On March 20, FINRA received a Letter of Acceptance, Waiver, and Consent (AWC) from an online brokerage firm, censuring and fining the firm $450,000 for alleged compliance failures related to its BSA/AML program, customer identification program (CIP), and identity theft prevention program (ITPP). Specifically, FINRA found that between January 2019 and June 2023, the firm failed to: (i) establish and maintain a reasonably designed CIP; (ii) develop and implement a reasonable BSA/AML compliance program to detect and report suspicious transactions; and (iii) develop and implement a reasonable written ITPP. The AWC noted that, between January 2019 and April 2022, the firm approved approximately 350 accounts despite applicants providing only the last four digits of a Social Security number, and approved certain accounts for customers despite indicia of potential identity fraud, among other deficiencies identified.

FINRA also found that the firm’s suspicious activity monitoring relied solely on automated alerts for large or frequent deposits and withdrawals, with no policies linking account-opening red flags to post-opening activity. For instance, FINRA cited a failure to detect approximately 200 accounts opened using a common phone number that its clearing firm flagged for suspicious payment reversal requests indicative of attempted securities free riding. The firm also allegedly failed to detect timely certain accounts using email addresses routed to the same inboxes or temporary email domains. Additionally, FINRA stated that the firm’s ITPP prior to October 2021 primarily relied on customers to self-report instances of stolen identity, and that, even after receiving alerts about potential identity theft methods, the firm failed to take timely corrective action. According to the AWC, the firm began implementing new procedures in June 2023 to address red flags of identity theft in its account opening process. The firm neither admitted nor denied FINRA’s findings.