The Outlier Lab

Broker-Dealer Obligations (FINRA and SEC)

Fraud-relevant obligations for US broker-dealers: CIP and SARs, Reg S-ID red flags, amended Reg S-P, FINRA 4512 trusted contacts, 2165 holds, ACATS 11870 timing, and the 2026 proposals.

Core components

Rule map for fraud teams

RuleWhat it requires or permitsFraud relevance
FINRA 3310 / 31 CFR 1023.210AML compliance programUmbrella for monitoring, SARs, CIP, CDD
31 CFR 1023.220 (CIP)Collect name, DOB, address, ID number before account opening; verify identity within a reasonable time with documentary or non-documentary methods; procedures for when verification fails (refuse, restrict, close, SAR); retain identifying info 5 years after closure; check government lists; customer notice; conditional reliance on another FINew-account and synthetic fraud; ACATS inbound with stolen identities. See KYC and Customer Identification Program (CIP)
31 CFR 1023.320 (SAR)SAR for transactions ≥ $5,000 meeting suspicion criteria; 30 days (60 if no suspect); 5-year retention; joint filing allowed; certain exceptions (e.g., some securities-law violations reported to SEC/SRO)ATO, mule, manipulation, elder exploitation cases. See BSA-AML and SAR Filing
Reg S-ID (17 CFR 248.201–202)Written Identity Theft Prevention Program for firms with covered accounts: identify, detect and respond to Red Flags, update periodically; board (or committee) approval of the initial program; staff training; service provider oversight; consider Appendix A guidelinesAccount opening and account maintenance identity theft, incl. ATO red flags
Reg S-P (17 CFR 248, as amended 2024)Safeguards for customer information; incident response program to detect, respond to and recover from unauthorized access, including notice to affected individuals; service provider oversightCredential and data breaches that fuel ATO; notification after compromise
FINRA 4512Maintain customer account information, including reasonable efforts to obtain a trusted contact person (age 18+) for non-institutional accounts, with written disclosure of when the firm may contact themEnables outreach during suspected exploitation or scams
FINRA 2165Permits temporary holds on disbursements and securities transactions for Specified Adults (65+, or 18+ with impairment) when the firm reasonably believes financial exploitation has occurred, is occurring, has been attempted or will be attemptedElder exploitation and many scam patterns. See Trusted Contact and Senior Investor Holds
FINRA 11870 (ACATS)Customer account transfer timing: carrying firm validates or takes exception within one business day; completes transfer within three business days after validationOutbound ACATS theft and inbound fraudulent transfers. See ACATS Transfer Fraud
FINRA 4530Reporting of certain events to FINRAMay apply after incidents (consider with counsel)
Reg E exclusionTransfers whose primary purpose is buying/selling securities through a registered broker-dealer are excluded from Reg EThe trade isn't a Reg E EFT, but bank-side ACH and linked debit products may be. See Regulation E and Unauthorized Transfers

FINRA 2165 hold mechanics

ElementRequirement
WhoSpecified Adults: age 65+, or 18+ with a mental or physical impairment the firm reasonably believes renders them unable to protect their interests
WhatTemporary hold on a disbursement of funds or securities, or a securities transaction (added effective March 17, 2022)
DurationUp to 15 business days. Extendable by 10 business days if internal review supports the belief. A further 30 business days if the firm has reported to a state regulator/agency or court. Max 55 business days unless terminated or extended by a regulator, agency or court
NoticeWithin 2 business days: all parties authorized on the account and the trusted contact (unless unavailable or reasonably believed to be involved)
Internal reviewStart immediately
Who can placeAssociated persons in supervisory, compliance or legal roles named in WSPs
Training and recordsDocumented training; records of the request, belief, who authorized, notices, internal review, extensions
Safe harborFrom FINRA Rules 2010, 2150 and 11870 when holds are placed per the rule

FINRA's 2026 oversight report found firms relying on 2165 without documented training and without records of the internal review supporting a hold. Trusted contact findings included firms collecting TCPs only from seniors, or skipping them during periodic account updates.

ACATS timing and fraud

ACATS fraud uses stolen or synthetic identities to open an account at a receiving firm, then pulls a victim's assets from the carrying firm. In other cases, a compromised account is transferred out. FINRA flagged a rising trend in Regulatory Notice 22-21 (Oct 2022) and published effective practices in Regulatory Notice 23-06 (Mar 2023):

  • Receiving firms: strengthen identity verification on online account opening; watch for multiple accounts under one identity or shared contact/bank details; get the customer's latest statement before sending a transfer request; check signatures and digital signature metadata.
  • Carrying (delivering) firms: notify the account owner (push, email, phone) and assigned broker of transfer instructions; watch for clusters of transfers to the same receiving firm; review IP/geolocation against prior legitimate contacts (2026 report).
  • Warning signs: repeated rejected transfer requests for the same customer, transfer soon after account opening, rapid movement of assets out after arrival, changes in how the customer communicates.

The one-business-day validation window leaves little room for manual review, so most of the defense has to happen before the transfer request (receiving-firm onboarding) or in parallel (customer notification). Rule 11870 permits exceptions on listed grounds, such as improper authorization and customer rescission. Use them, and document them, rather than letting fraud cases age past validation.

ATO, new-account fraud and ATO-driven manipulation

  • Regulatory Notice 20-32 (Sep 2020): ATO and new-account fraud used to trade thinly traded options against victim accounts for the benefit of a separate "profiting" account at another broker.
  • Regulatory Notice 21-18 (May 2021): effective practices against ATO: identity verification at onboarding, MFA, adaptive authentication for high-risk actions (large withdrawals, bank or email changes), monitoring for credential stuffing, secure account recovery, and incident response.
  • 2026 Oversight Report: a newer trend in which bad actors use ATO to sell victims' holdings and buy small-cap stocks targeted by pump-and-dump schemes. The report also cites failures to detect identity theft and synthetic identities at onboarding, GenAI-enabled fake IDs and deepfake selfies, and missing escalation of compromise red flags to SAR decisions. See Ramp-and-Dump via Account Takeover and Case Study - Japan Brokerage Account Takeovers (2025).

Regulation S-P amendments (2024)

The SEC adopted Reg S-P amendments on May 16, 2024. Covered institutions must maintain a written incident response program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. That includes assessing and containing incidents and notifying affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

  • Customer notice: within 30 days of becoming aware of the incident. A delay is permitted only at the written request of the U.S. Attorney General on national security or public safety grounds.
  • Service providers: firms must oversee service providers, including requiring notice to the firm within 72 hours of a service provider becoming aware of a breach. The firm remains responsible for customer notice.
  • Compliance dates: larger entities December 3, 2025; smaller entities June 3, 2026.

For fraud teams, the amendments link breach response to fraud response. Customers whose credentials or sensitive information were exposed are ATO targets. Coordinate notification, forced resets and heightened monitoring. FINRA's compromised-account checklist covers assessing exposure, preserving evidence, notifying the clearing firm, and considering SAR and FINRA 4530 reporting.

2026 proposals to watch

FINRA Regulatory Notice 26-02 (January 8, 2026) requested comment (deadline March 9, 2026) on:

  • Rule 2165: raise the maximum hold from 55 to 145 business days through three 30-business-day extensions, conditioned on follow-up with authorities. Expand reporting to federal authorities. Allow people in specialized senior-investor-protection or fraud-prevention roles to place holds. Codify that firms may restrict an entire account in some cases.
  • New Rule 2166: a "speed bump" of up to 5 business days on a disbursement or transaction for any natural-person customer 18+ when the firm reasonably believes fraud by a third party (including identity theft and ATO) has occurred, is occurring, was attempted or will be attempted. It has notice requirements and a safe harbor from FINRA 2010, 2150 and 11870.
  • Rule 4512: allow "emergency contact" terminology, and one trusted contact applied across a customer's accounts.

Status (late October 2026): FINRA filed the proposals with the SEC on August 13, 2026 as SR-FINRA-2026-018. The filed version keeps the 145-business-day Rule 2165 maximum and lengthens the Rule 2166 delay to up to 10 business days (from 5 in RN 26-02). It was pending SEC action, so these are not yet effective rules (FINRA weekly update, Aug 19, 2026).

What changes for the money path

Diagram: Onboarding: CIP + Reg S-ID red flags, Funding: ACH/wire/ACATS in, Trading: manipulation and ATO patterns, Money-out: ACH/wire out, ACATS out, journal to other account, Exploitation or fraud suspected?, 2165 hold + TCP notice + internal review, Contractual hold / step-up (2166 if adopted), AML referral and SAR decision

How to build it

  1. Map each money path (ACH in/out, wire, ACATS in/out, journals, debit card, crypto if offered) to the applicable rules.
  2. Reg S-ID program: red flag inventory that explicitly includes ATO and transaction red flags (contact change followed by money-out, new bank link followed by full liquidation), not only onboarding ones.
  3. Hold authority: written 2165 procedures, plus contractual hold terms for non-specified adults. Train the named roles.
  4. TCP collection at onboarding and during periodic updates for all non-institutional customers, using effective prompts ("Who is your trusted contact?").
  5. ACATS controls on both sides; daily review of outbound transfers to receiving firms with clusters.
  6. Escalation paths from cyber, support and fraud to AML for SAR decisions.
  7. Breach-to-fraud playbook under amended Reg S-P.

Artifacts and templates

Broker-dealer fraud compliance checklist

  • CIP procedures cover non-documentary verification, synthetic identity red flags and failed-verification actions
  • Reg S-ID program approved; red flags cover onboarding and account maintenance; annual board/committee report
  • Reg S-P incident response program with customer notification procedures and service provider oversight
  • TCP requested from all non-institutional customers; disclosure provided
  • 2165 WSPs, named roles, training records, internal review documentation
  • ACATS: receiving-side onboarding checks; delivering-side customer notifications; exception usage documented
  • Fraud, cyber and support escalate red flags to AML within a defined SLA
  • Compromised-account response aligned with FINRA's checklist; clearing firm notified where applicable

Metrics

  • ACATS out fraud: attempts, stopped before validation, losses
  • TCP coverage (non-institutional accounts with a TCP)
  • 2165 holds: count, duration, outcome, documentation completeness
  • Time from red flag to AML referral
  • ATO-to-money-out interval and losses by path (ACH, wire, ACATS, trading)

Pitfalls

  • Assuming Reg E covers trading losses from ATO. It doesn't; your own policies and customer-protection posture govern.
  • TCPs only for seniors. FINRA flagged this; the rule covers non-institutional customers generally.
  • 2165 holds without documented reviews. The safe harbor depends on following the rule.
  • Relying on one-business-day ACATS review. Push controls upstream and notify customers.
  • Treating Reg S-ID as an onboarding-only checklist. Most losses come from account maintenance events.

Sources and further reading