1 

July 31, 2023 

OBSERVATIONS FROM ANTI-MONEY LAUNDERING COMPLIANCE 

EXAMINATIONS OF BROKER-DEALERS

The Division of Examinations* conducts examinations of broker-dealers (also referred to herein

as firms or registrants) regarding their compliance with anti-money laundering (AML) and 

countering the financing of terrorism (CFT) requirements. In 2021, the Division published a Risk 

Alert discussing compliance issues in the suspicious activity monitoring and reporting 

components of broker-dealers’ AML programs, noting the critical importance of AML 

compliance to the Commission and law enforcement’s pursuit of misconduct that could threaten 

the safety of investor assets and the integrity of the financial markets.1

 This Risk Alert presents 

examination observations about other key AML requirements, such as independent testing of 

firms’ AML programs and training of their personnel, and identification and verification of 

customers and their beneficial owners. 

Before discussing those specific observations, the Division would like to highlight two other, 

more general staff observations about registrants’ AML programs. First, some registrants did not 

appear to devote sufficient resources, including staffing, to AML compliance given the volume 

and risks of their business. This issue can be exacerbated in the current environment of new and 

increasing sanctions imposed by the Office of Foreign Assets Control (OFAC) against 

individuals and entities,2 particularly where the same firm personnel perform both AML and 

sanctions compliance functions. Second, the staff observed that the effectiveness of policies, 

 

*

 The views expressed herein are those of the staff of the Division of Examinations (EXAMS or the 

Division). This Risk Alert is not a rule, regulation, or statement of the U.S. Securities and Exchange 

Commission (the SEC or the Commission). The Commission has neither approved nor disapproved 

the content of this Risk Alert. This Risk Alert, like all staff statements, has no legal force or effect: it 

does not alter or amend applicable law, and it creates no new or additional obligations for any person. 

This document was prepared by Division staff (the staff) and is not legal advice. In preparing this 

document, Division staff consulted with staff from the U.S. Department of the Treasury’s Financial 

Crimes Enforcement Network (FinCEN).

1

 Division, “Compliance Issues Related to Suspicious Activity Monitoring and Reporting at BrokerDealers” (Mar. 29, 2021).

2

 See, e.g., “FinCEN Advises Increased Vigilance for Potential Russian Sanctions Evasion Attempts,” 

FIN-2022-Alert001 (Mar. 7, 2022). 
2 

procedures, and internal controls was reduced when firms did not implement those measures

consistently. With the goal of assisting registrants in reviewing and enhancing their AML 

programs, EXAMS reminds registrants of their obligations to comply with all applicable AML 

and financial sanctions laws and regulations. 

I. AML Programs:3 Spotlight on Independent Testing and Training

Broker-dealers are required to implement and maintain a written AML program, approved in 

writing by senior management, that includes, at a minimum:4

• policies, procedures, and internal controls reasonably designed to achieve compliance 

with the Bank Secrecy Act (BSA)5

 and the implementing regulations thereunder;

• policies and procedures that can be reasonably expected to detect and cause the reporting 

of transactions under 31 U.S.C. § 5318(g) and the implementing regulations thereunder; 

• the designation of an AML compliance officer responsible for implementing and 

monitoring the operations and internal controls of the program (including notification to 

FINRA); 

• ongoing employee AML training;

• an independent test of the firm’s AML program, annually for most firms;6

 and 

 

3

 FinCEN amended its AML Program Rule for broker-dealers, 31 C.F.R. § 1023.210, in 2016, when it 

adopted the Customer Due Diligence (CDD) Rule, 31 C.F.R. § 1010.230. See FinCEN, Customer Due 

Diligence Requirements for Financial Institutions, 81 Fed. Reg. 29398 (May 11, 2016) (CDD 

Adopting Release). The Anti-Money Laundering Act of 2020 (AMLA) and the Corporate 

Transparency Act, William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 

2021, Pub. L. No. 116-283, § 6216, 134 Stat. 3388, 4582-83 (2021), require the Secretary of the 

Treasury to, among other things, revise the AML Program Rule and the CDD Rule. This Risk Alert 

discusses the relevant rules as they existed during the period of the examinations.

4

 See 31 U.S.C. § 5318(h)(1); 31 C.F.R. § 1023.210; and Financial Industry Regulatory Authority 

(FINRA) Rule 3310. 31 C.F.R. § 1023.210(c) provides that a broker-dealer’s AML program that, 

among other things, complies with the rules, regulations, or requirements of its self-regulatory 

organization governing such programs will be deemed to satisfy the requirements of 31 U.S.C. 

§ 5318(h)(1). 

5

 31 U.S.C. §§ 5311 et seq.

6

 Testing should be done more frequently if circumstances warrant. See FINRA Rule 3310 

Supplementary Material .01(a). Independent testing is required to be done annually unless the 

member broker-dealer does not execute transactions for customers or otherwise hold customer 

accounts or act as an introducing broker with respect to customer accounts, in which case the 

independent testing is required every two years. FINRA Rule 3310(c). 
3 

• appropriate risk-based procedures for conducting ongoing CDD. These should include, 

but not be limited to, procedures to: (1) understand the nature and purpose of customer 

relationships to be able to develop a risk profile, and (2) conduct ongoing monitoring to 

identify and report suspicious transactions as well as maintain and update customer 

information, including beneficial ownership information for legal entity customers.

Information gathered as part of CDD should also be used for compliance with OFAC 

regulations.7 With respect to 

beneficial ownership information 

for legal entity customers, brokerdealers are reminded that Rule 17a8 under the Securities Exchange Act 

of 1934 requires compliance with 

the reporting, recordkeeping, and 

record retention requirements of the 

BSA—including the recordkeeping 

obligations set forth in the CDD 

Rule. 

Regarding the independent testing 

requirement, the staff observed: 

• Broker-dealers that did not 

conduct testing in a timely 

manner or could not 

demonstrate (for example, 

by a report or other 

documentation) that they 

conducted such testing. 

• Independent tests that 

appeared ineffective

because: they did not cover 

aspects of the firm’s

business or AML program; 

the personnel conducting the testing was not independent or did not have the appropriate 

level of knowledge of the requirements of the BSA; or the testing was conducted under 

requirements not applicable to the securities industry. In other instances, the firm was 

 

7

 CDD Adopting Release, supra note 3, at 29398; see also, generally, 31 C.F.R. Chapter V. 

OFAC Compliance

All U.S. persons, including broker-dealers as well as

investment advisers and registered investment 

companies, must comply with regulations 

promulgated by OFAC, which administers and 

enforces sanctions against certain jurisdictions and 

foreign persons based on U.S. foreign policy and 

national security interests.

OFAC’s website provides tools for searching its 

sanctions lists and best practices for compliance. 

During the course of examinations for compliance 

with the federal securities laws and the BSA,

EXAMS staff observed certain weaknesses in OFAC 

compliance programs, including instances in which 

entities did not adopt or implement reasonable, riskbased internal controls for (1) following-up on 

potential matches with the sanctions lists and 

documenting the outcome of such follow-up; 

(2) performing periodic or event-based screening of 

existing clients or customers based on, among other 

things, changes in ownership or to the sanctions lists; 

and (3) conducting OFAC searches in a timely 

manner (or documenting that such searches were 

completed).
4 

unable to demonstrate, via documentation or otherwise, that the independent testing 

adequately tested the firm’s compliance with its AML program. 

• Broker-dealers that did not timely address, or have procedures for addressing, issues

identified by independent testing. 

As to ongoing training, the staff observed: 

• Training materials that were not updated based on changes in the law (e.g., the adoption 

of the CDD Rule) or tailored to the risks, typologies, products and services, and business 

activities of the broker-dealer (e.g., training materials focused on bank AML 

requirements).

8

 

• Broker-dealers that could not demonstrate that all appropriate personnel attended the 

firms’ ongoing training or did not establish a process for following up with personnel 

who did not attend required training. 

II. Customer Identification Program (CIP) Rule9

The CIP Rule requires a broker-dealer to establish, document, and maintain a written CIP 

appropriate for its size and business that includes, at a minimum, procedures for certain

requirements including: 

• Obtaining the minimum specified customer identifying information from each customer 

prior to account opening; 

• Verifying the identity of each customer, to the extent reasonable and practicable, within a 

reasonable time before or after account opening—and, in circumstances in which the firm 

cannot verify a customer’s identity, implementing follow-on procedures describing: when 

the firm should not open an account for the customer; the terms under which a customer 

may conduct transactions while the firm attempts to verify the customer’s identity; when 

 

8

 See “NASD Provides Guidance to Member Firms Concerning Anti-Money Laundering Compliance 

Programs Required by Federal Law,” Notice to Members 02-21 (Apr. 10, 2002). For an example of 

material that in the staff’s view may be appropriately tailored for some firms, see SEC’s Division of 

Trading and Markets’ Staff Bulletin: Risks Associated with Omnibus Accounts Transacting in LowPriced Securities, which highlights various risks arising from illicit activities associated with 

transactions in low-priced securities through omnibus accounts, particularly transactions effected on 

behalf of omnibus accounts maintained for foreign financial institutions. 

9

 31 C.F.R. § 1023.220. Customer identification and verification pursuant to a broker-dealer’s CIP is 

another core element of CDD. See CDD Adopting Release, supra note 3, at 29398. 
5 

the firm should close an account after attempts to verify a customer’s identity fail; and

when the firm should file a Suspicious Activity Report; and

• Making and maintaining a record of information obtained under the firm’s procedures.

The procedures of the CIP must enable the broker-dealer to form a reasonable belief that it 

knows the true identity of each customer and be based on the broker-dealer’s assessment of the 

relevant risks, including risks involved in the types of accounts and methods of opening 

accounts, types of identifying information available, and a broker-dealer’s size, location, and 

customer base. The rule permits the use of documentary or non-documentary methods, or a 

combination of both, to verify a customer’s identity.10

The staff observed broker-dealers whose CIPs appeared not to be properly designed to enable the 

firm to form a reasonable belief that it knows the true identity of customers. For example, the 

staff observed registrants that did not: 

• Perform any CIP procedures as to investors in a private placement, where customer 

relationships established with the registrant to effect securities transactions appeared to 

be formal relationships for purposes of the CIP Rule.11

• Collect customers’ dates of birth, identification numbers, or addresses, or permitted 

accounts to be opened by individuals providing only a P.O. box address. 

• Verify the identity of customers, including instances in which the firms’ files indicated 

that verification was complete but required information was missing, incomplete, or 

invalid.

• Use exception reports to alert the firm when a customer’s identity is not adequately 

verified in accordance with the CIP Rule, even though such use would be appropriate 

given the size and nature of the firm’s business.

 

10 31 C.F.R. § 1023.220(a)(ii). Particularly when accounts are opened by electronic means, the use of a 

combination of documentary and non-documentary methods may help address risks related to the use 

of stolen or synthetic identities to attempt to open an account. See “FINRA Reminds Firms to Beware 

of Fraud During the Coronavirus (COVID-19) Pandemic,” Reg. Notice 20-13 (May 5, 2020).

11 31 C.F.R. § 1023.100(a)(1) and (d)(1); see also Joint Final Rule: Customer Identification Programs 

for Broker-Dealers, Exchange Act Release No. 47752 (Apr. 29, 2003), 68 Fed. Reg. 25113, 25115 

(May 9, 2003) (indicating that the definition of “account” can include transactions in which the 

broker-dealer’s role is limited); but see 31 C.F.R. § 1023.100(a)(2), (d)(2) (exclusions from the 

definitions of “account” and “customer”). 
6 

• Accurately document aspects of a firm’s CIP regarding the firm’s review of alerts 

generated by third-party vendors to monitor for missing, inconsistent, or inaccurate 

information. 

• Follow procedures of their own CIP, which included: reviewing and documenting the 

resolution of discrepancies in customer information and conducting searches through 

third-party vendors.

III. Customer Due Diligence and Beneficial Ownership Requirements12

Adopted in 2016, the CDD Rule requires a broker-dealer’s AML program to contain written 

procedures that are reasonably designed to identify and verify the identity of beneficial owners of 

legal entity customers, as that term is defined in the rule.13 The procedures should enable a 

broker-dealer to identify the beneficial owners—generally, up to four individuals directly or 

indirectly owning 25% or more of the equity interests of the legal entity and also a single 

individual with significant responsibility to control, manage, or direct the legal entity—of each 

of its legal entity customers at the time a new account is opened. A broker-dealer may comply 

with this requirement by using the FinCEN certification form in the appendix to the rule or by 

collecting the information required by the form (names, addresses, dates of birth, and Social 

Security Numbers) by other means.

A broker-dealer must use risk-based procedures, to the extent reasonable and practicable, to 

verify the identities of each beneficial owner. These procedures must, at a minimum, contain the 

elements required for verifying the identity of customers who are individuals under the CIP Rule.

The CDD Rule also has a recordkeeping component, which requires a broker-dealer to establish 

procedures for creating and maintaining a record of all information obtained under its CDD

procedures, including descriptions of documents relied on for identity verification and nondocumentary methods used, and the resolution of substantive discrepancies in the verification. 

At the same time that FinCEN adopted the CDD Rule, it also amended the AML Program Rule 

to explicitly include risk-based procedures for conducting ongoing customer due diligence, to 

include understanding the nature and purpose of customer relationships for the purpose of 

developing a “customer risk profile”—that is, “information gathered about a customer to develop 

 

12 As discussed above, pursuant to the AMLA and the Corporate Transparency Act, the requirements of 

31 C.F.R. § 1010.230 may change.

13 CDD Adopting Release, supra note 3. Subject to conditions set forth in the rule, a firm may rely on 

another financial institution to perform the requirements of the rule. 31 C.F.R. § 1010.230(j). Firms 

are encouraged to review the rule and release for definitions of key terms (such as “legal entity 

customer”), as well as exemptions from the rule. For further information, see FinCEN resources on 

the CDD Rule, available at: https://www.fincen.gov/resources/statutes-and-regulations/cdd-final-rule. 
7 

the baseline against which customer activity is assessed for suspicious transaction reporting.”14

The ongoing nature of customer due diligence refers to the expectation that firms “conduct[] 

ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to 

maintain and update customer information.”15

The staff observed broker-dealers that had not updated their AML programs and, as appropriate,

new account forms and procedures to account for the adoption of the CDD Rule. In addition, the 

staff observed:

• Procedures that, in violation of the CDD Rule, permitted an entity to be listed as a 

beneficial owner without a corresponding requirement to obtain adequate information 

about beneficial owners of the entity.16

• The opening of new accounts for legal entity customers without identifying all of the 

legal entity’s beneficial owners, including where no beneficial ownership information 

was obtained, required information was missing, or no control person was identified. 

• Relatedly, some firms did not obtain documentation necessary to verify the identity of 

beneficial owners of legal entity customers, including by accepting expired governmentissued identification, or otherwise did not perform such verification, or did not document 

the resolution of discrepancies noted by firm personnel or a firm’s third-party identity 

verification vendor. 

• Failure to follow internal procedures that required obtaining information about certain 

underlying parties acting through omnibus accounts.17

 

14 81 Fed. Reg. at 29422. Note, however, that FinCEN did not expect “the customer risk profile to 

necessarily be integrated into existing monitoring systems”; instead FinCEN expected firms “to 

utilize the customer risk profile as necessary or appropriate . . . to determine whether a particular 

transaction is suspicious.” Id.

15 Id. at 29399.

16 See id. (noting that, for FinCEN, one of the key elements of CDD is “identifying and verifying the 

identity of beneficial owners of legal entity customers (i.e., the natural persons who own or control 

legal entities)”); see also 31 C.F.R. § 1010.230(d). 

17 While the CDD Rule does not require broker-dealers to collect information regarding the underlying 

transacting parties in an omnibus account of another financial institution opened at the broker-dealer, 

broker-dealers may determine that certain financial institutions present higher risk profiles and, 

accordingly, collect additional information to better understand the customer relationships. FinCEN, 

“Frequently Asked Questions Regarding [CDD] Requirements for Covered Financial Institutions,” 

FIN-2020-G002 (Aug. 3, 2020). 
8 

Conclusion

In sharing the information in this Risk Alert, EXAMS encourages registrants to review and 

strengthen the policies, procedures, and internal controls of their AML programs to further their 

compliance with federal AML rules and regulations, and to monitor for amendments, pursuant to 

the AMLA and the Corporate Transparency Act, to the rules implementing the BSA. FinCEN 

provides updates on its implementation of the AMLA and the Corporate Transparency Act at: 

https://www.fincen.gov/anti-money-laundering-act-2020. 

Additional resources on the topics discussed herein can be found in EXAMS’ online research 

guide, or “source tool,” that contains compilations of key AML laws, rules, orders, and guidance 

applicable to broker-dealers: AML Source Tool for Broker-Dealers, 

https://www.sec.gov/about/offices/ocie/amlsourcetool.htm. 

This Risk Alert is intended to highlight for firms risks and issues that EXAMS staff has identified. In 

addition, this Risk Alert describes risks that firms may consider to (i) assess their supervisory, compliance, 

and/or other risk management systems related to these risks, and (ii) make any changes, as may be 

appropriate, to address or strengthen such systems. Other risks besides those described in this Risk Alert 

may be appropriate to consider, and some issues discussed in this Risk Alert may not be relevant to a 

particular firm’s business. The adequacy of supervisory, compliance and other risk management systems 

can be determined only with reference to the profile of each specific firm and other facts and 

circumstances.