FINRA Highlights Effective Practices For Protecting Customer Account Information

FINRA highlighted practices which firms found effective for mitigating risks associated with customer account takeovers ("ATOs"); i.e., criminals gaining unauthorized entry to customers' online accounts.

In its Notice, FINRA reported a substantial increase in ATO incidents due to an increase in the number of online accounts and the availability of customer information on the "dark web." In light of the increased risk of ATOs, FINRA reaffirmed rules that obligate broker-dealers to protect their customers' accounts, including FINRA Rules 2090 ("Know Your Customer"), 3310 ("Anti-Money Laundering Compliance Program") and 4512 ("Customer Account Information"), Regulation S-P ("Privacy of Consumer Financial Information and Safeguarding Personal Information"), and the requirement that firms have a Customer Identification Program.