Is FinCEN’s independent AML test really required every single year?
Not by the rule’s own words. The codified requirement, 31 CFR 1032.210(b)(2), names no fixed interval at all; it just requires independent testing, full stop. FinCEN’s own preamble ties the frequency to each adviser’s own money-laundering risk, not a calendar.
What the codified rule actually says
Strip away the preamble and the commentary, and the regulation itself is short. The minimum program standards at 31 CFR 1032.210(b) require an investment adviser to “Provide for independent testing for compliance to be conducted by the investment adviser’s personnel or by a qualified outside party” (31 CFR 1032.210(b)(2), from the final rule text, 89 FR 72156, p. 72276, September 4, 2024). No number of months, no “annually,” no “at least once per calendar year” anywhere in that clause. FinCEN’s own preamble draws the same contrast a page later, discussing the SEC’s separate Advisers Act “Compliance Rule,” under which “RIAs must review their policies and procedures at least annually” (89 FR 72156, p. 72217): a DIFFERENT, pre-existing SEC requirement that DOES name a fixed interval, cited by FinCEN as background, not as part of this rule. FinCEN clearly knows how to write “at least annually” when it means to. It chose not to write it into 31 CFR 1032.210(b)(2).
What decides the frequency instead
The rule’s preamble is explicit about what fills that gap: “The frequency of the independent testing would depend upon the money laundering, terrorist financing, and other illicit finance risks of the adviser and the adviser’s overall risk management strategy” (89 FR 72156, p. 72192). A commenter pushed back, asking FinCEN to relax the independence requirement for smaller advisers instead; FinCEN’s answer confirms the approach carried through unchanged: “FinCEN is implementing this requirement without change from the proposed rule” (89 FR 72156, p. 72192). The rule is risk-based on purpose, not vague by accident.
Why almost every firm still tests annually anyway
Risk-based does not mean untested in practice. FinCEN’s own regulatory impact analysis prices the recurring cost of this testing at roughly $17,000 a year, an ANNUAL modeling assumption FinCEN built its cost estimate around, not a floor the rule text imposes (89 FR 72156, regulatory impact analysis, pp. 72229-72230). Before this rule existed at all, industry practice already leaned the same way: FinCEN’s own baseline research found “40 percent performed independent testing of their AML/CFT program annually” among RIAs surveyed around 2016 (89 FR 72156, p. 72219). Add the actual spread of risk in the target population, 25.5 percent of the 11,223 firms already confirmed in scope carry none of the six risk factors this checker tracks while 23.4 percent carry three or more at once (computed above), and a 12-month cycle reads as the sensible default for most of that range, not a legal requirement for all of it.
What this means for your own firm
For the large majority of advisers, nothing changes: budget for a test every 12 months, because that is what almost every covered firm’s own risk profile will support, and because a shorter interval is the safer read of an ambiguous requirement. Where this actually matters is at the two tails: an adviser with several of the risk factors above compounding at once may have a documented case for testing MORE often than annually, and an adviser with none of them, and a genuinely low risk profile it can support in writing, is the one case where a longer interval is not obviously non-compliant on the rule’s own terms, though nothing in the rule or in FinCEN’s guidance states a safe maximum either. None of this is legal advice: the rule leaves this judgment to the adviser’s own documented risk assessment, and that document, not a blog post, is what an examiner will ask to see. Talk to counsel before setting an interval other than 12 months.
FAQ
Does the FinCEN rule use the word “annual” anywhere in its independent-testing requirement? No. The codified clause, 31 CFR 1032.210(b)(2), sets no interval at all. “Annual” comes from FinCEN’s own cost-modeling assumption and from how almost every secondary summary of the rule, including this site’s own sister page, describes the practical default. Could a firm legitimately test less often than every 12 months? Only with a documented, risk-based justification specific to that firm; nothing in the rule sets a floor, but nothing in it sets a safe minimum interval either, so this is a case to build with counsel, not to assume. Does a higher-risk firm have to test more than once a year? The rule’s own preamble ties frequency to risk in both directions: a firm with a materially higher risk profile, several of the factors above compounding at once, is the more plausible candidate for testing MORE often than annually, not less. How is this different from this site’s other page on annual independent testing? That page answers who can perform the test and what it costs. This page answers whether the interval itself is fixed by law. Read both; they are not the same question. Cta: Check my own firm’s risk profile Whether your own firm is in scope, and which risk factors apply to it, is what the checker at normfin.com reads off the SEC’s own adviser roster.
Sources
- FinCEN, final rule, “Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers,” 89 FR 72156 (September 4, 2024). RIN 1506-AB58. Retrieved 2026-08-23 from https://www.govinfo.gov/content/pkg/FR-2024-09-04/html/2024-19260.htm (HTTP 200, every quote in this draft verified by direct substring search against the fetched text, not summarized by a fetching tool alone): - Codified rule, 31 CFR 1032.210(b)(2): p. 72276. - “The frequency of the independent testing would depend upon...” and “FinCEN is implementing this requirement without change from the proposed rule”: both p. 72192. - “RIAs must review their policies and procedures at least annually” (the separate Advisers Act Compliance Rule, cited by FinCEN as background, not part of this rule): p. 72217. - “40 percent performed independent testing of their AML/CFT program annually”: p. 72219. - Testing cost estimate ($17,000/year): regulatory impact analysis, pp. 72229-72230, already cited on the site as TESTING_COST_QUOTE / COST_ANALYSIS_CITE in lib/fincen/citations.ts. - ~/Code/normfin/data/firms.json and data/meta.json: SEC investment-adviser roster, roster date 2026-08-03, 11,223 firms, computed 2026-08-23 (see command and output above). - ~/Code/normfin/lib/fincen/scope.ts: the six risk factors this page’s own computed number reuses exactly, for consistency with what the live /check/<crd> tool shows a visitor.
Published by Neige AI, Inc., last reviewed August 25, 2026. See the method and sources.
This page is independent research, not legal advice. It quotes FinCEN’s own rulemaking with pinpoint citations. Verify anything load-bearing against the Federal Register text itself before acting on it.