If you haven’t already figured out your costume, let this serve as a reminder that Halloween is coming this Saturday night. If you’re an investment manager, you already have a lot to be scared of this season, but at least that opens up some possibilities for Halloween attire. You could come dressed as earnings season (Eeyore). You could come dressed as the end of capital gains treatment for carried interests (Robin Hood). You could come as the Headless Horseman (robo-advisors). You could come dressed as Frankenstein (multi-strategy ETFs). You could come dressed as Donald Trump (Donald Trump). You could come dressed as the Fed (any hockey mask will do). Or you could always dress up like the living dead, and tell your friends that the zombie that haunts your dreams has a name, FinCEN, the US Treasury Department’s Financial Crimes Enforcement Network.

In the midst of a bumpy third quarter, the FinCEN released a proposal to establish anti-money laundering requirements for advisers registered with the Securities and Exchange Commission (SEC). If you think you’ve seen this horror movie before, you have. FinCEN made the same proposal back in 2003 – but then withdrew it as the financial world came crashing down in 2008, citing the “passage of time” as the primary reason. Apparently the passage of more time led regulators back to the same place in the corn maze. On August 25, FinCEN dusted off the proposal and is trying once more to bring investment advisors under the anti-money laundering (AML) obligations.

On the second go-around, FinCEN’s proposed rules have more (and sharper) teeth than the 2002 and 2003 proposals. Not only will registered investment advisors (RIAs) have to establish and maintain AML program requirements, advisors will be subject to additional suspicious activity reporting, information sharing, and record keeping. Investment advisers would be defined as “financial institutions” and would be required to file Currency Transaction Reports (CTRs), keep records on the transmittal of funds, and allow FinCEN to require advisers to search their records and voluntarily share information between financial institutions. Advisers would be responsible for filing suspicious activity reports (SARs) to FinCEN on any investor suspected of nefarious behavior. SARs reports are generally filed for transactions in excess of $5,000, though the adviser has discretion on reporting activity below the minimum threshold. Thankfully, all SARs reports are protected under a safe harbor provision to protect advisers from potential litigation for disclosing investor activity.

The greatest challenge under the proposal, however, will be in implementing the AML program itself. The AML program requirements are built on four main pillars, with varying degrees of difficulty in application. The pillars include 1) implementing and overseeing policies, procedures, and controls; 2) hiring or appointing an AML Compliance Officer; 3) ongoing employee training; and, 4) independent testing or auditing of the program. Although the proposal only applies to the larger, non-exempt investment advisers (advisers with less than $100 million in AUM are not required to register with the SEC), the burden of implementation will fall heavily on smaller RIAs without risk management processes already in place. The proposed rules will require additional staff, in-depth training, ongoing monitoring and oversight, and external expertise. RIAs are able to adapt existing rules and contractually delegate some parts of the compliance process, with the caveat that the RIA will remain fully responsible for the efficacy of the program. With the SEC capable of enforcing the AML requirements, all advisers will be spending a lot more time – and money – ensuring compliance.

Those in favor of the AML compliance believe the RIA industry got off easy, as it is still undecided on whether or not small and mid-sized RIAs, exempt reporting advisers, and foreign private investment advisers will be subject to the proposed rules. Misery loves company. FinCEN also expects to further address the controversial topics of customer identification procedures and information sharing requirements through future regulations. Although the proposal does not include a customer identification program requirement as stringent as those found within banks and broker-dealers, RIAs may have a hard time checking accounts and transaction records against names provided by FinCEN without stronger due diligence into customer identities.Comments on the Proposed Rules are open until November 2, although it is expected that the AML proposal will be passed mostly intact.

Sometimes the fear of a thing is worse than the thing itself, and being haunted by proposed regulations may indeed turn out to be worse than compliance. But this horror show may turn into a series with multiple episodes, so clutch your popcorn and stay tuned.