Skip to main content
Regulatory Notice 21-03

FINRA Urges Firms to Review Their Policies and Procedures Relating to Red Flags of Potential Securities Fraud Involving Low-Priced Securities

Published Date:


Low-priced securities1 tend to be volatile and trade in low volumes. It may be difficult to find accurate information about them. There is a long history of bad actors exploiting these features to engage in fraudulent manipulations of low-priced securities. Frequently, these actors take advantage of trends and major events—such as the growth in cannabis-related businesses or the ongoing COVID-19 pandemic—to perpetrate the fraud.2

FINRA has observed potential misrepresentations about low-priced securities issuers’ involvement with COVID-19 related products or services, such as vaccines, test kits, personal protective equipment and hand sanitizers. These misrepresentations appear to have been part of potential pump-and-dump or market manipulation schemes that target unsuspecting investors.3 These COVID-19-related manipulations are the most recent manifestation of this type of fraud.

This Notice provides information that may help FINRA member firms that engage in low-priced securities business assess and, as appropriate, strengthen their controls to identify and mitigate their risk, and the risk to their customers, including specified adults and seniors,4 of becoming involved in activities related to fraud involving low-priced securities. Firms that engage in low-priced securities business should also be aware of a recent SEC Staff Bulletin—Risks Associated with Omnibus Accounts Transacting in Low-Priced Securities—that highlights for broker-dealers various risks arising from illicit activities associated with transactions in low-priced securities through omnibus accounts, particularly transactions effected on behalf of omnibus accounts maintained for foreign financial institutions.5

This Notice does not create any new requirements or expectations for member firms outside of their existing obligations pursuant to FINRA rules and applicable law, nor does implementing any of the practices cited here create a safe harbor from these obligations.

Questions regarding this Notice should be directed to:

  • Greg Ruppert, Executive Vice President, National Cause and Financial Crimes Detection Programs, Member Supervision, at (415) 217-1120 or by email;
  • Sam Draddy, Senior Vice President, Insider Trading, Fraud Surveillance and PIPEs Surveillance, Member Supervision, at (240) 386-5042 or by email; or
  • Blake Snyder, Senior Director, Financial Intelligence Unit, Member Supervision, at (561) 443-8051 or by email.

Background and Discussion

Broker-dealers play an important part in identifying and protecting investors from potentially fraudulent activity. A firm’s failure to take appropriate steps as a gatekeeper to the public securities marketsfor example, by not conducting a reasonable inquiry into a security’s eligibility for distribution, where required—may expose that firm to liability risks, for example under Section 5 of the Securities Act of 1933 (“Securities Act”).6 In addition, Section 10(b) of the Exchange Act, Rule 10b-5 thereunder, and Section 17(a) of the Securities Act, as well as FINRA Rules 2010 (Standards of Commercial Honor and Principles of Trade), 2020 (Use of Manipulative, Deceptive or Other Fraudulent Devices) and 3110 (Supervision) establish obligations for member firms in connection with potential fraud. Firms also have obligations under the BSA and FINRA Rule 3310 (Anti-Money Laundering Compliance Program) to maintain appropriate risk-based procedures to conduct ongoing customer diligence and to report suspicious activity to the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury.

This Notice provides information to help firms strengthen their controls in four important areas related to potential fraud involving low-priced securities and thereby protect investors from financial harm and the firms themselves from financial, regulatory and reputational damage:

  • Detection: the Notice describes possible red flags of potentially fraudulent low-priced securities activity;
  • Monitoring: the Notice describes selected effective supervisory and other control practices FINRA has observed firms implement;
  • Suspicious Activity Report (SAR) filing: the Notice describes firms’ SARs filing obligations; and
  • Fraud Reporting: the Notice describes additional avenues for firms to report potential fraud involving low-priced securities.

FINRA notes that a pattern of involvement in low-priced securities transactions—including soliciting customers, conducting offerings or executing transactions related to low-priced securities—informs FINRA’s evaluation of a firm’s risk profile. FINRA may examine or otherwise review more frequently the activity of firms that display these elevated risk characteristics.

Detection: Potential Red Flags of Fraud Involving Low-Priced Securities

The red flags discussed below are intended to help inform firms about activity associated with potential fraud involving low-priced securities, including, but not limited to, schemes involving COVID-19 claims.The red flags discussed in this Notice may overlap in some instances with red flags of suspicious anti-money laundering activity FINRA identified in Regulatory Notice 19-18 (FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting Obligations). This Notice provides firms engaged in low-priced securities business with more detailed information regarding red flags that are specific to potential fraud involving low-priced securities.

Potential Indicators of Fraud Involving Low-Priced Securities

FINRA has observed that the following non-exhaustive list of issuer, third-party or customer activities may be red flags of fraud involving low-priced securities:


  • abrupt or frequent changes of issuer name, ticker symbol or business model, or abrupt expansion of an existing business model, often to benefit from the latest trend such as COVID-19 cures, test kits or prevention-related products (including instances in which the issuer has previously engaged in a business involved with other trends such as e-cigarettes, cannabis or cryptocurrency);
  • currently or previously a shell company;8
  • engaging in recapitalization or reorganization activities (e.g., a reverse or forward stock split in conjunction with a reverse merger) that appear to concentrate the shares into the hands of a small number of shareholders, who may be acting in coordination;
  • hiring executive or control persons or service providers—such as attorneys, auditors, transfer agents, consultants and promoters—who have a history of regulatory or criminal violations, or are associated with multiple low-priced stock issuers;
  • not providing current and adequate publicly available financial information9 in SEC filings or voluntary disclosures on an inter-dealer quotation system;
  • making claims about projected scale and revenue targets that are not supported by the issuer’s experience, assets or financial condition (e.g., an issuer that develops cannabinoid-based products announces that it could earn millions in revenue from manufacturing and shipping COVID-19 home test kits);
  • making unsupported claims regarding partnerships, joint ventures or financing agreements with private entities (e.g., an issuer promotes a press release touting the financial benefits of a new business partnership with a company whose financial condition cannot be independently verified);
  • conducting increased social media, press release or related investor outreach campaigns after a period of apparent dormancy, particularly if the information is not confirmed on the issuer’s website or in financial statements and disclosures filed with the SEC or on an inter-dealer quotation system, and often related to the latest trend; or
  • lacking verifiable evidence of the issuer’s business activities, such as limited or no operational website, social media accounts, references to issuer on employment websites or other independent reporting on the issuer’s business activities.

Third-Party Promotional Activities

  • hyping and promoting issuers (or their products or services), especially where the information cannot be reliably confirmed;
  • promotional investor email alerts, banner advertisements, dedicated promotional websites or seemingly independent news or research coverage, which prominently feature or advertise the issuer’s new potential business prospects that (1) may be related to the latest trend (e.g., winning a large contract or developing a new product or service), (2) may also present recent or projected investment returns, and (3) cannot be reliably confirmed;
  • generating a spike in social media promotions (e.g., on Twitter, Instagram or Facebook), and activity on investor chat rooms or message boards; or
  • conducting unsolicited phone calls or sending text alerts to tout specific stocks to garner interest from registered representatives and investors.

Firm Customers

  • customers that deposit large blocks of thinly traded low-priced securities, whether the securities are marked with a restrictive legend or not, particularly of issuers that recently changed business models to take advantage of the latest trend;
  • customers that engage in transactions that are consistent with an intent to affect the price of a low-priced stock, such as small purchases executed on behalf of a customer who owns a very large amount of the same low-priced stock, and do not have a legitimate investment rationale for the transactions;
  • customers that engage in a pattern of purchasing a low-priced security right before market close (which may be indicative of an attempt to mark the close);
  • customers or other parties that request the firm file a FINRA Form 21110 to initiate or resume quotations for an issuer that recently changed business models—often to take advantage of the latest trend—or was recently subject to a trading suspension;
  • current officers, former officers, significant shareholders or family members of these individuals, who trade low-priced securities prior to a corporate announcement or stock promotion campaign;
  • one or more customers suddenly trading the securities of a thinly traded issuer—often one that makes claims related to the latest trend—on opposite sides of the market, potentially leading to manipulative trading;
  • customers, particularly specified adults11, who are being solicited to purchase low-priced securities where (1) the customer has not invested in low-priced securities previously; (2) the purchase is outside the customer’s investment or risk profile; or (3) the low-priced security constitutes a large concentration of the customer’s investments;
  • multiple new customers opening accounts (particularly if they reside overseas and communicate with the firm only through electronic means) who either deposit shares of the same issuer or were introduced by the same individual to the firm; or
  • customers, including financial institutions, that route high volume or frequent sell orders (with no buys) for low-priced securities to the firm for execution, including customers who maintain an execution-only relationship with the firm, or use omnibus or Delivery versus Payment/Receive versus Payment (DVP/RVP) accounts for such transactions.

Monitoring: Supervisory and Other Controls

Measures that FINRA has observed firms implement in effective supervisory systems to mitigate risks associated with fraud involving low-priced securities include, but are not limited to, the following:

Supervision of Associated Persons

  • monitoring registered representatives’ customers’ investments in low-priced securities that are marked “unsolicited” to determine if the trades were in fact solicited;
  • monitoring registered representatives’ solicitations to customers to trade low-priced securities for compliance with FINRA rules and applicable laws;
  • monitoring the proprietary and customer accounts of registered representatives who primarily trade in low-priced securities; and
  • enhancing supervision of registered representatives who maintain direct or indirect outside business activities associated with companies with low-priced shares or trade in low-priced securities in their outside brokerage accounts.

Account and Share Acceptance

  • establishing risk-based criteria to determine the characteristics of securities (e.g., exchange-listed and SEC reporting companies) investors may hold in their accounts or in which they may initiate transactions on the firm’s platform;
  • establishing controls to identify situations where customers open new accounts and deposit or transfer large blocks of low-priced securities, including in omnibus or DVP/RVP accounts;
  • promptly reviewing deposits of physical certificates and electronic transfers of low-priced securities prior to acceptance to identify low-priced securities that are marked as restricted, as well as low-priced securities that are not marked restricted where the restrictive legend may have been inappropriately lifted;
  • implementing risk-based acceptance policies regarding physical and electronic deposits of low-priced securities that incorporate factors such as whether the issuer is exchange-listed, the markets or exchanges on which it trades, any compliance flags that exchanges and over-the-counter markets provide regarding the issuer12 and the existence of other red flags such as those referenced in this Notice;
  • requiring compliance or AML department approval of exceptions to firm policies on the deposit and trading of low-priced securities by customers; and
  • obtaining information regarding the customer’s occupation or business and establishing risk-based criteria to request additional information, such as whether the customer is employed by a company that trades on the public markets and whether the customer intends to deposit or trade low-priced securities.

Account Monitoring

  • monitoring customer accounts for shifts in investment strategy away from listed equities towards unlisted low-priced securities, especially if this is inconsistent with the customer’s stated or historic risk tolerance;
  • monitoring accounts held by specified adults and seniors for unusual purchases, or high concentrations, of low-priced securities and, where appropriate, contacting customers to determine if these decisions were the result of solicitation or influence by a third party;
  • monitoring customer accounts, including omnibus or DVP/RVP accounts, that are liquidating low-priced securities to address risks relating to the firm being engaged in, among other things, an unregistered securities offering;
  • establishing risk-based criteria to determine the circumstances under which a firm would consider placing restrictions on or closing an account;
  • monitoring for groups of related accounts trading in the same low-priced security at the same time; and
  • reviewing for indications of stock promotion activity in connection with share acceptance and account monitoring reviews.

Other Controls

  • conducting education and outreach—which could include providing risk alerts at the time of order entry—to customers, especially specified adults13, to inform them about the risks of investing in low-priced securities;14
  • identifying and, if necessary, prohibiting customers from opening new accounts with, or depositing in existing accounts, restricted shares of low-priced listed or low-priced OTC securities; and
  • increasing training and coordination between risk, compliance and operational personnel to ensure frontline staff are aware of red flags associated with potential fraud involving low-priced securities and schemes to unlawfully distribute unregistered securities and know how to report their concerns.

Reporting Potential Fraud Involving Low-Priced Securities

FINRA Rule 3310(f) and 31 CFR 1023.210(b)(5) require that member firms’ AML programs include appropriate risk-based procedures for conducting ongoing customer due diligence, including procedures for conducting ongoing monitoring to identify and report suspicious transactions. In addition, FINRA Rule 3310(a) requires firms to “[e]stablish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of transactions required under [the BSA] and the implementing regulations thereunder;” the BSA and its implementing regulations require financial institutions to report suspicious transactions to FinCEN using SARs.15 FinCEN has issued several notices and advisories noting emerging trends relating to illicit behavior connected to COVID-19, including investment scams and insider trading, and encouraged all financial institutions to enter the term “COVID19” or the specific term provided in a relevant FinCEN notice or advisory in Field 2 of the SAR and provide other requested information in the relevant fields and narrative.16

Financial institutions are also required to provide information to FinCEN in response to requests in furtherance of Section 314(a) of the USA PATRIOT Act for information regarding accounts reasonably suspected based on credible evidence of engaging in terrorist acts or money laundering.17

Financial institutions subject to an anti-money laundering program requirement under FinCEN regulations, and any qualifying association of such financial institutions, are eligible to share information under Section 314(b) of the USA PATRIOT Act. Section 314(b) provides financial institutions with the ability to share information with one another, under a safe harbor provision that offers protections from civil liability, in order to better identify and report potential money laundering or terrorist financing. Although sharing information pursuant to Section 314(b) is voluntary, FinCEN and FINRA strongly encourage financial institutions to participate to enhance their compliance with anti-money laundering/counter-financing of terrorism requirements.18

Beyond the filing obligations discussed above, FINRA urges firms to protect customers and other firms by immediately reporting potential fraud involving low-priced securities to one or more of the following:

In addition, firms should consider whether circumstances would trigger a reporting obligation pursuant to FINRA Rule 4530 (Reporting Requirements).20


  1. For the purposes of this Regulatory Notice, the term “low-priced securities” refers to those securities that are sometimes referred to as “microcap stocks” or “penny stocks.” The term “microcap stock” generally refers to securities issued by companies with a market capitalization of less than $250 to $300 million. See, e.g., U.S. Securities and Exchange Commission, Microcap Stock: A Guide for Investors (Sept. 18, 2013) and U.S. Securities and Exchange Commission (SEC), Investor Bulletin, Microcap Stock Basics (Sept. 30, 2016). The term “penny stock” generally refers to a security issued by a very small company that trades at less than $5 per share. See Fast Answers: Penny Stock Rules; Section 3(a)(51) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rule 3a51-1 thereunder.
  2. See also Regulatory Notice 20-13 (FINRA Reminds Firms to Beware of Fraud During the Coronavirus (COVID-19) Pandemic).
  3. As used here, “fraud involving low-priced securities” can include market manipulation and “pump and dump” schemes.
  4. “Specified adult” as defined in FINRA Rule 2165 (Financial Exploitation of Specified Adults) refers to: (A) a natural person age 65 and older; or (B) a natural person age 18 and older who a firm reasonably believes has a mental or physical impairment that renders the individual unable to protect his or her own interests.
  5. In addition to highlighting the risks described, the SEC Staff Bulletin also reminds brokers-dealers of their associated obligations under the Bank Secrecy Act (“BSA”),  Rule 17a-8 under the Exchange Act, Section 5 of the Securities Act of 1933 (“Securities Act”), and FINRA rules. The Bulletin states that in the view of SEC staff, sufficiently discharging existing anti-money laundering (“AML”) obligations under the BSA requires broker-dealers to consider, among other things, the risks associated with the multiple layers of accounts through which transactions in low-priced securities may have been routed.
  6. See Regulatory Notice 09-05 (Unregistered Resales of Restricted Securities).
  7. FinCEN has advised that as no single financial red flag indicator is necessarily indicative of illicit or suspicious activity, financial institutions should consider all surrounding facts and circumstances before determining if a transaction is suspicious or otherwise indicative of potentially fraudulent activities related to COVID-19. In line with a risk-based approach to compliance with the BSA, financial institutions also are encouraged to perform additional inquiries and investigations where appropriate. See Advisory on Unemployment Insurance Fraud During the Coronavirus Disease 2019 (COVID-19) Pandemic.
  8. See Exchange Act Rule 12b-2 (providing that a shell company is a “registrant . . . that has: (1) No or nominal operations; and (2) Either: (i) No or nominal assets; (ii) Assets consisting solely of cash and cash equivalents; or (iii) Assets consisting of any amount of cash and cash equivalents and nominal other assets.”).
  9. See 17 CFR 230.144(c) (addressing “adequate current public information”).
  10. See FINRA Rule 6432 (Compliance with the Information Requirements of SEA Rule 15c2-11).
  11. See supra note 4.
  12. For example, OTC Markets Group provides information on an issuer on the issuer’s quote page and in the Group’s Compliance Data feeds; these flags may identify an issuer as, for example, a shell company, bankrupt or delinquent in its SEC reporting.
  13. See supra note 4.
  14. Numerous resources are available at
  15. 31 U.S.C. 5318(g); 31 C.F.R. 1023.320. Under FinCEN’s SAR rule, broker-dealers are required to file a SAR if: (1) a transaction is conducted or attempted to be conducted by, at, or through a broker-dealer; (2) the transaction involves or aggregates funds or other assets of at least $5,000; and (3) the broker-dealer knows, suspects, or has reason to suspect that the transaction –

    1. involves funds or is intended or conducted in order to hide or disguise funds or assets derived from illegal activity as part of a plan to violate or evade any Federal law or regulation or to avoid any transaction reporting requirement under Federal law or regulation;
    2. is designed to evade requirements of the BSA;
    3. has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the broker-dealer knows of no reasonable explanation for the transaction after examining the available facts; or
    4. involves the use of the broker-dealer to facilitate criminal activity.

    31 C.F.R. 1023.320 (a)(2). The SEC maintains a SAR Alert Message Line at (202) 551-SARS (7277), which should only be used when firms have filed a SAR that requires the immediate attention of the SEC.

  16. See generally FinCEN’s coronavirus webpage and FinCEN’s March 20, 2020 guidance discussing investment scams and insider trading. For types of suspicious activity related to specific types of conduct, FinCEN has requested more detailed keywords be included in Field 2 of the SAR form and other specific fields as well as the narrative. For general guidance on relevant BSA obligations, see Notice Related to the Coronavirus Disease 2019 (COVID-19).
  17. 31 C.F.R. 101.520.
  18. For updated guidance on the expanded acceptable use of the Section 314(b) information sharing authority, see FinCEN’s December 10, 2020 press release.
  19. See NASAA’s webpage providing contact information for state securities regulators.
  20. For additional information about these requirements, see Rule 4530 Frequently Asked Questions.