Staff Bulletin: Risks Associated with Omnibus Accounts Transacting in Low-Priced Securities
Nov. 12, 2020
This bulletin highlights for broker-dealers various risks arising from illicit activities associated with transactions in low-priced securities through omnibus accounts, particularly transactions effected on behalf of omnibus accounts maintained for foreign financial institutions. These risks are heightened when the identities of a foreign financial institution’s underlying customer and/or the ultimate beneficial owner of the funds and securities are unknown to a broker-dealer because of the omnibus account structure.
This bulletin also reminds broker-dealers of their existing obligations under the Bank Secrecy Act (“BSA”), Rule 17a-8 under the Exchange Act, Section 5 of the Securities Act of 1933 (“Securities Act”) and FINRA rules, and considerations relating to the application of these obligations in the context of effecting low-priced securities transactions through omnibus accounts maintained for foreign financial institutions. In the Staff’s view, sufficiently discharging existing anti-money laundering (“AML”) obligations under the BSA requires broker-dealers to consider, among other things, the risks associated with the multiple layers of accounts through which transactions in these types of securities may have been routed. Specifically, in order to sufficiently manage the heightened risks that can be associated with low-priced securities transactions effected through omnibus accounts maintained for foreign financial institutions, a broker-dealer should consider whether it is appropriate to obtain information regarding the relevant characteristics of ultimate beneficial owners of the funds and securities (e.g., the registration status of the ultimate beneficial owner, or whether it is an entity or an individual), including their identities when the risk warrants such inquiry. Where the broker-dealer determines that the risks posed cannot be appropriately managed through the results of such inquiries or other risk mitigation measures, the Staff believes that broker-dealers should consider (1) refusing to open or closing the omnibus account, (2) restricting or rejecting transactions in low-priced securities effected on behalf of the customers of the foreign financial institution through such accounts, and (3) filing a Suspicious Activity Report (“SAR”) as appropriate.
- Low-priced securities transactions in omnibus accounts maintained for foreign financial institutions can pose a particularly high risk of illicit activities, including fraud, money laundering, and unregistered securities offerings.
- Nominee accounts and multiple foreign financial intermediaries can be used to obscure the identities of persons engaging in illicit activities.
- Layers of anonymity and concealment can facilitate violations of the federal securities laws, such as non-exempt unregistered securities offerings, fraudulent stock promotion and manipulative trading, as well as other illicit activities.
- Specific AML due diligence and reporting obligations apply to omnibus relationships with foreign financial institutions regardless of whether the ultimate beneficial owner of the funds and securities held in the account is a broker-dealer’s “customer” for customer identification programs (“CIP”) and CDD purposes or a “beneficial owner” for CDD purposes. For example, a broker-dealer must file a SAR on a suspicious transaction, whether or not the ultimate beneficial owner who requested the transaction is considered the broker-dealer’s customer.
- A broker-dealer’s inability to obtain information regarding the ultimate beneficial owners of funds and securities held in an omnibus account engaging in transactions that are considered higher risk (such as low-priced securities transactions) significantly increases the AML and other legal and compliance risks of the foreign omnibus account associated with those transactions.
1. What Has the Staff Been Seeing?
In the past few years, the Commission has brought a number of enforcement actions centered on allegations of unregistered securities offerings and/or schemes to defraud investors that have involved individuals and entities that allegedly concealed their control of publicly traded companies and increasingly used omnibus accounts to purchase and/or liquidate low-priced securities. These scenarios often involve allegations that omnibus accounts opened at a U.S. broker-dealer by a foreign financial institution can act to shield the nature of the illicit activities by, among other things, concealing a wrongdoer’s identity. These charges collectively also involve allegations of hundreds of millions of dollars in illegal sales proceeds at the expense of U.S. retail investors. These proceeds often were quickly transferred to overseas accounts.
To illustrate the chain of events that may be associated with scenarios involving low-priced securities transactions through omnibus accounts maintained for foreign financial institutions, the Staff has outlined below a typical fact pattern. This fact pattern can vary and include various combinations of the following components and other actions:
- Obtain Controlling Interest in an Issuer: First, an individual or a group of individuals (“Control Group”) obtains a controlling interest in an issuer by, for example, acquiring a large quantity of low-priced securities of the issuer that do not include a restrictive legend.
- Transfer to Nominees: The Control Group typically has the low-priced securities transferred to nominees, which are commonly offshore entities with foreign owners, with no apparent purpose other than to conceal the existence of and the identity of the Control Group, who maintains control of the securities. In an effort to evade detection and identification, such as through required disclosure of the existence of the Control Group, each nominee generally holds account-level positions of less than 5% of the total issued and outstanding securities.
- Accounts are Layered through “Nested” Account Relationships: The Control Group often opens several accounts on behalf of the nominees with a series of foreign intermediaries, which in turn deposit and subsequently trade through a series of other foreign intermediaries.
- Foreign intermediaries frequently use omnibus accounts in their names at other foreign intermediaries to execute the trades as instructed by the Control Group. All trading is ultimately controlled by and for the benefit of the Control Group, who communicates only with certain foreign intermediaries.
- There may be several layers of foreign intermediaries handling the order flow through successive omnibus account relationships before the trades are consolidated and ultimately executed with a U.S. broker-dealer.
- Foreign Financial Institutions Execute Trades at U.S. Broker Dealer(s): The foreign intermediaries execute trades through their omnibus accounts (which may be Delivery versus Payment/Receipt versus Payment (“DVP/RVP”) accounts) at U.S. broker-dealer(s). To attempt to evade scrutiny and reduce the likelihood of raising red flags of potential suspicious activity, the Control Group may use a network of foreign financial institutions and U.S. broker-dealers to transact in the low-priced securities so that none of them has complete visibility into the total amount of securities deposited, trading volume and activity, timing of the wire transfers of sales proceeds and other information.
By spreading the securities and trading activity among nominee accounts at multiple foreign intermediaries through multiple omnibus accounts, the Control Group obfuscates the identities of the ultimate beneficial owners of the funds and securities held in the accounts.
The layers of concealment enable the Control Group to engage in a fraudulent scheme (e.g., a fraudulent promotion of the stock, pump and dump, or coordinated manipulative trading), an unregistered distribution of securities, unregistered broker-dealer activity, and/or insider trading.
2. What Contributes to the Illicit Activity?
This type of illicit activity is facilitated when information about the identities of the individuals who buy and/or sell low-priced securities is shielded by the omnibus account structure. In the scenario discussed above, a U.S. broker-dealer typically knows only the identity of the foreign financial institution, and not the identity or relevant characteristics of the ultimate beneficial owner of the funds and securities associated with the illicit activity.
The Staff is concerned that this type of illicit activity, including fraud or unlawful distributions of securities, is being facilitated by U.S. broker-dealers who are not sufficiently discharging their AML and other obligations. In particular, the Staff is concerned that certain broker-dealers may be conducting insufficient due diligence on omnibus accounts held for foreign financial institutions, including insufficiently accounting for the risks associated with the nature of the foreign financial institution’s business and the markets it serves (including whether it offers services to other financial institutions and their customers) and the type, purpose, and anticipated activity of such omnibus accounts.
The Staff is also concerned that some U.S. broker-dealers may ignore red flags associated with the illicit activity and fail to report known or suspected suspicious activity conducted through the accounts. Moreover, to the extent a U.S. broker-dealer’s due diligence and risk assessment of a foreign omnibus account is dependent upon the activities of another financial institution, including an affiliate, that reliance may be unreasonable. For example, the other financial institution may not recognize the various risks associated with transactions in these types of securities; may be lax in its due diligence or assign ineffective risk weighting to transactions in these types of securities; or may be unfamiliar with or otherwise ignore common fact patterns of manipulation, concealment of coordinated activity and other illicit activities, including the increased risk of those activities associated with transactions involving low-priced securities.
3. What are the Staff’s Views Regarding a U.S. Broker-Dealer’s AML Obligations when Engaging in Transactions in Low-Priced Securities through Omnibus Accounts Maintained for Foreign Financial Institutions?
There are three key AML obligations that broker-dealers should consider when engaging in transactions in low-priced securities effected through omnibus accounts, particularly transactions effected on behalf of omnibus accounts maintained for foreign financial institutions: (1) AML program requirements; (2) correspondent account due diligence requirements; and (3) suspicious activity reporting obligations. Below is an overview of these obligations and the Staff’s views.
Overview of AML Obligations
Among other things, the BSA requires broker-dealers to establish a risk-based AML program, including policies and procedures reasonably designed to detect and report suspicious activities (“AML Program”). Specifically, a broker-dealer’s AML Program must be in writing and, among other things:
- Establish and implement policies, procedures, and internal controls reasonably designed to achieve compliance with the applicable provisions of the BSA and implementing regulations thereunder;
- Establish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of transactions required under the BSA; and
- Include appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to, the following:
- Understanding the nature and purpose of customer relationships to be able to develop a customer risk profile; and
- Conducting ongoing monitoring to identify and report suspicious transactions as well as, on a risk basis, to maintain and update customer information, including beneficial ownership information for legal entity customers.
In addition, as part of their AML Program, broker-dealers are required to establish a written risk-based due diligence program for any “correspondent accounts” established, maintained, administered or managed for foreign financial institutions (“Special Due Diligence Program”), which include omnibus accounts held for a foreign financial institution introducing transactions in low-priced securities.
Specifically, the Special Due Diligence Program must include appropriate, specific risk-based policies, procedures, and controls reasonably designed to enable a broker-dealer to detect and report, on an ongoing basis, any known or suspected money laundering conducted through or involving any foreign correspondent account. At a minimum, the due diligence program must include, among other things, the following:
- An assessment of the money laundering risk posed by such correspondent account, based on a consideration of relevant risk factors, including, as appropriate:
- The nature of the foreign financial institution’s business and the markets it serves;
- The type, purpose, and anticipated activity of such correspondent account;
- The nature and duration of the broker-dealer’s relationship with the foreign financial institution (and any of its affiliates);
- The AML and supervisory regime of the jurisdiction that issued the charter or license to the foreign financial institution, and its owners if applicable, to the extent that such information is reasonably available;
- Information known or reasonably available to the broker-dealer about the foreign financial institution’s AML record; and
- The application of risk-based procedures and controls to each such correspondent account reasonably designed to detect and report known or suspected money laundering activity, including a periodic review of the correspondent account activity sufficient to determine consistency with information obtained about the type, purpose, and anticipated activity of the account.
The five enumerated factors must be considered with regard to each correspondent account, as relevant, although it is not expected that it will be necessary to apply each factor to every correspondent account relationship. Although in some cases application of all five factors may be appropriate, a broker-dealer may apply some subset of the factors, depending upon the broker-dealer’s determination of the nature of the foreign financial institution that it is assessing and the relative money laundering risk posed by the institution. Similarly, the five factors are not meant to be exhaustive, and broker-dealers are expected to consider additional factors that are relevant to the particular risk profile of the foreign financial institution being assessed. As a result, a broker-dealer’s due diligence program should provide, as appropriate, for the consideration of additional factors that have not been enumerated in the rule when assessing foreign financial institutions with a unique risk profile or those that pose high risk.
FinCEN has made clear to broker-dealers that the Special Due Diligence Program supplements rather than supersedes a broker-dealer’s AML Program and that in high-risk situations involving any account, an AML Program should include provisions for obtaining any necessary and appropriate information about the customers underlying such an account.
Finally, under FinCEN’s SAR rule, broker-dealers are required to file a SAR if: (1) a transaction is conducted or attempted to be conducted by, at, or through a broker-dealer; (2) the transaction involves or aggregates funds or other assets of at least $5,000; and (3) the broker-dealer knows, suspects, or has reason to suspect that the transaction –
(a) involves funds or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation;
(b) is designed to evade requirements of the BSA;
(c) has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the broker-dealer knows of no reasonable explanation for the transaction after examining the available facts; or
(d) involves the use of the broker-dealer to facilitate criminal activity.
Staff Views Regarding Application of AML Obligations to Foreign Omnibus Accounts
The Staff believes that foreign financial institutions engaging in low-priced securities transactions on behalf of their customers through an omnibus account structure present a particularly high risk for illicit activities, including money laundering. Broker-dealers servicing these accounts are reminded that, pursuant to the Special Due Diligence Program requirements, they must assess the money laundering risks posed by their relationship with the foreign financial institution based on a consideration of the risk factors described above.
In the context of low-priced securities transactions, the Staff believes that relevant risk factors that a broker-dealer is expected to consider include, without limitation, the spectrum of activities involved and the foreign financial institution’s demonstrated ability and commitment to addressing the AML, securities law and other risks associated with those activities, in addition to the five other factors enumerated. Furthermore, in the Staff’s view, a consideration of these factors in this context – particularly the nature of the foreign financial institution’s business and the markets it serves (including whether it offers services to other financial institutions and their customers, which are sometimes referred to as nested relationships) and the type, purpose, and anticipated activity of such an omnibus account – generally should include an assessment of the risks imputed to the foreign financial institution by its underlying customers. With respect to transactions that involve heightened risk, the Staff believes that this should include an assessment of underlying customers at a more granular (or even individual) level.
With respect to the typical fact pattern described in section 1 of this bulletin, broker-dealers should consider, among other things, the risks associated with any nested account relationships, where its foreign financial institution customer may be requesting a transaction on behalf of one of a series of other financial institutions, one of which has the direct customer relationship with the ultimate beneficial owner. Broker-dealers should recognize that each such institution may be subject to varying degrees of regulatory obligations and oversight. As a result, customer risk assessment policies and procedures at one institution that may be sufficient if the customer is the ultimate beneficial owner may be insufficient if the customer is another financial institution acting on behalf of the ultimate beneficial owner. Accordingly, a broker-dealer’s Special Due Diligence Program should take into account whether or not the account relationship is a nested account relationship and if so, the number of layers involved. The Staff believes that varying (and increasing) levels of risk may be presented in such circumstances, and accordingly different (and increasing) levels and types of risk assessment measures and risk-based procedures and controls may be necessary. For example, a customer relationship in which the foreign financial institution customer is acting directly on behalf of the ultimate beneficial owner generally would present a different risk and require different risk-based procedures and controls than a relationship in which the foreign financial institution is acting on behalf of the ultimate beneficial owner through one or more other financial institutions. Each of these relationships present a different level of risk and requires a different level of risk assessment and risk-based procedures and controls.
In many instances, it may be difficult or impossible to obtain information about a foreign financial institution’s underlying customers, and in particular, ultimate beneficial ownership information for the funds and securities associated with an account. For example, privacy restrictions may prevent a broker-dealer from obtaining information about the foreign financial institution’s underlying customer that the broker-dealer would otherwise have considered. The Staff does not believe that these or other information access restrictions lessen the broker-dealer’s AML and other obligations. Rather, the Staff believes that these types of restrictions on beneficial ownership and other customer information generally increase the risk associated with an account, which should be taken into account in policies and procedures that the broker-dealer implements to discharge its AML and other obligations. We are aware that alternative or compensatory steps currently employed may include, among others, (1) obtaining a certification from the foreign financial institution that it has verified the identity of its customer and/or the ultimate beneficial owner and that it provides the information necessary (on an anonymized basis) to assess whether the transactions are suspicious; (2) engaging in more robust monitoring of transactions introduced by the foreign financial institution; and/or (3) adjusting alert parameters. There are circumstances where these alternative or compensatory steps would be insufficient to mitigate the risks of transacting in low-priced securities.
Where the broker-dealer determines that the risks cannot be appropriately managed, particularly in the context of low-priced securities transactions, the Staff believes that a broker-dealer should consider (1) refusing to open or closing the account, (2) restricting or rejecting transactions effected on behalf of the customers of the foreign financial institution (e.g., restricting transactions to those effected on behalf of ultimate beneficial owners where the relevant characteristics of those owners are known by the foreign financial institution and communicated to the U.S. broker-dealer to a sufficient extent for the U.S. broker-dealer to conclude that there is not a heightened risk of illicit activity), and (3) filing a SAR as appropriate.
Broker-dealers are reminded that nothing under the federal securities laws or FINRA rules obligates them to accept an order where they believe that the associated compliance or legal risks are unacceptable. In light of this fact, broker-dealers should consider the consequences of facilitating transactions, regardless of whether or not they fulfill their AML obligations. For example, under certain circumstances, a broker-dealer may fulfill its AML obligations by detecting and reporting suspicious activity, but in facilitating the transactions, the broker-dealer could expose itself to liability for aiding and abetting and/or causing misconduct, including by participating in an unregistered securities offering.
Intersection with CIP and CDD Obligations. As part of their AML obligations, broker-dealers also have an obligation to establish a written CIP to verify the identities of customers seeking to open an account. In addition to the CIP obligation, broker-dealers are subject to CDD requirements to identify and verify the identity of beneficial owners of their legal entity customers pursuant to FinCEN’s CDD rule.
The Staff notes that, in many circumstances associated with omnibus account relationships, the broker-dealer’s “customer,” for purposes of the CIP and CDD rules, would be the foreign financial institution and not the financial institution’s underlying customer and/or the ultimate beneficial owner of the low-priced security. However, it is critical for broker-dealers to remember that even when the ultimate beneficial owner is not a broker-dealer’s “customer” for CIP and CDD purposes, there are circumstances where the characteristics of that ultimate beneficial owner would need to be considered as part of the broker-dealer’s broader AML obligations. As stated above, in high-risk situations, information about the underlying customers and/or the ultimate beneficial owners (whether broadly understood as the types of customers with whom the foreign financial institution typically conducts business or in more granular terms where the circumstances and related risks of the account or particular transactions require such information), would be relevant to a broker-dealer’s assessment of the money laundering risks posed by the foreign financial institution itself as part of its broader AML Program and Special Due Diligence Program.
Moreover, while the CDD rule does not require broker-dealers to collect information that identifies the underlying transacting parties (i.e., a customer’s customer) in an omnibus account, broker-dealers may determine that a foreign financial institution presents a higher risk profile and, accordingly, collect additional information to better understand the customer relationship. In this vein, broker-dealers are reminded that the CDD rule requirements represent a “floor” in that it establishes a minimum course of action and, consistent with a risk-based approach pursuant to their broader AML program requirements, they may need to do more in situations of heightened risks.
4. Other Risks and Related Broker-Dealer Obligations
Broker-dealers are also reminded of their obligations: (1) to conduct a reasonable inquiry when selling securities in an unregistered transaction in reliance on Section 4(a)(4) of the Securities Act, and (2) pursuant to sanctions imposed by OFAC.
Reasonable Inquiry. With respect to transactions in securities, Section 5 of the Securities Act requires all offers and sales of securities in interstate commerce to be registered unless an exemption from registration is available. Section 4(a)(4) of the Securities Act provides such an exemption for “brokers’ transactions executed upon customers’ orders on any exchange or in the over-the-counter market but not the solicitation of such orders.” The Commission has stated, in connection with the Section 4(a)(4) exemption, that broker-dealers “‘have a responsibility to be aware of the requirements necessary to establish an exemption from the registration requirements of the Securities Act and should be reasonably certain such an exemption is available.’” Broker-dealers “must conduct a reasonable inquiry into the circumstances surrounding the transaction before the [broker-dealers] may claim the protection of the Section 4(a)(4) broker’s exemption.” A broker-dealer may claim the Section 4(a)(4) exemption if it “[a]fter reasonable inquiry is not aware of circumstances indicating that the person for whose account the securities are sold is an underwriter with respect to the securities or that the transaction is part of a distribution of securities of the issuer.”
In light of the risks of illicit activities associated with transactions in low-priced securities through omnibus accounts maintained for foreign financial institutions as discussed in this bulletin, broker-dealers should consider, as part of their reasonable inquiry, whether it is appropriate to obtain information regarding the foreign financial institutions’ underlying customers and the ultimate beneficial owners of the funds and securities, and whether such information is available. In situations where a broker-dealer determines it is appropriate to obtain such information but cannot, whether because of privacy restrictions or otherwise, the broker-dealer should consider the absence of this information as part of its assessment of whether it is reasonable to proceed with the transaction.
OFAC. OFAC administers and enforces economic and trade sanctions programs that are separate and distinct from, and in addition to, the AML requirements imposed on broker-dealers under the BSA. In general, OFAC regulations require broker-dealers to: block accounts and other property or property interests of entities and individuals that appear on OFAC’s List of Specially Designated Nationals and Blocked Persons or entities that are blocked by operation of law, including entities blocked because they are owned, individually or in the aggregate, directly or indirectly, 50 percent or more by one or blocked persons; block accounts and other property or property interests of governments, other entities, and individuals subject to blocking under OFAC country-based programs; and reject prohibited, unlicensed trade and financial transactions, including those involving OFAC-sanctioned countries. Broker-dealers must report to OFAC all blockings and rejections of prohibited transactions within 10 days of their being identified, and blocked property must be reported to OFAC annually. In addition to the blocking sanctions described above, OFAC maintains several sanctions programs that prohibit U.S. persons, including broker-dealers, from dealings in equity and debt of, and extension of credit to, certain sanctions targets. OFAC has stated that it will take into account the adequacy of a firm’s OFAC compliance program, among other factors, when it determines the appropriate enforcement response to an apparent violation, including whether a civil monetary penalty is warranted.
As highlighted above, the Staff is concerned about illicit activities involving low-priced securities transactions executed through omnibus accounts held in the name of foreign financial institutions. Broker-dealers should be aware of the common fact patterns and red flags associated with these transactions and appropriately account for the heightened risks of illicit activities. The Staff reminds broker-dealers of their existing risk-based AML obligations under the BSA, Exchange Act Rule 17a-8, and FINRA rules, as well as their obligations to address compliance with other legal requirements, such as Section 5 of the Securities Act and OFAC regulations. In addition to establishing risk-based AML compliance programs, broker-dealers should understand that sufficiently discharging existing AML obligations under the BSA may require, among other things, accounting for the risks associated with the multiple layers of accounts through which transactions may have been routed. Specifically, the Staff believes that in order to sufficiently manage the heightened risks associated with low-priced securities transactions effected through foreign omnibus accounts, a broker-dealer generally should inquire about the ultimate beneficial owners of the funds and securities under appropriate, risk-based circumstances.
Key Red Flags from FINRA Regulatory Notice 19-18:
- An account is opened in the name of a foreign financial institution, such as an offshore bank or broker-dealer, that sells shares of stock on an unregistered basis on behalf of customers.
- An account is opened for a foreign financial institution that is affiliated with a U.S. broker-dealer, bypassing its U.S. affiliate, for no apparent business purpose. An apparent business purpose could include access to products or services the U.S. affiliate does not provide.
- The account is using a master/sub structure, which enables trading anonymity with respect to the sub-accounts’ activity, and engages in trading activity that raises red flags, such as the liquidation of microcap issuers or potentially manipulative trading activity.
- There is a sudden spike in investor demand for, coupled with a rising price in, a thinly traded or low-priced security.
- The customer’s activity represents a significant proportion of the daily trading volume in a thinly traded or low-priced security.
- The customer is domiciled in, doing business in or regularly transacting with counterparties in a jurisdiction that is known as a bank secrecy haven, tax shelter, high-risk geographic location (e.g., known as a narcotics producing jurisdiction, known to have ineffective AML/Combating the Financing of Terrorism systems), or conflict zone, including those with an established threat of terrorism.
- The customer, for no apparent reason or in conjunction with other “red flags,” engages in transactions involving certain types of securities, such as penny stocks, Regulation “S” stocks and bearer bonds, which although legitimate, have been used in connection with fraudulent schemes and money laundering activity. (Such transactions may warrant further due diligence to ensure the legitimacy of the customer’s activity.)
- A customer buys and sells securities with no discernable purpose or circumstances that appear unusual.
- Two or more unrelated customer accounts at the firm trade an illiquid or low-priced security suddenly and simultaneously.
- The customer appears to buy or sell securities based on advanced knowledge of pending customer orders.
 This bulletin represents the views of the staff of the Division of Trading and Markets (“Staff”). It is not a rule, regulation, or statement of the Securities and Exchange Commission (“Commission”). The Commission has neither approved nor disapproved its content. This bulletin, like all staff guidance, has no legal force or effect: it does not alter or amend applicable law, and it creates no new or additional obligations for any person. This bulletin was prepared by the Staff in consultation with staff from the Financial Industry Regulatory Authority (“FINRA”), the Financial Crimes Enforcement Network (“FinCEN”), and the Office of Foreign Assets Control (“OFAC”) of the U.S. Department of the Treasury.
 As used in this bulletin, “low-priced securities” include those securities that are sometimes referred to as “microcap stocks” or “penny stocks.” The term “microcap stock” generally refers to securities issued by companies with low or “micro” capitalizations. See Microcap Stock: A Guide for Investors (Sept. 18, 2013), available at https://www.sec.gov/reportspubs/investor-publications/investorpubsmicrocapstockhtm.html. The term “penny stock” generally refers to a security issued by a very small company that trades at less than $5 per share. See Fast Answers: Penny Stock Rules, available at https://www.sec.gov/fast-answers/answerspennyhtm.html; Section 3(a)(51) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rule 3a51-1 thereunder.
 As used in this bulletin, the term “omnibus account” refers to an account that aggregates the accounts of undisclosed customer(s) that may be carried individually on the books of a broker-dealer’s customer.
 A “foreign financial institution” includes, among others: (i) a foreign bank (including a foreign branch or office of a U.S. bank); (ii) a foreign branch or office of a securities broker-dealer, futures commission merchant, introducing broker in commodities, or mutual fund; (iii) a business organized under foreign law (other than a branch or office of such business in the U.S.) that if it were located in the U.S. would be a securities broker-dealer, futures commission merchant, introducing broker in commodities, or a mutual fund; and (iv) a money transmitter or dealer in foreign exchange organized under foreign law (other than a branch or office of such entity in the U.S.). See 31 C.F.R. § 1010.605(f).
 The Staff notes that the term “beneficial owner,” as it is defined in FinCEN’s customer due diligence (“CDD”) rule, represents a different group of individuals than those highlighted in this bulletin. See 31 C.F.R. § 1010.230(d) (focusing on the beneficial owners of the “legal entity customer” that opens an account at a covered financial institution, which would generally be, for the purposes of this bulletin, the foreign financial institution). Here, we refer to “ultimate beneficial owner” to mean the true owner of the funds and securities held in the omnibus account and who bears the essential risk of the transactions associated with suspicious or illicit activity. Use of this term or other references to beneficial ownership in this bulletin does not represent a view on, or application of, the standards for determining beneficial ownership under Exchange Act Rule 13d-3 (17 C.F.R. § 240.13d-3).
 “Heightened risks can arise with respect to beneficial owners of accounts because nominal account holders can enable individuals and business entities to conceal the identity of the true owner of assets or property derived from or associated with criminal activity. Moreover, criminals, money launderers, tax evaders, and terrorists may exploit the privacy and confidentiality surrounding some business entities, including shell companies and other vehicles designed to conceal the nature and purpose of illicit transactions and the identities of the persons associated with them. Consequently, identifying the beneficial owner(s) of some legal entities may be challenging, as the characteristics of these entities often effectively shield the legal identity of the owner. However, such identification may be important in detecting suspicious activity and in providing useful information to law enforcement.” Joint Release – Guidance on Obtaining and Retaining Beneficial Ownership Information (March 5, 2010) (“Beneficial Ownership Guidance”), available at https://www.sec.gov/rules/other/2010/34-61651-guidance.pdf (joint release with FinCEN, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Office of Thrift Supervision and the Securities and Exchange Commission).
 The BSA is codified at 12 U.S.C. § 1829b, 12 U.S.C. §§ 1951–1959, and 31 U.S.C. §§ 5311–5314 and 5316–5332, and notes thereto, with implementing regulations at 31 C.F.R. Chapter X. See 31 C.F.R. § 1010.100(e).
 See, e.g., FinCEN, Application of the Regulations Requiring Special Due Diligence Programs for Certain Foreign Accounts to the Securities and Futures Industries, FIN-2006-G009 (May 10, 2006), available at https://www.fincen.gov/resources/statutes-regulations/guidance/application-regulations-requiring-special-due-diligence-0 (“FinCEN Special Due Diligence Guidance”); FinCEN, Frequently Asked Questions Regarding Customer Due Diligence (CDD) Requirements for Covered Financial Institutions, FIN-2020-G002 (August 3, 2020), available at https://www.fincen.gov/sites/default/files/2020-08/FinCEN%20Guidance%20CDD%20508%20FINAL_2.pdf (“FinCEN CDD Guidance”).
 See, e.g., Beneficial Ownership Guidance (“With respect to accounts that have been identified by an institution’s [customer due diligence] procedures as posing a heightened risk, these accounts should be subjected to enhanced due diligence (EDD) that is reasonably designed to enable compliance with the requirements of the BSA. This may include steps, in accordance with the level of risk presented, to identify and verify beneficial owners, to reasonably understand the sources and uses of funds in the account, and to reasonably understand the relationship between the customer and the beneficial owner.”); see also FinCEN CDD Guidance (“The CDD Rule does not categorically require . . . the collection of customer information from a financial institution’s clients when the financial institution is a customer of a covered financial institution. A covered financial institution may assess, on the basis of risk, that a customer’s risk profile is low, and that, accordingly, additional information is not necessary for the covered financial institution to develop its understanding of the nature and purpose of the customer relationship. In other circumstances, the covered financial institution might assess, on the basis of risk, that a customer presents a higher risk profile and, accordingly, collect more information to better understand the customer relationship.”).
 See 31 C.F.R. § 1010.610(d).
 As discussed in more detail below, as part of their AML obligations, broker-dealers are required to establish a written CIP to verify the identities of customers seeking to open an account. See 31 C.F.R. § 1023.220. In addition to CIP, broker-dealers are subject to CDD requirements to identify and verify the identity of beneficial owners of legal entity customers pursuant to FinCEN’s CDD rule. See 31 C.F.R. § 1010.230.
 See, e.g., SEC v. Peter DiChiara, No. 1:20-cv-11645 (D. Mass. filed Sept. 3, 2020) (settled action); SEC v. Bajic et al., No. 20-cv-00007 (S.D.N.Y. filed Jan. 2, 2020); SEC v. Morrie Tobin et al., No. 1:18-cv-12451 (D. Mass. filed Nov. 27, 2018); SEC v. Roger Knox et al., No. 18-cv-12058 (D. Mass. filed Oct. 2, 2018); SEC v. Philip Thomas Kueber, No. 15-cv-04479 (E.D.N.Y. filed Jul. 31, 2015) (settled Oct. 26, 2018).
 In many instances, the members of the Control Group may also be the ultimate beneficial owners of the securities associated with the fraud, either through control or ownership.
 For example, any person or group of persons who directly or indirectly acquires more than 5% of the outstanding shares of an issuer’s class of equity securities registered under Section 12 of the Exchange Act must file beneficial ownership reports until their holdings drop below 5%. See 15 U.S.C. § 78m(d) and 17 C.F.R. § 240.13d-1.
 See FINRA Regulatory and Examinations Priorities Letter (January 2015), available at https://www.finra.org/sites/default/files/p602239.pdf.
 The Staff notes that, while this bulletin focuses on omnibus accounts, wrongdoers can engage in illicit activities through any means that allow a nominee account holder to conceal the identity of the ultimate beneficial owner.
 See FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting Obligations, Reg. Notice 19-18, FINRA (May 6, 2019) (“Regulatory Notice 19-18”), available at https://www.finra.org/sites/default/files/2019-05/Regulatory-Notice-19-18.pdf. Key red flags relevant to this Staff bulletin from Regulatory Notice 19-18 appear at the end of the document.
 See, e.g., United States Senate, Permanent Subcommittee on Investigations, Committee on Homeland Security and Governmental Affairs, "U.S. Vulnerabilities to Money Laundering, Drugs, and Terrorist Financing: HSBC Case History" (July 17, 2012) (highlighting the AML risks for a U.S. financial institution in providing correspondent account services to “affiliates and foreign financial institutions that face substantial AML challenges, often operate under weaker AML requirements, and may not be as familiar with, or respectful of, the tighter AML controls in the United States”), available at https://www.hsgac.senate.gov/imo/media/doc/PSI%20REPORT-HSBC%20CASE%20HISTORY%20(9.6).pdf.
 In the past few years, the Commission has brought a number of enforcement actions alleging violations of Section 17(a) of the Exchange Act and Rule 17a-8 thereunder in connection with a broker-dealer’s failure to discharge certain AML obligations. See, e.g., In the Matter of Interactive Brokers, LLC, Exch. Act Rel. No. 89510 (Aug. 10, 2020) (settled action) (finding a violation of Section 17(a) of the Exchange Act and Rule 17a-8 thereunder where a broker-dealer “ignored or failed to recognize numerous red flags, failed to properly investigate certain conduct as required by its written supervisory procedures, and ultimately failed to file SARs on suspicious activity” involving certain U.S. microcap securities transactions the broker-dealer executed on behalf of its customers); In the Matter of E.S. Financial Services, Inc. n/k/a Brickell Global Markets, Inc., Exch. Act Rel. No. 77056 (Feb. 4, 2016) (settled action) (finding a violation of Section 17(a) of the Exchange Act and Rule 17a-8 thereunder where a broker-dealer did not accurately collect, verify and maintain information regarding sub-account holders or other beneficial owners of corporate accounts in accordance with the broker-dealer’s customer identification procedures); In the Matter of Oppenheimer & Co., Inc., Exch. Act Rel. No. 74141 (Jan. 27, 2015) (settled action) (finding a violation of Section 17(a) of the Exchange Act and Rule 17a-8 thereunder where a broker-dealer failed to file SARs when it knew, suspected or had reason to suspect that its customer was engaging in suspicious activities, including: (1) using its brokerage account to facilitate unlawful activity by depositing into, and selling out of, its account large quantities of low-priced securities, which should have raised concerns that the customer might be participating in unregistered offerings or sales of securities in violation of Section 5 of the Securities Act and (2) depositing billions of shares of low-priced securities into its brokerage account and then simply transferring the shares to other U.S. broker-dealers without any apparent legitimate economic or business purpose).
 31 C.F.R. § 1023.210. Moreover, Exchange Act Rule 17a-8 requires broker-dealers to comply with the reporting, recordkeeping, and record retention rules adopted under the BSA. See 17 C.F.R. § 240.17a-8.
 See 31 C.F.R. § 1023.210(b)(1); FINRA Rule 3310(b).
 See FINRA Rule 3310. FINRA has brought a number of enforcement actions involving allegations of a broker-dealer’s failure to establish and implement reasonably designed AML program procedures. See, e.g., BNP Paribas, FINRA Case No. 2016051105201 (Oct. 23, 2019); Aegis Capital Corp., FINRA Case No. 2013038750901 (Mar. 28, 2018); Credit Suisse Securities (USA) LLC, FINRA Case No. 2013038726101 (Dec. 5, 2016); In re Raymond James & Assocs., Inc., FINRA Case No. 2014043592001 (May 18, 2016); In re Brown Brothers Harriman, & Co., FINRA Case No. 2013035821401 (Feb. 4, 2014). As discussed below, broker-dealers must also report certain transactions involving suspicious activity by completing a SAR and filing it with FinCEN in accordance with FinCEN’s SAR rule. See 31 C.F.R. § 1023.320.
 See 31 C.F.R. § 1023.210(b)(5); FINRA Rule 3310(f).
 In this context, a “correspondent account” is defined as an account established for a foreign financial institution to receive deposits from, or to make payments or other disbursements on behalf of, the foreign financial institution, or to handle other financial transactions related to such foreign financial institution. See 31 C.F.R. § 1010.605(c)(1)(i). Further, for a broker-dealer, an “account” means any formal relationship established with a broker or dealer in securities to provide regular services to effect transactions in securities, including, but not limited to, the purchase or sale of securities and securities loaned and borrowed activity, and to hold securities or other assets for safekeeping or as collateral. See 31 C.F.R. § 1010.605(c)(2)(ii); see also 31 C.F.R. § 1010.610(a).
 See 31 C.F.R. § 1010.610(a); FINRA Rule 3310(b).
 Id. Broker-dealers are further required to establish enhanced due diligence procedures for any correspondent accounts established, maintained, administered, or managed in the United States, for foreign banks that operate under: (1) an offshore banking license; (2) a banking license issued by a country that has been designated as non-cooperative with international anti-money laundering principles or procedures; or (3) a banking license issued by a country designated by the Secretary of the Treasury as warranting special measures due to money laundering concerns. See 31 C.F.R. §§ 1010.610(b)-(c). While relevant depending on the facts and circumstances presented, these enhanced due diligence obligations are not the focus of this bulletin.
 See 31 C.F.R. § 1010.610(a).
 See FinCEN Special Due Diligence Guidance.
 Id. (emphasis added).
 See 31 C.F.R. § 1023.320.
 See FinCEN Special Due Diligence Guidance (“The securities or futures firm generally is not required to look through an omnibus account to perform due diligence on any foreign financial institutions that may be underlying accountholders. However, due diligence conducted on a foreign financial institution for which an omnibus account is established or maintained should include conducting a risk-based assessment into the ‘nature of the foreign financial institution’s business and the markets it serves,’ including the nature of the foreign firm’s account base. Moreover, we expect that a securities or futures firm will conduct increased due diligence on the intermediary institution’s account base in the highest risk situations.”).
 With regard to a nested relationship, the certification could include, as an example, a statement that the foreign financial institution verifies the identities of its customers, and that it obtains such a certification from other financial institutions with which it does business.
 See 31 C.F.R. § 1023.220.
 See 31 C.F.R. § 1010.230; see also FINRA Rule 3310(f). As indicated, the term “beneficial owner” for CDD purposes is distinct from the term “ultimate beneficial owner” used in this bulletin.
 But see In the Matter of Pinnacle Capital Markets, LLC and Michael A. Paciorek, Exch. Act Rel. No. 62811 (Sept. 1, 2010) (finding that a broker-dealer’s corporate customers’ omnibus sub-account holders were “customers” for CIP purposes because the sub-account holders effected securities transactions directly and without the intermediation of the master account holders); SEC Office of Compliance Inspections and Examinations, National Exam Risk Alert, Master/Sub-accounts, Volume 1, Issue 1 (Sept. 29, 2011), available at www.sec.gov/about/offices/ocie/riskalert-mastersubaccounts.pdf (“A broker-dealer must remain cognizant of its obligations under the CIP rule with respect to master/sub-account arrangements, as there are instances when the CIP rule may require identification and verification of sub-account holders.”); FINRA Issues Guidance on Master and Sub-Account Arrangements, Reg. Notice 10-18, FINRA (April 2010), available at https://www.finra.org/sites/default/files/NoticeDocument/p121247.pdf (reminding broker-dealers that maintain master/sub-account arrangements that, “depending on the facts and circumstances of such agreements, a [broker-dealer] may be required to recognize sub-accounts as separate customer accounts for the purposes of applying FINRA rules, the federal securities laws and other applicable federal laws”).
 In its Notice of Proposed Rulemaking of the CDD rule, FinCEN acknowledged the illicit finance risks posed by underlying clients of intermediary customers in light of the lack of information about those clients and activities. See Customer Due Diligence Requirements for Financial Institutions, 79 Fed. Reg. 45151, 45161 (Aug. 4, 2014). While these “underlying clients” might not be subject to beneficial ownership identification requirements, financial institutions are still obligated to “monitor for and report suspicious activity” associated with intermediated accounts, including activity related to the underlying clients of the intermediated account holder. Id. In addition, “due diligence conducted on a foreign financial institution for which an omnibus account is established or maintained should include conducting a risk-based assessment into the ‘nature of the foreign financial institution’s business and the markets it serves,’ including the nature of the foreign firm’s account base.” FinCEN Special Due Diligence Guidance.
 See FinCEN CDD Guidance.
 See Customer Due Diligence Requirements for Financial Institutions, 81 Fed. Reg. 29397, 29404 (May 11, 2016).
 See Staff Responses to Frequently Asked Questions about a Broker-Dealer's Duties When Relying on the Securities Act Section 4(a)(4) Exemption to Execute Customer Orders (Oct. 9, 2014), available at https://www.sec.gov/divisions/marketreg/faq-broker-dealer-duty-section4.htm.
 In the Matter of World Trade Financial Corp., Exch. Act Rel. No. 66114 (Jan. 6, 2012) (quoting Stone Summers & Co., Exch. Act Rel. No. 9839 (Nov. 3, 1972)) (Commission opinion), petition denied, 739 F.3d 1243 (9th Cir. 2014).
 World Trade Financial Corporation v. SEC, 739 F.3d 1243, 1248 (9th Cir. 2014).
 Id. (emphasis and alteration in original) (quoting Wonsover v. SEC, 205 F.3d 408, 415 (D.C. Cir. 2000) (quoting 17 C.F.R. § 230.144)); see also id. (“The extent of the inquiry required for any given trade will vary with the circumstances. The D.C. Circuit correctly explained that: ‘An oft-quoted paragraph of a Commission release clarifies when a broker's inquiry can be considered reasonable: “The amount of inquiry called for necessarily varies with the circumstances of particular cases. A dealer who is offered a modest amount of a widely traded security by a responsible customer, whose lack of relationship to the issuer is well known to [the dealer], may ordinarily proceed with considerable confidence. On the other hand, when a dealer is offered a substantial block of a little-known security, either by persons who appear reluctant to disclose exactly where the securities came from, or where the surrounding circumstances raise a question as to whether or not the ostensible sellers may be merely intermediaries for controlling persons or statutory underwriters, then searching inquiry is called for.”’”) (quoting Wonsover, 205 F.3d at 415 (quoting Distribution by Broker-Dealers of Unregistered Securities, Exchange Act Release No. 33-4445, 1962 WL 69442, at *2 (Feb. 2, 1962)).
 See Opening Securities and Futures Accounts from an OFAC Perspective, OFAC (Nov. 5, 2008) (“OFAC Opening Securities and Futures Accounts Guidance”), available at https://www.treasury.gov/resource-center/international/standards-codes/Documents/securities_future_accounts_11052008.pdf.
 Id., see, e.g., Foreign Assets Control Regulations for the Securities Industry, OFAC (April 29, 2004), available at https://www.sec.gov/about/offices/ocie/aml2007/ofac-t11facsc.pdf; Risk Factors for OFAC Compliance in the Securities Industry, OFAC (Nov. 5, 2008), available at https://www.sec.gov/about/offices/ocie/aml/ofacriskfactors110508.pdf.
 See OFAC Economic Sanctions Enforcement Guidelines, 31 C.F.R. Part 501 Appendix A.
 See, e.g., Beneficial Ownership Guidance.