Guidance

Impact: All Firms

Update (June 22, 2023): The link to the Advisory issued by CISA on June 7, 2023 has been updated to reflect CISA’s current guidance.

Firms should review this information with any vendors who provide information technology services to the firm.

Impact: All Firms

Firms without dedicated information security professionals may wish to review this information with any vendors who provide those services to the firm.

FINRA is a not-for-profit, self-regulatory organization (SRO) dedicated to promoting investor protection and market integrity in a manner that facilitates vibrant capital markets. One of FINRA’s tools for achieving this objective is fair and effective enforcement of member firms’ compliance with securities laws and regulations.

A clearing member may use negative response letters to assign orphan accounts to an introducing broker-dealer on the clearing member’s platform.

Dear Ms. Dyer:

I am responding to your letter dated March 10, 2023, as supplemented by conversations with the staff, in which you seek interpretive guidance regarding the use of negative response letters by National Financial Services LLC (“NFS”) to assign certain orphan brokerage accounts to an introducing broker-dealer that clears through NFS (the “Receiving Broker-Dealer”).

Overview

This publication outlines emerging insider threat risks and helps member firms identify, prevent, detect, and respond to these threats, including:

Impact: All Firms

This notification is to warn member firms of an ongoing phishing campaign that involves fraudulent emails purporting to be from FINRA and using the domain names “@finrarps.org” or “@finrarps.net”. The domains of “finrarps.org” and “finrarps.net” are not connected to FINRA, and firms should delete all emails originating from these domains. Member firms should be aware that they may receive similar phishing emails from other domain names in addition to those identified in this Alert.

The email from “finrarps.org” states:

This notification is to warn member firms of an ongoing phishing campaign that involves fraudulent emails purporting to be from FINRA and using either the domain name “@finra.eu” and “@finrarec.com”. Samples of both emails are provided in Appendices 1 and 2.

The domains of “finra.eu” and “finrarec.com” are not connected to FINRA, and member firms or their customers may receive similar phishing emails from other domain names in addition to those identified in this Alert.

November 2022

Background

In August 2021, FINRA launched a targeted exam (sweep) to review firms’ practices and controls related to the opening of options accounts and related areas, including account supervision, communications and diligence. FINRA’s review focuses on a cross-section of retail and diversified firms that offer options trading to their customers.

This email is to warn member firms of an ongoing phishing campaign that involves fraudulent emails purporting to be from FINRA and using the domain name “@filling-regfinra.com”. The domain of “filling-regfinra.com” is not connected to FINRA, and firms should delete all emails originating from this domain. Member firms should be aware that they may receive similar phishing emails from other domain names in addition to those identified in this Alert.

The email states:

Dear Name,

I hope all is well!