Does my custodian already handle AML for me?
It is the first thing most advisers without direct custody assume: the broker-dealer or bank holding client assets already runs an AML program, so surely that program covers the advisory relationship too. Someone asked FinCEN to confirm exactly that during the rulemaking. FinCEN said no, in writing.
The assumption, and why it feels reasonable
Most advisory firms do not hold client cash or securities directly; a qualified custodian does, and that custodian, if it is a broker-dealer or bank, has been subject to Bank Secrecy Act AML obligations for decades. It runs its own customer due diligence, its own transaction monitoring, its own suspicious activity reporting. From the adviser's side, it looks like the AML question is already someone else's job.
What FinCEN actually said
A commenter asked FinCEN to let advisers expressly rely on the diligence or AML/CFT measures performed by another financial institution, service provider, or intermediary, meaning exactly the custodian scenario above. FinCEN's final rule answered directly: "Regarding certain suggestions that FinCEN permit advisers to expressly rely on diligence or AML/CFT measures by other financial institutions, service providers, or other intermediaries, FinCEN declines to do so... the adviser will remain responsible for overall compliance with these requirements" (89 FR 72156, p. 72188, September 4, 2024).
What this means for your program
You can delegate the execution of parts of an AML program, including to your custodian or an outside compliance vendor. What you cannot delegate is the responsibility: your firm needs its own written program, its own risk assessment, and its own designated AML compliance officer, and you are the one who has to document all of it if examined. A custodian's existing program is a resource you can point to when you describe your controls. It is not a substitute for having your own.
This page is independent research, not legal advice. It quotes FinCEN's own rulemaking with pinpoint citations. Verify anything load-bearing against the Federal Register text itself before acting on it.