AML for forex trading: money laundering risk and checks

NFA's case against NinjaTrader Clearing and FINRA's against Webull set out what an examiner tests at a retail trading firm:

• 18 November 2024. NFA charged NinjaTrader Clearing, a futures commission merchant with about 85,000 mostly retail accounts, with failing to implement an adequate AML program.
• 29 May 2025. An NFA hearing panel accepted the firm's settlement offer and fined it $250,000 under Compliance Rules 2-9(a) and 2-9(c).
• 5 November 2026. FINRA fined Webull $4.2 million. Between January 2020 and September 2023, the firm approved more than 120,000 accounts without a reasonable belief that it knew who the customers were.

Neither firm is a forex dealer. A forex broker with retail clients still answers for the same checks. Through a trading account, money laundering can run all three stages of the placement, layering and integration model: deposits place the money, offsetting trades layer it and a withdrawal presented as profit integrates it. For a broker, the checks fall at four moments: account opening, every list change, every deposit and every withdrawal.

Where is the money laundering risk in forex trading?

Forex (FX, sometimes written 4x) is the over the counter (OTC) market where currencies trade in pairs, with no single exchange. In April 2025 it turned over $9.51 trillion a day, according to the final 2025 survey tables the BIS published in June 2026. Sales desks in the UK, the US, Singapore and Hong Kong SAR handled 75 percent of the world's FX trading, the BIS release of 30 September 2025 said.

Forex trading works in pairs. Picture a quote of USD/SGD at 1.30 (illustrative): one US dollar, the base currency, buys 1.30 Singapore dollars, the counter currency. The BIS counts retail investors as private individuals who trade on their own account, speculatively, on margin and settled in cash. Their trades came to about $242 billion a day.

For a broker, the money laundering risk for forex trading sits in the client account. Money arrives by card, bank wire or crypto, and an account funded with crypto adds wallet checks of its own. A client can hold accounts at several brokers. A withdrawal can be presented as trading profit, and the broker's records have to show whether the trading was real.

Which AML regulations come with a forex broker's license?

Table 1. AML rules by license for forex and CFD brokers, as of 7 November 2026.

Every row turns on the license. For a broker, forex compliance starts the day it holds one, and a 4x platform licensed in any of these countries sits inside the AML rules for brokers and investment firms. Dealing with an unlicensed firm can be illegal in the client's own country. That is a licensing question, separate from AML. The effect of these regulations is the same in each country, whether the law says AML and CFT or AML and CTF: customer due diligence (CDD) when the relationship starts, screening, monitoring and reports of suspicious activity.

In the US, FinCEN's rules for futures commission merchants and introducing brokers set the program, customer identification, suspicious activity report and 314(a) duties, and 31 CFR 1010.810(b)(9) gives the CFTC the authority to examine these firms for compliance.

NFA adds a rule of its own. Compliance Rule 2-9(c) requires each FCM and IB Member to run a written AML program.

In the UK, an FCA authorized investment firm is a financial institution under the MLR, and regulation 7 makes the FCA its AML supervisor.

The UK's MLR regulation 27(1)(a) requires CDD when a business relationship is established. The EU's AML Regulation says the same in Article 19(1)(a). It applies from 10 July 2027.

Until then, EU firms apply national law made under Directive (EU) 2015/849, which in Cyprus is Law 188(I)/2007.

CySEC's settlement with Fintailor Investments, a CIF, covered customer due diligence, the examination of unusual transactions and the duties of its board and compliance officer from 2016 to 2019.

South Africa's FIC Act names, as item 12 of its accountable institutions, a financial services provider that needs authorization under the FAIS Act of 2002 to advise on or act as intermediary for investments. National Treasury announced the country's gray list exit on 24 October 2025.

A forex broker is not a currency exchange bureau, which falls under money service rules; the same South African list puts dealers in foreign exchange apart, as item 10.

Is a retail forex dealer covered by the Bank Secrecy Act?

It depends on the registration. For a futures commission merchant or an introducing broker, the Bank Secrecy Act reaches the firm through part 1026. A firm registered only as a retail foreign exchange dealer (RFED) under the CFTC's retail forex rules should get its position confirmed by counsel.

Part 1026 names FCMs and IBs, not RFEDs. NFA's rule for forex dealers has no AML clause of its own.

What is new in 2026 for forex brokers?

• 28 January 2026. UK screening moved to one source: OFSI's Consolidated List stopped updating, and the UK Sanctions List became the only UK list.
• June 2026. BIS released the final 2025 survey tables: daily FX turnover of $9.51 trillion, against a preliminary $9.6 trillion.
• 30 June 2026. S.I. 2026/621 put regulation 27's sums in sterling, so it now reads £800 for an occasional transfer of funds.
• 5 November 2026. FINRA's Webull settlement put identity checks and same device surveillance inside a $4.2 million fine.

Next: the EU AML Regulation applies from 10 July 2027.

What must a broker check when it opens a forex account?

Four things go on file when the account opens, whatever the first deposit, because a trading account is a business relationship:

1. Identity, verified. FINRA found Webull approved more than 50 accounts for customers who sent photos of scenery in place of a government ID.
2. Stated income and net worth. NFA's complaint says NinjaTrader's alerts compared deposits with the income and liquid net worth clients gave at opening or in a yearly update.
3. Source of funds. Where deposits come from, and from which bank account.
4. Who controls the account. Owners, managers and anyone with trading authority.

US futures commission merchants and introducing brokers have a little more room: 31 CFR 1026.220 lets them verify identity within a reasonable time before or after the account opens.

NFA's complaint describes an account where the fourth item was missed. A single member company opened it in September 2022. Its owner was 20, reported income and net worth under $50,000 and named inheritance as the source. Deposits of $82,000 set off three alerts by February 2023, and none led to enhanced due diligence. A parent of the owner had pleaded guilty to money laundering in 2019 and, by the owner's written instructions, had no trading authority. That parent phoned in November 2022 and had an order canceled.

complead, formerly Sanction Scanner, runs onboarding through customer risk assessment and KYC on the same engine as screening, monitoring, fraud and investigation, and each client ends up with one risk score across all of them.

What changes when an introducing broker or affiliate brings the client?

Only the grouping changes. NFA's complaint says the firm's deposit alerts ran per account, so a customer's accounts from different introducing brokers (IBs) were never added up for deposits, though they were combined for withdrawals. On 28 February 2023 it held more than 475 accounts for customers in countries on its own blocked list, over 100 opened by the firm and the rest taken on by bulk transfer from other firms. Keep the IB or affiliate code on every account. Match clients by person.

How do sanctions and PEP checks work for forex clients?

NFA tested the search of FinCEN's 314(a) list that NinjaTrader ran on 7 February 2023 and found nearly 61,000 accounts left out. They had zero balances, and nobody at the firm had noticed the gap, the complaint says. Each could be funded the next day.

So the rule covers every account, at onboarding and on every list change: the client, the owners and managers of a company client, and anyone with trading authority. A match from PEP screening leads to enhanced due diligence and a source of wealth check. In the UK, the UK Sanctions List has been the one UK list to screen since 28 January 2026.

In complead's client screening and ongoing monitoring, each client name is set beside 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Through the API, the broker switches monitoring on or off for any one name and so picks who stays in the run: a closed account can leave it, while a zero balance account stays.

How should a broker monitor deposits, trading and withdrawals?

Table 2. Monitoring rules for a forex or CFD broker (thresholds illustrative; set yours from your own client book)

The logic of the first three rows comes from NFA's complaint. The firm's triggers reset once an analyst reviewed an account, so only new deposits counted after each review. One 70 year old customer held three accounts introduced through two IBs, with combined deposits over $98,000 by September 2022. Added up, they would have alerted that month. The first alert came in June 2023, nine months later.

Picture a new client (illustrative) who states liquid net worth of $70,000 and, over 20 days, deposits $48,000 by card in four payments. The client trades $60,000 in notional value and asks to withdraw $46,500 by wire to an account in another person's name. Three rows fire. Deposits reach 69 percent of liquid net worth, 97 percent of the money leaves within 30 days at a turnover of 1.25 times, and the payee is not the cardholder. The analyst asks for the source of funds and the payee's relationship to the client before the wire goes.

Offsetting trades between linked accounts move value from one client to another, the pattern behind mirror trading. The AML tools a forex broker needs follow from these rows and the checks before them: identity verification with the documents kept, a KYC form that records stated income and source of funds, screening on every list change, and monitoring with tracking by person, each alert closed with a record of who decided it and why.

In complead's transaction monitoring, a team writes rules like these without code and tests each one against 30, 60 or 90 days of real history, reading its alert volume, clearance rate and true positives before switching it on. Every change keeps a version. The record says who made it, when and why.

Forex trading red flags: what should send an account to review?

1. Deposits above stated means. Funding outruns the income and net worth the client gave at opening.
2. One person, several IB codes. Per account alerts never add the same client up.
3. Someone else trading. A third party places or cancels orders on an account it does not own.
4. Shared device or address. Unrelated clients log in from one device, IP address or home address.
5. Unauthorized incoming transfers. FINRA found Webull failed to identify or investigate 473 unauthorized ACH transfers that moved over $1.5 million from customers at other financial institutions into Webull accounts.
6. Deposit and exit. Money leaves soon after it arrives, with little trading between.
7. Payout to another name. The withdrawal account does not match the depositor.
8. Client in a blocked country. Residence in a country the firm's policy excludes, or in one of the high risk countries on the FATF lists.

A PEP or sanctions match, or negative news, also sends an account to review, and the review decides. Items 4 and 5 double as forex fraud detection signals: an account takeover or stolen funding looks like laundering until the analyst checks whose money it is.

How can a broker prevent AML risks before an examiner finds them?

Four controls answer the NFA findings. Name an AML officer with the authority to stop business, and train staff on the firm's own scenarios. Write procedures that match practice: NinjaTrader told NFA that its AML practices did not align with its written program, which still barred countries the firm had begun to accept. Commission an independent test that can find something, since the firm's auditor reported no findings in 2021 and 2022.

The fourth control is closing alerts with evidence. In the complaint, an analyst closed three alerts on one account without contacting the customer. An evidenced close records the rule behind the alert, what in the data matched it and the analyst who made the call. The decision acknowledged remedial actions from before and after the complaint.

Before the next exam, run three checks:

1. Rerun the latest 314(a) or sanctions search, zero balances included.
2. Group last quarter's deposits by person across IB and affiliate codes, and compare them with stated income.
3. Pull last month's withdrawals and flag each one paid to a name other than the depositor's.

Forex page sources and review. Melis Alparslan wrote this page from sources read on 7 November 2026: the FINRA release on Webull; NFA's complaint, decision and Compliance Rule 2-9 on NinjaTrader Clearing; 31 CFR parts 1026 and 17 CFR part 5; MLR 2017 regulation 27; Regulation (EU) 2024/1624; CySEC's Fintailor decision; the FIC's item 12 page; the BIS 2025 survey release and final tables; GOV.UK's UK Sanctions List page; and National Treasury's statement of 24 October 2025. Fact checked by Ufuk Gürdaş, Compliance Specialist; reviewed on 8 November 2026.