Senators Elizabeth Warren and Ron Wyden are urging FINRA to close what they describe as a security gap in the Automated Customer Account Transfer Service, the system brokerages use to move client assets between firms.
In a letter to FINRA president and CEO Robert Cook, the members of the Senate Committee on Finance argued that ACATS' speed – a feature built decades ago to stop firms from slow-walking client transfers to competitors – has effectively become a liability that fraudsters are actively exploiting.
According to the letter, ACATS requires no notification to or authentication from the actual account holder before an outgoing firm processes a transfer. Once a request is submitted, the outgoing brokerage has just one business day to validate or object, then three business days to complete the transfer.
Warren and Wyden say criminals are using stolen personal information to open accounts in a victim's name at a separate brokerage, then initiating an ACATS pull on the victim's legitimate holdings – often draining retirement savings before the account owner notices anything's amiss.
The senators' offices reviewed practices at major brokerages and found wide inconsistency in the protections that are in place. Fidelity and Vanguard offer customers a self-managed transfer-block feature, while J.P. Morgan, Robinhood, Webull and Wells Fargo said similar locks exist but can only be toggled by customer service representatives, according to the letter.
Following outreach from the senators' offices, Webull and Robinhood have reportedly committed to moving to user-managed lock features by the third quarter of 2026 and first quarter of 2027, respectively, and Interactive Brokers has committed to a self-service lock by the third quarter of 2026.
Citi, E*TRADE, Merrill Lynch and Morgan Stanley Wealth Management do not offer comparable mechanisms, according to the letter, while Charles Schwab reportedly declined to provide written commitments on future plans.
The letter also flags a gap in basic transfer notifications. FINRA's Regulatory Notice 23-06, published in March 2023, identified customer alerts by email, phone or push notification as an "effective practice" for reducing ACATS fraud risk, but stopped short of requiring it. The fact that the guidance was voluntary, Warren and Wyden argued, allowed firms including Citi and Wells Fargo to avoid giving customers any warning that a transfer is underway, eliminating the three-day window in which a victim could otherwise intervene.
On authentication, the senators want FINRA to require phishing-resistant multi-factor authentication – specifically passkeys – noting that Interactive Brokers, Merrill Lynch, Morgan Stanley Wealth Management, Robinhood, Vanguard, Webull and Wells Fargo support the technology without mandating it.
J.P. Morgan supports passkeys only for web access, not its mobile app, while Fidelity and E*TRADE are still rolling the feature out, with Fidelity targeting September 2026. Charles Schwab and Citi support only weaker authentication methods, as per the letter.
To make a point about what's achievable, the senators pointed to Japan, where regulators required passkey-based authentication for securities accounts starting July 1, 2026.
FINRA has been asked to respond by September 17.
Learn more: What’s new with FINRA enforcement?
Warren has pushed FINRA on the speed of its response to industry problems before. In 2024, the senator pressed the regulator on the decline in enforcement actions and fines, calling out the multi-year low in activity as evidence of deliberate deregulatory drift. FINRA pushed back, attributing the plunge to membership expulsions and barred individuals, rather reduced scrutiny on its part.
The ACATS letter also arrives as FINRA looks to build other speed bumps against fraud. Last week, the brokerage industry regulator asked the SEC to approve new Rule 2166, which would let firms delay a suspicious transaction or withdrawal for up to 10 business days, and has proposed extending the maximum hold period for exploited senior investors to as much as 145 business days under amendments to Rule 2165.
In that filing, FINRA cited Federal Trade Commission estimates that fraud cost older Americans roughly $81.5 billion in 2024, as well as FBI data showing more than $7.7 billion in reported losses among Americans over 60 in 2025.
The 70% time savings I expected from AI hasn't fully arrived, but the quality of our advice and our private markets platform have changed.
The J.C. Flowers-backed investor’s latest RIA deal adds five next-gen leaders to the Massachusetts firm’s ownership ranks
Meanwhile, UBS and Raymond James talk recruiting.
Elderly clients lost about 70% after a South Carolina advisor held inverse ETFs for 798 days on average, the regulator says
The new chat feature is expected to launch in 2027.
Knighthead Life entered the market with a competitive MYGA. A strong launch earned advisor confidence and paved the way for FIAs.
As AI makes financial information more accessible than ever, Lana Hock explains why human judgment, trust, and empathy remain the qualities clients value most in a financial advisor
