FINRA alleged that Webull Financial failed to maintain reasonably designed programs for anti-money laundering (AML) and identity theft protection, and the firm agreed to pay a $4.2 million fine. The firm had also been cited previously by FINRA and the SEC for compliance failures, and the U.S. House Select Committee on China investigated it earlier this year over alleged ties to the Chinese government.
Cases like this matter less for the dollar figure than for the assumptions they expose. Compliance programs often fail because a team believes something that sounds reasonable but isn't. Here are five of those beliefs, and what the rules actually say.
Myth 1: "If we have a written AML program, we're covered."
Reality: The standard is a program that is reasonably designed, not just one that exists on paper. This enforcement action reflects how regulators interpret obligations from the USA PATRIOT Act and the FATF Recommendations. A policy binder doesn't prove that your customer identification procedures work, that your monitoring thresholds fit your actual customer base, or that your escalation path ends with a defensible decision.
Regulators test design against your real risk profile. Consider whether your onboarding volume, product mix, and customer geography are reflected in your risk assessment. If your business changed and your program didn't, that gap is the finding waiting to happen.
Myth 2: "A prior citation is behind us once we remediate."
Reality: Prior citations become part of your record. FINRA and the SEC had previously cited Webull for compliance failures, and that history influences the current action. Examiners review your history to determine whether weaknesses were fixed at the root or merely patched.
If you've been cited before, treat the remediation plan as a living commitment. Document what changed, who owns it, and how you validated that it works. Then retest. A repeat issue in an adjacent area signals a structural problem in your control environment, not an isolated lapse.
Myth 3: "Identity theft protection is a fraud team problem, not a compliance problem."
Reality: The allegation covered two distinct programs: AML and identity theft protection. Treating them as one workstream, or handing the second to fraud operations alone, leaves a gap. Identity theft controls require their own red flag identification, detection, and response procedures, and they need compliance oversight.
The practical overlap is significant. Weak identity verification at onboarding increases both money laundering risk and account takeover risk. A synthetic or stolen identity that passes your checks is a fraud loss today and a suspicious activity reporting question tomorrow. Build a single view of onboarding data quality, but keep documented ownership and testing for each program.
Myth 4: "Geopolitical scrutiny is a political matter, separate from compliance."
Reality: The House Select Committee on China investigated Webull over alleged ties to the Chinese government. While this investigation is separate from the FINRA action, it highlights something compliance officers can't ignore: ownership structure, data flows, and foreign affiliations draw scrutiny from bodies beyond your primary regulator.
Congressional attention increases scrutiny on your next exam. Your program should already answer these questions on demand: Who ultimately owns and controls the firm? Where is customer data stored and who can access it? Which affiliates touch onboarding or monitoring? If you can't answer quickly and with documents, expect a regulator under political pressure to find that gap uncomfortable.
Myth 5: "A fine this size is a cost of doing business."
Reality: Treating a penalty as a line item overlooks the larger exposure. Enforcement actions are public. They shape how counterparties, partners, and customers view your firm, and they feed directly into the next examination cycle. The reputational and supervisory consequences outlast the payment.
There's also a governance angle. When boards and senior management see a fine as affordable, they underinvest in the Money Laundering Reporting Officer function, in monitoring technology, and in testing. That underinvestment leads to the next finding. The fine is the visible part of a cost that includes remediation, heightened scrutiny, and lost trust.
What to do instead
Start from the phrase regulators use: reasonably designed. Then work backward.
Test design against your actual risk. Refresh your AML risk assessment whenever your products, customer segments, or geographies shift. Tie monitoring rules and customer identification procedures to that assessment, and record why you set each threshold where you did.
Run the programs separately and together. Keep distinct documentation, ownership, and testing for AML and identity theft protection. Then review the shared inputs, especially onboarding verification, so one weak control doesn't undermine both.
Treat history as a work plan. If you've been cited before, maintain a remediation register with owners, completion evidence, and independent validation. Ensure internal audit or an outside reviewer retests the fix.
Map your exposure to scrutiny beyond your primary regulator. Document ownership, control, data location, and affiliate access in a form you can hand over within a day. Use ISO 31000 principles to incorporate geopolitical and third-party exposure into your enterprise risk assessment rather than leaving it to legal or communications.
Give the program real authority. Make sure your compliance function has budget, access to the board, and the ability to escalate. A program that can't say no to a business line isn't reasonably designed, regardless of how thorough the manual looks.
The lesson from this penalty isn't that regulators are unpredictable. It's that they judge design, history, and follow-through. You control all three.
