FINRA Fines Webull $4.2 Million for AML, Identity Verification and Surveillance Failures

The Financial Industry Regulatory Authority (FINRA) has fined Webull Financial LLC US$4.2 million following an investigation that identified significant deficiencies in the brokerage’s anti-money laundering (AML), customer identity verification, identity theft prevention and trading surveillance controls. The enforcement action, announced on 5 November 2026, concerns weaknesses spanning several years and highlights the challenges faced by rapidly expanding digital brokerage platforms in maintaining effective compliance systems.

FINRA found that Webull’s customer identification programme was not reasonably designed to verify customers’ identities adequately. Between January 2020 and September 2023, the company approved at least seven million new customer accounts, with approximately 6.5 million processed through identity verification services provided by a third party. Despite the scale of onboarding, the firm failed to maintain sufficient procedures and oversight to ensure that the verification process reliably identified applicants.

More than 120,000 accounts were approved despite unresolved discrepancies in customer information or indicators of possible identity fraud. In one example cited in the regulatory findings, more than 50 applicants submitted photographs of landscapes instead of images of government-issued identification documents, yet their applications were automatically approved. Other applications were approved even though internal records indicated that the applicants were deceased.

FINRA also identified weaknesses in the procedures governing manual reviews and the handling of failed automated checks. Before November 2022, Webull’s written policies did not adequately explain how employees should verify identities, assess discrepancies or escalate questionable applications. The regulator further found that some reviewers were handling application volumes that were unreasonable, while the company’s supervision of its external verification provider was insufficient to compensate for weaknesses in the service.

The investigation also identified substantial deficiencies in transaction monitoring and suspicious activity surveillance. Webull’s procedures did not adequately define which reports analysts should review, how investigations should be conducted or when cases should be escalated. Although the company generated alerts for certain trading activities, it lacked effective processes to identify wider patterns involving repeatedly flagged customers or multiple alerts associated with the same security. FINRA also considered the resources allocated to investigations insufficient for the volume of activity requiring review.

One of the most significant findings concerned 473 unauthorised automated clearing house (ACH) transfers identified between June 2020 and January 2021. These transfers brought more than US$1.5 million from customers’ accounts at other financial institutions into Webull accounts. Although the transactions were eventually reversed following fraud claims by the affected institutions, FINRA found that Webull had failed to identify and investigate the activity adequately and to establish its underlying cause. The settlement also identified at least 25 instances involving malicious access or fraudulently opened accounts followed by suspicious trades or transfers that were not investigated and reported promptly.

Trading surveillance presented further concerns. FINRA identified an account that generated nearly 2,000 equity layering alerts and almost 11,000 spoofing alerts across more than 100 securities over approximately 18 months. Webull did not investigate the alerts in a timely manner and did not report the suspected conduct until months after the account had been closed. The regulator also identified potentially manipulative wash trading in at least four accounts and options transactions involving out-of-the-money contracts that were not appropriately detected or reported.

The surveillance deficiencies extended to the design of detection rules. For example, Webull’s approach to identifying potential wash trading was limited by thresholds relating to the average daily trading volume of securities and the number of suspected transactions involving the same symbol and price. The firm also lacked adequate processes for identifying certain suspicious options activity, simultaneous geographical indicators and unrelated accounts using the same internet address. These findings demonstrate how narrowly designed monitoring parameters can prevent firms from recognising potentially significant patterns when individual alerts are assessed in isolation.

Separate deficiencies were identified in Webull’s identity theft prevention programme. Between January 2020 and February 2023, the firm did not maintain a reasonably designed written programme for identifying, preventing and mitigating identity theft involving covered accounts. FINRA found that Webull relied substantially on its customer identification procedures and information received from its clearing firm, rather than maintaining an adequate standalone framework for responding to identity theft indicators.

Examples included approximately 80 accounts associated with foreign nationals that used only two device identifiers, with each account transferring and withdrawing approximately US$1,000 on the same day. Another 91 applications used the same internet address, temporary email domains and employers that could not be verified. The regulator also identified instances in which unrelated applicants shared telephone numbers or email addresses without sufficient investigation. These indicators were not, in themselves, proof that every affected applicant was involved in identity theft, but they required more effective scrutiny and escalation.

The enforcement action also addressed deficiencies in Webull’s best execution obligations. FINRA found that, from at least February 2020 through October 2025, the company had not reasonably reviewed execution quality or adequately supervised its order-routing practices. Comparisons with alternative trading venues were absent or insufficient for extended periods. The firm also failed to conduct appropriate analyses by order type and individual security.

Webull received payment for order flow and rebates on routed orders, making independent assessments of execution quality particularly relevant. FINRA noted that non-marketable orders, which represented approximately 60% to 70% of order flow before March 2021, were excluded from the company’s execution reviews during that period. The regulator’s findings concerned the adequacy of execution reviews and supervision, rather than the mere receipt of payment for order flow.

Under the settlement, Webull agreed to a censure, the US$4.2 million fine and a series of corrective measures. A registered senior principal must certify that the required remediation relating to AML and identity theft prevention has been implemented within 180 days of the notice accepting the settlement. The certification must be supported by a written explanation and relevant evidence. Separately, the company must retain an independent consultant within 60 days to assess its best execution compliance and related supervisory arrangements, with a report due within 120 days of acceptance, subject to the settlement's specific requirements.

FINRA acknowledged that Webull had made improvements during and after the period under review, including engaging an AML specialist consultant, developing additional automated surveillance capabilities, increasing compliance staffing and changing its identity verification arrangements. Nevertheless, the settlement requires the firm to demonstrate that its revised procedures and systems operate effectively.

Webull accepted the regulatory findings without admitting or denying them. The action is a regulatory settlement and does not constitute a criminal conviction or establish that the company itself engaged in money laundering.

The case highlights the importance of ensuring that compliance capabilities develop alongside business growth. Outsourcing customer verification does not transfer a brokerage’s responsibility for establishing the identity of its customers, while automated monitoring systems must be supported by clear investigation procedures, appropriate escalation arrangements and sufficient personnel. The findings also demonstrate the risks of relying on isolated alerts without assessing connections between accounts, devices, transactions and trading activity.

For financial institutions and other regulated businesses, the enforcement action reinforces the need for ongoing assessment of customer onboarding controls, third-party service providers, transaction monitoring parameters and the effectiveness of internal investigations. The existence of written policies or automated alerts is not sufficient where operational practices fail to identify, investigate and escalate potentially suspicious activity in a timely manner.

By fLEXI tEAM