# FINRA fines Brex Treasury over an untested machine-learning account-risk model in its AML onboarding Source: https://www.bankingnewsai.com/ai-incidents/brex-2024-finra-ml-account-risk-model Last updated: Oct 21, 2026 Brex Treasury LLC · Governance finding · severity 3 of 5 Per FINRA's August 2024 letter of acceptance, waiver and consent, Brex Treasury relied in 2020 and 2021 on an identity-verification algorithm that, from early 2021, used a machine-learning account risk model to let some applications bypass manual review of fraud checks. FINRA found the model had been built mainly on data from venture-backed and middle-market customers and applied to higher-risk small businesses without reasonable design, testing or validation procedures, so it "was not generalizable to that wider population". Brex Treasury approved hundreds of potentially fraudulent accounts that attempted over $15 million of transactions with deposits that failed to settle. It was censured and fined $900,000 without admitting or denying the findings. FINRA noted machine-learning models "can be considered an artificial intelligence technology". ## Key facts | | | | --- | --- | | Date | Aug 30, 2024 | | Institution | Brex Treasury LLC | | Country | United States | | AI system | Account risk model (ARM score) · Machine-learning account risk model inside an automated identity-verification algorithm | | AI? | Machine-learning system (inferred from the record) — The sources describe a machine-learning model; nobody on the record labelled it AI. | | Category | Regulatory finding (Governance finding) | | Status | Settled | | Severity | 3 of 5 — A regulatory finding: a FINRA censure and $900,000 fine after hundreds of potentially fraudulent accounts attempted over $15 million of transactions with deposits that failed to settle; innocent third parties were reimbursed when the deposits were reversed. | ## What happened? Brex Treasury, a FINRA member since 2019 that offers cash management accounts to corporate customers, relied from 2020 through 2021 on "a software algorithm as its primary procedure", with manual review in some instances, to verify new legal entity customers and their beneficial owners. The algorithm matched applicant data to identity vendors, ran risk-based fraud checks and could approve, reject, request more information or escalate an application. "Beginning in early 2021, the algorithm incorporated a machine learning model to assign a score to each customer that helped determine how to evaluate the results of certain fraud checks." [1] FINRA found that by early 2021 Brex Treasury "was allowing applications to bypass manual reviews of certain fraud check results based on the results of a machine learning account risk model" that produced an "ARM score". The firm had developed the model mainly from its historical base of venture-backed and middle-market companies and applied it to a wider market that included small businesses, which were relatively higher-risk. Because the firm "did not have reasonable policies and procedures governing the design, testing, and validation of the account risk model or the identity-verification algorithm in general, the technology was not generalizable to that wider population." [1] The rules around the model were also weak, according to the AWC: the firm initially collected only beneficial owners' names and phone numbers, set "unreasonably high thresholds" before a vendor's fraud score triggered more review and ignored some probative reason codes. In one example it automatically approved an account whose beneficial owner had a vendor fraud score of .992 and a photo ID flagged as potentially manipulated. Its manual screening lacked standards too; one reviewer approved an application with "benefit of the doubt". [1] As a result, FINRA found, Brex Treasury approved hundreds of potentially fraudulent accounts that attempted over $15 million of transactions using ACH or check deposits that were later recalled, rejected or refused; in most cases the firm could not recover the funds or confirm the customers' identities. FINRA also found its AML procedures were not reasonably designed to cause suspicious activity reports to be filed for most of these new-account fraud incidents. [1][2] ## Timeline - Jan 2021 — Brex Treasury starts collecting full identifying information for beneficial owners directly from customers; from early 2021 a machine-learning account risk model lets some applications bypass manual review of fraud checks. [1] - Aug 30, 2024 — FINRA accepts the AWC, which originated from its 2021 cycle exam: Brex Treasury is censured and fined $900,000. [1][2] - Oct 2024 — FINRA publishes the action in its monthly Disciplinary and Other FINRA Actions report. [2] ## What was the impact? - Financial: Over $15 million of attempted transactions using deposits that failed to settle; $900,000 fine - Customers: Hundreds of potentially fraudulent small business and other corporate accounts approved - Other: By reversing the deposits, Brex Treasury reimbursed innocent third parties whose funds may have been transferred without authorisation, per the AWC; FINRA did not state Brex Treasury's own net loss. [1] ## How did Brex Treasury LLC respond? No public statement found as of 2026-10-21 (searched Brex's newsroom and press coverage of the fine; no corrective action statement is attached to the AWC). According to the AWC, Brex Treasury began updating its policies, procedures and systems, hiring experienced staff including at senior levels, and engaging a third-party consultant to review its AML program. It consented to the findings without admitting or denying them. [1] ## What was the outcome? FINRA censured Brex Treasury and fined it $900,000 for violating FINRA Rules 3310(a), 3310(b), 3310(f)(ii) and 2010. FINRA agreed not to bring further actions on the same factual findings. [1][2] ## FAQ ### Why did FINRA fine Brex Treasury? FINRA found in August 2024 that Brex Treasury's AML program did not reasonably verify the identities of new corporate customers and their owners in 2020 and 2021, partly because an automated algorithm and a machine-learning risk model let some applications skip manual review. It was censured and fined $900,000. ### What was wrong with Brex's machine-learning model? According to FINRA, the account risk model was trained mainly on Brex's historical venture-backed and middle-market customers, then used for a wider and riskier small-business population. Brex had no reasonable procedures for designing, testing or validating it, so the model was not generalizable to the new customers. ### Was the Brex system AI? FINRA described a machine learning model and, in a footnote, said such models "can be considered an artificial intelligence technology", but it did not label Brex's own system AI. This record therefore classes it as a machine-learning system inferred from the regulator's description. ### Was any money lost? FINRA said the potentially fraudulent accounts attempted over $15 million of transactions using deposits that later failed to settle, and that in most cases Brex Treasury could not recover the funds. Innocent third parties were reimbursed when the deposits were reversed; FINRA did not state a net loss figure. ## Sources 1. [Letter of Acceptance, Waiver, and Consent No. 2021071100401 (Brex Treasury LLC)](https://www.finra.org/sites/default/files/fda_documents/2021071100401%20Brex%20Treasury%20LLC%20%20CRD%20299606%20AWC%20lp%20%282024-1727655599455%29.pdf) — FINRA, Aug 30, 2024 (official): "By early 2021, Brex Treasury was allowing applications to bypass manual reviews of certain fraud check results based on the results of a machine learning account risk model that generated an "ARM score" for prospective accounts using various attributes of prospective customers and beneficial owners as inputs." 2. [Disciplinary and Other FINRA Actions, October 2024 (Brex Treasury LLC)](https://www.finra.org/sites/default/files/2024-10/Oct_2024_Disciplinary_Actions.pdf) — FINRA, Oct 1, 2024 (official): "The firm relied on regulatory technology that was not reasonably designed to verify the identities of new customers." ## Related incidents - [FINRA fines SoFi $1.1m after fraudsters beat its largely automated account-opening checks](https://www.bankingnewsai.com/ai-incidents/sofi-2024-finra-automated-identity-verification) - [FINRA: Robinhood's largely automated identity checks approved accounts despite red flags; $26m fine](https://www.bankingnewsai.com/ai-incidents/robinhood-2025-finra-automated-cip-approvals) All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents --- Canonical page: https://www.bankingnewsai.com/ai-incidents/brex-2024-finra-ml-account-risk-model Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.