New for 2028 — FinCEN AML Rule

AML Independent Testing

Fixed-fee BSA/AML reviews for RIAs, broker-dealers, fintechs, MSBs, and private funds. Scoped, productized, audit-ready.

Scope Your Review Sign Up for Notifications

Three Fixed-Fee Tiers

Final pricing depends on the scoping questionnaire below. Bundle with a RegReview subscription for 10–15% off.

AML Review – Essentials

$3,500flat

Independent BSA/AML testing for smaller RIAs with low-risk client bases.

Policy & procedures review
CIP / KYC file sampling — 15 investor/client files (10% of accounts, min 10, max 25)
OFAC / sanctions screening test
Risk assessment refresh
Written independent test report

Best for: RIA, ≤$500M AUM, no custody, primarily US individual clients

Most Common

AML Review – Standard

$7,500flat

Full FinCEN / FINRA 3310 independent testing for BDs and RIAs serving funds.

Everything in Essentials
CIP / KYC file sampling expanded to 30 investor/client files
Transaction monitoring sample testing (25 transactions / alerts)
SAR / CTR filing review
Training program assessment
AML officer interview & control walkthroughs
Findings memo + remediation plan

Best for: Broker-Dealers, RIAs to private funds, mid-size firms

AML Review – Complex

From $15,000scoped

Risk-based independent testing for fintech, MSBs, and multi-entity programs.

Everything in Standard
Multi-entity / multi-jurisdiction scope
CIP / KYC file sampling from 50 files across entities
Enhanced transaction monitoring testing (50+ transactions / alerts)
Third-party / BaaS partner program review
State MTL & FinCEN MSB compliance check
Executive readout + board-ready report

Best for: Fintech, BaaS, money transmitters, neobanks, crypto-adjacent, MSBs

Why AML Testing Matters in 2028

FinCEN Final Rule (Effective Jan 1, 2028)

SEC-registered RIAs and ERAs are now subject to BSA/AML program requirements, including independent testing.

FINRA Rule 3310

Broker-dealers must complete independent AML testing annually (or every two years for limited-business firms).

State MTL & MSB Programs

Money transmitters, fintechs, and BaaS partners face multi-state and FinCEN MSB testing expectations.

Penalties Are Climbing

2024–2025 AML enforcement actions averaged $5M+ per firm; even small RIAs see $25K–$250K deficiency settlements.

AML Independent Testing FAQ

How much does AML independent testing cost?

FIN Group prices AML independent testing as a fixed fee by scope: Essentials $3,500 for smaller RIAs with low-risk client bases, Standard $7,500 for firms with broader products or investor types, and Complex from $15,000 for multi-entity, multi-jurisdiction, MSB, fintech, or high-volume transaction programs. Bundling with a RegReview subscription takes 10–15% off the testing fee.

How many investor or client files are sampled in each package?

Essentials samples 15 CIP/KYC files (10% of accounts, minimum 10, maximum 25). Standard samples 30 files plus 25 transactions or alerts. Complex samples 50 or more files plus 50 or more transactions or alerts. Final sample size is risk-based — higher-risk client types, geographies, or product lines can increase it.

When does the FinCEN AML rule for investment advisers take effect?

The FinCEN AML/CFT program rule for SEC-registered investment advisers and exempt reporting advisers takes effect January 1, 2028. Advisers need a written AML program, a designated AML officer, ongoing training, and independent testing in place by that date.

How often does an AML program need independent testing?

Broker-dealers must test annually under FINRA Rule 3310 (every two years for firms that do not hold customer accounts or execute transactions). Investment advisers under the FinCEN rule should test annually, or at least every two years for low-risk programs, with the cadence documented in the AML program itself.

Who can perform the independent test?

Anyone independent of the AML program's design and day-to-day operation — an outside firm like FIN Group, or an internal person with no AML program responsibilities and no reporting line to the AML officer. The AML officer cannot test their own program.

What do we receive at the end of the review?

A written independent test report with scope, sampling methodology, findings by severity, and remediation recommendations, plus a management response template and a risk assessment refresh. The report is the document regulators and clearing firms ask to see.