Platforms · Software · Providers · Markets
FINRA identifies control weaknesses
FINRA, the Financial Industry Regulatory Authority, fined Webull Financial LLC $4.2 million over weaknesses in customer identification, defences against identity theft and money laundering, and execution quality. The settlement leaves the firm neither admitting nor denying FINRA's findings. Webull agreed to certify that it had remedied the AML and identity-theft deficiencies and to appoint an independent consultant to assess its best execution programme.
Execution reviews lacked essential comparisons
FINRA's review of Webull's execution-quality work covered February 2020 to May 2025. It found that the broker sometimes did not compare results with competing market centres and, at certain points, left non-marketable orders out of its reviews.
Those orders represented 60% to 70% of order flow in some periods. The assessments also lacked analysis broken down by order type and individual security.
Identity and transaction checks broke down
Between January 2020 and September 2023, Webull approved more than 120,000 accounts without sufficient identity verification, according to FINRA. Some applications included scenic landscape photographs rather than government-issued identification; other applicants were marked as deceased in Webull's own systems.
The regulator also found dozens of accounts for foreign nationals tied to a shared IP address or device. Checks for unrelated accounts using the same Social Security number were not introduced until August 2021.
Webull did not investigate 473 unauthorised Automated Clearing House transfers worth more than $1.5 million, which moved customer funds from other financial institutions into Webull accounts. One account produced nearly 13,000 alerts linked to potentially manipulative trading in more than 100 stock symbols over approximately 18 months.
FINRA also cited weak monitoring of suspicious out-of-the-money options activity, shared customer addresses or devices, and account takeovers. The case follows a separate $1.6 million FINRA fine in 2025 over the supervision and retention of influencer promotions. FINRA said some promotional claims were unbalanced or made exaggerated promises. Finance Magnates reported that Webull had not responded to a request for comment by publication.
| Measure | Reported figure |
|---|---|
| FINRA fine | $4.2 million |
| Accounts approved with inadequate identity checks | More than 120,000 |
| Unauthorised transfers | 473, worth more than $1.5 million |
| Alerts on one account | Nearly 13,000 across more than 100 stock symbols over approximately 18 months |
| Non-marketable share of order flow | 60% to 70% during some periods |
| Account identity-check period | January 2020 to September 2023 |
| Execution review period | February 2020 to May 2025 |
| Shared Social Security number checks introduced | August 2021 |
| Earlier FINRA fine | $1.6 million in 2025 |
What this means on the desk
For operations and compliance teams, the findings touch both account onboarding and post-trade oversight. Operators should check how identity controls handle invalid documents, deceased applicants and accounts linked by an address, device, IP address or Social Security number. They should also establish whether alerts for transfers, options activity and potential account takeovers reach a team that investigates and records their disposition.
Execution-review owners should confirm that their process covers competing market centres, non-marketable orders, order types and individual securities. The settlement also makes remediation evidence and consultant review relevant operational tasks. The source does not specify the systems involved or the cost of the remedial work, so teams should ask which controls and records will be used to demonstrate completion.
Teams responsible for incoming Automated Clearing House transfers can check how the recipient account is matched to the customer, how exceptions are flagged and whether each alert has a documented investigation outcome. They should also ask how surveillance coverage and execution-review records are tested after remediation, since the findings do not specify the particular tools or procedures Webull will use.
