FINRA Fines Stash Capital $450K for AML, Identity Theft Program Failures

The Financial Industry Regulatory Authority censured and fined Stash Capital LLC $450,000 for systemic failures in its anti-money laundering and identity theft prevention programs. The enforcement action follows a period of rapid growth for the online brokerage, which saw its customer base expand to more than 9 million accounts by the end of 2023.

The settlement, detailed in a letter of acceptance, waiver and consent, or AWC, centers on violations occurring between January 2019 and June 2023.

According to FINRA, Stash Capital failed to maintain a reasonable customer identification program, or CIP, appropriate for its size. The firm’s automated account approval process allowed numerous accounts to be opened without verifying the true identity of customers.

FINRA identified three significant lapses in the firm’s CIP.

• Incomplete data: The firm approved approximately 350 accounts between 2019 and 2022 that provided only the last four digits of a Social Security number, despite rules requiring complete identification;
• Automated overrides: Applications that were initially rejected or deemed “indeterminate” by automated systems were often submitted through additional automated reviews that failed to address the specific reasons for the initial rejection; and
• Identity fraud indicators: In some instances, the firm approved accounts for applicants purportedly born in the 1930s and 1940s without further verification, despite clear indicators of potential identity fraud.

FINRA also found that Stash failed to implement an AML program reasonably designed to detect and report suspicious transactions. While the firm used automated alerts for large or frequent deposits, it lacked procedures to link red flags identified during the account-opening process with later suspicious activity.

In one instance, the firm’s clearing firm flagged approximately 200 accounts opened using a common phone number — a potential indicator of securities free riding, a practice in which investors exploit settlement timing to trade without sufficient funds. Despite the alert, Stash allowed new accounts to be opened using that same flagged number for nearly six additional months, according to FINRA.

The firm was also cited for failing to develop a written identity theft prevention program, or ITPP, as required by Regulation S-ID. Until late 2021, Stash primarily relied on customers to self-report identity theft rather than maintaining proactive detection systems.

Stash Capital accepted the findings and consented to the censure and $450,000 fine without admitting or denying the allegations.

The firm has since updated its written CIP in February 2022 and revising its identity verification procedures in June 2023 to better address rejected or indeterminate applications.

Stash Capital LLC has been a FINRA member since August 2017. The firm, headquartered in New York City, offers self-directed investing through online brokerage accounts.

Visit the AltsWire directory page.