Auto-Approved Account, Shell Company Wire, and Penny Stocks
A retail broker's onboarding system auto-approved a new margin account for a client who deposited $250,000 by wire from a shell company incorporated in a jurisdiction the firm's policy lists as high risk. The client provided a passport and a utility bill; the bill was eight months old, and the address did not match the passport. The client described himself as a 'consultant' and declined to provide source of funds, saying 'it's private.' The third-party verification vendor marked the documents 'verified.' Within 10 days, the account bought $240,000 of penny stocks and wired $200,000 to another offshore entity. The firm's AML policy requires enhanced due diligence for high-risk jurisdictions and third-party wires, and prohibits auto-approval when source of funds is missing.
1. Identify the red flags and explain which policy requirements were missed.
Read the worked answer
Red flags: third-party wire from a shell company; high-risk jurisdiction; stale utility bill; address mismatch; client refuses source of funds; 'consultant' with no verifiable employment; rapid in-and-out trading in penny stocks; offshore wire-out. Missed policy requirements: enhanced due diligence for high-risk jurisdiction and third-party wires; beneficial ownership identification; source of funds and wealth; senior management approval; no auto-approval when source of funds is missing. The vendor's 'verified' label does not override the firm's own risk-based judgment.
2. What should the firm have done before opening the account?
Read the worked answer
The firm should not have auto-approved. It should have paused onboarding, requested source of funds and wealth, identified beneficial owners, verified the shell company, screened for PEPs and sanctions, obtained senior management approval, and documented the risk assessment. If the client refused, the firm should have declined the account.
3. Now that the activity has occurred, what remediation and reporting steps are required?
Read the worked answer
After the fact: freeze or close the account, preserve records, conduct an investigation, file a suspicious activity report if required, review whether other accounts are linked, remediate the vendor and auto-approval rules, train staff, and consider reporting to the regulator. The firm should also assess whether it has an obligation to offboard the client and whether any third-party wires should be returned.