October 29, 2026 Written by: Sutherland Editorial

Onboarding and AML Modernization in 2026: Why the 2028 Deadline Is Already a 2026 Problem

Key Points

The 2028 AML Deadline Is an Immediate Priority: Delaying KYC and AML modernization until 2028 will cause resource bottlenecks and regulatory risk; firms must use the 2026 runway to upgrade data quality, screening, and workflows.
Client Onboarding Drives Revenue, Not Just Operations: Reducing manual touchpoints and Not-in-Good-Order (NIGO) loops directly accelerates time-to-funding, lowering customer acquisition costs and boosting asset growth.
Zero-Touch Onboarding Requires Governed, Explainable AI: Successful automation relies on risk-based routing and strong AI governance (human-in-the-loop controls, audit trails, and confidence scoring) to pass SEC examination priorities.

US capital markets firms are being squeezed from two directions at once. Client expectations have gone fully digital-first, trading volumes and client complexity keep rising, and regulators are widening what they examine, all while cost pressure, margin compression and legacy technology make it harder to staff the response. For the COO, Chief Compliance Officer and Chief Risk Officer sitting in the same operating committee meeting this year, client onboarding and KYC/AML are no longer back-office housekeeping. They are where growth, cost and regulatory exposure all collide, and 2026 is the year that collision becomes unavoidable.t

How Big Is the US Onboarding and KYC Opportunity Right Now?

The scale of the US registered investment adviser market makes the operational stakes concrete. The 2026 IAA Investment Adviser Industry Snapshot reports 16,544 SEC-registered advisers, 73.7 million clients and $176.8 trillion in regulatory assets under management in 2025^[1]. Every one of those relationships passed through an onboarding and KYC process at some point, and a meaningful share will need a refresh, remediation or account-maintenance event in the next two to three years. At that scale, even small improvements in onboarding cycle time or KYC accuracy translate into material dollars, because the volume behind the process is enormous even when the per-case friction looks minor.

Why Is Client Onboarding Now a Revenue Problem, Not Just an Operations Problem?

Every unnecessary manual touch in onboarding delays funded assets, raises customer acquisition cost and introduces avoidable control risk. Heavy reliance on manual, labor-intensive onboarding and compliance processes drives up operational cost, while data silos and inconsistent workflows across onboarding, KYC and screening create rework and limited visibility into where a case actually is. Not-in-good-order loops, where a document is missing, mismatched or incomplete, force clients and advisors into repeated back-and-forth that slows funding and, for complex entities such as trusts, SPVs and institutional structures, can stretch account activation well past what a client or advisor will tolerate before abandoning the process.

That reframes onboarding for a COO or Chief Client Officer. It is not simply a cost center to trim. It is the gate that determines how quickly revenue-generating assets actually land, which means the metric that matters is not headcount, it is time from application to funded and verified.

What Is the SEC Actually Examining in 2026?

Regulatory scrutiny is intensifying at exactly the moment firms are trying to move faster. The SEC’s FY2026 examination priorities explicitly include AI use, identity theft prevention, AML programs, sanctions compliance, customer identification, beneficial ownership and data protection and cyber controls^[2].That list matters because it puts AI governance in the same examination scope as AML and identity verification, not as a separate, future-facing concern. A firm that automates onboarding or KYC decisioning without being able to show how the AI reached a decision is building an exam finding into its own operating model.

Why Does the 2028 AML Rule Delay Matter for RIAs Right Now?

The SEC and FinCEN have postponed the effective date of the Investment Adviser AML rule to January 1, 2028^[3]. On the surface, that reads as room to breathe. In practice, it is a narrowing window rather than an open-ended one. Firms that treat the delay as permission to wait will hit 2027 needing to redesign KYC and AML operating models under a compressed timeline, competing for the same vendors, integration resources and compliance talent as every other adviser making the same move at once. Firms that use the runway now to modernize data quality, screening and exception handling will enter the next regulatory cycle with lower cost, stronger controls and a client experience advantage already in place, rather than scrambling to build one under deadline pressure.

How Big Is the Financial Crime Exposure Behind Every KYC/AML Program?

The stakes behind a KYC and AML program are not abstract. Nasdaq Verafin estimated that $3.1 trillion in illicit funds flowed through the global financial system in 2023, including $485.6 billion linked to fraud scams and bank fraud^[4]. That scale is precisely why false positives and false negatives both carry real cost. A screening process tuned too loosely misses genuine risk, while one tuned too tightly buries a Chief Risk Officer’s team in alert volume that obscures the cases that actually matter, and better data quality entering the screening process is what moves both numbers in the right direction at the same time.

Is AI Actually Ready for Capital Markets Operations?

Deloitte’s 2025 investment management outlook frames AI as a disruptive force capable of reshaping efficiency, risk management, data strategy and business models across the industry, while cautioning that firms deploying boldly now are separating from firms that wait^[5]. That framing matters for how a CIO or Chief Digital Officer should read the current moment. The risk in 2026 is no longer primarily about AI capability. It is about which firms build the governance, explainability and human-in-the-loop controls that let them deploy AI with confidence, while others stay stuck evaluating pilots that never reach production because compliance cannot sign off on them.

What Does Real Zero-Touch Onboarding Actually Require?

“Zero-touch” is frequently misunderstood as removing people from the process. It actually means something more precise: automating the low-risk work that does not need a person, preparing complex cases intelligently before a specialist ever sees them, and preserving human judgment exactly where risk, complexity or regulation requires it. A few principles follow from that distinction, independent of which CLM, screening or core platform a firm already runs.

Fix the data before the decision. Most onboarding documentation, IDs, tax forms, trust deeds, subscription documents and entity ownership charts, arrives in inconsistent formats. Poor data quality entering a screening engine is what drives false positives and rework downstream, so improving document intelligence at intake has a direct, measurable effect on screening accuracy later in the process.

Coexist with the platform you already have. Firms with an existing CLM, CRM or screening platform are rarely missing technology. They are missing true straight-through processing, and the gap is usually orchestration, data quality, exception design and operating discipline rather than the platform itself. Modernization does not have to wait for a multi-year core replacement to show results.

Route by risk, not by default. Applying the same manual review path to every case regardless of complexity is what creates onboarding backlogs. Distinguishing zero-touch, low-touch and specialist-review cases up front, using confidence thresholds and predictive scoring, lets experienced staff spend their time on trusts, SPVs and institutional entities where judgment genuinely changes the outcome.

Build explainability and audit trail in from the start. A Chief Compliance Officer or MLRO cannot sign off on AI-assisted decisioning that cannot produce evidence of how a decision was reached. Confidence scoring, human override and a defensible audit trail are what let AI-assisted KYC and onboarding survive an examination rather than becoming one.

The Real 2026 Question

Growth, cost and regulatory exposure in capital markets operations are no longer three separate conversations. They meet in the same onboarding and KYC workflow, and the firms that pull ahead in 2026 will be the ones that use the current modernization window, before the 2028 AML deadline compresses it, to build onboarding and screening processes that move fast for low-risk clients and stand up to scrutiny for everyone else.

That is a narrower, more disciplined bar than “adopt AI.” It is also the one that actually shows up in funded assets and audit outcomes.

Frequently Asked Questions

What is zero-touch client onboarding in capital markets?

It is an operating model where low-risk, straightforward applications move from submission to funded and verified with minimal manual intervention, while complex or high-risk cases are automatically routed to a specialist with an AI-prepared case file, rather than a process that removes human review entirely.

Is the 2028 AML rule delay a reason to slow down KYC modernization now?

No. FinCEN’s postponement of the Investment Adviser AML rule to January 1, 2028[3] creates a strategic window to redesign KYC and AML operating models before compliance pressure peaks, not a reason to wait, since firms that delay will be competing for the same resources under deadline pressure later.

Can AI-driven KYC and onboarding decisions withstand an SEC examination?

Only if the underlying process was designed for it. The SEC’s FY2026 examination priorities explicitly cover AI use alongside AML, identity verification and data protection[2], so any AI-assisted decisioning needs confidence scoring, human override and a documented audit trail to be defensible in an exam.

Does zero-touch onboarding require replacing an existing CLM platform like Fenergo, FNZ or nCino?

No. Most onboarding friction sits in data quality, orchestration and exception handling around an existing platform rather than in the platform itself, which means automation can improve straight-through processing rates without a rip-and-replace program.