Webull FINRA Fine: A Vendor Pass Is Not Knowing Your Customer

FINRA Fines Webull $4.2 Million Over AML, Identity Theft and Best Execution

FINRA fined Webull Financial LLC $4.2 million on November 5, 2026 for failing to implement reasonably designed programs for anti-money laundering (AML), identity theft prevention and best execution, according to FINRA's news release. The AWC listing on FINRA.org identifies the matter as Case ID 2021073404901 against Webull Financial LLC, CRD 289063. Webull consented to the findings without admitting or denying them.

This was not a case of a brokerage that skipped identity verification. It was a case of a brokerage that bought verification from vendors and, in FINRA's finding, still did not know its customers. Between January 2020 and September 2023, Webull approved the opening of more than 120,000 new customer accounts using identity verification services provided by its third-party vendors without forming a reasonable belief that it knew the true identity of those customers.

FINRA frames the failure as a scaling problem. Webull opened millions of new customer accounts each year in that period, and Bill St. Louis, FINRA's Executive Vice President and Head of Enforcement, said: "Webull's business grew rapidly, but its compliance program did not keep pace."

A Vendor Pass Is Not a Reasonable Belief

The distinction that matters is between running an identity check and knowing a customer. The vendor service does the first. FINRA's finding turns on the second: Webull approved accounts without forming a reasonable belief that it knew the true identity of those customers.

The examples in FINRA's release show how wide that gap was:

• More than 50 customers had accounts approved after submitting photos of scenery instead of government-issued identification.
• Some accounts were approved even though information in Webull's own systems indicated the customers were deceased.
• Dozens of accounts for foreign nationals were opened using the same IP address or device.
• Webull had no process to check whether multiple unrelated accounts were opened using the same Social Security number until August 2021.

The second item deserves board attention. The disqualifying information was not hidden at a vendor. It sat in Webull's own systems.

FINRA also found that between January 2020 and February 2023, Webull lacked an identity theft prevention program reasonably designed to detect, prevent and mitigate identity theft, and instead relied on a deficient customer identification program. One weak onboarding process produced two separate program failures.

Nearly 13,000 Alerts on One Account

Onboarding was half of the AML story. The other half was what Webull did not see after accounts opened. According to FINRA, Webull failed to identify or investigate 473 unauthorized ACH transfers used to transfer over $1.5 million from customers at other financial institutions into Webull accounts.

It also failed to timely investigate a single account that triggered nearly 13,000 alerts for potentially manipulative trading activity in more than 100 stock symbols during the approximately 18 months the account was open. An alert system that fires nearly 13,000 times on one account without timely review is producing data, not oversight.

Surveillance gaps FINRA identified

• No processes to identify potentially suspicious out-of-the-money options trading.
• No surveillance to identify unrelated customers trading from the same address or device.
• No reasonable surveillance to detect fraudulent account takeovers in a timely manner.

Payment for Order Flow Without Regular and Rigorous Review

From at least February 2020, according to FINRA, Webull executed billions of shares and received payment for order flow. FINRA found that Webull failed to reasonably supervise for best execution and failed to conduct reasonable regular and rigorous reviews of customers' execution quality.

FINRA's release states that at certain points between at least February 2020 and at least May 2025, Webull conducted no review of the execution quality available at competing market centers, and at other times obtained that data but failed to sufficiently review it. At certain points the firm also failed to review execution quality for non-marketable orders, which made up 60% to 70% of its order flow during certain periods, and did not conduct reviews on a type-of-order or security-by-security basis.

Two findings, two remedies

The settlement splits the fix. Webull agreed to certify remediation of the deficiencies in its AML and identity theft prevention programs, and to retain an independent consultant to address its best execution program. The practical effect is that the best execution fix runs through an outside party, while the AML fix rests on Webull's own certification.

FINRA's release points member firms to Regulatory Notice 21-23 for guidance on best execution obligations under FINRA Rule 5310 and payment for order flow.