FINRA said Webull lacked adequate procedures to verify customer identities, detect and report suspicious transactions, and guard against identity theft as the digital investment platform added millions of accounts. The company agreed to the sanctions without admitting or denying the charges.

The regulator cited cases involving hackers taking malicious actions on Webull accounts, unauthorized ACH transfers, transactions that raised potential fraud concerns, and potentially manipulative trading. Many of those incidents went undetected or unreported, FINRA said.

FINRA also said Webull violated its Best Execution rule, which requires broker-dealers to seek the most favorable terms for customers’ orders. The independent consultant will address the company’s best-execution program.

“Webull's business grew rapidly, but its compliance program did not keep pace,” FINRA Head of Enforcement Bill St. Louis said. The regulator previously censured Webull and fined it $1.6 million in 2025 over inadequate supervision and retention of activity by social media influencers promoting the company.