Client Data Is the Compliance: Why the Client Record an Advisor Cannot Build Is the One the FinCEN Rule Assumes
Every element of the FinCEN investment-adviser rule that takes effect January 1, 2028 can be built inside the firm except one. An RIA or MFO can write the program, designate the officer, train the staff and schedule the independent test. Those are the operations of compliance and they are within reach of any firm with a budget and a calendar. What no amount of internal operation produces is the substance those operations are meant to act on: a current, verified, client-specific picture of the household. Meaningful know-your-customer and meaningful appropriateness come from client data, and the data an adviser can generate from inside its own four walls is limited to what passes through its own accounts and what the client remembers to disclose. Tight Ship's forthcoming Client Command Center, "Chronometer", is a pathway to the rest. It is a third-party platform and service provider — bill pay, cash flow and concierge support — whose day-to-day work yields exactly the client-specific, real-time data the rule assumes an adviser has and that the adviser otherwise cannot get.
WHAT THE RULE ASSUMES
The rule's due-diligence element requires the adviser to understand the nature and purpose of each customer relationship in order to develop a customer risk profile, to monitor for suspicious activity and to keep customer information current on a risk basis. Read those three duties against what an adviser actually sees. The nature and purpose of an HNW+ relationship is not visible in a brokerage statement. It is visible in how the household lives: what it owns across entities and properties, what it owes, what it spends and to whom, who depends on it and which obligations are approaching. Monitoring inside advisory accounts catches movements the adviser already controls; the wires, counterparties and liquidity events that actually characterize a household's behavior happen in operating accounts the adviser never sees. And "keeping information current" is, in every firm we have met, a periodic re-papering exercise that depends on the client's memory and goodwill.
The rule assumes a depth of client knowledge that the adviser's own operations cannot supply. That is not a flaw in the adviser. It is a structural limit of where the data lives.
WHY THE REGULATOR LEFT IT THERE
The question deserves to be asked plainly. FinCEN first proposed AML obligations for investment advisers in 2003 and withdrew them, proposed again in 2015 and never finalized, finalized in 2024 with a 2026 effective date, then postponed to 2028 with a stated intention to review. The finished rule still omits identity verification and beneficial ownership, deferring both to future rulemaking. Twenty-three years to reach a floor that names the duty to know the customer but declines to say what the customer's profile must contain.
Part of the answer is jurisdictional. FinCEN's mandate is illicit finance. Appropriateness and the client's investment profile sit with the SEC and FINRA; the duty of care sits with the Advisers Act. The drivers of a real client profile — health trajectory, family structure, property and entity complexity, held-away assets, spending behavior, the cost of care where a client intends to retire — fall in the seams between agencies, so no agency defines them. Part of the answer is practical. A standard specific enough to be meaningful would have to say where the data comes from, and the honest answer is that most advisers have no reliable source for it. A regulator that cannot point to a source writes a duty without a definition and leaves the industry to decide what "sufficient" looks like.
The consequence is that the client's faith in their fiduciary and the regulation's demands on that fiduciary are not in congress. A client assumes the person managing their capital knows what they own, what they owe, what they spend and what would break. The regulation requires a risk profile, a monitoring procedure and a refresh cadence, and is silent on whether any of them reflect the actual household. A firm can be fully compliant in 2028 and be advising on a portfolio whose owner's real cash flow it has never observed.
THE PATHWAY
Chronometer closes that distance because of how the data is produced, not because of what the platform claims. Tight Ship's foundational work is cash flow management and bill pay. Every domain of home, health and life has a transaction attached to it, and paying the household's bills means seeing the household's transactions — property, staff, insurance, care, tuition, philanthropy, debt service, entity expenses — every month, from source. Onboarding captures the domains that exist in no feed: legal structure, estate documents, health and care considerations, family and dependents, property and lifestyle. The ongoing service keeps that record true without asking the client to remember anything. The output is a client-specific, real-time data layer that the adviser licenses and reads in a single pane: consolidated multi-entity net worth, liabilities, liquidity, cash-flow forecast, budget versus actual, tax position and the documents behind them.
Applied to the rule, that layer is the substance of the due-diligence element. The customer risk profile is built from verified accounts & observed cash flow rather than self-report. Customer information is current by construction, because the monthly close is the refresh. Monitoring extends to the household's operating activity, where an unusual wire or a new counterparty or a sudden liquidity move actually surfaces, and Tight Ship's duty to escalate anomalies to the covered adviser is written into the agreement so that "reason to suspect" is met by a process rather than a hope. The adviser owns the program, the officer, the training, the testing and the filings. The firm licenses the engine; Tight Ship supplies the hands that keep the engine's inputs true.
The same data serves appropriateness. The nine factors regulators list for an investment profile — age, other investments, financial situation and needs, tax status, objectives, experience, time horizon, liquidity needs and risk tolerance — are the household record read from a different angle. A Monte Carlo simulation run on a guessed spend is a compliant exercise in fiction. Run on the observed household, it is both the plan the client needs and the evidence the examiner asks for.
WHAT “ABOVE & BEYOND” MEANS HERE
It does not mean a bigger compliance department. It means a compliance plan whose client knowledge is sourced from the household's own activity, labeled by origin and date so an examiner can tell an API-sourced balance from a Client Manager's note, refreshed continuously rather than on an anniversary and monitored at the household level rather than the account level. None of that is required by the rule. All of it is what the client already believes their fiduciary is doing, and all of it becomes available to the adviser only through a provider that is inside the household's operations every day.
CLOSING
The 2028 rule gives advisers a floor and a deadline. The operations of compliance will be met by every firm that wants to remain registered. The substance — meaningful KYC, meaningful appropriateness — will be met only by firms that have a source for client data they cannot generate themselves. Tight Ship does not replace the adviser's compliance function; we enhance it with the one input it cannot produce. Your adviser manages the nest egg. We manage the nest — and the nest is where the answers to the regulator's questions have been all along.
Compliance leaders and advisory firms preparing for 2028 — book a 30-minute conversation with Jill Dillingham. [Book a Meeting]
Comments