AML and ID Theft Programs: A Field Guide for Security Teams

Introduction

This guide focuses on two critical program types highlighted in a recent FINRA enforcement action: anti-money laundering (AML) programs and identity theft protection programs. It's designed for security awareness teams involved in training, controls, and escalation paths. The case in point involved Webull Financial, which faced a $4.2 million fine for not having adequately designed AML and identity theft programs. This guide will help you build and verify effective programs within your organization.

Key Concepts

"Reasonably designed." This standard asks if your program fits your business, customers, and risk, and if it works in practice. A policy that exists only on paper but doesn't align with actual account practices is vulnerable.

AML program. A set of policies, controls, and training to detect and report suspicious activity and verify customer identities.

Identity theft protection program. A written plan to detect, prevent, and respond to signs of identity theft.

Red flag. Indicators like mismatched documents or unusual account activity that suggest fraud.

Pattern of scrutiny. Prior citations from regulators influence how future findings are viewed. Repeat issues suggest a program isn't improving.

Geopolitical scrutiny. Investigations, like those by the U.S. House Select Committee on China, show that compliance review extends beyond financial regulators. Ownership and foreign ties can impact your reputation.

Requirements Breakdown

While specific rule numbers aren't cited, expect regulators to look for these components:

1. Written policies and procedures that align with your business.
2. Internal controls for customer identification and verification.
3. Ongoing monitoring to flag unusual activity.
4. Escalation and reporting paths for suspicious activity.
5. Independent testing of the program.
6. Designated oversight with a named person accountable.
7. Training for relevant staff.
8. Red flag detection and response for identity theft, updated as needed.

These align with the Seven Elements of an Effective Compliance Program, a helpful framework for explaining the program to leadership.

Implementation Guidance

Start with the account-opening flow. Walk through it as a customer would. Identify where and how identity is verified, and what happens if verification fails.

Tie red flags to real signals. Customize your red flag list based on recent incidents and fraud attempts.

Make escalation easy. Ensure employees know who to contact and how quickly. Pair this with Anti-Retaliation Safeguards and a Speak-Up Program.

Train by role, not by calendar. Use role-based scenarios to change behavior, not just generic annual modules.

Test independently and document fixes. Track findings to closure, just like you would for employee reports.

Plan for external scrutiny. Document governance clearly if you operate internationally or have foreign ties. Be ready to explain data handling and ownership structures.

Treat prior findings as live risk. Show regulators evidence of remediation, detailing changes and confirming effectiveness.

Common Pitfalls

• Policy-practice drift. Ensure written controls are actually used.
• Template programs. Avoid using generic documents that don't fit your business.
• Training as the whole program. Awareness is just one element.
• No owner. Shared responsibility can lead to a lack of accountability.
• Ignoring non-financial scrutiny. Be aware of broader inquiries and media attention.
• Treating a prior citation as closed. Past findings guide where regulators will look next.
• Slow escalation. Delayed responses undermine detection and trust.

Quick Reference Table

Conclusion

A $4.2 million fine underscores the need for programs that are "reasonably designed." Ensure your programs fit your business operations, test them independently, and maintain evidence of improvements. Use the table above as a reference whenever your business changes. For further guidance, consider consulting official AML guidance.