Customer Identification Program (CIP): SEC/FinCEN RIA/ERA Proposal

KPMG Insights:

• “Closing the Gap”: Ongoing rulemakings expanding the regulatory perimeter to “close the gap” in regulatory coverage and further mitigate potentially illicit finance activity through the investment adviser sector, specifically RIAs and ERAs.
• Industry Alignment: Proposal would align customer identification programs for investment advisers with those of other financial institutions under the AML/CFT framework.
• Complements AML/CFT Framework: Proposal complements FinCEN’s February 2024 proposed rule to expand the definition of “financial institution” under the AML/CFT framework to include investment advisers and subject them to AML/CFT program and SAR filing requirements.

_______________________________________________________________________________________________________________________________________

May 2024

The Securities and Exchange Commission (SEC) and the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issue a joint notice of proposed rulemaking to apply customer identification program (CIP) obligations to:

• Investment advisers registered with the SEC (RIAs)
• Investment advisers that report to the SEC as exempt reporting advisers (ERAs)

The obligations would include procedures for:

• Verifying the identity of each customer to the extent “reasonable” and “practicable”.
• Maintaining records of the information used to verify the customer’s identity, including name, address, and other identifying information.   

The proposal complements a separate FinCEN proposal (issued in February 2024) that would expand the definition of “financial institutions” under the Bank Secrecy Act to include RIAs and ERAs and subject those entities to AML/CFT (anti-money laundering/countering the financing of terrorism) Program requirements, including obligations to file suspicious activity reports (SARs). At present, the definition of “financial institution” under the AML/CFT framework applies to several categories of financial institutions, including banks, broker dealers, and mutual funds but does not include RIAs or ERAs.

Highlights from the joint proposal are outlined below.

Proposed Rule on CIPs for Investment Advisers. The proposal includes several definitions along with the proposed minimum requirements for investment advisers’ CIPs.

Definitions. The proposal includes the following definitions:

• Account would be defined specifically for investment advisers' CIP obligations as any contractual or business relationship under which investment advisory services are provided, excluding accounts acquired through acquisitions, mergers, or asset purchases.
• Customer would be defined as a person (natural or legal entity) who opens a new account with an investment adviser. Certain exemptions would apply, including for financial institutions regulated by a Federal functional regulator, certain persons listed on U.S. securities exchanges, and persons that have an existing account at the investment adviser.
• Financial Institution would be defined in alignment with the Bank Secrecy Act’s definition and implementing regulations at 31 CFR 1010.100(t).
• Investment Adviser would be defined consistent with the AML/CFT Program and SAR Proposed Rule, encompassing both registered investment advisers (RIAs) and exempt reporting advisers (ERAs), as defined below:
  • RIAs - Any person who is registered or required to register with the SEC under Section 203 of the Investment Advisers Act.
  • ERAs - Any person that is exempt from SEC registration under Section 203(l) or 203(m).

Proposed CIP Requirements. The proposal would require RIAs and ERAs to establish, document, and maintain a written CIP as part of the AML/CFT Program (consistent with the February proposal). The CIP would be required to be appropriate for the investment adviser’s size and business model, but at a minimum incorporate the following:

• Customer Identity Verification Procedures: Risk-based procedures for verifying customer identities with “reasonable” certainty and in a “practical” time before or after account opening.
  • Required Information: Name, date of birth (for individuals)/date of formation (for entities), address, and identification number, as well as additional voluntary information based on risk assessments.
  • Verification: Two methods for identity verification through: 1) documents (e.g., government-issued ID for individuals, business licenses for entities) and 2) non-documentary means (e.g., contacting the customer, obtaining financial statements). The proposal includes guidance on using these methods based on the risk associated with the account, particularly for customers that are not individuals and pose a heightened risk of identity mis-verification.
• Recordkeeping: Creation and maintenance of records in a bifurcated schedule in which 1) identifying information about a customer is retained while the account remains open and for five (5) years after the account is closed, and 2) information regarding customer identity verification is retained for five (5) years after the record is made.
• Comparison with Government Lists: Procedures for comparing customer information against government lists of known or suspected terrorists or terrorist organizations as designated by relevant authorities.
• Customer Notice: Provision of “adequate” notice to customers that information will be requested to verify their identity, such that a prospective customer is able to view the notice, or is otherwise given notice, prior to opening an account.
• Reliance on another Financial Institution: Allows investment advisers to rely on CIP performed by a contracted, compliant financial institution.

Effective Date. The proposed effective date would be sixty (60) days after the date of a final rule’s publication in the Federal Register. Investment advisers would be required to develop and implement a compliant customer identification program on or before six (6) months from the effective date, but no sooner than the compliance date of the AML/CFT Program and SAR Proposed Rule, if adopted.

Comment Period. SEC and FinCEN seek public comments on the proposed rule with a submission deadline of sixty (60) days after publication in the Federal Register.  

Note: See related KPMG Regulatory Alert, here (Financial Crimes and AML: FinCEN Proposal and Treasury Actions).