Securities Regulation Daily Wrap Up, BROKER-DEALERS—Senators Wyden and Warren ask FINRA to tighten security around account transfers, (Aug 21, 2026)

By John Filar Atwood

The Senators want FINRA to shut down vulnerabilities in the automated customer account transfer service that are allowing bad actors to steal from consumers’ brokerage accounts.

Senators Ron Wyden (D-OR) and Elizabeth Warren (D-MA) have written to FINRA asking it to address a vulnerability in the automated customer account transfer service (ACATS) that allows bad actors to transfer funds out of brokerage accounts without the account owners’ knowledge or consent. In their letter to FINRA’s CEO, the Senators ask that FINRA immediately adopt a rule to require brokers to send text, email, or push alerts to account holders when an ACATS transfer request is received, several days before the assets are transferred out of the account.

ACATS is an automated system through which investors transfer their stocks, bonds, and cash from one brokerage firm to another. Under existing rules, brokers have one business day to validate or object to a transfer request and three business days to complete asset transfers. The Senators noted that FINRA recommends, but does not require, that brokers notify customers before they transfer their assets to another company.

Exploiting the system. The Senators pointed out that bad actors exploit the system by using stolen personal information to open a fraudulent account in a victim's name at a different brokerage and then submitting an ACATS request to transfer the funds out of the legitimate account. Given the quick turnaround and without authentication from the actual account holder, victims often lose their savings without even knowing that an account transfer has been initiated, the Senators said.

The Senators stated that an analysis conducted by their offices revealed an inconsistent security landscape, with only a fraction of brokers voluntarily providing customers with protections. Some firms allow customers to independently block outgoing ACATS transfers, and others will block transfers if requested through customer service. However, many brokers offer no protection from fraudulent ACATS transfers, they found.

Binding rule. The Senators acknowledged that in Regulatory Notice 23-06, published in March 2023, FINRA identified customer notification via email, phone call, or mobile push notification as an effective practice to mitigate the risks of fraudulent ACATS transfers. The Senators requested that FINRA immediately codify that guidance into a binding rule that would require brokers to send alerts to account holders when an ACATS transfer request is received.

The Senators also asked that FINRA require member broker-dealers to provide consumers with a self-managed, opt-in feature to safeguard their accounts against unauthorized transfers.

FINRA must also modernize the ACATS process, according to the Senators, by requiring verified confirmation of the transfer by the outgoing account holder through a mandated dual-track authentication framework. For the majority of customers who manage their accounts online, the Senators want FINRA to require that the transfer request be explicitly approved within an authenticated session on the outgoing broker’s website or mobile application. Because most financial institutions already handle secure verifications, extending similar protections to ACATS transfers should not require significant additional resources, the Senators argued.

Passkey authentication. The Senators requested that FINRA also require brokers to secure customer accounts with phishing-resistant multi-factor authentication using passkeys. Passkeys meet federal cybersecurity standards, they noted, and were recently adopted by brokerage firms in Japan. Based on that model, industry-wide adoption of cybersecurity technology is entirely achievable, the Senators argued.

Finally, the Senators said that for consumers who do not manage their outgoing broker account online and cannot digitally approve a transfer request, FINRA should require that the transfer application include a traditional medallion signature guarantee. That would require an in-person trip to a financial institution, and would ensure that offline investors are protected by a verified paper trail before their assets can be transferred, they noted.

LegislativeActivity: BrokerDealers ClearanceSettlement FinancialIntermediaries FINRANews FraudManipulation GCNNews RiskManagement