FINRA Rule 2166: A Fraud "Speed Bump" for Every Customer
Anyone who has worked a fraud escalation knows the moment. A customer calls to wire a large sum to a "new investment platform," and every red flag is flashing. However, outside of Rule 2165, firms have had no FINRA safe harbor to slow that transfer down. FINRA Rule 2166 is built to close that gap; in my view, it is one of the most practical fraud prevention tools FINRA has proposed in years.
What Is FINRA Rule 2166?
In August 2026, FINRA filed Rule 2166 with the SEC. It is part of a larger package, File No. SR-FINRA-2026-018. The new rule creates a separate safe harbor, modeled on Rule 2165. In short, it lets a firm place a fraud hold of up to 10 business days on a disbursement or transaction. The trigger is a reasonable belief of fraud; age and capacity do not matter.
Under the rule, a "customer" is any natural person age 18 or older. So, a 35-year-old hit by an imposter scam gets the same protection as a 75-year-old.
How Broad Is "Fraud"?
The definition is deliberately wide. Specifically, fraud means a deceptive scheme run by a third party. That scheme targets the customer and leads to a request based on false or misleading information. As a result, it reaches identity theft, account takeover attempts, romance scams, and "pig butchering" schemes. It also covers "funds, securities, or other assets," which includes payment stablecoins.
Why a Speed Bump Works
Scammers depend on urgency and isolation. For that reason, FINRA ties the rule to the FBI's "Take A Beat" campaign. That campaign urges people to pause before acting under pressure. Likewise, research shows strong emotion makes people easier to defraud. Ten business days is often enough to break that spell.
Rule 2166 vs. Rule 2165: Key Differences
FINRA kept the two rules separate on purpose. Rule 2165 protects "Specified Adults": people 65 and older, or adults with an impairment. Its longer holds give firms time to refer cases to Adult Protective Services. By contrast, similar agencies do not always exist for younger fraud victims. Therefore, Rule 2166 is the lighter touch. Meanwhile, the same filing would stretch the maximum Rule 2165 hold from 55 to 145 business days.
| Feature | Rule 2165 | Proposed Rule 2166 |
|---|---|---|
| Who is covered | Age 65+, or adults with an impairment | Any customer age 18+ |
| Trigger | Reasonable belief of financial exploitation | Reasonable belief of third-party fraud |
| Maximum hold | 55 days today; 145 proposed | 10 business days |
| Who gets notice | Authorized parties and trusted contact | Customer only; others optional |
| Mandatory? | No, a permissive safe harbor | No, a permissive safe harbor |
What Changed Since Regulatory Notice 26-02
FINRA listened to industry comments. First, the January 2026 Notice proposed a five-day delay. Commenters said that was too short, so FINRA doubled it to 10 days. However, FINRA refused to go further; a longer delay could become a freeze and undercut customer autonomy.
Second, notice rules were simplified. The Notice would have required notice to authorized parties and trusted contacts. Now, only the customer must be notified. Firms may still contact others at their discretion.
How the 10-Day Fraud Hold Works
Rule 2166 is optional. Even so, relying on the safe harbor comes with firm conditions. Here is the sequence, step by step.
Notice Within Two Business Days
The firm must tell the customer about the delay, the reason, and how to reach the firm. Notice may be oral. Also, a voicemail or an email to the address on file counts. Mail, however, may be too slow for a 10-day window.
Supervision, Training, and Records
The rule carries supervision and training duties, consistent with Rule 2165. In addition, firms must keep records of the request, the basis for their belief, and who approved the delay. They must also log notices, customer education, and any regulator contact.
Account-Level Restrictions
A firm may restrict a whole account; however, it must still let legitimate activity through, such as regular bill payments. If it blocks transactions with no reasonable belief of fraud, it loses the safe harbor.
My Take: Why the Safe Harbor Matters
The strongest feature of Rule 2166 is regulatory cover. When a firm follows the rule, it gains a safe harbor from FINRA Rules 2010, 2150, and 11870. That last one matters most for fraudulent ACATS transfers. Moreover, the rule does not limit firms that already use contractual hold language in account agreements.
The catch: a safe harbor only protects you if you can prove you were inside it. The "reasonable belief" standard is flexible by design. Consequently, the burden of proof lives in your procedures, your escalation notes, and your training records.
Firms that treat Rule 2166 as a policy memo, rather than a workflow, will struggle to defend a delayed wire when a customer complains.
Compliance Checklist: What Firms Should Do Now
Comment deadline. Comments on SR-FINRA-2026-018 are due to the SEC by September 30, 2026. Have a view on the 10-day cap or notice rules? Weigh in now at sec.gov.
Beyond commenting, start preparing now. Don't wait for an effective date. Use this broker-dealer compliance checklist to get ahead:
- Update your WSPs. Name who can place, extend, and lift a Rule 2166 delay, and how that differs from your Rule 2165 process.
- Build a two-day notice workflow. Default to phone and email, not mail.
- Create a documentation template. Capture the basis for reasonable belief at the moment of decision.
- Train front-line and operations staff. Teach common fraud types, so escalations happen early enough to matter.
- Revisit trusted contact collection. The proposal also lets firms use the term "emergency contact," which may lift adoption.
Need a hand? Our compliance consulting services cover WSP updates, escalation design, and staff training.
Frequently Asked Questions
Is FINRA Rule 2166 in effect?
No. It is a proposal pending SEC review. If approved, FINRA will announce the effective date in a Regulatory Notice.
Are firms required to place a Rule 2166 hold?
No. Like Rule 2165, it is a permissive safe harbor. Firms may choose other responses, such as customer education or enhanced monitoring.
Can a firm lift the delay before 10 days?
Yes. In fact, FINRA expects firms to lift the delay once they no longer reasonably believe fraud is involved.
Can a senior customer be protected under either rule?
Yes. A customer who is a Specified Adult may be protected under Rule 2165 or Rule 2166, depending on the facts.
The Bottom Line
Fraud is not slowing down. Rule 2166 will not stop every scam; still, ten business days and a well-timed phone call can mean the difference between a saved account and an unrecoverable loss. For more updates like this, visit the MCG RegRadar blog.
Ready to Build Your Rule 2166 Workflow?
MCG Consulting helps broker-dealers turn new FINRA rules into defensible, auditable practice, from WSPs to escalation playbooks to staff training. Learn about our team.
Talk to Our Compliance Team
