The Outlier Lab

FINRA files proposal to extend holds to all adult customers

FINRA asked the SEC to approve Rule 2166, a 10-business-day fraud delay for customers of any age, plus longer Rule 2165 senior holds and easier trusted contact collection.

What happened

FINRA filed SR-FINRA-2026-018 with the SEC. FINRA's weekly update gives the filing date as August 13, 2026; the SEC's notice (Release 34-106275, dated September 3) records it as August 20. The notice ran in the Federal Register on September 9 and comments closed September 30. The package follows Regulatory Notice 26-02 from January 2026.

RuleChangeSpecifics as filed
New Rule 2166Temporary delay for suspected fraud, any customer 18 or olderUp to 10 business days (the January proposal said 5). Trigger is a reasonable belief of third-party fraud, expressly including identity theft and account takeover. Customer notice, oral allowed, within two business days; trusted contact notice optional. Only a regulator, agency or court can extend it.
Rule 2165 amendmentsLonger holds for Specified Adults (65+ or impaired)Maximum rises from 55 to 145 business days through three 30-business-day extensions, each needing documented follow-up with the investigating authority. Covered property expands to "other assets," which reaches payment stablecoins.
Rule 4512 amendmentsTrusted contact collectionFirms may say "emergency contact," and one designation can cover all of a customer's accounts.

Both hold rules are permissive and create no private right of action. A firm acting under Rule 2166 gets a safe harbor from FINRA Rules 2010, 2150 and 11870, the last being the customer account transfer rule. SIFMA's September 30 comment letter backed the 10-day delay and the 145-day maximum.

Why it matters for transaction fraud teams

Today the only FINRA safe harbor for pausing a disbursement is Rule 2165, which covers only Specified Adults. When a 45-year-old is being coached through a liquidation by a fake adviser, or an attacker has just changed the bank link and requested a withdrawal, firms fall back on account agreement language and case-by-case legal judgment. Rule 2166 gives those Account Takeover (ATO) and scam cases a defined option between releasing the money and restricting the account, with a fixed notice clock and a hard stop.

Ten business days buys time for a callback to a number on file, a fresh identity check, a recall request to the receiving bank, and a second conversation with a customer who may be following a scammer's script. It rarely talks a committed investment scam victim down; those cases still need Rule 2165 where the customer qualifies, a trusted contact, or law enforcement.

For ACATS Transfer Fraud, the 11870 safe harbor means a firm delaying an outbound transfer under 2166 would have cover for missing the ACATS clock. A commenter argued ACATS timing and indemnification rules could still blunt the rule; FINRA said only that it is considering further steps on account opening and transfers. On August 20, Senators Wyden and Warren separately asked FINRA to require customer notice of transfer requests and phishing-resistant MFA, and said several brokerages had agreed to build self-service transfer locks.

Banks and payment apps get nothing from this filing. Their outbound delays still rest on account terms and their own Withdrawal and Payout Controls.

What to do now

  • List the alert types that would justify a 2166 delay, such as contact-change anomalies before a withdrawal, Scam Victim Indicators during a liquidation, or an outbound ACATS request soon after a profile change.
  • Map every money-out path that can be paused today (ACH, wire, check, journal, outbound ACATS) and flag any that can't.
  • Build the two-business-day customer notice into case management, logging the reason, expiry date and release decision.
  • Decide who can place and release a delay, require supervisory sign-off, and train that group before approval.
  • Draft a trusted contact re-collection campaign using the "emergency contact" wording, with a baseline uptake number to beat.
  • Check whether outbound ACATS requests notify the customer and whether customers can lock transfers themselves.
  • Track delays placed, released early, confirmed fraud, losses avoided and complaints.

What to watch

  • SEC action. The notice gave the Commission 45 days from Federal Register publication (about October 24) to act, extendable to 90 days. FINRA will set the effective date in a Regulatory Notice after approval.
  • FINRA said it may issue guidance on whether complaints about delayed disbursements are reportable under Rule 4530.
  • FINRA's answer to the senators' ACATS letter, and whether transfer notice or locks become a rule.

Sources

Updates

  • 2026-10-26: Published.