Webull fined $4.2 million by FINRA

Webull Financial LLC will pay $4.2 million after FINRA found it failed to run reasonably designed anti-money laundering (AML), identity theft prevention and best execution programmes. FINRA announced the settlement yesterday, 5 November 2026. Webull, a US retail online broker-dealer, settled without admitting or denying the findings, and the release gives no split of the fine and no restitution.

The onboarding failures came first. Between January 2020 and September 2023, while Webull opened millions of accounts a year, FINRA found it approved more than 120,000 accounts without a reasonable belief of the customer’s true identity, using identity-verification services provided by third-party vendors. More than 50 customers submitted scenic landscape photos instead of government-issued identification, and others were approved although Webull’s own systems indicated they were deceased. FINRA found the firm had no identity theft prevention programme reasonably designed to detect, prevent and mitigate identity theft from January 2020 to February 2023, and that until August 2021 it did not check for multiple unrelated accounts opened with the same social security number.

Surveillance gaps followed. Webull failed to identify or investigate 473 unauthorised automated clearing house (ACH) transfers, which were used to move more than $1.5 million from customers at other financial institutions into Webull accounts. One account triggered nearly 13,000 alerts for potentially manipulative trading across more than 100 stock symbols over about 18 months, and Webull did not investigate them in a timely way. It also had no process to spot potentially suspicious out-of-the-money options trading, and it lacked surveillance for unrelated customers trading from the same address or device and for account takeovers.

On best execution, the duty to get customers the best available terms, FINRA found that at certain points between at least February 2020 and at least May 2025 Webull did not review execution quality at competing market centres, or obtained the data but did not sufficiently review it. Webull executed billions of shares and received payment for order flow, meaning it was paid for routing customer orders. Non-marketable orders, such as limit orders that cannot fill immediately, made up 60% to 70% of order flow in certain periods, and at certain points were not reviewed. FINRA said Webull did not review by order type or security by security as required.

Bill St. Louis, Executive Vice President and Head of Enforcement at FINRA, said:

Webull’s business grew rapidly, but its compliance program did not keep pace.

Bill St. Louis, FINRA

He added that firms must ensure their supervisory systems grow with their business and address the risks they present.

Webull must certify that it has remediated the AML and identity theft deficiencies and retain an independent consultant for best execution. In 2025, FINRA censured and fined Webull $1.6 million over its supervision and retention of influencer social media communications.

For operators onboarding retail clients at scale, the findings suggest that using vendors for identity checks does not remove the firm’s own duty to form a reasonable belief that it knows the customer. FINRA also found that Webull failed to carry out regular and rigorous execution-quality reviews, including for non-marketable orders.