Senators press FINRA to require account transfer locks

A routine back-office safeguard is about to become a client-retention question for advisors after two Democratic senators asked FINRA to require brokerage firms to let customers lock their accounts against unauthorized transfers, a change that would standardize protections now uneven across the industry, AdvisorHub reports. In an August 20 letter, Elizabeth Warren of Massachusetts and Ron Wyden of Oregon, the ranking minority members on the Senate Finance Committee, urged FINRA chief executive Robert Cook to take immediate action against fraud running through the Automated Customer Account Transfer Service, which moves assets between firms. The New York Times earlier reported on the letter; the lawmakers said their reviews of firm policies uncovered "a deeply concerning lack of standardized, consumer-controlled protections across the industry."

The vulnerability sits in ACATS, the National Securities Clearing Corporation system that lets clients shift stocks, bonds, and cash from one brokerage to another; fraudsters open an account in a victim's name with stolen personal information, then pull assets out of the victim's legitimate account. The lawmakers quoted criminals exploiting "the complete lack of an outbound verification step by the account holder." FINRA recommends that firms notify account holders before transferring assets, but the recommendation is not a requirement, and some firms do not notify customers when an outgoing transfer has been initiated; firms typically have one day to validate or object to a transfer and three business days to complete it.

Wyden's review of major brokerage firms, included in a press release, found that only a few offer consumers a way to protect their accounts, and the pressure is already producing movement: Interactive Brokers, Robinhood, and Webull told lawmakers they would develop self-service transfer locks, while Schwab said it would add passkey authentication later this year and "additional capabilities designed to give clients greater visibility into and control over outbound account transfers." Bank of America said the lock question did not pertain to advisor-led accounts and noted that Merrill Edge customers can place a transfer-blocking restriction by calling customer service; Wells Fargo confirmed the chart's information about the firm but did not address planned changes, and Morgan Stanley did not respond to questions, according to AdvisorHub.

For advisors, the ACATS hole is more than a compliance topic: a client who discovers a drained account is likely to call the advisor first, and the recovery work—proving the transfer was unauthorized, chasing the receiving firm, rebuilding the account—lands on the practice. An advisor's familiarity with the firm's lock process will determine whether a fraud incident becomes a small paperwork exercise or a relationship event, and the Senate letter makes lock capability table stakes. Advisors should know today what their home firm offers, because the client will ask; the firm that builds transfer locks into onboarding converts a safeguard into a retention feature, while the one that waits for FINRA to mandate it will spend 2027 explaining why the protection was ever optional.