Securities and Broker-Dealer Risks

1. Why This Topic Matters

The securities industry is one of the most attractive sectors for money launderers, and it is a recurring theme on the CAMS examination. In the ACAMS study guide, securities and broker-dealer risks sit within the broader domain of Risks and Methods of Money Laundering and Terrorist Financing, which carries significant weight on the exam. Understanding this sector is important for three reasons:

• Scale and speed. Trillions of dollars move through global securities markets daily. Transactions settle quickly, cross borders routinely, and can be reversed or converted to cash with ease. This makes the sector ideal for the layering stage of money laundering, where criminals seek to obscure the audit trail.
• Dual threat. Securities firms face two distinct financial crime exposures: they can be used to launder the proceeds of crimes committed elsewhere (drugs, corruption, fraud), and they can be the venue where the underlying crime itself occurs (insider trading, market manipulation, pump-and-dump schemes). The CAMS exam tests whether you can distinguish these two scenarios.
• Regulatory focus. Broker-dealers are explicitly covered by FATF Recommendations as financial institutions, and regulators such as the US SEC, FINRA, FinCEN, the UK FCA, and IOSCO have issued extensive guidance. Enforcement actions against broker-dealers for AML failures have produced some of the largest fines in the industry.

If you work in compliance, you will almost certainly encounter securities-related transactions, even if your institution is a bank, because wire transfers to and from brokerage accounts are commonplace. The exam expects you to recognize the red flags regardless of your own institution type.

2. What Are Securities and Broker-Dealer Risks?

Definitions you must know

• Securities: Tradable financial instruments including equities (stocks), debt instruments (bonds), derivatives (options, futures, swaps), mutual fund shares, exchange-traded funds, and structured products.
• Broker: A person or firm that executes securities transactions on behalf of customers for a commission.
• Dealer: A person or firm that buys and sells securities for its own account (as principal), profiting from the spread.
• Broker-dealer: A firm that performs both functions. Most large securities firms are broker-dealers.
• Introducing broker: A firm that has the customer relationship, opens accounts, and takes orders, but does not hold customer assets or settle trades.
• Clearing broker (or carrying broker): A firm that holds customer funds and securities, settles trades, and maintains the books and records on behalf of introducing brokers.
• Investment adviser / asset manager: A person or firm that manages portfolios or provides investment advice. Historically, in some jurisdictions (notably the United States), investment advisers were not directly subject to AML program requirements, creating a regulatory gap that FinCEN addressed with a 2024 rule extending Bank Secrecy Act obligations to many registered and exempt reporting advisers.
• Omnibus account: An account held by one financial institution at another in which the transactions of many underlying customers are commingled. The carrying firm sees only the omnibus account holder, not the underlying beneficial owners.
• Delivery-versus-payment (DVP) account: An account in which securities are delivered only against payment, often with assets held at a third-party custodian rather than at the broker-dealer, which can limit the broker-dealer's visibility into the flow of funds.

Why the sector is vulnerable

The ACAMS study guide and FATF guidance on the securities sector identify several structural characteristics that make the industry attractive to launderers:

• International nature. Securities can be bought in one country, held in another, and sold in a third, often within hours.
• Speed of transactions. Funds and securities move rapidly, leaving little time for scrutiny before assets have moved on.
• Ease of conversion. Liquid securities can be sold and converted into cash or wired out almost immediately, giving illicit proceeds the appearance of legitimate investment returns.
• Routine use of wire transfers. Because the industry rarely handles physical cash, incoming and outgoing wires are normal and attract less suspicion than they would at a retail bank.
• Competitive, commission-driven culture. Registered representatives are frequently compensated on production. This can create pressure to open accounts and execute trades without asking difficult questions about the source of funds.
• Complex ownership structures. Hedge funds, private investment vehicles, trusts, nominee accounts, and omnibus relationships can obscure beneficial ownership.
• Reliance on third parties. The split between introducing and clearing brokers, the use of custodians, and the use of intermediaries such as independent financial advisers can create confusion over which party is responsible for customer due diligence.
• Variety of products. Products such as variable annuities, wrap accounts, structured notes, and bearer securities (where still permitted) have features that can be exploited.

Where in the laundering cycle does the sector fit?

This is a frequent exam point. Because broker-dealers generally do not accept large amounts of cash, the securities industry is rarely used for placement. It is primarily used for layering (moving funds through multiple accounts, products, and jurisdictions to obscure origin) and integration (where illicit funds emerge as apparently legitimate investment proceeds). The exception is when a broker or representative is complicit and accepts cash or structured deposits, or when the firm is affiliated with a bank that handles the cash side.

3. How It Works: Typologies, Methods, and Red Flags

Common laundering methods in the securities sector

• Account used as a pass-through or de facto bank account. Funds are wired into a brokerage account and wired out shortly afterwards, with little or no securities activity in between. This is sometimes called journaling or pass-through activity and is one of the most cited red flags.
• Deposit and immediate liquidation of securities. A customer deposits physical stock certificates or transfers in securities (often low-priced or thinly traded) and immediately sells them and requests a wire of the proceeds.
• Microcap and penny stock schemes. Pump-and-dump schemes involve inflating the price of a thinly traded security through false promotion, then selling at the inflated price. The proceeds are themselves criminal and must then be laundered. Unregistered or restricted securities are often involved.
• Wash trades and matched orders. A customer or group of related customers simultaneously buy and sell the same security to create the appearance of trading activity, to move value between accounts, or to manipulate prices. Mirror trading (buying a security in one currency in one jurisdiction and selling the same security in another currency in a different jurisdiction through related accounts) has been used to move large sums across borders while disguising capital flight.
• Deliberately losing trades. Related accounts take opposite positions so that one account loses money to the other, transferring value under the cover of normal trading losses.
• Use of omnibus and nominee accounts. Underlying beneficial owners are hidden behind a foreign financial institution or intermediary.
• Abuse of insurance-linked securities products. Variable annuities and investment-linked insurance can be funded with illicit money and surrendered early; the launderer accepts the surrender penalty as a cost of cleaning the funds.
• Free-riding. A customer buys securities without sufficient funds and sells them before settlement, pocketing gains without ever paying. While primarily a fraud, it signals a customer willing to violate rules.
• Funding from unrelated third parties. Accounts funded by multiple individuals or entities with no apparent connection to the account holder.

Key red flags (learn these for the exam)

Customer behavior:
• The customer appears unconcerned with investment risk, commissions, fees, or returns, suggesting the goal is movement of funds rather than profit.
• The customer wants to liquidate positions or transfer funds out very quickly after they arrive.
• The customer is reluctant to provide information about the source of funds, occupation, or beneficial ownership, or provides information that is inconsistent or cannot be verified.
• The customer requests that transactions be structured to avoid reporting or record-keeping thresholds.
• The customer has a questionable background, is subject to adverse media, or is a politically exposed person without a plausible source of wealth.
• The customer frequently changes address, contact information, or the authorized persons on the account.

Account activity:
• Wire transfers in and out with no corresponding securities transactions.
• Funds wired to or from high-risk or secrecy jurisdictions, or to third parties with no apparent relationship.
• Multiple accounts opened under different names or entities controlled by the same individual, with transfers among them.
• Large deposits of physical certificates, especially of low-priced securities, followed by immediate sale.
• Trading patterns that make no economic sense, such as simultaneous buy and sell orders in the same security, or repeated losses to the same counterparty.
• Activity that is inconsistent with the stated purpose of the account or the customer's financial profile.
• An account for a legal entity that has no apparent business purpose or that is located in a jurisdiction unrelated to its stated activities.
• Payments to or from parties on sanctions lists or with addresses that are mail drops.

Market abuse and securities fraud as predicate offenses

Remember that insider trading, market manipulation, and securities fraud are predicate offenses for money laundering in most jurisdictions and are explicitly listed in the FATF designated categories of offenses. A broker-dealer that identifies manipulative trading must consider both its market conduct reporting obligations and its suspicious activity reporting obligations.

4. Controls and Regulatory Expectations

AML program requirements

Broker-dealers are expected to maintain a risk-based AML program with the same core pillars as other financial institutions. In the United States, Section 352 of the USA PATRIOT Act and FINRA Rule 3310 require:
• Written policies, procedures, and internal controls reasonably designed to detect and report suspicious activity.
• Designation of an AML compliance officer, with contact details filed with FINRA.
• Independent testing (annually, or every two years if the firm does not execute transactions for customers or hold customer accounts).
• Ongoing training for appropriate personnel.
• Risk-based customer due diligence, including identifying and verifying beneficial owners of legal entity customers.

Broker-dealers in the US must also maintain a Customer Identification Program, file Suspicious Activity Reports (historically known as SAR-SF), file Currency Transaction Reports if they handle cash, comply with the travel rule for funds transfers, and perform due diligence on correspondent accounts for foreign financial institutions under Section 312.

Allocation of responsibilities between introducing and clearing brokers

This is a classic exam area. Both the introducing broker and the clearing broker are independently responsible for their own AML programs. They may allocate specific functions by written agreement (for example, the introducing broker performs customer identification and the clearing broker performs transaction monitoring), but neither firm can contract away its ultimate legal responsibility. Both must file suspicious activity reports when they identify suspicious activity, and regulators encourage information sharing between the two so that each has a complete picture.

Enhanced due diligence triggers

Higher-risk situations that typically warrant enhanced due diligence include: accounts for foreign financial institutions and omnibus arrangements; private banking or high-net-worth accounts; politically exposed persons; accounts held through offshore shell entities or trusts; customers trading heavily in low-priced or microcap securities; DVP or prime brokerage arrangements where the firm has limited visibility; and accounts connected to jurisdictions with weak AML regimes.

Transaction monitoring considerations

Effective monitoring in a broker-dealer looks beyond cash and wires. It should capture: deposits and liquidations of securities, journal entries between accounts, trading patterns such as wash and matched trades, concentration in low-priced securities, and movement of funds to third parties. Surveillance for market manipulation and AML monitoring are increasingly integrated because the same data reveals both.

International guidance

FATF issued Risk-Based Approach Guidance for the Securities Sector (originally 2009, updated 2018) describing sector-specific vulnerabilities, indicators, and the application of the risk-based approach to intermediaries, asset managers, and markets. IOSCO (the International Organization of Securities Commissions) has published principles on client identification and beneficial ownership for the securities industry. The Wolfsberg Group has also addressed AML in the context of private banking and correspondent relationships relevant to securities firms.

5. Exam Tips: Answering Questions on Securities and Broker-Dealer Risks

Tip 1: Know the stage of laundering. If a question asks which stage of money laundering the securities industry is most associated with, the answer is layering (and sometimes integration), not placement. If an answer choice describes a broker accepting bulk cash, treat it as unusual and highly suspicious rather than typical.

Tip 2: Memorize the signature red flag. The single most tested indicator is a customer who wires funds into a brokerage account and wires them out shortly afterwards with little or no securities activity. Whenever you see this pattern in a scenario, it is the red flag the examiners want you to spot. The second most common is a customer who shows no interest in investment performance, fees, or risk.

Tip 3: Recognize the vulnerability list. Questions often ask why the securities sector is attractive to launderers. Correct answers will mention the international nature, speed of transactions, ease of converting securities to cash, routine wire activity, and commission-driven culture. Wrong answers typically mention things like high cash intensity or lack of regulation, which do not characterize the sector.

Tip 4: Understand introducing versus clearing responsibilities. If a scenario involves an introducing broker and a clearing broker, remember that both firms have independent AML obligations and that a contractual allocation of duties does not eliminate either firm's responsibility to detect and report suspicious activity. An answer stating that the clearing firm alone is responsible, or that the introducing firm can rely entirely on the clearing firm, is almost always wrong.

Tip 5: Distinguish fraud from laundering. Some scenarios describe a pump-and-dump or insider trading. Read carefully to see whether the question asks about the predicate crime or about the subsequent laundering of its proceeds. Also remember that securities fraud and market manipulation are predicate offenses, so suspicious activity reporting obligations apply.

Tip 6: Look for the proportionate, risk-based response. CAMS answers favor measured, risk-based actions: escalate to the compliance officer, conduct enhanced due diligence, document findings, and file a suspicious activity report where warranted. Avoid extreme answers such as immediately closing every account from a particular country, refusing all foreign customers, or confronting the customer with your suspicions (which may constitute tipping off). Equally avoid answers that defer action indefinitely, such as waiting for a second instance before reviewing.

Tip 7: Watch for omnibus and nominee language. When a scenario mentions an omnibus account, a foreign intermediary, or a nominee shareholder, the point being tested is the difficulty of identifying underlying beneficial owners and the need for enhanced due diligence on the intermediary, including understanding its AML controls and the nature of its customer base.

Tip 8: Low-priced securities are a flag. Any mention of penny stocks, microcap shares, physical certificates, restricted or unregistered shares, or thinly traded issuers should raise your attention. Deposit followed by rapid liquidation and wire-out is the classic pattern.

Tip 9: Apply the economic rationale test. Ask whether the trading in the scenario makes sense for a profit-seeking investor. Simultaneous buy and sell of the same security, repeated losses to the same counterparty, or indifference to large commissions indicate the account is being used to move value, not to invest.

Tip 10: Read every answer choice. CAMS questions frequently include several partially correct options. Choose the one that most directly addresses the specific risk or control the question is testing. If two options both seem right, prefer the one grounded in a risk-based approach and in the institution's documented policies and procedures over the one that relies on personal judgment or ad hoc action.

Quick revision summary

• Securities sector: used mainly for layering and integration; rarely for placement.
• Vulnerabilities: international, fast, liquid, wire-based, commission-driven, complex ownership, reliance on intermediaries.
• Top red flags: pass-through wires with no trading, indifference to risk and fees, rapid liquidation of deposited securities, low-priced stocks, wash and matched trades, third-party funding, unverifiable source of funds.
• Controls: risk-based AML program, CIP and beneficial ownership, EDD for omnibus, foreign intermediaries, and PEPs, integrated trade and AML surveillance, suspicious activity reporting.
• Introducing and clearing brokers each retain full AML responsibility regardless of contractual allocation.
• Securities fraud, insider trading, and market manipulation are predicate offenses.

Master these points and you will be well prepared for any CAMS question on securities and broker-dealer risks.