Shared addresses, identical trade requests, investments far larger than customers’ stated resources and hundreds of unpreserved business messages: a FINRA settlement describes compliance controls that repeatedly failed to connect the dots.
TL;DR
- FINRA censured Prime Number Capital, imposed a $335,000 fine and required the firm to retain an independent consultant under an agreement accepted on June 10, 2026.
- FINRA found that, from January 2021 through the settlement period, the firm’s anti-money laundering program was not reasonably designed for its core business: underwriting small-cap IPOs, many involving China-based issuers, and opening accounts for investors in those offerings.
- The firm did not reasonably investigate accounts sharing addresses, phone numbers, Social Security numbers or bank accounts; transactions up to seven times customers’ stated income and net worth; or trading patterns that appeared potentially coordinated.
- FINRA found that the firm did not review transaction data for potentially suspicious post-IPO sales—even when customers’ sales represented as much as 80% of a low-priced security’s daily volume.
- Between July 2020 and December 2024, the firm failed to preserve or review hundreds of business communications sent over unapproved platforms, including messages involving firm management.
- The firm also made late required filings in approximately 25 public offerings; eight were more than 30 days late.
The central compliance problem was not a lack of visible signals. According to FINRA’s accepted findings, the signals appeared in customer data, trading records, internal messages and annual testing—but the firm’s systems did not reliably turn them into investigation or escalation.
Transparency Notice
This article is based on FINRA Letter of Acceptance, Waiver, and Consent No. 2023076995501 concerning Prime Number Capital, LLC. The firm accepted and consented to FINRA’s findings without admitting or denying them. FINRA accepted the agreement on June 10, 2026.
An AWC is a negotiated disciplinary resolution, not a decision issued after a contested hearing. Prime Number waived a complaint, hearing and appeal, and the accepted agreement became part of its permanent disciplinary record. Under the agreement, the firm may not publicly deny its findings or create the impression that they lack a factual basis. Those circumstances make the findings operative for FINRA disciplinary purposes, but they should not be described as findings reached after a trial.
The Facts
One customer’s proposed IPO investment was up to seven times larger than the income and net worth reported in the customer’s account documents. Other seemingly unrelated customers supplied the same residential address, phone number, Social Security number or outside bank account. Two accounts opened on the same day, used the same commercial address in China and invested in the same small-cap IPO.
FINRA found that Prime Number Capital did not reasonably investigate those signals.
The New York firm joined FINRA in December 2018. At the time described in the agreement, it had eight registered representatives and two branch offices. Its investment-banking work included underwriting initial public offerings, often for foreign issuers with small market capitalizations.
That business model matters because compliance programs are supposed to fit the risks a firm actually takes. A generic anti-money laundering manual may look respectable on a shelf. It is less useful when it does not tell employees how to identify relationships between accounts, review post-IPO trading or escalate the patterns appearing in the firm’s own records.
The enforcement chronology
FINRA found that Prime Number failed to preserve and review business communications sent through unapproved platforms.
The firm failed to make required FINRA filings on time in approximately 25 public offerings.
FINRA found that the firm failed to establish and implement a reasonably designed AML program tailored to its investment-banking business.
Annual independent AML tests were conducted, but FINRA found that the tests did not reasonably address the risks associated with the firm’s business.
The firm adopted procedures to retain and review messages on the previously unapproved communications platforms.
FINRA accepted the AWC, imposing a censure, fine and independent-consultant undertaking.
An AML Program That Did Not Fit the Business
FINRA Rule 3310 requires a member firm to build and operate a written anti-money laundering program that can reasonably detect transactions that may require reporting. It also requires ongoing customer due diligence and risk-based monitoring.
In practical terms, the firm does not have to prove that a crime occurred before investigating. It must recognize warning signs, gather enough information to understand them and decide whether further diligence, escalation or a suspicious activity report is warranted. A suspicious activity report is a regulatory filing concerning a potentially suspicious transaction; it is not itself proof that the customer committed a crime.
Prime Number’s main source of revenue during the period was investment banking. The firm served as lead underwriter or co-manager on IPOs for more than 20 issuers with small market capitalizations, many based in China. Customers opened accounts to invest in firm-sponsored IPOs and then traded those securities after the offerings. Many had been referred by the issuers.
FINRA had issued notices describing warning signs relevant to that activity. They included new overseas customers introduced by the same person, multiple accounts connected by common identifying information, trading inconsistent with a customer’s finances and customers whose transactions made up a significant share of the volume in a thinly traded or low-priced security.
According to the AWC, Prime Number’s written program did not specifically address risks arising from issuer-referred accounts or deals involving China-based and other foreign issuers. It did not adequately explain how transactions should be reviewed, how risks should be reassessed, what concerns required escalation or how identified warning signs should be investigated.
The regulatory standard
“Upon detection of red flags through monitoring, firms should consider whether additional investigation, customer due diligence measures or a SAR filing may be warranted.”
FINRA Regulatory Notice 19-18, as quoted in AWC No. 2023076995501
The Signals the System Did Not Connect
The firm relied on manual transaction review rather than trade-surveillance or exception reports reasonably designed for activity involving firm-sponsored IPOs. FINRA found that, in practice, personnel did not review transaction data for potentially suspicious post-IPO sales.
That included customer sales representing as much as 80% of the daily trading volume in a low-priced security.
The AWC also says the firm had no system for identifying relationships among accounts that appeared unrelated but shared information such as email addresses, home addresses, phone numbers or external bank accounts. Even after the firm became aware of common information, FINRA found that it did not review the connected accounts for potentially coordinated trading.
Red flags cited by FINRA
- Multiple ostensibly unrelated customers supplied the same address, Social Security number, phone number or external bank account.
- Two accounts used the same China-based commercial address, opened on the same day and invested in the same small-cap IPO.
- The clearing firm flagged those two customers after they requested a wire transfer to an address not listed in their account-opening forms.
- Some customers expressed interest in IPO investments up to seven times larger than their stated income and net worth.
- Two customers referred by a foreign firm working for an issuer requested sales of that issuer’s stock at the same price, on the same day and from geographically similar IP addresses.
- Seemingly unrelated accounts placed buy orders on the same day, at approximately the same time and at the same price in a low-priced security whose IPO involved Prime Number.
Firm personnel noticed the identical sale requests from suspicious IP addresses in the issuer-referred example. FINRA nevertheless found that AML personnel did not conduct a reasonable investigation of the accounts.
The distinction is important: the AWC does not establish that these customers engaged in market manipulation or another crime. It establishes FINRA’s finding that the patterns required a more reasonable compliance response than the firm provided.
The compliance gap was not hidden in an obscure technicality. It appeared where customer identities, financial profiles and trading instructions overlapped—and where the firm’s controls did not reliably compare them.
The Check on the Check Also Failed
Broker-dealers that execute customer transactions or maintain customer accounts generally must arrange annual independent testing of their AML programs. The point is to test whether the controls work in practice, not merely whether a policy exists.
Prime Number conducted independent tests in 2022, 2023 and 2024. FINRA found those tests were not reasonably designed for the firm’s risks.
One test described all of the firm’s customers as high-net-worth individuals. That description did not match the income and net-worth figures on many account-opening forms, according to the AWC, even though those customers later invested large sums in firm-sponsored IPOs.
The transaction-monitoring review was limited to third-party wire transfers. It did not assess other monitoring, including surveillance of customer trading. In multiple years, the firm also failed to provide the independent consultant with requested customer-risk and exception-report information. The consultant therefore lacked enough information to independently assess those areas—but the reports did not note an exception for the missing material.
The annual test was supposed to identify weaknesses in the AML program. FINRA found that the test itself omitted the trading activity central to the firm’s business and did not flag missing evidence that prevented a complete review.
Hundreds of Messages Outside the Record
Federal securities recordkeeping rules require broker-dealers to preserve business-related communications, including electronic messages, for at least three years. FINRA’s supervision rule also requires procedures for reviewing correspondence and internal communications related to investment banking and securities business.
Between July 2020 and December 2024, FINRA found that Prime Number lacked a reasonably designed system for reviewing and retaining messages sent through unapproved third-party platforms. The messages included communications with issuers about firm-sponsored IPOs and discussions with the firm’s clearing firm about trading in customer accounts.
Supervisors were on notice that registered representatives were using unapproved messaging applications. At times, the AWC says, supervisors participated in those communications themselves.
The firm did not preserve hundreds of business-related messages for review and did not take timely corrective action to stop continued use of the platforms. It adopted procedures to retain and review communications on those platforms in January 2025.
That later procedural change is relevant, but it does not reconstruct messages that were not retained during the preceding period. Recordkeeping rules exist partly because regulators and supervisors cannot review communications that no longer exist in the firm’s archive.
The Offering Paperwork Arrived Late
FINRA Rule 5110 requires firms participating in public offerings to submit documents and information about underwriting terms and arrangements. Documents filed with or submitted to the Securities and Exchange Commission generally must reach FINRA within three business days. Changes to underwriting terms must also be filed.
From September 28, 2020 through October 2025, Prime Number failed to file required documents on time in approximately 25 offerings, according to the AWC. Eight were more than 30 days late.
This may sound less cinematic than suspicious trading patterns or disappearing message trails. It still matters. Timely filings allow FINRA to review underwriting terms while an offering is current, rather than after the relevant deadlines have drifted by.
What FINRA Required
Prime Number consented to a censure, a $335,000 fine and an undertaking to hire an independent consultant. The consultant’s mandated review covers compliance with the cited AML requirements and the public-offering filing rule.
The firm must retain, at its own expense, an independent consultant not unacceptable to FINRA.
The consultant must deliver an initial report evaluating the relevant AML and offering-filing controls and recommending procedural or systemic changes.
Prime Number must implement the recommendations or propose alternatives intended to achieve the same objectives.
The consultant must determine whether the alternative would achieve the objective of the original recommendation. If the firm and consultant cannot agree, the firm must follow the consultant’s ultimate determination.
An officer must certify and document implementation within 30 days after the later of the initial report or any report addressing proposed alternatives.
The firm must give the consultant access to relevant files, records and personnel. It cannot restrict communications with FINRA, invoke attorney-client privilege to block transmission of the consultant’s work or terminate the consultant without FINRA’s written approval. The agreement also imposes independence restrictions before, during and after the engagement.
The settlement’s consultant mandate expressly focuses on the AML and offering-filing rules. The AWC separately records that the firm adopted new procedures for the messaging platforms in January 2025.
What the Resolution Establishes—and What It Does Not
Prime Number accepted FINRA’s findings without admitting or denying them. It waived the procedural rights that would have applied if FINRA had issued a complaint, including a disciplinary hearing and subsequent appeals.
The accepted AWC establishes a FINRA disciplinary resolution and a permanent regulatory record. It does not represent a verdict after witnesses were examined and competing evidence was tested at a hearing. It also does not establish that the customer patterns described in the document were part of a proven manipulation, money-laundering or pump-and-dump scheme.
What it does establish for FINRA’s purposes is narrower and substantial: the firm’s AML design, independent testing, communications supervision, record preservation and offering-filing practices violated the rules identified in the agreement.
What a Legitimate Fix Looks Like
Editorial analysisThe following recommendations are editorial analysis grounded in the control failures documented by FINRA. They are not additional requirements quoted from the AWC and should not be read as guarantees that similar failures could never recur.
Regulatory Track
- FINRA should evaluate evidence that the new controls operate on real account and trading data, not rely only on revised policy language.
- Follow-up reviews should test whether shared identifiers, common funding sources, similar IP data and concentrated trading generate documented investigations.
- Where an outside reviewer receives incomplete information, the limitation should appear clearly in the report rather than disappearing into the audit process.
Corporate Governance Track
- Prime Number Capital’s management should connect customer onboarding, financial profiles, referral sources, trading data and external bank information so that related signals can be reviewed together.
- Escalation rules should specify who investigates a warning sign, what evidence must be gathered, when the matter reaches the AML officer and how the decision is documented.
- Business communications should enter a searchable firm archive regardless of which approved device or platform employees use. Supervisors should not be exempt from the controls they enforce.
Independent Testing Track
- Testing should sample the activities that produce the firm’s revenue, including issuer-referred IPO accounts and post-IPO trading—not just wire transfers.
- Customer descriptions used in testing should be checked against original account records rather than accepted as broad labels such as “high net worth.”
- A reviewer who cannot obtain necessary risk profiles or exception reports should issue a documented limitation and require remediation before giving the relevant control a clean assessment.
What to Watch
- FINRA’s oversight: whether the independent consultant is retained on schedule and whether FINRA requests further evidence of compliance.
- The independent consultant: the conclusions and recommendations in the initial report, including any proposed systemic changes to AML monitoring and Rule 5110 filing controls.
- Prime Number Capital: whether it implements the recommendations or proposes alternatives, and how an officer documents the completed work.
- Communications supervision: whether the procedures adopted in January 2025 produce a complete, reviewable archive of business messages in practice.
- Future examinations: whether customer relationships, financial inconsistencies and potentially coordinated trading now generate timely, documented review.
The unresolved issue is operational, not rhetorical. The firm now has a settlement, deadlines and a consultant requirement. The public record does not yet show whether the resulting controls will connect customer data, trading activity and supervisory evidence quickly enough to catch the patterns the old system missed.
The source document for this investigation is attached below.
Related posts:
A $50,000 Fine for a $25 Million Lie
Wells Fargo Municipal Securities Violations Ran for Seven Years
Liquidnet (Wall Street Firm) published 74 fraudulent reports and only paid a $50,000 fine
The Firm That Forgot to Supervise: How World Investments Approved 150 Annuities Without Checking the Fine Print
