On May 13, 2024, the Securities and Exchange Commission (“SEC”) and the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”) jointly proposed a new rule (“CIP Proposed Rule”) that would require advisers registered or required to be registered with the SEC (“RIAs”) and those exempt from registration under sections 203(l) or 203(m) of the Investment Advisers Act of 1940 (“ERAs”)¹ to establish, document, and maintain written customer identification programs (“CIPs”). According to SEC Chairman Gary Gensler, the proposal is “designed to make it more difficult to use false identities to establish customer relationships with investment advisers,” and could decrease the risk of bad actors “accessing the U.S. financial markets to launder money, finance terrorism, or move funds for other illicit purposes.” The proposal refers to a recent Treasury risk assessment that identifies the investment adviser sector as vulnerable to such criminal activity by sanctioned entities and others, “most notably the People’s Republic of China and Russia, [which seek] to access certain technology and services with long-term national security implications through investments in early stage companies.”

The CIP requirements in the proposed rule already apply to financial institutions like banks, broker-dealers and mutual funds and would build on FinCEN’s February 2024 proposal to expand the definition of “financial institutions” to include RIAs and ERAs under the Bank Secrecy Act (“BSA”), subjecting them to anti-money laundering/countering the financing of terrorism (“AML/CFT”) and Suspicious Activity Report filing obligations and other rules (“AML/CFT Program and SAR Proposed Rules”).

What Does the CIP Proposed Rule Require?

The proposal would require RIAs and ERAs to adopt written CIPs and collect, at a minimum, specific identifying information on each customer “within a reasonable time” before or after an account is opened. Further, the investment adviser must be able to “form a reasonable belief that [they] know the true identity of their customers”; thus, some situations will require the investment adviser to assess certain risk factors to determine whether additional identifying information will be needed. When developing a CIP, an investment adviser should weigh potential risks that stem from, e.g., (a) the different types of accounts that the investment adviser maintains as well as the various methods for opening accounts with the investment adviser, (b) the types of identifying information available, (c) whether the account is being opened in-person as opposed to online, and (d) the types of money laundering and terrorist financing activities in the present jurisdiction.

Under the CIP Proposed Rule, RIAs and ERAs would be required to create:

• A written CIP;
• Procedures to identify and verify each customer that opens an account, including:
  • Collecting minimum information on each customer, like their name, date of birth (or date of formation for non-individual customers), and identification number (e.g., a Social Security number or tax-payer ID number); and
  • Procedures to verify the identity of each customer based on the above information (e.g., through documentary or non-documentary information, or both);
• Recordkeeping procedures for collecting and maintaining records of customer information obtained pursuant to the CIP and how such records were verified, which records must be retained for at least five years after the closure of the related customer account;²
• Procedures for determining whether a customer is listed on any known or suspected terrorist lists;³
• Procedures for giving adequate notice to customers of the investment adviser’s CIP requirements.

Triggering CIP Obligations – Understanding “Customers” and “Accounts” Under the CIP Proposed Rule.

CIP obligations are triggered under the CIP Proposed Rule when a customer opens an account with an investment adviser. An “account” means “any contractual or other business relationship between a person and an investment adviser under which the investment adviser provides investment advisory services” (excluding accounts acquired through an acquisition, merger, purchase of assets or assumption of liabilities, as these accounts are not newly opened). A “customer” means a natural person or legal entity that opens a new account with the RIA or ERA. To be consistent with CIP requirements for other financial institutions, the following are excluded from the scope of the “customer” definition: (a) a financial institution regulated by a federal functional regulator or a bank regulated by a state bank regulator; (b) certain U.S. government entities; (c) certain entities (other than banks) that are publicly listed on U.S. securities exchanges; or (d) persons that have an existing account with the RIA or ERA, provided the RIA or ERA has a reasonable belief that it knows the true identity of such person. Further, “customer” only applies to the accountholder and would not ordinarily require a “look through” to individuals with authority or control over an account but are not the accountholder.⁴

While there is some confusion whether the foregoing definition of “customer” includes the underlying investors in a private fund, as opposed to the private fund itself (which is the “client” reported by advisers on Form ADV, Item 5.D), that interpretation would run counter to the overall concerns raised by the SEC and FinCEN with respect to, and the CIP Proposed Rule’s focus on, natural persons and other bad actors engaged in criminal activity.

Reliance on Another Financial Institution to Perform CIP obligations.

The CIP Proposed Rule allows for RIAs and ERAs to rely on other financial institutions to perform all or a portion of the adviser’s CIP, provided: the reliance is reasonable under the circumstances; the other financial institution is subject to a rule implementing the AML/CFT compliance program requirements and regulated by a federal functional regulator; and the other financial institution has entered into a contract with the RIA or ERA in which it must annually certify to the investment adviser that it has implemented an AML/CFT program. However, it should be noted that the RIA or ERA remains responsible for ensuring compliance with the CIP Proposed Rule and must monitor the operation of its CIP and ensure its effectiveness.

Many RIAs and ERAs outsource their current, know-your-customer procedures and other regulatory requirements to third parties. These third parties, particularly non-U.S. fund administrators or placement agents, would not likely meet the above requirements to allow another financial institution to perform CIP procedures. If the CIP Proposed Rule goes into effect unmodified, it would be important for RIAs and ERAs to review their existing policies to ensure they comply with the CIP obligations.

****

SEC Commissioner Mark T. Uyeda has issued his statement in opposition to the CIP Proposed Rule. While he finds the goals of preventing money laundering and terror financing laudable, he questions whether the proposal’s additional burdens placed on RIAs and ERAs, particularly smaller investment advisers already grappling with the “mountain of new regulations that have been imposed in recent years,” will meaningfully contribute to those efforts. Written comments from the public on the CIP Proposed Rule may be submitted before July 12, 2024. We encourage clients to reach out to the Dentons attorneys listed here or their Dentons contact with any questions as we monitor developments on the CIP Proposed Rule.

1. While the CLP Proposed Rule would cover both U.S. and non-U.S. RIAs and ERAs, state-level registered or exempt investment advisers are outside the scope of the proposal.↩
2. This five-year period is generally consistent with the retention period under the Advisers Act books and records rule. Advisers, however, may be required to keep certain records for longer periods under the books and records rule.↩
3. These lists have not yet been designated for CIP purposes.↩
4. The CIP Proposed Rule does require that the CIP address scenarios where, pursuant to the RIA or ERA’s risk-based assessment of a non-individual customer, the investment adviser might need to obtain further information regarding the individuals with authority or control over the account so that it can verify the customer’s identity.↩