According to FINRA, Merrill Lynch, Pierce, Fenner & Smith Incorporated was censured and fined $950,000 for failing to reasonably supervise the transmittal of customer funds via externally-initiated automated clearing house (ACH) transfers, allowing two representatives to steal in excess of $6 million from customers.
The firm was found in violation of its supervisory obligations regarding customer fund transfers. Merrill Lynch's system to review and monitor ACH transfers was not reasonably designed to identify improper transfers by the firm's own registered representatives. Critically, the firm did not systematically screen ACH transfers to detect instances where one of its representatives was the beneficiary of a transfer from a customer's account. Instead, the firm relied on a fraud-detection system designed to detect fraud by third parties, not by its own employees.
The firm's fraud unit monitored ACH transactions and, when unable to clear a transaction based on guidance, would escalate it to the representative assigned to the customer account. The representative was then responsible for validating that the transaction had been initiated by the customer—creating an obvious conflict of interest when the representative was the perpetrator. Despite being aware that a representative had previously converted customer funds via ACH transfers, the firm failed to enhance its supervisory system to identify such theft.
Only after the firm developed a tool to monitor externally initiated ACH transfers for the benefit of firm personnel and ran it for the first time did it discover a representative's conversion of millions of dollars. This came too late to prevent two representatives from running separate schemes over multiple years, stealing in excess of $6 million combined. The firm has already made restitution to affected customers. Investors should monitor their accounts regularly for unauthorized transfers and immediately report suspicious activity. This case illustrates a critical supervisory failure: firms must have controls to detect theft by their own employees, not just by external fraudsters.
