FINRA fines Osaic Institutions $650k over AML lapses

Osaic Institutions has been subject to a censure, a $650,000 fine, and a remediation undertaking after FINRA found the firm’s anti-money-laundering program fell short of Bank Secrecy Act requirements over several years.

In a letter of acceptance, waiver, and consent, dated December 19, Finra said the firm – previously known as Infinex Investments – failed to maintain an AML program reasonably designed to flag and report suspicious activity, particularly in relation to money movements and customers in higher-risk jurisdictions.

A FINRA member firm since 1994, Osaic Institutions is based in Meriden, Connecticut, and works with roughly 730 registered reps in about 950 branches serving retail investors, including clients in Argentina, Bolivia, and Mexico. It was renamed after Osaic, then named Advisor Group, acquired the bank broker-dealer in 2022.

According to the FINRA letter, “Infinex’s anti-money laundering (AML) program is not reasonably designed to achieve compliance with the requirements of the Bank Secrecy Act (BSA) and its implementing regulations in multiple respects.”

FINRA said that, beginning in September 2021, the firm did not have adequate policies and procedures to detect and escalate red flags or ensure suspicious activity reports were filed when warranted.

From September 2021 until December last year, the firm also reportedly relied heavily on exception reports to surveil for questionable trades and money movements. However, those reports either did not screen for relevant red flags, or Osaic Institutions failed to review them consistently and on time, FINRA found.

The order noted that in 2022 “the firm had approximately 310,000 customer accounts and effected 185,000 securities transactions, more than 130,000 securities movements, and more than 400,000 money movements.” Against that backdrop, Finra said Osaic Institutions did not subject many transactions – such as movements involving high-risk geographies or non-US currencies – to appropriate AML scrutiny.

While the firm's AML policies required exception reports to be reviewed by a surveillance analyst at least weekly, the reports were not run through the process consistently in practice as there was reported confusion among AML group members over who had responsibility for doing the reviews. Some reports were never checked, while others were delayed for as long as 24 weeks, including reports involving large trades, foreign securities, and third-party wires. 

"In addition, the firm failed to review attempted but unsuccessful cyber-events for the purpose of determining whether to file a SAR," the FINRA AWC letter read in part.

Finra also concluded the firm failed to implement risk-based ongoing customer due diligence as required under Rule 3310. The written program did not provide practical guidance on developing customer risk profiles or on applying heightened monitoring to higher-risk accounts.

According to the order, the firm did not create risk profiles for domestic customers and only designated all foreign accounts as high risk in December 2023, while still not conducting risk-based ongoing due diligence for either group.

Osaic Institutions accepted and consented to FINRA's findings without admitting or denying wrongdoing.

As part of the settlement, a senior firm executive who is a registered principal must, within 60 days of Finra’s acceptance of the agreement, certify that the firm has remediated the AML deficiencies and now has a written program that complies with Rule 3310. The certification must include a narrative and supporting exhibits, and Finra reserved the right to request additional evidence of the firm’s remediation efforts.