The Webull FINRA fine: $4.2 million after landscape photos passed as government ID

The Webull FINRA fine is $4.2 million, for failures that include approving more than 120,000 accounts without a reasonable belief about who the customers were. FINRA announced the settlement on 5 November 2026. Some applicants cleared automated checks with photos of scenery. Webull neither admitted nor denied the findings, which place responsibility for vendor results on the firm.

• FINRA censured Webull Financial LLC and fined it $4.2 million, an amount that also covers best execution failures.
• A member of senior management who is a registered principal must certify anti-money laundering (AML) and identity theft remediation within 180 days of notice of acceptance.
• More than 120,000 accounts were approved between January 2020 and September 2023 although the identifying information could not be reasonably verified.
• More than 50 customers were approved automatically after submitting landscape photos in place of government ID.
• Manual review also failed: reviewers lacked reasonable documented guidance, in many instances carried unreasonably high volumes, and on occasion approved applicants whom the firm's own systems indicated were deceased.

What did FINRA find in the Webull case?

FINRA found that Webull approved more than 120,000 accounts without forming a reasonable belief about who the customers were, and that its suspicious activity monitoring and identity theft program were not reasonably designed. At least 6.5 million of at least seven million new accounts went through a third-party vendor's identity service.

The AML findings run from January 2020 to September 2023. The Identity Theft Prevention Program findings end in February 2023, when Webull adopted a standalone procedure.

The primary record is the letter of acceptance, waiver and consent (AWC No. 2021073404901), which FINRA's news release summarises. The Webull FINRA fine covers AML and identity theft failures alongside separate best execution violations. In the AWC's words, Webull approved accounts on an automated basis for more than 50 customers who submitted "photos of scenic landscapes instead of government-issued identification".

FINRA attributes that outcome to two things: a vendor without reasonable processes to verify photo identification, and a firm without reasonable procedures to supervise the vendor. The AWC adds that even after the landscape issue was resolved, Webull and its vendor still failed to identify when customers submitted fraudulent identification.

The figures behind the Webull FINRA fine come from the AWC. The 120,000 figure is about 1.7 percent of the seven million floor, and both are stated as minimums. The AWC describes those approvals as cases the vendor could not reasonably verify, so the ratio is better read as override exposure than as total identity failure.

How did the vendor-led identity check fail?

The failure ran through three layers: how the firm handled vendor signals, how it checked photo identification and how it ran manual review. FINRA does not fault the use of a vendor. It faults what Webull did with the results, approving some applicants after the vendor had reported inconsistencies or indicators of possible identity fraud.

The first layer was the handling of vendor signals. Webull approved certain senior customers without additional verification even though its vendor had noted logical inconsistencies or risk indicators. Some customers approved that way went on to engage in other fraudulent activity, according to the AWC.

The second layer was photo identification. Webull had no reasonable procedures for reviewing government photo ID, and relied on a vendor that FINRA found did not reasonably verify it.

The third layer was people. When applications did reach manual review, staff lacked reasonable documented guidance and in many instances handled an unreasonably high monthly volume. On occasion they approved applications without investigating unresolved identity questions. That matters for anyone reading the Webull FINRA fine as an argument for adding reviewers: the AWC treats unsupported human review as a defect in its own right.

A further gap sat outside those layers: cross-account signals were missing. Webull approved unrelated individuals with the same phone number or email address, and had no process to catch one Social Security number used across unrelated accounts until August 2021. Roughly 80 accounts on two device IDs each transferred in and then withdrew about $1,000 on the same day. Another 91 accounts on one IP address each listed an unverifiable employer and a temporary email domain.

How does the Webull FINRA fine compare with earlier CIP cases?

The closest precedents for customer identification program (CIP) failures are FINRA's two Robinhood settlements, in 2021 and 2025, which also included findings on automated approval of accounts that identity checks had flagged. Those fines were larger, but each covered many other violations. Headline amounts therefore do not measure the identity failures alone, and the same caution applies to Webull.

The three counts measure different things: approvals without a reasonable belief, flagged approvals without review, and closures after a lookback. At $4.2 million, the Webull FINRA fine is the smallest of the three fines. The 2021 Robinhood AWC records automatic approval of accounts flagged because a Social Security number belonged to a deceased person, the same type of signal that appears in the Webull findings. That settlement was public for more than two years of the Webull period.

The 2025 Robinhood AWC describes vendor discrepancies treated as resolved once a customer linked a bank account. It also records a lookback, run throughout 2021, that identified about two million accounts needing further review. Taken together, the three settlements show a consistent reading of the rule for app-based brokers: the approval logic around vendor data is the control under examination.

What does the Webull FINRA fine change for CIP, SAR and identity theft duties?

The Webull FINRA fine adds no new rule, but it shows how FINRA reads existing ones: a vendor pass does not by itself form the firm's reasonable belief. Broker-dealers should map each finding to the customer identification, suspicious activity, ongoing due diligence and identity theft rules, then test whether their evidence holds up.

The customer identification program rule for broker-dealers, 31 CFR 1023.220, requires procedures that enable the firm to form that reasonable belief, based on risks that include how accounts are opened. The program must say when not to open an account and when to file a report.

The rule also requires a record describing the resolution of each substantive discrepancy, kept for five years after the record is made. The AWC does not cite that paragraph, yet it is where override logic gets tested: every vendor inconsistency a firm clears needs a recorded reason.

Reliance is narrow. Paragraph (a)(6) permits reliance on another financial institution that is subject to an AML program rule, regulated by a federal functional regulator and contractually bound to certify annually. A commercial verification vendor outside that description cannot use the route, so responsibility stays with the firm.

For suspicious activity reports (SARs), 31 CFR 1023.320 sets a $5,000 threshold for broker-dealers and a filing deadline of 30 calendar days from initial detection, or 60 if no suspect is identified. The AWC's account takeover and alert backlog findings are detection failures, and FINRA ties them to staffing as well as tooling. Before November 2022, Webull's procedures did not describe when potential identity theft should be reported on a SAR, so firms should confirm their own procedures state that trigger.

The AWC cites FINRA Rule 3310(b) for the CIP failures, Rule 3310(a) for suspicious activity and Rule 3310(f)(ii) for ongoing due diligence. The identity theft failures fall under Rule 201 of Regulation S-ID. The AWC also cites Regulatory Notice 19-18, which lists suspicious identification documents as a red flag.

Regulation S-ID Rule 201 requires a written program to identify, detect and respond to red flags, and to oversee service provider arrangements. Webull had no procedures identifying red flags before November 2022 and relied on its CIP and clearing firm reports. FINRA did not single out the oversight paragraph, but the vendor findings sit close to it. Appendix A already lists forged documents, shared Social Security numbers and shared telephone numbers as example red flags.

What remains uncertain after the Webull settlement?

The settlement leaves four questions open: who the vendor was, what happened to the 120,000 accounts, how the fine divides, and whether other regulators will act. FINRA names no vendor and does not expressly order re-verification. Firms should not read either silence as comfort or as a standard.

The vendor is unnamed, and the AWC says Webull later onboarded a new one to review photo identification. Firms using identity verification services therefore cannot tell from the document whether their own provider is implicated. The AWC is also silent on any recourse Webull may have against the vendor, so contract allocation stays a private question.

The AWC does not say how many of the 120,000 accounts were later closed or re-verified, or how many proved fraudulent. The AWC records steps taken during and after the period: an independent consultant's AML review, new automated surveillance tools and additional compliance staff. Robinhood's lookback flagged about two million accounts, the scale of exercise a comparable firm undertook, and a board asking about exposure should expect that comparison.

The Webull FINRA fine is a single amount covering conduct that, for best execution, ran to at least October 2025. No figure can be attributed to the identity failures, so the settlement is a poor basis for pricing this risk.

Finally, the outcome is a settlement rather than an adjudication, and FINRA's undertaking not to bring further action on these findings binds FINRA. The AWC gives no protection against other authorities, and says it may be considered in any future action brought by FINRA or any other regulator.

How should compliance teams respond?

Start by testing the live onboarding path with inputs that should fail, then review every approval that overrode a vendor warning. Those two exercises show whether a firm has the problem FINRA describes, and they produce the evidence an examiner will ask for.

The AWC's findings suggest a test script. Run non-document images, expired documents and test records for deceased subjects through production-equivalent flows, and record each outcome. Sample approvals from the last 12 months where the vendor returned an inconsistency, and confirm each has a documented resolution. The CIP compliance checklist and the document verification guide can structure that review.

Write a manual review standard covering what reviewers must check and what they may not clear, and set a caseload limit tied to volume. Screen applications at intake for shared devices, IP addresses, phone numbers, emails and Social Security numbers, and treat matches as red flags. Link each identity escalation to a decision on whether a report is due. Add vendor oversight to the program itself, with periodic sampling, notice of model changes and a named owner.

For chip-enabled documents such as passports, Zyphe's KYC software reads the NFC chip to ICAO 9303 and pairs it with two-step liveness, with no image upload, so a photograph cannot pass the check. The business receives verification results and proofs rather than copies, and there is no central store of customer PII. The reasonable belief remains your firm's to form. To see how that fits your program, book a demo.

The bottom line

The lasting point of the Webull FINRA fine is where FINRA placed responsibility. The vendor's process was inadequate, but the findings land on the firm that accepted its output, overrode its warnings and left reviewers without reasonable guidance. Teams running KYC at scale should treat every automated pass as an input to their own decision, and be able to show the reasoning behind every exception.

Cited sources

• FINRA, Letter of Acceptance, Waiver and Consent No. 2021073404901, Webull Financial LLC
• FINRA news release on the Webull settlement, 5 November 2026
• FINRA, Letter of Acceptance, Waiver and Consent No. 2020066971201, Robinhood Financial LLC, June 2021
• FINRA, Letter of Acceptance, Waiver and Consent No. 2019060756501, Robinhood Financial and Robinhood Securities, March 2025
• FINRA news release on the Robinhood settlement, 7 March 2025
• 31 CFR 1023.220, customer identification programs for broker-dealers
• 31 CFR 1023.320, suspicious activity reports by broker-dealers
• 31 CFR 1020.220, customer identification programs for banks
• 17 CFR 248.201, Regulation S-ID identity theft prevention programs
• Appendix A to Subpart C of 17 CFR Part 248, identity theft red flags
• FINRA Rule 3310, anti-money laundering compliance program
• FINRA Regulatory Notice 19-18, suspicious activity monitoring and reporting