Merrill Fined $225K After Banking Lexicon Buried 1,600+ Brokerage Complaints for Six Years
If your firm's compliance tech was built for one business line and repurposed for another without rigorous testing, you are carrying regulatory risk that won't surface until FINRA does the digging for you.
Merrill Lynch ran a complaint surveillance system for six straight years that was calibrated for banking — not brokerage — and in that gap, more than 1,600 customer complaints vanished into the void, never reaching FINRA's quarterly reports as required by Rule 4530(d).
FINRA announced the $225,000 fine and censure this week, closing out a case that spans January 2018 through December 2023. The unintentional nature of the conduct didn't spare Merrill from the enforcement action, and the mechanics of how it happened should get every wirehouse compliance officer's attention immediately.
The Lexicon That Couldn't Speak Brokerage
Merrill invited customers who called its service centers to complete post-call surveys with a free-text comment section. An automated surveillance system scanned those responses using a keyword lexicon designed to flag potential complaints. The problem: that lexicon was built around banking terminology, not brokerage.
Brokerage customers writing about investment accounts, trade execution, or advisor conduct used language the system simply didn't recognize as complaint-worthy. Thousands of survey responses that met FINRA's own definition of a customer complaint were never captured, never escalated, and never reviewed.
Merrill never adequately tested or calibrated the system for the brokerage context. The surveillance gap ran on autopilot for six years before regulators caught what internal governance had missed.
What the Rules Actually Require
FINRA Rule 4530(d) requires member firms to compile and report statistical and summary complaint data on a quarterly basis. This isn't a gray area — it's a standing obligation with explicit reporting deadlines.
FINRA also found Merrill in violation of Rules 3110(a) and 3110(b), which require firms to establish and maintain supervisory systems and written supervisory procedures reasonably designed to achieve compliance. And because the conduct fell below industry standards, Rule 2010 — the catch-all requiring just and equitable principles of trade — was triggered as well.
Three rule violations from one misconfigured lexicon. That's the compounding effect of a technology governance failure left unaddressed.
Merrill's Enforcement Track Record Is Getting Harder to Ignore
This $225,000 fine doesn't exist in isolation. Merrill has accumulated a notable string of FINRA settlements in recent years:
- August 2024: $3 million FINRA settlement tied to supervisory and communications-related failures across broader brokerage operations
- May 2023: $1.4 million FINRA settlement resolving Telephone Consumer Protection Act violations and cold-calling compliance failures
- This action: $225,000 fine plus censure for six years of complaint under-reporting across the call center
Each case involves a different operational failure, but the thread running through all three is the same: supervisory systems and procedures that weren't built to catch what they were supposed to catch.
The Broader Risk Every Wirehouse Compliance Team Should Clock
The real story here isn't the $225,000 — that's a rounding error for a firm Merrill's size. The story is how a technology tool got repurposed from one business line to another without the governance infrastructure to ensure it actually worked.
This happens more than anyone in compliance wants to admit. A system gets built for the bank, the bank and brokerage share infrastructure, and the brokerage side inherits a tool that was never stress-tested against brokerage-specific language, workflows, or customer behavior. Nobody breaks it. Nobody tests it against real complaint samples. Years pass.
Regulators have made clear they are scrutinizing exactly this failure mode — automated surveillance tools that are misconfigured, siloed, or simply not fit for purpose in the specific business context where they're deployed. The post-call survey channel, which handles enormous volumes of customer interactions at large firms, is precisely the kind of high-throughput environment where a lexicon gap multiplies fast.
What Advisors and Branch Leaders Should Watch
This enforcement action is a compliance department problem, but the downstream risk touches advisors directly. When client complaints don't get captured and reported, firms lose the supervisory data they need to identify patterns — patterns that could indicate a legitimate client service problem, a rogue process, or an advisor who needs additional oversight.
If your clients call a service center and complain about something related to your book of business, you want that complaint logged, reviewed, and resolved. An invisible complaint is not a resolved complaint.
Merrill has accepted the settlement and the censure. The lexicon, presumably, is getting an overhaul. But the six-year window of uncaptured data is gone.