Democratic Senators Push FINRA to Require Account Transfer Locks, Notifications

U.S. Senators Elizabeth Warren, D-Massachusetts, and Ron Wyden, D-Oregon, on August 20 wrote to the Financial Industry Regulatory Authority urging the brokerage industry’s self-regulator to require firms enable customers to lock their accounts to help fight fraud.

In the letter, the two Senate Finance Committee members asked FINRA President and CEO Robert Cook to “take immediate regulatory action” to address the threat of fraud perpetrated through the Automated Customer Account Transfer Service, the system brokerage firms use to move client assets between firms. The senators wrote that fraudsters are exploiting the system by using stolen personal information to open an account in a victim’s name at a separate brokerage firm, then initiating a transfer from the victim’s legitimate account.

“Bad actors are increasingly exploiting structural weaknesses in the ACATS system to illicitly drain consumers’ brokerage accounts, including retirement funds,” the senators warned in the letter. “While the speed of the current transfer process was originally designed to protect consumers by preventing anti-competitive behavior by brokerages, criminals are exploiting the complete lack of an outbound verification step by the account holder.”

The letter calls for FINRA to require that firms issue notifications to participants about ACATS transfers, as well as protect accounts with “phishing-resistant multi-factor authentication technology,” such as passkeys. FINRA currently recommends only that brokerages notify account holders of ACATS requests. Once a request is submitted, the outgoing brokerage has only one business day to validate or object to the transfer, then three days to complete it.

In their related press release, the senators included a chart based on a review of major brokerage firms that showed “only a fraction of brokerages [are] voluntarily providing customers with strong protections.” Fidelity Investments and Vanguard were the only firms listed in the chart as allowing participants to conduct a transfer lock via self-service. Several other firms listed either blocked transfers if requested through customer service, were working on self-service capabilities or did not offer participants ways to block transfers at all.

After receiving direct outreach from the senators, several brokerages, including Webull Financial LLC and Interactive Brokers Inc., agreed to upgrade their security by developing self-service transfer locks, according to the release.

The senators requested that FINRA respond by September 17.

Proactively Addressing the Issue

Emmett Ong, a trial attorney at Bryan Cave Leighton Paisner LLP and former principal counsel in FINRA’s Department of Enforcement, says many of his client firms have asked what they can do to proactively address a potential response to the letter and an eventual rule from FINRA.

Wanting to be proactive stems from the letter requesting two things, according to Ong: First, the letter “tells FINRA that it should put in a rule that requires brokerage firms to put in additional safety measures,” and second, it “urges the industry itself to take its own safety precautions in the absence of a rule.”

While Ong expects just a letter response by September 17, he would “not be surprised” if rulemaking followed. However, he does not anticipate the process to be speedy.

In the interim, Ong recommends brokerage firms and plan sponsors continue to provide guidance and education to their participants about account safety precautions. Reporting suspicious account activity, using multi-factor authentication and passkeys, and coming up with alternatives for “paper-based” investors are among Ong’s top recommendations.

Ong says FINRA has probably not put a formal rule in place yet due to the evolving nature of technology and the challenge of creating a rule that is “future-proof” and “technology-agnostic.” Some industry firms claim they are developing account lock technologies and do not want a rule that will force their hands and budgets. In time, and with feedback from FINRA’s member firms, however, a rule could still ensue, Ong claims.

FINRA declined to comment on the senators’ letter directly but stated, “FINRA was among the first regulators to identify this misconduct and alert our member firms. We continue to share intelligence and support firms implementing defenses suited to their customers and business. We are actively engaged with the wider securities industry to determine what further actions are necessary to protect investors.”

In an emailed response to questions, a FINRA spokesperson noted that the regulator previously published several Regulatory Notices about ACATS, including, “FINRA Shares Effective Practices to Address Risks of Fraudulent Transfers of Accounts Through ACATS,” published in March 2023, and “FINRA Shares Effective Practices to Address Risks of Fraudulent Transfers of Accounts Through ACATS, published in October 2022.”