This commentary is general information, not legal advice. Rules and their interpretations change; check the current rules or consult counsel before acting on anything here.
FINRA announced on November 5, 2026, that it had accepted a Letter of Acceptance, Waiver, and Consent (AWC No. 2021073404901) with Webull Financial LLC (CRD No. 289063). Webull consented without admitting or denying the findings—the standard AWC posture—and agreed to a censure, a $4.2 million fine, certification that it remediated AML and identity-theft program deficiencies, and an independent consultant for best execution. See FINRA’s news release.
The AWC ties the case to scale. From January 2020 through September 2023, Webull opened millions of new accounts each year; by fall 2023 it had at least seven million. FINRA found the compliance program did not keep pace.
On AML and CIP, FINRA found violations of Rules 3310(a), 3310(b), 3310(f)(ii), and 2010. Webull approved more than 120,000 accounts through third-party identity verification without forming a reasonable belief that it knew the customers’ true identities—including more than 50 accounts opened on scenic-landscape photos instead of government ID, and accounts approved despite firm records indicating the customers were deceased. It failed to identify or investigate 473 unauthorized ACH transfers of more than $1.5 million into Webull accounts, and failed to timely investigate one account that triggered nearly 13,000 alerts for potentially manipulative trading in more than 100 symbols over roughly 18 months.
The lesson here isn’t that Webull used a vendor to verify identities. Most retail firms do. The problem is that a vendor’s “pass” doesn’t satisfy the firm’s own obligation to form a reasonable belief that it knows who its customer is. When a firm signs up millions of accounts, its compliance oversight has to grow just as fast: more people, sharper escalation rules, and someone who actually looks at the exceptions. A landscape photo uploaded as a government ID is the kind of thing a human reviewer catches. Thousands of unreviewed alerts on one account tell you the firm’s surveillance had outgrown the staff assigned to it.
Between January 2020 and February 2023, Webull lacked an Identity Theft Prevention Program reasonably designed under Regulation S-ID Rule 201 and FINRA Rule 2010. The AWC cites reliance on a deficient CIP, foreign-national accounts sharing device IDs or the same IP address, and no process until August 2021 to check whether unrelated accounts used the same Social Security number.
From at least February 2020 to at least October 2025, FINRA found best-execution and supervisory failures under Rules 5310(a), 5310.09, 3110, and 2010: no or insufficient review of competing-market execution quality; no review of non-marketable orders (60%–70% of order flow); and no type-of-order or security-by-security reviews, while routing non-directed orders to PFOF venues and executing billions of shares.
Mark J. Astarita, Esq.
Sallah Astarita & Cox, LLC
11 Broadway, Suite 615, New York, NY 10004
(212) 509-6544 | Direct: (973) 559-5795
mja@sallahlaw.com
seclaw.com | securitieslawyer.us | sallahlaw.com
Mark Astarita is a nationally recognized securities attorney, who represents investors, financial professionals and firms in securities litigation, arbitration and regulatory matters, including SEC and FINRA investigations and enforcement proceedings.
He is a partner in the national securities law firm Sallah Astarita & Cox, LLC, and the founder of The Securities Law Home Page - SECLaw.com, which was one of the first legal topic sites on the Internet. It went online in 1995 and is updated daily with news, commentary and securities law related links.
Discover more from SECLaw
Subscribe to get the latest posts sent to your email.
