The SEC compliance rule vs FinCEN’s AML rule: two programs, one small firm

The SEC compliance rule (17 CFR 275.206(4)-7) and FinCEN’s AML rule for investment advisers (31 CFR 1032.210, compliance date January 1, 2028) both require a registered adviser to keep a written compliance program, and that resemblance is exactly why so many firms assume the manual they already maintain covers the obligation that is coming. It does not. The two rules answer to two different agencies, protect against two different failures, and only one of the two programs exists at most firms today. This page walks the two texts side by side, so you can see precisely what your existing program already gives you and what still has to be built.

What the SEC rule actually requires, in its entire text

Strip the releases and the exam commentary away, and 17 CFR 275.206(4)-7 makes three demands (text read 2026-08-27 via Cornell LII, law.cornell.edu/cfr/text/17/275.206(4)-7). Adopt and implement “written policies and procedures reasonably designed to prevent violation, by you and your supervised persons, of the Act and the rules” (paragraph (a)). Review, “no less frequently than annually, the adequacy of the policies and procedures established pursuant to this section and the effectiveness of their implementation” (paragraph (b)). And designate a chief compliance officer, “an individual (who is a supervised person) responsible for administering the policies and procedures that you adopt under paragraph (a)” (paragraph (c)). Notice what is absent from that list. There is no training requirement anywhere in the rule text. There is no independent testing requirement: the annual review in paragraph (b) is your own firm reviewing its own program. And there is no government filing obligation of any kind. The rule is about preventing violations of the Advisers Act, by your own people, checked by your own people.

What the FinCEN rule adds that 206(4)-7 never asked for

FinCEN’s rule (89 FR 72156, September 4, 2024, adding 31 CFR 1032.210, compliance date moved to January 1, 2028 by 91 FR 36) borrows the outer shape of a compliance program and fills it with different substance, element by element:

Program element	Under the SEC compliance rule (17 CFR 275.206(4)-7)	Under FinCEN’s AML rule (31 CFR 1032.210)
Written policies and procedures	Required, aimed at preventing violations of the Advisers Act by the firm and its supervised persons	Required, aimed at the money-laundering and terrorist-financing risk of your own advisory business, built around what your own Form ADV discloses
Checking that the program works	An annual review your own firm performs on itself, paragraph (b)	Independent testing, “conducted by the investment adviser’s personnel or by a qualified outside party” (31 CFR 1032.210(b)(2), rule text at 89 FR 72156, p. 72276), performed by someone independent of the function being tested
Designated person	A chief compliance officer administering the paragraph (a) policies	An AML/CFT officer responsible for implementing and monitoring the program; the two roles may be held by one person, with the caution quoted below
Training	Not in the rule text	Ongoing training for the employees whose duties touch the program’s risks
Filings to the government	None	Suspicious activity report filing obligations, named in the final rule’s own title

The row advisers most often misread

It is the second one. FinCEN’s own preamble draws the contrast itself, describing the SEC’s separate Compliance Rule under which “RIAs must review their policies and procedures at least annually” (89 FR 72156, p. 72217) as background to its own, different independent-testing demand. Your annual 206(4)-7 review does not become the AML test by being thorough; it fails independence by construction, because the reviewer is the firm itself. The annual test is priced by FinCEN’s own regulatory impact analysis: “FinCEN estimates the average cost of such testing will be approximately $17,000... a new recurring cost for all RIAs and ERAs” (89 FR 72156, regulatory impact analysis, pp. 72229-72230).

One person, two hats: what FinCEN actually said

The overlap that genuinely exists between the two rules is the person. FinCEN wrote that “An RIA that is subject to the SEC’s Compliance Rule... could designate its chief compliance officer... to be responsible for this provision of this final rule. The final rule does not, however, require that an investment adviser designate the same person” (89 FR 72156, p. 72193, footnote 165). The same page carries the caution that an officer with “multiple additional job duties or conflicting responsibilities that adversely impact the officer’s ability to effectively coordinate and monitor day-to-day AML/CFT compliance generally would not fulfill this requirement” (89 FR 72156, p. 72193). The industry’s own annual survey found that “the majority of CCOs (63 percent) continue to wear more than one hat (with 17 percent also serving in some legal capacity)” (2025 Investment Management Compliance Testing Survey, Investment Adviser Association, ACA Group, and Yuter Compliance Consulting, 577 responding firms, fielded May 2025, published July 22, 2025). So the same person can hold both roles, and at most small firms the same person will; what the rule refuses is a title with no time, authority, or access behind it.

How many firms will run both programs with five people or fewer

Computed on 2026-08-27 on this site’s own extract of the SEC’s public adviser roster (data/firms.json, roster dated 2026-08-03, the same file the checker on this site reads): of the 11,223 SEC-registered advisers the extract holds in scope, 4,595 firms, 40.9 percent, report five or fewer total employees, and the median firm reports seven. The 206(4)-7 program those firms already run and the AML program they must build by January 1, 2028 will, in nearly half of the population, be carried by the same handful of people. That is the practical reason this comparison matters: it is not two departments reading two rules, it is one person deciding what their existing manual already covers. FinCEN estimated the build effort itself: “FinCEN estimates it will take approximately 120 hours... to develop the necessary policies, procedures, and controls to establish an AML/CFT program” (89 FR 72156, regulatory impact analysis, pp. 72229-72230). The full field-by-field description of the extract lives on the method page, and whether your own firm is in the covered population is what the checker reads off the roster.

FAQ

Does a thorough 206(4)-7 manual satisfy the FinCEN rule? No. The two programs can live in one binder, but the AML program has its own required elements, its own designated officer, and an independent test your own annual review cannot substitute for. Can our CCO be the AML/CFT officer? Yes, FinCEN said so explicitly, with the workload caution quoted above; the practical detail is on the checklist page for firms with no compliance team. Is any of this due before January 1, 2028? The compliance date is January 1, 2028, moved from January 1, 2026 by FinCEN’s delay notice (91 FR 36, published January 2, 2026); the delay changed the date, not the content. Does the FinCEN rule replace or amend the SEC rule? No. Both run in parallel, and the SEC remains your examiner for 206(4)-7 exactly as before.

Sources

- 17 CFR 275.206(4)-7, Compliance procedures and practices, text read 2026-08-27 via Cornell LII, law.cornell.edu/cfr/text/17/275.206(4)-7. - Financial Crimes Enforcement Network, final rule, 89 FR 72156 to 72278, published September 4, 2024, RIN 1506-AB58, 31 CFR Parts 1010 and 1032, https://www.federalregister.gov/documents/2024/09/04/2024-19260/. Independent-testing clause at p. 72276 (31 CFR 1032.210(b)(2)); the Compliance Rule contrast at p. 72217; the CCO dual-hat discussion and footnote 165 at p. 72193; the cost and hours estimates at pp. 72229-72230. - FinCEN, compliance-date delay, 91 FR 36, release 2025-24184, published January 2, 2026: compliance date moves from January 1, 2026 to January 1, 2028. - 2025 Investment Management Compliance Testing Survey, Investment Adviser Association, ACA Group, and Yuter Compliance Consulting, 577 responding firms, fielded May 2025, published July 22, 2025. - SEC investment adviser public roster, roster dated 2026-08-03 per data/meta.json; firm counts computed on 2026-08-27 on data/firms.json; extraction method per scripts/build-data.ts, described on the method page.