Fund AML Policy: What It Must Contain (Outline)

Regulators rarely ask whether a fund manager has an AML policy. They ask whether the policy matches the firm's risks, whether the right people approved it, and whether staff and the administrator follow it in practice. A policy copied from a bank template often fails on all three, because it says little about subscriptions, capital calls, nominee investors or delegated onboarding.

This guide is for compliance officers, money laundering reporting officers (MLROs) and chief operating officers at fund managers, and for the administrators and transfer agents who apply their policies. It sets out the regulatory requirements, then a model outline. For the wider programme, see our step-by-step guide to a risk-based AML programme and the AML compliance checklist. It cites the texts as read on 14 November 2026 and is general information, not legal advice.

The requirement applies to the regulated entity, which may be the manager, the fund, or both. The approval level differs by regime:

Two points stand out for fund managers. In the US, the Financial Crimes Enforcement Network (FinCEN) has delayed the investment adviser rule: the AML/CFT program must be in place "on or before January 1, 2028" (31 CFR 1032.210(c), as amended by the delay rule published on 2 January 2026). In the EU, the AMLR applies from 10 July 2027 (Article 90). See our guides to the FinCEN investment adviser AML rule and AIFM AML under the EU AMLR.

The outline below fits a manager with one or more funds and an external administrator. Adapt the headings to your regime's terms and keep each section short, with references to the procedures that sit beneath it.

Name the legal entities covered: the manager, each fund vehicle that is itself an obliged entity, and any branches. State which regimes apply to each, the approval date and the approver. Under the EU AMLR, both an alternative investment fund and its manager can be obliged entities, so record which entity does what.

Senior management's accountability, the compliance officer or compliance manager, the MLRO and deputy, and the reporting lines to the board. MAS Guidelines 14-3-2(h) expect the compliance officer to report key AML/CFT issues to the board of a locally incorporated firm "at least annually and as and when needed".

How the business-wide risk assessment is produced, approved and refreshed, and the investor types, jurisdictions, products and distribution channels the firm will and will not accept. Cover proliferation financing where the regime requires it, as in the UK (regs 18A and 19A), Singapore (MAS Notice SFA04-N02, footnotes 1 and 3) and the Cayman Islands (regs 5 and 8).

Standard, simplified and enhanced measures by investor type; beneficial ownership; PEP determination; source of funds and source of wealth; and when verification must be complete before a subscription is accepted. Link to the detailed procedures rather than repeating them.

Who the customer is for each distribution channel, when the firm looks through to underlying investors, and the conditions for relying on a regulated intermediary.

The lists screened, when screening runs (onboarding, list updates, payments), how matches are resolved and who can release a hold. The Cayman Regulations require systems that include checks against all applicable sanctions lists (reg 5(a)(v)).

Subscriptions, capital calls, distributions, redemptions, transfers of interests and switches; third-party payments; and review cycles by risk rating, with event triggers.

Internal escalation to the MLRO, the decision record, filing with the financial intelligence unit, handling of the relationship after a report and the tipping-off prohibition. Use the local term: a suspicious transaction report (STR) in Singapore and Hong Kong, and a suspicious activity report (SAR) in the Cayman Islands, the UK and the US.

What is delegated to the administrator, transfer agent or distributor, what stays with the firm, how delegated work is overseen and when reliance is permitted. The Cayman Regulations keep responsibility with the person carrying out relevant financial business even where functions are delegated (reg 3(2) and (3)).

What is kept, where, for how long, and how records are retrieved for regulators and auditors.

The risk assessment that must happen before launching a new fund, share class, distribution channel or onboarding technology (MAS 5.2; UK reg 19(4)(c)).

Pre-hire and ongoing screening of relevant staff, role-based training, frequency and records.

Scope, frequency, who performs it and how findings are tracked to closure.

When the policy is reviewed, what management information goes to the board, and how breaches of the policy are recorded and escalated.

UK firms must tell their supervisor within 14 days of appointing their first compliance officer under reg 21(1)(a) or their first nominated officer. The same 14-day notice applies to any later appointment to either role (reg 21(4)). See our guide to the MLRO role.

An illustration, not a real case. A Singapore fund manager subject to MAS Notice SFA04-N02 manages a Cayman Islands fund. An administrator onboards investors and processes subscriptions and redemptions.

• One policy, two entities. The manager writes a group policy that covers its own obligations under the MAS Notice and, as a separate annex, the Cayman fund's obligations under the Cayman AML Regulations. Each is approved by the relevant senior management or board.
• Named officers. The manager appoints an AML/CFT compliance officer at management level (MAS 14.10). For the fund, the annex names the AML Compliance Officer, the MLRO and the Deputy MLRO required by the Cayman Regulations (regs 3 and 33).
• Delegation. The annex records the tasks delegated to the administrator. It states that responsibility for compliance stays with the person carrying out relevant financial business, here assumed to be the fund (Cayman reg 3(3)), and lists the reports the administrator must send.
• Standard. Where the MAS and Cayman requirements differ, the policy applies the stricter one to investors onboarded for the fund, and records the decision.
• Review. The enterprise-wide risk assessment is reviewed at least every two years or on trigger events (MAS Guidelines 4-18), and the policy is reviewed at the same time.

Whether the fund itself is a person carrying out relevant financial business depends on Cayman law and the fund's structure; confirm it with local counsel. Our guide to MAS Notice SFA04-N02 for fund managers sets out the Singapore requirements in detail.

• The policy names every entity it covers and the regime that applies to each.
• It records who approved it and when, matching the approval level your regime requires.
• It sets out the risk appetite, including investor types and jurisdictions the firm will not accept.
• Proliferation financing is covered where your regime requires it.
• Every delegated task has a named provider, a standard to follow and an oversight method.
• Nominee, omnibus and fund-of-funds investors have a stated look-through rule.
• Capital calls, distributions, redemptions and transfers of interests are covered by monitoring.
• Sanctions screening covers investors, beneficial owners and payment counterparties.
• The MLRO, deputy and escalation route are named, using the local reporting term.
• Training, audit and review intervals are stated and evidenced.
• The policy links to procedures rather than repeating them, so each can be updated at the right approval level.
• There is a record of how the policy was communicated to staff and service providers.