What makes wealth management useful to money launderers?
On 17 July 2025, the UK's national risk assessment kept the money laundering risk of wealth management at high (para 5.50). About 400 FCA supervised firms do wealth management as their main business, with about 43,000 staff and £9 billion in revenue (para 5.48). It also estimates at least 1,000 family offices in the UK managing more than £700 billion, many of them not required to be regulated (para 5.53).
Anti money laundering (AML) controls assume a firm sees the person behind each payment. Portfolio managers handle high values "without direct involvement of the end customer" (para 5.51). High net worth clients are more likely to use complex structures and accounts in several countries, and criminal money placed in a portfolio earns a legitimate return that hides its origin (para 5.52).
In the US, Treasury's 2024 Investment Adviser Risk Assessment counted 15,391 registered advisers with about $125 trillion under management and 5,846 exempt reporting advisers in July 2023. Advisers, it found, sit largely outside full AML rules. They are "not examined for AML/CFT compliance". It put the highest risk with exempt reporting advisers, then with registered advisers to private funds.
Which AML laws apply to investment firms, asset managers and wealth managers?
| Rulebook | Law (in force, November 2026) | Supervisor | Firms caught |
|---|---|---|---|
| FATF | FATF Recommendations (updated June 2026); Guidance for a Risk Based Approach for the Securities Sector (October 2018) | National supervisors, assessed in mutual evaluations | Securities providers, including brokers and investment fund managers |
| EU | Directive (EU) 2015/849 art. 3(2)(c), (d) as transposed, until 9 July 2027; Regulation (EU) 2024/1624 (AMLR) arts. 2(1)(6)(d), (e) and 3(2) from 10 July 2027 | National supervisors (in Italy, the Bank of Italy for asset management companies); AMLA directly supervises selected institutions from 2028 | Investment firms as defined in MiFID II art. 4(1)(1); UCITS and their management companies; alternative investment funds and their managers |
| UK | Money Laundering Regulations 2017 (MLR) reg. 10(2)(c), (e); Proceeds of Crime Act 2002 (POCA) | FCA | Firms whose regular business is investment services or activities; collective investment undertakings marketing their units |
| US | Bank Secrecy Act; 31 CFR part 1023 (broker dealers), part 1024 (mutual funds); part 1032 for advisers from 1 January 2028 (89 FR 72156) | FinCEN; SEC; FINRA | Broker dealers and mutual funds now; registered and exempt reporting advisers from 2028, except advisers registered only as mid sized, multi state or pension consultant advisers and those reporting no assets under management on their latest Form ADV (31 CFR 1010.100(nnn)) |
| Türkiye | Law No. 5549; Regulation on Measures art. 4(1)(d), (f), (h); Capital Markets Law No. 6362 | MASAK (financial intelligence unit), whose compliance audits are run by inspectors that include Capital Markets Board experts (Law 5549 arts. 2(1)(e), 11); Capital Markets Board (SPK) for licenses | Intermediary institutions (brokers), portfolio management companies, investment trusts, clearing and custody institutions |
| UAE | Federal Decree by Law No. 10 of 2025; Cabinet Resolution No. 134 of 2025 (CR 134) art. 2(7) to (11) | Capital Market Authority (CMA, formerly the SCA) onshore; DFSA in the DIFC; FSRA in ADGM | Trading in financial market instruments for clients; securities issuance services; fund and portfolio management; safekeeping of cash or liquid securities for others; investing or managing funds for others |
Every rulebook reaches the firm that manages or holds client assets; US advisers are the gap until 2028. In the EU, national law under the Directive reaches investment firms and collective investment undertakings today; the AMLR binds them directly from 10 July 2027. The AMLR's investment firm is the one MiFID II defines in art. 4(1)(1), so MiFID scope sets AML scope. Banks are covered in the banking industry guide.
What are the AML requirements for investment and wealth firms in 2026?
| Duty (in force, November 2026; AMLR from 10 July 2027) | FATF | EU | UK | US (31 CFR) | Türkiye | UAE |
|---|---|---|---|---|---|---|
| Customer due diligence and purpose | R.10 | Directive art. 13; AMLR arts. 20, 25 | MLR regs. 27, 28 | CIP 1023.220; customer risk profile 1023.210(b)(5) | Regulation on Measures art. 5 | CR 134 art. 7 |
| Beneficial owner | R.10, R.24 | Directive art. 3(6): more than 25%; AMLR art. 52: 25% or more | MLR reg. 5: more than 25% | 1010.230(d): 25% or more plus one control person; since 13 February 2026 verified at the first account, on doubt or by risk | Regulation art. 17/A: more than 25% | CR 134 art. 10: 25% or more |
| PEPs and their wealth | R.12 | Directive art. 20(b)(ii); AMLR art. 42(1)(b): adequate measures to establish source of wealth and source of funds | MLR reg. 35(5)(b): source of wealth and funds; reg. 35(3A): a domestic PEP starts at lower risk than a foreign one | 1010.620(c): enhanced scrutiny for proceeds of foreign corruption where a senior foreign political figure owns a private banking account ($1,000,000 minimum, non US owner, a liaison officer: 1010.605(m)) | No PEP article in the Regulation on Measures | CR 134 art. 16(1)(a)(3): reasonable measures on source of funds and wealth of foreign PEPs; domestic PEPs when the relationship is high risk (art. 16(1)(b)(2)) |
| Enhanced due diligence and source of wealth | R.10, R.19 | Directive art. 18; AMLR art. 34(4)(c): source of funds and wealth of client and owners, one of the listed measures; art. 34(5): clients with €50 million or more | MLR reg. 33 | 1010.620(b)(3): source of funds, purpose and expected use of a private banking account | Regulation art. 26/A(1)(c): source of assets and funds, as far as possible, one of the listed measures | CR 134 art. 5(2)(c)(4): source of funds and wealth, one of the example measures; ADGM Rule 8.4.1(2)(c): identify and verify both for high risk clients |
| Suspicious transaction report | R.20 | Directive art. 33: promptly, any amount; AMLR art. 69: FIU requests answered within 5 working days | POCA s. 330: as soon as is practicable | 1023.320: $5,000 or more, conducted or attempted; 30 days from detection, 60 if no suspect; a call to law enforcement at once for ongoing schemes; advisers under 1032.320 from 1 January 2028 | Regulation arts. 27(2), 28(2): any amount, within 10 business days of the suspicion | CR 134 art. 18(1)(a): immediately, any value |
| Records | R.11 | Directive art. 40; AMLR art. 77(3): 5 years | MLR reg. 40: 5 years | 1010.430(d); 1023.410: 5 years | Law 5549 art. 8; Regulation art. 46: 8 years | CR 134 art. 25(1): at least 5 years |
| Program and officer | R.18 | Directive arts. 8, 46(4); AMLR arts. 9, 11 | MLR regs. 19, 21 | 1023.210: written, approved by senior management, independently tested | Compliance Program Regulation (2008) | CR 134 arts. 21, 22: policies approved by senior management; compliance officer at management level |
Two rows carry most of a wealth file. The PEP row asks for source of wealth in the EU, UK and UAE, and the enhanced due diligence row lists it among the measures for any other higher risk client. The owner row splits at exactly 25 percent. A holding of exactly 25 percent counts in the AMLR, the US and the UAE; the UK, Türkiye and the 2015 Directive need more. Since 13 February 2026, FinCEN's exceptive relief limits a US broker dealer's owner checks on a legal entity client to its first account, facts that call the earlier information into question, and risk procedures.
Which AML rules apply to US broker dealers and investment advisers?
A broker dealer runs a written program approved by senior management under 31 CFR 1023.210. FINRA Rule 3310 adds the detail: procedures to detect and report suspicious transactions, an independent test each calendar year, an AML officer identified to FINRA, ongoing training and risk based customer due diligence. A firm that does not execute customer transactions, hold customer accounts or act as an introducing broker tests every two years.
Advisers are different. FinCEN's 2024 rule makes registered and exempt reporting advisers financial institutions with program, SAR and records duties, first due on 1 January 2026. It leaves out family offices and foreign private advisers. On 2 January 2026 FinCEN delayed it to 1 January 2028 (91 FR 36) to review and tailor it. The adviser customer identification rule, proposed on 21 May 2024, is not final. Sanctions law needs no date: OFAC rules bind every US adviser today.
How fast must a wealth or securities firm report suspicious activity?
The EU Directive says promptly (art. 33). From 10 July 2027 the AMLR adds 5 working days to answer an FIU request, a limit the FIU may shorten or extend (art. 69). The UK says as soon as is practicable. A firm that asks for consent to proceed may go ahead if seven working days pass without a refusal; a refusal opens a 31 day moratorium (POCA s. 335).
A US broker dealer files a suspicious activity report within 30 calendar days of first detecting the facts, or up to 60 when no suspect is identified. Türkiye gives 10 business days from the suspicion, and the UAE wants the report at once. Picture an alert on 2 March (illustrative). The Turkish report is due by mid March, the US one by 1 April.
Which red flags point to laundering through a brokerage or wealth account?
Most come from Annex B of the FATF's securities guidance; the last two, from enforcement cases.
- Opaque vehicles. A trust, shell or private investment company slow to name controllers and beneficiaries (IV.4).
- Wealth that does not fit. Net worth that cannot support the account activity (IV.9).
- Purposeless accounts. Family or company accounts with no apparent purpose (IV.10).
- Quick exits. Money placed for the long term, then liquidated and moved out (I.13).
- Ignored losses. Frequent losing trades the client does not mind (I.4).
- Trades as currency conversion. Mirror trades or securities trades used to convert currency (I.6, I.7).
- Linked accounts. One security traded across accounts the same people control (I.9).
- Out of profile. Purchases unlike the client's history (I.11).
- Corruption ties. Proceedings or negative news on corruption (IV.6; FinCEN, UBS, 2026).
- Blind distribution. Distributor chains or omnibus accounts the firm cannot see through (II.3; Pictet, 2026).
- Proxies. A relative acting for a sanctioned owner (OFAC, GVA Capital, 2025).
- New issue patterns. Small cap offerings that spike after listing, then collapse (FINRA, Revere, 2026).
How should a wealth firm check source of wealth, trusts and personal investment companies?
Picture a client (illustrative) who sold a logistics company in 2019. She now invests €6 million through a personal investment company in the British Virgin Islands, which a discretionary trust in Jersey owns, with a professional trustee in charge. Her total assets come to €60 million without her home.
An examiner reading that file wants two answers first: where the wealth came from (the source of wealth question, apart from this €6 million's source), and who stands behind the company and the trust, down to natural persons. Then comes purpose.
ADGM's regulator expects a firm to be satisfied that a client's use of "trust and private investment vehicles" has "a genuine and legitimate purpose" (AML Rulebook 8.4.1, guidance 4). The trustee is often a trust or company service provider with AML duties of its own. Those duties do not lift the firm's.
What evidence proves source of wealth?
Independent documents that show how the wealth was built. ADGM's guidance lists share certificates, public ownership registers, bank or brokerage statements, probate documents, audited accounts and news items from a reputable source (AML Rulebook 8.4.1, guidance 7). For the client above: the 2019 sale agreement, the completion statement, the company's last audited accounts and the bank statement that received the proceeds. FinCEN's 2026 UBS Financial Services action names that gap for high risk clients with ties to Russia and Latin America.
Source of funds needs its own trail. Here, the statement showing this €6 million leaving her account. A private banking and wealth management client form asks for net worth and how it was built, and a source of funds and wealth declaration records the client's own account before the evidence check.
Who is the beneficial owner of a trust or a personal investment company?
The personal investment company is traced like any company, at the 25 percent line of table 2, through every layer. When a trust holds the shares, the ultimate beneficial owners are the trust's people, and the rulebooks differ on who they are:
| Rulebook (in force, November 2026) | Who counts behind a trust | Beneficiaries not yet chosen | Basis |
|---|---|---|---|
| EU | Settlors, trustees, protectors, beneficiaries, any other person with ultimate control; owners of a legal entity holding one of those roles | Class of beneficiaries; for discretionary trusts, objects of a power and default takers | Directive art. 3(6)(b) until 9 July 2027; AMLR arts. 58 to 60 from 10 July 2027 |
| UK | Settlor, trustees, beneficiaries, any individual with control over the trust | The class in whose main interest the trust is set up or operates | MLR reg. 6 |
| US | The trustee, when a trust owns 25% or more of a legal entity client | Not addressed | 31 CFR 1010.230(d)(3) |
| Türkiye | Trustee identified and verified; settlor, beneficiaries and any protector identified, with reasonable verification; the persons in ultimate control | Beneficiary groups | Regulation on Measures art. 11(2), (3), since 24 February 2021 (trusts set up abroad) |
| UAE | Trustee, settlor, protector, beneficiaries, any natural person with ultimate effective control; owners of a legal person that is party to the trust | Classes of beneficiaries, when none is identifiable at set up | CR 134 art. 10(2) |
A trust KYC form collects the deed and those roles.
Which clients fall under the EU's €50 million rule?
From 10 July 2027, AMLR art. 34(5) adds three measures for credit and financial institutions and trust or company service providers. They apply when a higher risk relationship handles at least €5 million through personalized services for a client holding at least €50 million in financial, investable or real estate assets, excluding the client's private residence. The measures: specific steps for those personalized services, more information on the source of funds, and no conflicts of interest between the client and the senior managers or staff doing compliance work on that client.
Take the client above. Total assets of €60 million pass the test, €6 million handled passes the €5 million line, and with a higher risk rating all three conditions hold, so the measures apply. At €4 million they would not, though art. 34(4) still would. AMLA must publish guidelines on valuing the €50 million by 10 July 2027.
What have brokers and investment firms been fined for since 2024?
| Date | Authority | Firm | Penalty | Finding |
|---|---|---|---|---|
| 12 June and 23 July 2024 | Bank of Italy | Two asset management companies (SGRs): Sagitta, AVM Gestioni | €30,000 each | Customer due diligence at both (Sagitta: beneficial owners and the origin of funds invested in its AIFs); suspicious transaction reporting (Sagitta) |
| 8 January and 29 April 2025 | Bank of Italy | Two asset management companies (SGRs): ART, Hedge Invest | €30,000 (ART); €45,000 (Hedge Invest) | AML organization and controls over customer due diligence, enhanced included, at both; suspicious transaction reporting (ART) |
| 9 January 2025 | FCA | Arian Financial LLP | £288,962.53 | Weak controls over Solo Group clients, BVI and Cayman companies and US 401(k) plans, in 2015 |
| 17 February 2025 | FCA | Mako Financial Markets Partnership LLP | £1,662,700, of which £1,137,283 disgorgement | The same client network, with purported trades of about £68.6 billion in Danish equities, 2013 to 2015 |
| 7 March 2025 | FINRA | Robinhood Financial; Robinhood Securities | $26 million fine; $3.75 million restitution | AML, supervisory and disclosure violations |
| 12 June 2025 | OFAC | GVA Capital Ltd. | $215,988,868 | Managed an investment for a sanctioned Russian oligarch through his nephew, a known proxy; a related Delaware trust held about $1.3 billion when OFAC blocked it in 2022 |
| 6 March 2026 | FinCEN | Canaccord Genuity LLC | $80,000,000 | At least 160 SARs not filed on over the counter securities; due diligence on foreign correspondent accounts |
| 20 May 2026 | FINRA | Pictet Overseas Inc. | $610,000 | Low priced securities, more than 70 percent through an affiliate's omnibus account |
| 3 August 2026 | FinCEN; FINRA | UBS Financial Services Inc. | $125,000,000 (FinCEN); $20 million (FINRA) | Repeat offender: more than 50,000 foreign currency wires over $10 billion not properly monitored (FinCEN's count); source of wealth and negative news on clients with ties to Russia and Latin America |
| 6 October 2026 | FINRA | Revere Securities LLC | $800,000 | Small cap IPOs for foreign issuers; customer identification and due diligence |
FinCEN called Canaccord's penalty the largest ever against a broker dealer for Bank Secrecy Act violations; five months later UBS's passed it. The findings repeat. Nobody tested the client's wealth, or the firm could not see through an omnibus or correspondent account. No published AML fine on a Turkish or onshore UAE investment firm since 2024 turned up for this guide; the DFSA's 2026 Al Ramz case concerned a market abuse report.
What changed in 2025 and 2026, and what comes next for wealth firms?
- 17 July 2025. The UK keeps wealth management at high money laundering risk; terrorist financing risk rises to medium.
- 22 September 2025. FinCEN proposes delaying the adviser rule.
- 14 December 2025. The UAE's CR 134 comes into force.
- 2 January 2026. FinCEN moves the adviser rule to 1 January 2028.
- 13 February 2026. FinCEN drops the owner check at each new account.
- 10 April 2026. FinCEN's proposed AML program rule; the adviser rule is untouched.
- 10 July 2026. EU deadline for the register access rules of Directive (EU) 2024/1640 (arts. 11 to 13, 15).
- 7 October 2026. Türkiye doubles its identification lines to 370,000 TL, and to 30,000 TL for wire transfers (Regulation art. 5(1)(b), (c)).
Next: the AMLR and its €50 million rule on 10 July 2027, US advisers on 1 January 2028, AMLA direct supervision from 2028.
Which controls should a wealth firm's AML program show an examiner?
An examiner or auditor asks for these lines first. Where a line says "outside the platform", the work stays with the firm.
| Line | Source | How complead covers it |
|---|---|---|
| Business risk assessment by product, client type and channel | Directive art. 8; MLR reg. 18; AMLR art. 10 from 2027 | Outside the platform; rules can then be scoped per product, segment or jurisdiction |
| Owners traced to natural persons through trusts and personal investment companies | Tables 2 and 3 | KYB and UBO verification follows owners up the chain until natural persons are reached; unresolved layers reported as unresolved |
| Settlor, trustees, protector and beneficiaries identified | Directive art. 3(6)(b); MLR reg. 6; Regulation on Measures art. 11(2); CR 134 art. 10(2) | Outside the platform for the deed; every party screened against sanctions, PEP, watchlists and adverse media |
| Source of wealth evidence on file before a higher risk client starts | ADGM 8.4.1, guidance 7 | Outside the platform |
| PEP and sanctions screening at onboarding and on list changes | FATF R.12; securities guidance para 94 | PEP data within 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes |
| €50 million client test | AMLR art. 34(5), from 10 July 2027 | Rules built without code, with conditions and thresholds |
| Omnibus and distributor due diligence | FATF Annex B II.3 | Outside the platform |
| Trade and transaction surveillance tied to AML review | FINRA Rule 3310(a); 31 CFR 1023.320 | Transaction monitoring rules backtested on 30, 60 or 90 days of history, showing alert volume, clearance rate and true positives |
| Report clock per jurisdiction | Table 2 | Reporting support within case management |
| US advisers: program and SAR process ready | 31 CFR 1032, from 1 January 2028 | Outside the platform for the program |
| Records 5 years, 8 in Türkiye | Directive art. 40; MLR reg. 40; 31 CFR 1010.430; Law 5549 art. 8 | Every screening search recorded with who searched, what, when and the result, including searches with no match |
| Independent test each calendar year | FINRA Rule 3310(c) | Outside the platform |
| Senior management approval of the program | 31 CFR 1023.210; FINRA Rule 3310; CR 134 art. 21 | Outside the platform |
Where does complead fit in a wealth manager's AML program?
In complead, formerly Sanction Scanner, a wealth manager runs onboarding, screening, monitoring and investigation on one engine through its AML for investment and wealth firms setup. Each client then carries one risk score.
Client screening checks clients and their owners at onboarding and monitors them after, starting and stopping per name through API triggers. Customer risk assessment classifies each client on the same record. Routine cases are closed by agents, each with its evidence, narrative and work log. The rule that fired and the signals that matched sit on every alert; the MLRO decides and files, and the record names who decided.
This week:
- Pull every client held through a trust or personal investment company and check that the file names settlor, trustees, protector and beneficiaries.
- List the EU clients who may pass €50 million in total assets.
- At a US adviser, name who owns the AML program before 1 January 2028.
In the 2026 PDF. The download form beside this guide sends four templates for the client file: a source of wealth evidence grid by type of wealth, an owner worksheet for trusts and personal investment companies, a €50 million client test card and a report clock card for the six rulebooks. Each legal line on this page was checked against the official text or the regulator's own release on 4 November 2026.
