What changed
FinCEN finalized a delay of the IA AML Rule's effective date by two years (FACT, Federal Register 2026-01-02 final rule). The underlying mandate stands: SEC-registered investment advisers and exempt reporting advisers must develop and implement written AML/CFT programs and file SARs (FACT). In parallel, FinCEN, the Fed, OCC/FDIC/NCUA all published 2026 proposed rules reworking AML/CFT program standards across financial institutions (FACT), signaling the whole AML program regime is being modernized, not abandoned.
Why now
Two-sided timing. FOR: the delay hands a solo builder an uncontested runway to build and seed the market before the compliance date, and the filer class (small RIAs with zero compliance staff) is already defined in the rule. AGAINST: the same delay removes near-term deadline pressure — FinCEN delayed explicitly while it reviews the rule, so the mandate could be narrowed before it bites. This is a build-cheap-now, monetize-fully-later window, not a 30-day cash play.
Converging signals
(1) Final rule delaying but preserving the IA AML mandate (FinCEN, 1/2/2026); (2) the September 2025 proposal showing the original 1/1/2026 effective date and the deliberate two-year push; (3) three 2026 agency proposed rules (FinCEN 4/10/2026, OCC/FDIC/NCUA 4/10/2026, Fed 7/9/2026) rebuilding AML/CFT program requirements economy-wide — the rule, the filer class, and the standard SAR channel (FinCEN BSA E-Filing — inference, it is the established SAR portal) meet at one point.
Customer pain
A 2-10 person RIA has no CCO, no BSA officer, and no idea how to write a risk assessment, run independent testing, or assemble a SAR. Their alternatives are a compliance consultant at $5k-$25k/yr or ignoring it until an SEC exam. HYPOTHESIS as to intensity today: pain is real but deferred — the compliance date is ~2028, so most small RIAs will not feel urgency until 2027.
Who pays
Primary: small SEC-registered RIAs (~15,000) and ERAs (~5,000) — counts are stated in the convergence input as inference, not sourced in the rule text provided. Secondary (better near-term): the compliance consultants and outsourced-CCO shops that serve them, who would white-label a program generator and SAR assembler to serve more clients without hiring.
Solved today
Compliance consultants (ACA Group, COMPLY/RIA in a Box, AdvisorAssist) sell annual compliance programs; many already sell AML add-ons for advisers voluntarily aligned with bank standards. SARs for other BSA institutions are filed via FinCEN BSA E-Filing, often manually by consultants (FACT that the channel exists; consultant workflow is inference).
Why current solutions are bad
Consultant-delivered programs are Word-document templates at boutique prices; nothing is instrumented for the ongoing obligations (annual review, training logs, independent testing evidence, SAR narratives). Small RIAs are exactly the segment consultants underserve because the ticket is too small.
Proposed product
AML-program-in-a-box: intake wizard → generates the firm-specific written AML/CFT program and risk assessment; a compliance calendar that runs annual-review/training/independent-testing checklists and stores the evidence trail an examiner asks for; a SAR workbench that assembles narratives and files via BSA E-Filing (batch spec) with a per-SAR fee. Founder's proven ELDT shape: read the mandate, find the forced filer, own the submission layer, charge per transaction.
MVP version
Skip e-filing initially. MVP = program/risk-assessment generator + annual-review checklist engine, built on the rule text and FinCEN's adviser-specific requirements, white-labeled to 3-5 RIA compliance consultants as design partners. Claude-assisted document generation is squarely in the founder's stack; 4-6 weeks.
30-day build
Pull the full IA AML Rule + delay docket; extract every discrete obligation into a requirements matrix. Scrape SEC IAPD/Form ADV data (public records strength) to segment RIAs by size/custody/state and build the outreach list. Interview 10 outsourced-CCO/consultant shops: what do they charge for an AML program today, would they resell a generator.
60-day build
Ship the generator + checklist MVP. Sign 3 consultant design partners at founder pricing ($200-500/mo white-label). Publish an 'IA AML Rule readiness' assessment tool as lead capture — the delay means content ranks now with no competition.
90-day revenue plan
Convert design partners to paid; sell direct 'early adopter' program packages to RIAs whose institutional investors or custodians already demand AML programs (a real segment that buys before deadlines — HYPOTHESIS). Target $2-5k MRR by day 120-180; the full wave comes 2027 as the compliance date approaches, and owning the SEO/consultant channel now is the moat then.
Distribution path
Form ADV/IAPD public data gives a complete, free, addressable list of every buyer with AUM, headcount, and email — rare distribution advantage. Channel-first via compliance consultants avoids one-by-one trust building. Content/SEO on the rule (low competition during the delay window).
Pricing hypothesis
$1,500-$3,000/firm/yr subscription for program + calendar; $75-150 per SAR filed; consultant white-label tier per seat. Undercuts the $5k+ consultant ticket — the classic undercut-the-percentage wedge.
Technical difficulty
Low-moderate. Document generation, checklist workflows, and ADV data ingestion are days-to-weeks with AI assistance. BSA E-Filing batch integration is the hard part (spec-driven XML, testing regime) — defer to phase 2; SAR 'assembly + guided manual filing' is a shippable intermediate.
Legal / regulatory risk
The adviser retains legal responsibility for its program; product must be positioned as tools + templates, not legal advice — standard disclaimer posture (HYPOTHESIS: same posture incumbents use). SAR confidentiality rules constrain how filing-support data is handled; solvable with design, not licensure. Founder does not need to be licensed to sell this.
Platform dependency
None that can deplatform him — the 'platform' is a federal filing system. Real dependency is REGULATORY: FinCEN delayed specifically to revisit the rule; a narrowed or rescinded rule guts the forced-buyer thesis. That is the risk to monitor, docket by docket.
Founder fit
Very high on shape: identical to his shipped ELDT/Training Provider Registry business — mandate → forced filer class → submission layer → per-transaction fee. Public-records skill maps directly to Form ADV prospecting. Gap: no financial-services domain background, mitigated by selling through consultants who have it.
Breakout potential
If the rule takes effect as written, 20,000 forced filers with a hard deadline and almost no incumbent focus on the sub-$1B-AUM tier; expansion into state-registered advisers and the broader 2026 AML/CFT program modernization wave (banks' vendors won't chase 3-person RIAs). Even 300 firms at $2k/yr + SAR fees is a $600k+/yr solo business.
Final recommendation
CONDITIONAL GO at low burn. This is the founder's exact proven shape with a fully enumerable buyer list, but the two-year delay converts it from a deadline-driven sprint into an option play. Build the cheap MVP (generator + checklists), sell through consultants and early-adopter RIAs for modest revenue in 90-180 days, set a docket watch on the FinCEN review, and hold the SAR e-filing build until the effective date and rule scope firm up. Kill only if FinCEN's review guts the adviser mandate.
Next action
Read the full final delay rule and original IA AML Rule preamble (respondent counts, burden estimates); pull the Form ADV data set and count RIAs with ≤10 employees; book 5 calls with outsourced-CCO firms this month to price-test a white-label program generator.