The Wire Instruction That Changed at 11:40 A.M.
An LLC customer has signed subscription documents for a $500,000 private placement closing today at 3:00 p.m. At 11:40 a.m. you receive an email from the member's address directing that the wire go to a new bank account in another state because 'our old account is frozen.' The email domain is one character off from the one on file, the signature block has no phone number, and the subscription agreement is signed by a different member than the one who normally signs. The offering memorandum names an escrow agent, but the email gives different wiring instructions. Your operations manager asks you to approve release of the wire.
1. What should you do before any wire is released?
Read the worked answer
Stop and verify out of band. The combination of facts is a textbook business-email-compromise pattern:
- A last-minute change of bank account.
- A domain that is one character off from the known address.
- A request to move funds to a different state.
- A stated reason ('frozen account') that pressures speed.
Call the member at the number already in the firm's records - never a number supplied in the suspicious email - and confirm the instruction. Separately confirm the wire instructions with the escrow agent named in the offering memorandum, since the email conflicts with the PPM. Escalate to compliance and the AML group. If the request is fraudulent, the firm may need to file a suspicious activity report and should preserve the email and headers.
2. The subscription agreement is signed by a different member than the one who usually signs. What does that require?
Read the worked answer
It requires an authority check before the subscription is accepted:
- Obtain the LLC's operating agreement and any resolutions designating authorized signers.
- Confirm that the signing member actually has authority to bind the LLC for an investment of this size, and document the confirmation.
- If authority is unclear, get a written ratification from the authorized member or a fresh resolution.
- Reconcile the entity's account records with the signer and with the bank account on file.
An entity subscription signed by someone whose authority is unverified is an account-documentation problem independent of the wire fraud issue, and both need to be resolved before closing.
3. Assuming the wire is verified as legitimate, what must happen around the closing and confirmation?
Read the worked answer
Once verified through independent channels:
- Send funds only to the escrow agent or issuer account specified in the offering memorandum, not to an account introduced by email.
- Confirm the subscription is accepted and the investor's ownership interest is recorded.
- Provide the customer with a confirmation reflecting the transaction, the amount, the security, and the capacity in which the firm acted, consistent with the firm's confirmation procedures and the private placement documents.
- Retain the subscription documents, the authority documentation, the verification record, the wire confirmation, and all related correspondence.
If verification had failed, the correct outcome would have been no wire and an escalation, even if that meant missing the 3:00 p.m. close. A missed closing is recoverable; a misdirected $500,000 is not.