AML and KYC: The Fund Operations Mandate

AML and KYC: The fund operations mandate

Author: The Carta Team
Read time: 11 minutes
Published date: November 20, 2025

Learn the core compliance requirements for AML and KYC, covering the key definitions, operational processes, and regulations you must follow to protect your fund.

Contents

Funds in the private market face increasing scrutiny to ensure their operations are secure, transparent, and compliant with global regulations. Anti-money laundering (AML) and know your customer (KYC) requirements are at the heart of these efforts, designed to prevent crime and promote trust in the financial services ecosystem.

AML regulations require financial institutions to take specific measures to detect, prevent, and report financial crimes. Customer due diligence (CDD) and KYC rules are a core component of AML laws: they require financial institutions to verify their clients’ identities and monitor their business activities for potential red flags.

What is money laundering?

Money laundering is the process of making illegally gained proceeds, or “dirty money,” appear to be from a legitimate source. This financial crime is often associated with other serious offenses, such as embezzlement, bribery, terrorist financing, and fraud. The goal is to disguise the criminal origins of the money so it can be used without detection by law enforcement.

Criminals achieve this by moving funds through complex transactions, and private funds can be an attractive entry point for these proceeds due to their potential for high returns and anonymity. Ultimately, the laundered money is integrated back into the legitimate financial system, appearing as normal business profits or assets.

In 2020, a leaked FBI memo stated that the agency believes investment funds in the PE and hedge fund industry are being used to launder “at scale.” The memo called for greater AML scrutiny from existing enforcement agencies, and for Congress to enact uniform protocols for KYC compliance. As of now, it’s up to financial institutions to develop their own processes for compliance with KYC regulations.

What is anti-money laundering (AML)?

Anti-money laundering (AML) refers to the complete set of laws, regulations, and internal procedures that a fund establishes to detect and report suspicious financial activity. The purpose of an AML program is to prevent your fund from being used for illicit purposes. A strong AML framework protects the fund's integrity, its investors, and its reputation within the financial ecosystem.

The U.S. first established AML laws in 1970 as part of the Bank Secrecy Act (BSA), a piece of federal legislation that requires businesses and financial institutions to report cash deposits of more than $10,000, register foreign bank accounts, and take other measures intended to combat money laundering.

Think of AML as your firm's comprehensive defense system against financial crime. It's an ongoing program that includes everything from investor screening to transaction monitoring and reporting to government authorities. This program, a core part of your overall fund administration, demonstrates that you are actively working to keep illicit funds out of your investment vehicles.

What is know your customer (KYC)?

Know your customer (KYC) is a specific and required component of your overall AML framework. It's the process of verifying an investor's identity and assessing the potential risk they might pose to the fund. Think of KYC as the practical first step in any credible AML program, as it provides the foundational information needed to understand who is investing in your fund.

Beyond verifying customer identity, firms conducting KYC reviews on their customers look to see if a client has been the subject of negative news (such as regulatory enforcement actions), negative social media, or other publicity that might make a client undesirable.

KYC reviews may uncover politically exposed persons (PEPs) who are in positions of authority and potentially at risk for bribery or corruption. CDD may also uncover a connection to government sanctions from the Office of Foreign Assets Control (OFAC) or other governmental bodies. For example, recent additions to OFAC’s sanctions list relating to the Russia-Ukraine conflict require private equity (PE) funds with sanctioned Russian investors to restrict and report those clients’ investments. Financial institutions, like banks and credit unions, must determine an individual or institution’s risk profile and decide whether to go forward with that client.

AML regulations and sanctions

In the United States, government bodies oversee AML compliance with federal laws. The Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, is the primary agency responsible for administering these regulations. Financial institutions, including many private funds, are required to comply with these rules.

Failure to comply with the broader scope of venture capital (VC) regulations can result in serious penalties, and OFAC administers these actions. This agency also enforces economic and trade sanctions based on U.S. foreign policy and national security goals. These sanctions can range from significant fines to other enforcement actions that can disrupt a fund's operations and damage its reputation.

While the VC, PE, and hedge fund industries have not historically faced AML or KYC requirements, industry watchdogs have amped up calls for heightening AML oversight in the private fund industry, particularly in the wake of broad U.S. sanctions of Russian oligarchs in 2022. FinCEN adopted a final rule to extend AML program requirements to SEC-registered investment advisers and exempt reporting advisers, who previously were not subject to the requirements. These requirements were set to take effect on Jan. 1, 2026, but have been delayed until at least Jan. 1, 2028, though FinCEN is expected to reconsider the scope of these requirements as part of a broader AML review.