Building an AML program from zero: the retro-planning timeline to January 1, 2028
If your firm has no AML program today, the planning question is not what the rule requires in the abstract. It is what has to already exist on January 1, 2028, and working backward from that date is what decides when each earlier step has to start.
The three real dates behind this deadline
The rulemaking history below was read 2026-08-23 on the Federal Register, and the dates it sets are the ones this whole timeline is built backward from; if a further delay is published, every date on this page moves with it. FinCEN’s rule adding certain investment advisers to the Bank Secrecy Act was finalized on September 4, 2024 (89 FR 72156 to 72278), with an original compliance date of January 1, 2026. FinCEN proposed a two-year delay on September 22, 2025 (90 FR 45361 to 45365), and finalized that delay on January 2, 2026 (91 FR 36 to 41), setting the current compliance date at January 1, 2028. Nothing about the rule’s substance changed in that delay; only the date moved, twice documented, both times in the Federal Register. The separate question of whether that date could move again is answered on this site’s own status page, /use-cases/does-the-january-2028-aml-deadline-still-apply; this page assumes January 1, 2028 and works backward from it.
The five things that have to be running, not just written, by that date
FinCEN’s rule (31 CFR 1032.210(b), effective January 1, 2028) requires an AML/CFT program with, at minimum: internal policies, procedures, and controls; independent testing; a designated compliance officer; an ongoing employee training program; and risk-based procedures for ongoing customer due diligence. The same five elements, in the same order, already apply to broker-dealer and bank custodians under 31 CFR 1023.210 and 1020.210, which is exactly why a new program can feel like it should already be a solved problem elsewhere in the industry. It is not solved for your firm specifically until your own version of all five exists and is operating, not sitting in a drafted policy binder nobody has followed yet.
Working backward from January 1, 2028
This retro-plan is a construction from the rule’s own required elements and from FinCEN’s own hour estimates in its regulatory impact analysis (89 FR 72156, pp. 72229 to 72230), not a schedule FinCEN itself publishes. FinCEN sets the compliance date; it does not tell any specific firm when to start. 1. By the compliance date itself. All five elements operating: written program in force, a designated officer actually functioning (not just named on paper), employees trained at least once, customer due diligence procedures running against your own advisory book. 2. Before that: the independent test is complete and its findings are addressed. The rule requires the tester to have no role in building or running the program (see the quote below). For the 26.1 percent of the roster with 2 or fewer advisory staff (see the calculated number above), that test has to be performed by someone outside the firm, and sourcing, scoping, and scheduling an outside tester takes real lead time that has to be budgeted before this step, not during it. 3. Before that: employees are trained on the program that actually exists. Training has to follow a real program, not a draft; FinCEN’s rule expects the “nature, scope, and frequency” of training to match each employee’s actual exposure to AML/CFT-relevant work, which means the training plan cannot be finalized until the policies it trains people on are. 4. Before that: written policies, procedures, and controls are finished and approved, customer due diligence procedures are built and operating in practice, and the designated officer is functioning day to day, not simply named in an org chart. 5. Before that: an officer is designated and the build is approved by whoever has authority to commit the firm’s resources to it. 6. Earliest step: a risk assessment and a build-resourcing decision. FinCEN’s own estimate for a firm with limited existing AML measures is approximately 120 hours to develop the necessary policies, procedures, and controls (89 FR 72156, p. 72229); firms with some existing measures in place (commonly dual registrants or bank/broker-dealer affiliates) are assessed at roughly 25 percent of that burden, about 30 hours, to update rather than build from nothing. This is also where the in-house-versus-outside-tester decision belongs, given how many firms in the roster have no internal candidate for that role at all. One industry commenter on FinCEN’s own delay rulemaking put the shape of this plan in one sentence: “building a compliant AML program is a complex, multi-year process that requires significant planning, budgeting, and coordination” (91 FR 36, January 2, 2026, summarizing comments received). That characterization is what earned the industry side of the two-year delay FinCEN ultimately granted; it is also, read the other way, the argument for starting the build years before the date, not months.
The independent test’s frequency is risk-based, not fixed by the rule text
FinCEN’s own cost estimate assumes an ANNUAL recurring test for modeling purposes, roughly $17,000 a year (89 FR 72156, p. 72230), and that number gets repeated as if the rule itself said “test once a year.” It does not. The rule’s own text sets frequency by risk, not by calendar: “the frequency of the independent testing would depend upon the money laundering, terrorist financing, and other illicit finance risks of the adviser and the adviser’s overall risk management strategy” (89 FR 72156, discussing section 1032.210(b)(2)), and FinCEN adopted that provision “without change from the proposed rule.” A firm building its retro-plan around a hard annual mandate is planning against a number FinCEN uses for its own budget modeling, not against the actual legal requirement, which leaves the real cadence for your firm’s own risk assessment to set, informed by but not fixed at that $17,000/year estimate.
FAQ
Does the January 1, 2028 deadline still apply? As of today, yes. The full analysis of that question, including FinCEN’s stated intent to revisit the rule under the current deregulatory review, lives on this site’s own status page: /use-cases/does-the-january-2028-aml-deadline-still-apply. This page assumes that date and plans backward from it. Do I really need an outside party to test my program? Not automatically, but for a large share of the roster the rule’s own independence requirement leaves no other option. See the calculated number above: 26.1 percent of firms in scope report 2 or fewer advisory employees, meaning nobody in the firm both understands the program and had no role in running it, which is what the rule requires of a tester. Is the annual testing cost, about $17,000, a fixed yearly requirement? It is FinCEN’s own cost-modeling assumption for its regulatory impact analysis, not a fixed cadence written into the rule text, which sets testing frequency by the adviser’s own risk profile instead. See the section above for the exact language. Where do the dates and hour estimates in this timeline come from? Every date and every hour or dollar estimate above is sourced to the Federal Register text of either the original rule or its delay, page-cited. See Sources below. Is this legal advice? No. This is a retro-plan built from the rule’s own required elements and FinCEN’s own published estimates, not a substitute for counsel, and it makes no promise about any specific firm’s compliance status or timeline. Whether your own firm is in scope, and which risk factors apply to it, is what the checker at normfin.com reads off the SEC’s own adviser roster.
Sources (primary, dated)
- Financial Crimes Enforcement Network, “Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers,” 89 FR 72156 to 72278, published September 4, 2024, RIN 1506-AB58, 31 CFR Parts 1010 and 1032. https://www.federalregister.gov/documents/2024/09/04/2024-19260/ - Original compliance date: January 1, 2026 (per this document’s own effective-date metadata, verified via the Federal Register API 2026-08-23). - 120-hour build estimate and roughly 25 percent (about 30 hours) update estimate for firms with existing measures: printed page 72229. - Approximately $17,000/year independent-testing cost estimate: printed page 72230. - Independent test frequency is risk-based, not fixed: discussion of proposed section 1032.210(b)(2), verified verbatim against the full text 2026-08-23. - Financial Crimes Enforcement Network, “Delaying the Effective Date of the Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers” (notice of proposed rulemaking), 90 FR 45361 to 45365, published September 22, 2025, proposing the compliance date move to January 1, 2028. https://www.federalregister.gov/documents/2025/09/22/2025-18271/ - Financial Crimes Enforcement Network, same title (final rule), 91 FR 36 to 41, published January 2, 2026, setting the compliance date at January 1, 2028 and effective the same date. Industry-comment characterization of the build as “a complex, multi-year process” quoted from this document’s summary of comments received. https://www.federalregister.gov/documents/2026/01/02/2025-24184/ - 31 CFR 1023.210 (broker-dealers) and 31 CFR 1020.210 (banks), same five-element program structure, confirmed via Cornell Law’s Legal Information Institute 2026-08-23, cited above for comparison only. - SEC investment adviser public roster, sec.gov/help/foiadocsinvafoiahtm.html, roster dated 2026-08-03 per ~/Code/normfin/data/meta.json, filtered per ~/Code/normfin/scripts/build-data.ts. Staff-size cross-tab computed 2026-08-23, method and code shown above. - staged/praxtrust/seo/aio-queries.txt, AI Overview measurement dated 2026-08-20, for the related tracked query’s AIO status only (see “AI Overview risk” above for scope).
Published by Neige AI, Inc., last reviewed August 25, 2026. See the method and sources.
This page is independent research, not legal advice. It quotes FinCEN’s own rulemaking with pinpoint citations. Verify anything load-bearing against the Federal Register text itself before acting on it.