Senators Warren & Wyden Target Morgan Stanley, Citi, and Schwab in FINRA Letter Demanding ACATS Transfer Locks
If FINRA acts on this legislative pressure, wirehouse advisors could face new friction in client onboarding and asset transfers — and Morgan Stanley's silence on the matter suggests the firm has no easy answer ready.
Senators Elizabeth Warren (D-MA) and Ron Wyden (D-OR) sent a letter to FINRA CEO Robert Cook on August 20, 2026, naming Morgan Stanley, Citigroup, and Charles Schwab as firms that lack standardized, customer-controlled tools to lock outbound ACATS transfers — a gap the senators argue is actively enabling fraud.
This isn't a broad, vague congressional inquiry. The senators reviewed transfer-lock policies across major brokerages and found specific, operational shortcomings: no automated outbound verification, no self-service freeze mechanisms, and no phishing-resistant authentication tied to transfer activity. For wirehouses that have built recruiting velocity around frictionless ACATS movement, that critique lands like a compliance grenade.
Why Morgan Stanley Became the Named Target
Morgan Stanley drew explicit mention in the senators' letter and supporting materials, and its response was telling: a spokesperson declined to commit to any practice changes. In the current regulatory environment, that non-answer reads as a liability, not a strategy. The firm's ACATS infrastructure has long been a competitive weapon in recruiting, but speed and security are now in direct tension.
The senators' core argument is that criminals are opening fraudulent brokerage accounts and then using ACATS — the system designed to move legitimate assets between firms — to drain real client accounts. Without a customer-initiated lock feature, there is no quick brake a client can pull when they suspect something is wrong.
Who Is Already Moving and Who Is Frozen
The divide between wirehouse and platform firms on this issue is striking. Interactive Brokers, Robinhood, and Webull all told lawmakers they would build self-service transfer lock features in direct response to the senators' inquiry. Meanwhile, the three named wirehouses — Morgan Stanley, Citi, and Schwab — offered no equivalent commitments.
- Morgan Stanley: No standardized consumer-controlled transfer lock; spokesperson made no commitment to change
- Citigroup: Identified as lacking customer-facing tools to restrict outbound ACATS transfers
- Charles Schwab: Scrutinized for not universally offering client-controlled locks despite robust ACATS functionality
- Interactive Brokers: Committed to developing self-service transfer locks
- Robinhood: Plans to implement customer-initiated lock tools
- Webull: Indicated it will create transfer lock features for clients
Bank of America's Merrill platform added a wrinkle worth noting: lock controls don't apply uniformly across advisor-led accounts versus self-directed platforms. That channel distinction matters enormously for wirehouse advisors whose books live in advisor-led structures — and it signals that any FINRA rulemaking here will require precise, channel-specific definitions.
The ACATS Fraud Vector Regulators Can't Ignore
This push didn't emerge from nowhere. Between 2020 and 2023, a string of high-profile unauthorized ACATS transfer cases generated enforcement actions across the industry. As reported by AdvisorHub, the senators' letter frames this as a systemic gap, not isolated incidents. FINRA already addressed transfer-related disclosures through Rule 2273 in 2016, which required standardized educational communications when brokers move firms — but that rule was designed to protect clients from conflicted advice, not from outright fraud.
The new ask is operationally heavier: mandatory transfer notifications, customer-initiated account locks, and phishing-resistant authentication. Any one of those three would require meaningful back-end build for firms that haven't prioritized them. All three together represent a significant infrastructure overhaul.
What This Means for Advisors on the Ground
For wirehouse advisors, the immediate concern is recruiting. The ACATS-driven wirehouse recruiting process has operated on the assumption that transfers are fast, client-friendly, and mostly frictionless. A mandatory lock regime introduces a new step — client opt-in or opt-out of transfer restrictions — that could slow movement and create friction at exactly the moment a recruited advisor needs client momentum.
Longer term, if FINRA acts, compliance teams will build the workflows and advisors will adapt. But firms that voluntarily move first — building client-facing lock tools before any mandate — could reframe security as a differentiator rather than a drag. Right now, Morgan Stanley's silence suggests that reframe isn't coming from its executive floor anytime soon.
The senators have the attention of the smaller platforms. Whether they have FINRA's — and whether FINRA has the appetite to take on the wirehouses on this — is the question that will define whether this letter becomes a rule or a press release.