Investment Funds: US Regulators propose new KYC requirements

A new Customer Identification Program (CIP) rule advanced by US regulators forms part of a global initiative to tackle money laundering and promote transparency.  The CIP proposal is allied to a regulatory package introduced in February 2024, which pulls private funds and investment advisers into the same regulatory framework (under the US Bank Secrecy Act) as financial institutions.

Why are investment advisers in the regulatory spotlight?

The private funds sector has been implicated in laundering the proceeds of corruption, fraud and tax evasion.  

The US Treasury's 2024 Investment Adviser Risk Assessment suggests that Chinese and Russian entities are using venture capital and early stage companies to infiltrate new technologies, with national security implications.  Those vehicles are also being used by Russian oligarchs in order to avoid sanctions.  

One route for these activities is to assume false identities in order to do business with private funds and their investment advisers.

Alignment with 'financial institutions' in regulatory treatment

On 15 February 2024, the Financial Crimes Enforcement Network (FinCEN) proposed the Anti-Money Laundering/Countering the Financing of Terrorism Program (AML/CFT Program).  This:

• designates SEC-registered investment advisers (RIAs) and exempt reporting advisers (ERAs) as 'financial institutions' under the Bank Secrecy Act, requiring them to develop and implement anti-money laundering compliance programmes within 12 months of the effective date of the Final Rule
• obliges RIAs and ERAs to monitor suspicious activity and to file suspicious activity reports with FinCEN as appropriate.  

The February 2024 and CIP initiatives together bring investment advisers in line with financial institutions such as banks, securities broker-dealers, credit unions and mutual funds.

Timings

The SEC's Proposed Rule was issued on 13 May 2024.  The consultation period ends on 22 July 2024.

The effective date will fall 60 days after the date of publication of the Final Rule in the Federal Register (the Effective Date).

ClP compliance will become mandatory six months after the Effective Date but in any case no sooner than the compliance date of the AML/CFT Program, if adopted.

Application

The Proposed Rule is far-reaching.  It applies to RIAs and ERAs who may be US advisers or non-US advisers; and dealing with US clients and non-US clients (Advisers).

The Proposed Rule will require RIAs and ERAs to establish, document and maintain written CIPs.  These will need to set out risk-based procedures to (a) identify; and (b) verify the identity of each customer upon the opening of an account.

'Identify'

Advisers will need to collect the following information from each customer prior to opening an account (at a minimum):

• customer's full name
• date of birth (individual)
• date of formation (entity)
• physical address
• identification number (for a US person, a taxpayer ID number).

'Verify'

The CIP must contain procedures to verify the identity of each customer to the extent reasonable and practicable. The procedures must describe when each method will be used and the verifying process must take place within a reasonable time before or after the customer's account is opened.

Advisers may verify identities through documentary means and/or non-documentary means.  They must specify the documentary evidence scrutinised (e.g. driver's licence for an individual; formation documents or business licences for a legal entity) and/or the non-documentary evidence (e.g. reference checks with other financial institutions, credit checks, account verification services).

An Adviser must use the information it has collected to form a reasonable belief that it knows the true identity of each customer.    

What does 'Account' mean?

'Account' means any contractual or other business relationship between a person and an Adviser under which the Adviser provides investment advisory services.
Accounts acquired via mergers and acquisitions, purchase of assets or assumption of liabilities are excluded.

What does 'Customer' mean?

'Customer' means a natural person or legal entity that opens a new account with an adviser.

This definition does not include:

• those with authority or control over an account, if such persons are not the accountholder
• persons who provide the necessary information to set up an account, but are not the accountholder
• other regulated institutions, e.g. banks; financial institutions regulated by a federal functional regulator; companies with publicly listed securities on US exchanges; and government entities
• those with existing accounts with the Adviser (where the customer's identity has already previously been verified, provided the Adviser continues to have a reasonable belief that it knows the true identity of the customer).

The private fund context: who is the customer?

When applied to private funds, the fund itself is the 'customer' and not the investors.  In a standard structure, where the investment adviser is organising the private fund entity, identity and verification checks should therefore be a formality.  

In the face of it, the Proposed Rule should not therefore prove very onerous for Advisers.  However, the following should be borne in mind:

• the Proposed Rule is, of course, not the finished article. 

  Some commentators have suggested that the present draft does not address regulators' stated concerns about investors engaged in fraud, money-laundering and other illicit activities.  The market would therefore be well-advised to watch this space

• February's AML/CFT Program is a separate regulatory piece and Advisers will need to be aware of their obligations under this.  Commentators have suggested  that an Adviser may, depending on the circumstances, need to take additional steps by 'looking through' the account to investors in connection with customer due diligence procedures described in their CIPs

• Advisers will of course need to ensure compliance with all AML procedures applicable to them e.g. because they voluntarily adopted them.

A risk-based approach

CIPs must be based on specific risk factors pertaining to a customer or the account.   Advisers should consider the following:

• the method of opening account – was this online or in-person? 
• the Adviser's location
• the Adviser's size
• the types of services and transactions offered by the Adviser 
• the Adviser's customer base
• the types of money laundering and terrorist financing activities present in the Adviser's location. 

When risks increase, enhanced information should be required for the purposes of the CIP.

Next steps

Following identification and verification, the Adviser must check the customer's name against lists of known or suspected terrorist organisations provided by government agencies (including OFAC).   If that check is cleared, the Adviser must make a decision on whether or not to open the account.  

Where it cannot form a reasonable belief of the verified identity of a customer, the CIP should define next steps, e.g.:  

• when the Adviser should not open an account
• the circumstances in which the adviser can  provide temporary advisory services whilst checking  their ID requirements
• when an account should be closed
• when a SAR should be filed.

Other CIP procedures

Advisers need to keep:

• information identifying customers for the life of the account plus five years
• a description of verification methods and the documents used to verify for five years
• a note of any discrepancies discovered when carrying out verification; and how these were resolved.

Advisers also need to notify potential customers of their identity verification procedures.

Reliance on third parties

Advisers can rely on the checks of other financial institutions on their customer, where:

• that customer is opening or has already opened an account with that financial institution to engage in services/transactions
• such reliance is reasonable in the circumstances
• the financial institution is regulated by a federal regulator and subject to AML/CFT programs
• the financial institution enters into a contract with the Adviser to certify annually that it has implemented an AML program and will perform the specified requirements in the CIP
• If KYC procedures are outsourced already, Advisers will be responsible for ensuring that those engaged comply with CIP.

Conclusion

As things stand, we believe that the requirements of the proposed CIP rule impose minimal administrative burdens on Advisers.  However, there is also an argument that things may change before the Proposed Rule is finalised, to dovetail this with regulators' stated aims of combatting illegal financial activity at the investor level.

Before we consider whether or not the Proposed Rule will change, there is a wider and more fundamental question at stake. As we write this, the US Appeals Court (Fifth Circuit) has overruled significant and onerous private fund reforms introduced in August 2023, a victory for those in the funds markets who have challenged the SEC for overreaching its powers.  This result may encourage similar litigation in respect of the CIP Proposed Rule.  In particular, one could argue that it exceeds the SEC's authority in connection with ERAs in particular: the point of ERA status is surely to exempt qualifying entities from substantive regulation.

The Fifth Circuit Court questioned the SEC's authority to regulate entities that Congress has exempted from regulation.  It remains to be seen whether the Biden administration is prepared to appeal the Fifth Circuit decision to the US Supreme Court, at a time when the Supreme Court is decidedly pro-business and anti-regulation.

To learn more about the Proposed Rule and to explore the possibility of responding to the regulatory authorities during the consultation period, please contact our market-leading Funds and Regulatory teams.