Protecting Your Portfolio: Account Protection Opportunities for Investors
Key Takeaways:
- Most retail account transfers move through ACATS, a standardized system that moves assets between firms quickly. The investor starts the transfer at the new firm, the current firm checks the request for discrepancies and approves or rejects it, and approved assets move in kind within a few days.
- Investors can take simple steps to reduce the risk of unauthorized transfers. These include account locks, enabling multi-factor authentication and real-time alerts, responding promptly to transfer notifications, reviewing statements regularly, and keeping contact information current.
- Regulators have added protections for senior, vulnerable, and fraud-targeted investors. These include trusted contact persons (FINRA Rule 4512), temporary holds for specified adults (Rule 2165), and a proposed five-business-day “speed bump” for any suspected fraud victim (Rule 2166), which SIFMA supports.
Moving a brokerage account from one firm to another is one of the most routine — and most sensitive — transactions in the securities industry. Whether an investor is switching advisors, consolidating accounts, or simply looking for a better fit, the transfer process moves real assets across firms, systems, and custodians. Understanding how that process works, and what protections exist along the way, can help investors move with confidence.
How Account Transfers Work
Most retail account transfers in the U.S. move through the Automated Customer Account Transfer Service (ACATS), a system operated by the National Securities Clearing Corporation that standardizes the movement of assets between member firms. At a high level:
- The investor initiates the transfer at the receiving firm (the firm which the customer intends to switch to) by submitting a Transfer Initiation Form (TIF), typically referencing a recent account statement from the delivering firm.
- The receiving firm submits the request through ACATS, with the receiving firm electronically entering specified data from the TIF, including the customer’s name, social security number, and account number. If the submitted form contains the required information, then the ACATS system electronically informs the delivering firm of the transfer instruction.
- The delivering firm reviews and either approves or rejects the transfer within a set number of business days, reviewing the ACATS record for any discrepancies such as: invalid account number, account title mismatch, SSN/TIN mismatch, or account restrictions. If all account details match and the assets are in a good deliverable form, the delivering firm validates (accepts) the instruction and uploads an itemized list of the account’s assets for the receiving firm to review.
If there is a mismatch (such as a typo in the account number) or an ineligible/proprietary asset, the delivering firm takes exception and rejects the transfer with a specific reason code, requiring the receiving firm or client to resolve and resubmit the transfer.
- Assets are transferred in kind — After the delivering firm validates and the receiving firm approves the asset list, the securities, cash, and other eligible holdings move to the new firm within a few days without any additional action from the investor.
ACATS is designed to drive efficiency and standardization, but the speed of the process is precisely why account security matters so much during a transfer. A transfer request is, in effect, an instruction to move an investor’s assets from one institution to another, which makes it a natural target for bad actors attempting to impersonate an account holder.
Proactive Steps Investors Can Take
There are concrete steps investors can take which meaningfully reduce the risk of an unauthorized or fraudulent transfer:
- Account locks. Many firms allow investors to place a lock or restriction on their account that prevents transfers, disbursements, or certain transactions until the lock is manually lifted — typically requiring a phone call or in-person verification. This is one of the simplest, highest-leverage tools available, especially for accounts that see infrequent activity.
- Customer notification upon a transfer request. Many firms proactively contact a customer, sometimes via email, if they receive a request to transfer assets to a new firm. FINRA regulation requires that the request be accepted or denied within one business day, so if you receive a communication from your current firm, make sure to be timely in your response to the verified notification.
- Enhanced authentication. Make sure two-factor or multi-factor authentication is enabled, using unique credentials rather than reused passwords, and setting up real-time alerts for login attempts, address changes, or transfer requests all shrink the window in which a bad actor can act undetected.
- Monitoring statements. Because ACATS transfers generate notifications at both the delivering and receiving firm, regularly reviewing your account and statements promptly is often how unauthorized activity gets caught early.
- Keeping contact information current. Outdated phone numbers or email addresses on file can delay the verification methods firms rely on to confirm a transfer is legitimate.
Firm-Placed Protections for Senior and Vulnerable Investors
Firms have several tools to assist. Regulators have built additional layers of protection specifically for senior and vulnerable customers, recognizing that financial exploitation disproportionately affects this population.
The Trusted Contact Person (FINRA Rule 4512). Since 2018, FINRA has required member firms to make reasonable efforts to obtain the name and contact information of a “trusted contact person” for every non-institutional customer account. This person isn’t authorized to make trades or withdrawals, but the firm can reach out to them if there are concerns about the customer’s whereabouts, health, or the possibility of financial exploitation. It’s a low-friction safeguard that costs the investor nothing to set up and can be invaluable if something looks wrong.
Temporary holds under FINRA Rule 2165. Rule 2165 allows a firm to place a temporary hold on a disbursement or securities transaction in the account of a “Specified Adult” — generally someone 65 or older, or an adult the firm reasonably believes has a mental or physical impairment limiting their ability to protect their own interests — when the firm reasonably believes financial exploitation has occurred, is occurring, or has been attempted. When a hold is placed, the firm is generally required to notify the trusted contact person, unless that person is unavailable or is suspected of being involved in the exploitation. The rule also requires the firm to promptly begin an internal review of the situation.
Temporary holds under FINRA Rule 2166. (Pending)
FINRA recently proposed Rule 2166 which would create a “speed bump” for investors suspected of being a victim of fraud. Under this proposed rule, customers who are suspected of being the target of fraud, irrespective of age or capacity, would be permitted a temporary delay of up to five business days on disbursements or transactions. This separate safe harbor framework, modeled on existing Rule 2165, serves as a “speed bump” to alert a customer of suspected fraud. SIFMA was pleased to offer our support on behalf of members of this new rule as it is an additional method/tool for firms to protect their customers. 1
Looking Ahead
Protecting investors is central to SIFMA’s mission: investor protection is the foundation of market integrity. Whether saving for retirement, purchasing a home, or transferring an account to a new firm, investors deserve transparent markets and strong safeguards against financial fraud and abuse. Understanding how the transfer process works and what protections are available is the strongest line of defense. SIFMA continues to work with its members, regulators, and industry partners to strengthen these protections and help investors participate in the capital markets with confidence.
The authors would like to thank Betsy Gilligan, Assistant Vice President, Financial Services Operations & Assistant General Counsel at SIFMA, for her contributions to this piece.
