FINRA fines Webull $4.2m for best-execution and anti-money-laundering failures

FINRA announced on 5 Nov that it had fined Webull Financial LLC $4.2 million. The firm, a New York introducing broker-dealer that offers commission-free online trading of equities and options to retail customers, consented in a Letter of Acceptance, Waiver, and Consent (No. 2021073404901) to a censure, the fine and corrective undertakings, without admitting or denying the findings.

Bill St. Louis, FINRA’s executive vice president and head of enforcement, said on 5 Nov: “Webull’s business grew rapidly, but its compliance program did not keep pace. Firms must ensure that their supervisory systems grow with their business and address the risks they present. Webull failed to do so in fundamental areas, including verifying its customers’ identities, detecting suspicious activity and ensuring the best possible execution of customer trades.”

The AWC says Webull became a FINRA member in January 2018, has about 120 registered representatives and two branch offices, and that by the autumn of 2023 it “had at least seven million customer accounts”.

Best execution and payment for order flow

The AWC finds that, from at least February 2020 to at least October 2025, Webull “failed to review customer execution quality with the reasonable diligence required by FINRA Rule 5310(a) and failed to conduct reasonable regular and rigorous reviews as required by FINRA Rule 5310.09”. It also failed to reasonably supervise for those obligations, in violation of Rules 3110 and 2010.

At all relevant times, the firm “routed its customers’ non-directed orders for execution to market makers and exchanges which provided either payment for order flow (PFOF) or rebates for that order flow”. “Throughout the relevant period, the firm executed billions of equity shares and received PFOF.”

Webull had a best-execution committee that met monthly. The AWC breaks the competing-market review into three phases:

• From at least February 2020 through June 2021, the firm’s reviews “only included the execution of orders the firm routed to its existing routing venues and did not include any data for the execution quality available at market centers to which it did not already route its order flow”.
• Between July 2021 and April 2023, it obtained a quarterly third-party report covering market centres it did not route to, but “the firm’s best execution committee did not sufficiently review that data, including by failing to formulate analysis, conclusions or observations it made as a result of its review of that data …”.
• In May 2023 the firm stopped obtaining the report. From then to at least May 2025, “the firm did not compare the execution quality of its order routing and execution arrangements to the execution quality the firm could have obtained from competing markets”.

The reviews of its existing venues were also found wanting. “Prior to March 2021, Webull did not review the execution quality it was receiving for non-marketable orders, which represented 60% to 70% of its order flow during that period.” Prior to January 2023, it did not review on a type-of-order basis, instead aggregating data across order types. And “from at least February 2020 to at least October 2025, Webull did not conduct its reviews on a security-by-security basis as required by FINRA Rule 5310.09”.

Its written supervisory procedures “generally restated the requirements of Rules 5310 and 5310.09” but “did not provide any process or procedures for how the firm would conduct or document its best execution reviews, nor did they identify who was responsible for conducting the reviews”.

Rule 5310.09 requires a firm that does not review order by order to carry out “regular and rigorous” reviews on a quarterly basis, “on a security-by-security, type-of-order basis”, and to “compare, among other things, the quality of the executions the member is obtaining via current order routing and execution arrangements … to the quality of the executions that the member could obtain from competing markets”. The factors listed in the rule include price improvement, the likelihood of execution of limit orders, and “the existence of internalization or payment for order flow arrangements”.

AML and identity-theft findings

Between January 2020 and September 2023, the AWC finds, Webull failed to implement a reasonably designed AML programme, including a customer identification programme and procedures to detect and cause the reporting of suspicious transactions. Between January 2020 and February 2023, it also failed to implement an Identity Theft Prevention Programme reasonably designed to detect, prevent and mitigate identity theft, in violation of Rule 201 of Regulation S-ID.

The firm was found to have been “approving more than 120,000 accounts without forming a reasonable belief that it knew the true identity of its customers”. It “approved accounts on an automated basis for more than 50 customers who submitted photos of scenic landscapes instead of government-issued identification”, and “approved certain customer applications despite information in the firm’s systems indicating that the customers were deceased”.

On surveillance, it “did not have any processes to identify potentially suspicious out-of-the-money options trading”, lacked reasonable surveillance to detect account takeovers in a timely way, and “lacked surveillance systems to identify instances in which the same account traded from multiple locations on the same day, or unrelated customers trading from the same IP address”. Examples in the AWC include a failure, between June 2020 and January 2021, to identify or investigate “473 unauthorized ACH transfers that were used to transfer over $1.5 million from customers at other financial institutions into Webull”, and a single account that “triggered nearly 2,000 equity layering alerts and nearly 11,000 equity spoofing alerts in over 100 different symbols in the approximately 18 months it was open”; “the firm did not timely investigate this volume of alerts and did not report the conduct until months after the account was already closed”.

The AWC records that, during and after the relevant period, the firm “made enhancements to its CIP policies and procedures, including by onboarding a new third-party vendor to review customers’ submitted photo identification”, and that it engaged an independent consultant for a broad review of its AML programme and then “made numerous enhancements to its AML processes and procedures”. In February 2023 it established a standalone Identity Theft Prevention Programme procedure.

What the firm must do next

The fine is $4,200,000. Within 180 days of notice that the AWC has been accepted, a registered principal in senior management must certify in writing that the firm has implemented remediation reasonably designed to address the AML and identity-theft issues identified in the AWC.

Separately, Webull must retain, at its own expense and within 60 days of that notice, an independent consultant “not unacceptable to FINRA” to review the adequacy of its compliance with Rules 5310 and 5310.09. The consultant’s initial written report is due no more than 120 days after the notice of acceptance. Within 60 days of that report, the firm must adopt the consultant’s recommendations or propose alternatives designed to achieve the same objective; if the two cannot agree, the firm “must abide by the independent consultant’s ultimate determination”.

FINRA’s 5 Nov release also notes that in 2025 it censured and fined Webull $1.6 million for failing to reasonably supervise and retain social-media communications by influencers who promoted the firm.

Why it matters

Analysis. The best-execution findings are the part other retail brokers will feel. Webull was a PFOF firm: it sent non-directed customer orders to market makers and exchanges that paid for the flow, executed “billions of equity shares”, and for long periods either never obtained competing-market data, or obtained it and did not sufficiently review it, or stopped obtaining it. A monthly best-execution committee did not cure that. The gaps also covered the unglamorous part of the book — non-marketable orders, which were most of the flow before March 2021 — and the security-by-security and type-of-order cuts that Rule 5310.09 requires.

FINRA is not, in this AWC, making a finding that customers received worse prices, or that PFOF is itself a violation. The case is about the review. Firms that still route on PFOF terms need a documented, regular comparison with markets they do not use, including for non-marketable orders, and WSPs that say who does the work and how it is written down. The independent consultant, with a 120-day report and a requirement to implement its recommendations, will become the practical test of whether Webull’s reviews change.

The AML and identity-theft facts explain the size of the fine and the 180-day certification. They are a reminder that CIP and surveillance have to scale with account growth, and that vendor identity checks do not transfer the obligation.

What we are watching

• The independent consultant’s initial report on Webull’s Rule 5310 reviews, due within 120 days of the AWC’s acceptance.

Sources

• FINRA Fines Webull $4.2 Million for Anti-Money Laundering and Best Execution Violations, FINRA, 5 Nov 2026
• Letter of Acceptance, Waiver, and Consent No. 2021073404901, Webull Financial LLC, FINRA, 5 Nov 2026