Fund Administrator AML Responsibilities: Who Does What

Before allocating tasks, decide which legal model each arrangement falls under. Regulators distinguish them sharply, and the consequences for who must do what differ.

Many real arrangements combine the models. A Cayman administrator is an obliged entity for its own business (the fund is its customer), an outsourced provider for the investor procedures the fund has delegated to it, and, for a Singapore manager of the same fund, simply a service provider that the manager controls, because it is not an Appendix 2 institution. The agreement should say which model applies to which task.

The Cayman framework is the most explicit about the administrator's position, because mutual fund administration is itself relevant financial business and CIMA regulates administrators directly.

• Both are relevant financial business. Schedule 6 of the Proceeds of Crime Act (2025 Revision) lists "individual and collective portfolio management and advice" (para 11) and "otherwise investing, administering or managing funds or money on behalf of other persons" (para 19). CIMA's Guidance Notes define a Mutual Fund Administrator as a person conducting mutual fund administration under the Mutual Funds Act, and Part VI states that funds and their administrators "have separate obligations" and that "the ultimate responsibility for maintaining and implementing adequate Procedures ... remains with the Mutual Funds and Mutual Fund Administrators" (Part VI, G.2 and G.3).
• Officers come first. Regulation 3(1) of the Anti-Money Laundering Regulations requires a person carrying out relevant financial business to designate a person at managerial level as Anti-Money Laundering Compliance Officer; regulation 33 covers the MLRO and deputy. CIMA's notice of 1 February 2019 says a fund must designate natural persons to all three roles and that delegation or reliance under regulation 3(2) "presupposes that the designation ... has first taken place". CIMA's FAQs confirm that an independent person employed by a service provider to the fund, such as an administrator or investment manager, may be appointed MLRO or deputy, and that the officers may be based outside the Cayman Islands.
• Delegation does not move responsibility. Regulation 3(2) allows the fund to delegate the performance of any function to a person, or to rely on a person to perform it; regulation 3(3) states that "the responsibility for compliance with the requirements of these Regulations is that of the person carrying out relevant financial business". CIMA's notice of 7 June 2021 repeats that where the AML officer function is outsourced, the licensee or registrant "retains ultimate responsibility".
• The administrator's own customer is the fund. Part VI of the Guidance Notes lists the Mutual Fund (and its operators) as the administrator's applicant for business, recommends that an administrator should not treat the fund as a simplified-due-diligence case merely because the fund is itself regulated, and says the administrator "may be satisfied that the Mutual Fund, if not itself carrying out customer identification or record keeping, has in place appropriate safeguards" (Part VI, E.7). Where the function is delegated to it, the administrator must maintain records on the fund's behalf for the requisite period (Part VI, H.3).
• Outsourcing standards. Part II, section 10.C requires a risk assessment before outsourcing the compliance or MLRO function, due diligence on the provider, an outsourcing agreement that clearly sets out the obligations of both parties, regular reporting, access to all relevant information, a contingency and exit plan, no arrangements where access to data would be impeded by secrecy or data-protection restrictions, a requirement that the provider files a SAR with the Financial Reporting Authority where suspicion arises, and Cayman standards where the provider or sub-contractor operates from a lower-standard country.
• Reliance standards. CIMA's 2019 notice expects reliance arrangements to include provisions that the person relied on has adequate knowledge and expertise, a risk assessment before the agreement, a formalised agreement setting out each party's responsibilities, a review and periodic testing of the person's policies and procedures, and adoption of Cayman standards where the person operates in a lower-standard country. Regulation 25 (eligible introducers) is a separate, narrower route for verification of identity.
• The July 2026 Rule. CIMA's Rule on an Effective Compliance Programme, in force since 18 September 2026, requires the policies to address "outsourcing of the Compliance Programme or components of the Compliance Programme, ensuring that any outsourced functions do not impede regulatory access and that the FSP remains ultimately responsible" (10.3(d)), written notification to CIMA of any material outsourced compliance function (10.3(e)), timely evidence on request of how reliance on a third party or group member works (10.4), and an AMLCO who may delegate specific duties but "must retain the overall responsibility" (8.6). Our Cayman AML rules for funds guide covers the Rule in full.

The US position matters to every fund with a US adviser or US investors, and FinCEN addressed fund administrators by name.

• The rule and its timing. FinCEN's final rule of 4 September 2024 (89 FR 72156) makes SEC-registered investment advisers and exempt reporting advisers "financial institutions" under the Bank Secrecy Act and adds 31 CFR Part 1032. A final rule published on 2 January 2026 (91 FR 36) delayed the effective date from 1 January 2026 to 1 January 2028. FinCEN's proposed rule of 10 April 2026 on AML/CFT programmes for other financial institutions states that it "does not propose any amendments" to the adviser rule, and the August 2026 regulatory agenda lists a new customer identification programme proposal for advisers that would replace the May 2024 proposal. Our FinCEN investment adviser rule guide tracks the status.
• Delegation is allowed, liability is not. In the 2024 preamble FinCEN wrote that it "will permit an investment adviser to delegate contractually the implementation and operation of some or all aspects of its AML/CFT program to a third-party provider, including a fund administrator", and chose not to put that in rule text because delegation is already common practice. The condition: the adviser "will remain fully responsible and legally liable for, and be required to demonstrate to examiners, the program's compliance", must ensure FinCEN and the SEC can obtain information and records, must identify and document the procedures appropriate to its own vulnerabilities, and must take reasonable steps to assess whether the provider carries them out effectively.
• What oversight looks like. FinCEN says it "would not be sufficient to simply obtain a certification from a service provider that the service provider 'has a satisfactory anti-money laundering program'", though a certification can form part of periodic oversight. Examples it gives: due diligence on the provider's AML/CFT policies against the adviser's standards; a written agreement with representations and covenants, including a duty to maintain risk-based policies and to report deficiencies found in the provider's audit; and periodic monitoring of compliance.
• Offshore administrators and SARs. Footnote 214 of the preamble recognises that "an offshore fund administrator may be in the best position to perform certain aspects of an investment adviser's AML/CFT program requirements, including monitoring for suspicious activity", so an adviser may delegate contractually to an offshore administrator to monitor, report the details to the adviser and file SARs on its behalf, while the adviser "remains fully responsible and legally liable". Commenters told FinCEN that administrators in Ireland, Luxembourg and the Cayman Islands have long been subject to AML requirements.
• What the programme must contain. 31 CFR 1032.210(b): internal policies, procedures and controls; independent testing by the adviser's personnel or a qualified outside party; designation of a person or persons responsible for implementing and monitoring the programme; ongoing training; and risk-based ongoing customer due diligence including understanding the nature and purpose of customer relationships and ongoing monitoring to identify and report suspicious transactions. The programme must be approved in writing by the board or equivalent and made available for inspection by FinCEN or the SEC.

Three further markets that fund administrators serve, each with a reliance provision that leaves liability with the relying firm.

• United Kingdom. Regulation 39 of the Money Laundering Regulations 2017 lets a relevant person rely on another relevant person, or on a third-country person subject to equivalent CDD and record-keeping requirements and supervision, to apply the measures in regulation 28(2) to (6) and (10) and regulation 30A, but "the relevant person remains liable for any failure to apply such measures". The relying firm must immediately obtain all the information needed to satisfy regulation 28 and have arrangements under which it can obtain copies of the identification and verification data immediately on request and the third party retains them for the regulation 40 period. No reliance is permitted on a third party established in a FATF call-for-action country (reg 39(4)). Our MLR 2017 guide has the wider framework.
• Hong Kong. Under section 18 of Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, a financial institution may carry out any CDD measure by means of a specified intermediary (including a licensed corporation or an equivalent-jurisdiction institution that is regulated and supervised for similar requirements) if the intermediary consents in writing and will provide copies of documents and records on request without delay; the institution "remains liable under this Ordinance for a failure to carry out that customer due diligence measure" (s.18(2)), must obtain the data immediately after the measure is carried out (s.18(4)(a)), and remains liable equally where it uses an agent (s.18(6)). Section 18 covers CDD measures, not continuous monitoring. See our guide to SFC AML requirements for asset managers.
• Luxembourg. The CSSF framework for investment fund managers and registrar agents is compared with MAS and the HKMA in our cross-border AML whitepaper for fund administrators.

• Calling an outsourcing arrangement "reliance". The manager then skips its own control measures and testing, while the administrator is not an eligible third party under the relevant provision. Regulators test the substance.
• Officers on paper. An MLRO named in the fund's filing who has no access to the administrator's case queue or no time to review it. CIMA's 2021 notice requires officers who can dedicate sufficient time and whose other roles do not compromise their independence.
• Monitoring that nobody owns. The administrator watches subscriptions and redemptions, the manager watches the portfolio, and nobody reconciles investor activity to the risk profile. Monitoring cannot be relied upon under SFA04-N02 9.3 or Notice 626 9.3, so the manager must either do it or control it as outsourcing.
• Certification instead of oversight. An annual letter saying the administrator has a satisfactory programme. FinCEN says that is not sufficient on its own; the Central Bank of Ireland expects sample testing, MI and KPIs.
• Records the fund cannot produce. Files held by a former administrator, or held under a secrecy regime, with no retention undertaking or hand-over clause.
• One standard for several domiciles. A master-feeder with a Cayman master, a Singapore manager and US investors is subject to three sets of expectations at once. The agreement should name the highest applicable standard for each task.