Platforms · Software · Providers · Markets
FINRA has fined Webull Financial LLC $4.2 million, finding weaknesses in Webull's identity-theft safeguards and money-laundering controls, as well as its execution-quality practices. The findings span customer onboarding from January 2020 to September 2023 and execution-quality reviews conducted through May 2025.
Onboarding and surveillance gaps
FINRA found that Webull approved more than 120,000 customer accounts without sufficient identity checks. Some applications passed with landscape photographs rather than government-issued identification; other accounts were linked to applicants marked as deceased in Webull's systems.
Bill St. Louis, FINRA's Executive Vice President and Head of Enforcement, said the firm's compliance programme had not matched the pace of its business growth.
The regulator also identified 473 unauthorised Automated Clearing House transfers, worth more than $1.5 million, that Webull did not investigate. One account produced nearly 13,000 alerts for potentially manipulative activity across more than 100 stock symbols over approximately 18 months, without an investigation. Surveillance weaknesses also covered suspicious out-of-the-money options activity, account takeovers, and customers sharing an address or device. Webull opened dozens of accounts for foreign nationals using a common IP address or device, and did not add checks for unrelated accounts with the same Social Security number until August 2021.
Execution reviews missed order flow
For the period from February 2020 to May 2025, FINRA found Webull's reviews of execution quality were insufficient. At times, the broker did not compare results across competing market centres or assess non-marketable orders, which made up 60% to 70% of its order flow during some periods. The reviews also omitted analysis at the level of order type and individual security.
Webull settled without admitting or denying FINRA's findings. It agreed to certify that it had addressed deficiencies in its controls against money laundering and identity theft, and to appoint an independent consultant to examine its best execution programme. The case, first reported by Finance Magnates, follows a separate $1.6 million FINRA fine in 2025 concerning the supervision and retention of influencer promotions.
FINRA said some promotional claims were not fair and balanced or made exaggerated promises. Webull had not responded to a request for comment by publication.
What to watch next
Operations teams should review whether identity-verification controls reject incomplete or implausible documents and flag applicants recorded as deceased. They should also check what happens when unrelated accounts share an identifier, address, device or IP address, and whether suspicious transfers and trading alerts reach an investigator.
For execution-quality reporting, teams should confirm that reviews cover competing market centres, non-marketable orders, each order type and individual securities. The findings do not specify how Webull will certify remediation or how the independent consultant will assess the programme, so firms applying the lessons should establish what evidence supports those reviews and how exceptions are tracked.
Operators can also ask whether they can trace identity-check decisions to the documents reviewed, and whether alerts tied to transfers or trading activity have clear investigation outcomes. For execution reviews, the practical check is whether the records show which order types and securities were assessed, including non-marketable flow, and how gaps are escalated for follow-up.
