Webull pays $4.2M fine after *AML and identity theft* failures

The case

Webull Financial will pay a $4.2 million fine to settle charges from FINRA, the US financial industry regulator, that it failed to maintain reasonably designed anti-money laundering and identity theft protection programmes between May 2018 and December 2021 ^[1].

The settlement comes after FINRA alleged Webull's systems for detecting suspicious activity and responding to identity theft red flags were inadequate during a period of rapid growth. The firm neither admitted nor denied the findings ^[1].

Think of it like running a nightclub that doesn't check IDs at the door. You might let a lot of people in quickly, but you have no idea who half of them are.

What FINRA alleged

FINRA's case centred on three main failures.

First, Webull's AML programme was not reasonably designed to detect suspicious activity. The firm did not adequately surveil for red flags such as frequent deposits and withdrawals, high-dollar transactions inconsistent with customer profiles, or patterns that might indicate layering, structuring or other money laundering techniques ^[1].

Second, the firm did not monitor foreign wire transfers at all for nearly three years. Between January 2019 and November 2021, Webull processed approximately $15 billion in foreign wire transfers across more than 600,000 transactions, without any automated or manual surveillance for money laundering or suspicious activity ^[1].

Third, Webull's identity theft prevention programme failed to respond appropriately to red flags. The firm received thousands of alerts about possible identity theft, including cases where customers reported their information had been used without permission, but it did not investigate or escalate many of them ^[1].

The settlement

Webull agreed to pay a $4.2 million fine, censure, and to retain an independent consultant to review and make recommendations about its AML and identity theft programmes ^[1]. The firm has since replaced its chief compliance officer and made changes to its systems ^[2].

FINRA's action follows an earlier $575,000 fine in 2022 for similar failures related to email retention and supervision ^[2].

What this means for you

If you run a financial firm or oversee compliance, here are three questions worth asking.

First, does your AML surveillance actually look for the patterns that matter: unusual deposits and withdrawals, high-value transactions that don't fit a customer's profile, and layering or structuring? A system that flags everything is as useless as one that flags nothing.

Second, are foreign wire transfers monitored separately, and if so, since when? In Webull's case, $15 billion moved without any oversight for nearly three years.

Third, when an identity theft alert comes in, does someone investigate it, and is there a record of what they found? An alert that sits in a queue helps nobody.

The logs that matter

In cases like this, the logs are what tell the story: which alerts were raised, when they were reviewed, and what action was taken.

Here, the thing to seal is the log of each alert as it is recorded: the customer reference, the alert type, the time it was raised and the reviewer's decision. Sealing takes a fingerprint, not the data, so the log itself never leaves your systems.

If a regulator or an auditor later asks whether alerts were handled promptly, anyone you share the sealed log with can check that it's the one written at the time, unchanged since.

It doesn't show that the decision was correct, and it doesn't replace proper investigation. It shows that the log wasn't quietly rewritten after the fact. That matters when the question is whether you had systems in place, not just whether you ran them well.

You seal each segment of the alert log as it closes, using the REST API, the SDK or the MCP server. The alert record stays in your compliance system; WitniumChain only sees a fingerprint. To check it later, you calculate the fingerprint again and compare. A match means nothing has changed. The first 2,000 witnesses a month are free, and the documentation walks through the integration.

How it would work

1. Each time an alert is logged or reviewed, your compliance system sends a fingerprint of that log entry to WitniumChain.
2. The sealed fingerprint and a witness ID are returned immediately.
3. If questioned later, you share the log entry and the witness ID. Anyone can check the fingerprint matches.

What to watch

Webull has until mid-2025 to complete the independent review and implement the consultant's recommendations ^[1]. FINRA's enforcement priorities continue to focus on firms that grow quickly without building compliance infrastructure to match.

For firms in the EU, DORA's technical standards on ICT risk management require logs to be protected against tampering, deletion and unauthorised access from 17 January 2025 ^[3]. The principle is the same: logs are only useful if you can trust them.

Sources

^[1] FINRA, Letter of Acceptance, Waiver and Consent No. 2019062088701, regarding Webull Financial LLC, 8 January 2025
https://www.finra.org/rules-guidance/oversight-enforcement/finra-disciplinary-actions?search=2019062088701

^[2] Compliance Week, "Webull pays $4.2M to settle allegations of AML, ID theft failures", 9 January 2025
https://www.complianceweek.com/regulatory-enforcement/webull-pays-4-2m-to-settle-allegations-of-aml-id-theft-failures/

^[3] Commission Delegated Regulation (EU) 2024/1774, Article 12(2)(d), under DORA
https://eur-lex.europa.eu/eli/reg_del/2024/1774/oj