The relief is optional and does not end ongoing monitoring. Update approved procedures before changing a workflow that currently collects information at every account opening.
Keep OFAC screening separate from the CDD ownership test
OFAC administers US economic and trade sanctions. Sanctions obligations are separate from BSA customer due diligence and can apply even where a firm is outside a particular BSA program rule. OFAC’s compliance framework describes management commitment, risk assessment, internal controls, testing and auditing, and training. The framework guides a sanctions compliance program; it is not a substitute for the prohibitions in each sanctions program.
Under OFAC’s 50 Percent Rule, an entity owned, directly or indirectly, 50% or more in the aggregate by one or more blocked persons is itself considered blocked, even if it is absent from a sanctions list. That is a different test from the CDD Rule’s 25% ownership threshold and control requirement.
A clear name-screening result does not settle the ownership question. In a review file, document the ownership analysis, the information used to resolve possible matches and any escalation. PEP status and adverse media are risk inputs; neither automatically establishes an OFAC prohibition. Apply enhanced due diligence where the applicable rules or assessed risk require it, including source-of-funds or source-of-wealth work where relevant.
Do not confuse corporate BOI reporting with customer KYC
The Corporate Transparency Act’s Beneficial Ownership Information reporting regime concerns reports to FinCEN. A covered institution’s CDD Rule obligations concern its own customers. They are separate systems.
FinCEN’s current BOI guidance states that US-created entities are exempt from BOI reporting. Its final rule, effective August 14, 2026, made the domestic-entity exemption permanent and expanded relief for US persons. Certain foreign-formed entities registered to do business in the United States remain within scope unless exempt.
An exemption from filing a BOI report does not by itself exempt a company from a bank’s beneficial-owner checks. Keep the customer’s CDD classification and any BOI reporting analysis separate in your records.
Connect review findings to monitoring, reporting and records
FinCEN’s CDD FAQ F.6 requires customer information to be updated when monitoring identifies changes relevant to customer risk. Review timing is risk-based. A firm may set periodic reviews under its policy, and a material change or suspicious activity can require attention before the scheduled date. Document the update and reassess the customer risk profile where relevant.
For file work, we recommend recording changes in ownership, control, expected activity or relevant adverse information, with an owner for each unresolved question. Feed those findings into the institution’s investigation process. SAR thresholds, timing and confidentiality rules depend on the applicable sector provisions; a KYC review does not replace that assessment or the required filing process. Currency Transaction Reports and other BSA reports also require separate controls where applicable.
Retention periods depend on the record. For example, the bank CIP rule and the CDD beneficial-ownership rule generally distinguish identifying information kept for five years after account closure from verification records kept for five years after they are made. Other records, including sanctions records, have separate requirements. Agree the retention schedule, retrieval rights and post-engagement access rather than applying one deletion date to every document.
Clear the KYC backlog without losing oversight
Operational outsourcing leaves the institution responsible for compliance. Regulatory reliance on another financial institution has specific conditions, including eligibility, reasonableness and contractual annual certification. An ordinary service-provider engagement does not automatically meet those conditions.
Before transferring files, agree the legal entity and policy version, the review population, evidence standards, quality checks and escalation route. Document data access, hosting, retention and handover terms. Keep customer acceptance, exceptions and reporting decisions with the institution’s authorized team.
Our managed US KYC services cover onboarding, remediation and periodic or event-driven file reviews. Agents organize the evidence and perform the first pass; qualified compliance reviewers check the work. Your team receives reviewed files with open issues recorded. Bring the case count, entity type and target date to scope the project.