The Financial Industry Regulatory Authority (FINRA) has asked the Securities and Exchange Commission (SEC) to let broker-dealers freeze a suspected elder-exploitation disbursement for up to 145 business days under Rule 2165 and to pause any adult customer’s payment for 10 business days under a new Rule 2166. The only member-firm data on hold length behind this expansion is a 2020 survey in which 31 firms said they had ever used a hold.

FINRA filed SR-FINRA-2026-018 on August 20, 2026, and the SEC published it in the Federal Register on September 9, 2026 (Release No. 34-106275, 91 FR 57407), with comments due by September 30, 2026. The filing adds three 30-business-day extensions to the current 55-business-day ceiling in Rule 2165 and creates a separate “speed bump” safe harbor for fraud against customers of any age. This analysis covers the rule text, compares it with UK and Singapore scam-delay powers, and tests FINRA’s evidence for longer holds.

Methodology and sources: reading the filing, not the summaries

This analysis rests on primary documents: the full Federal Register text of SR-FINRA-2026-018, including FINRA’s economic impact assessment and its summary of comments; the SEC’s 2017 approval of Rule 2165 (Release No. 34-79964, 82 FR 10059); and the record for the 2021 amendments, SR-FINRA-2021-016, ending in the January 25, 2022 approval order. The comparisons come from statute: the UK’s SI 2024/1013, Singapore’s Protection from Scams Act 2025 and Section 303 of the US Economic Growth, Regulatory Relief, and Consumer Protection Act. The documents run from February 2017 to September 11, 2026. We could not retrieve FINRA’s rulebook pages directly, so current rule mechanics are taken from text published in the Federal Register.

What Rules 2165 and 2166 would say, and the data behind them

Rule 2165 took effect on February 5, 2018. It lets a member firm hold a disbursement, and since March 17, 2022 a securities transaction, in the account of a “Specified Adult”: someone aged 65 or older, or an adult the firm reasonably believes is impaired and unable to protect their own interests. The hold runs for 15 business days. An internal review can extend it by 10 business days, and a report to a state regulator, agency or court allows a further 30 business days, for a maximum of 55. A state agency can already ask for a longer hold, without a formal order.

Proposed Rule 2165(b)(5) adds three further 30-business-day extensions. Each requires “reasonable follow-up efforts” with the authority, no substantive response and a continuing reasonable belief of exploitation. Before the first of these extensions, the firm must tell authorised parties and trusted contacts about “the potential for the extension to last 90 business days,” unless it reasonably believes one of them is involved in the exploitation. Federal agencies are added to the authorities a firm can report to. The phrase “funds or securities” becomes “funds, securities, or other assets”, so that the rule also covers payment stablecoins held at a broker.

FINRA Rule 2166 is a proposed safe harbor that would let a broker-dealer delay a transaction or disbursement for up to 10 business days when it reasonably believes that fraud “has occurred, is occurring, has been attempted, or will be attempted” against a customer. Unlike Rule 2165, it applies to any natural person aged 18 or older, regardless of age or capacity. Proposed Rule 2166(a)(4) defines fraud as “a deceptive scheme perpetrated by a third party that targets a customer and results in a request for a disbursement of funds, securities, or other assets or a transaction in securities based on false or misleading information,” and FINRA says the definition covers identity theft and account takeovers. The firm must notify the customer within two business days; telling a trusted contact is optional. The delay protects firms from claims under FINRA Rules 2010, 2150 and 11870, but it is permissive, creates no private right of action and must end once the reasonable belief lapses.

The case for longer holds rests on one member-firm dataset: FINRA’s 2020 survey, in which about 53% of respondents that had used a hold could not resolve a matter within 25 business days. The 2021 filing gives the details: the survey went to 3,516 firms, 238 replied, 31 had ever placed a hold and 17 of those had a matter run past 25 days. Some 84% of large-firm respondents had used a hold, against 6% of all others. From these numbers FINRA concludes that “about 28 percent of member firms face instances where a matter took more than 50 days to resolve.”

The 2026 filing gives no count of holds since 2022 and no median hold length. The Cardozo Law Clinic cited a national median of 36 days for adult protective services investigations, rising to 113 days in Washington state, while FINRA itself acknowledges that “the majority of matters are resolved within the current maximum of 55 business days.” The extra 90 days target a minority of cases that FINRA has not measured since 2020 (see our report on rising senior exploitation).

How five regimes set the length of a fraud pause

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Maximum duration	Penalty / liability
US (FINRA Rule 2165, current)	February 5, 2018; amended March 17, 2022	Specified Adults (65+, or impaired adults 18+)	Reasonable belief of exploitation; state report for the 30-day extension	55 business days (15 + 10 + 30)	Safe harbor from FINRA Rules 2010, 2150, 11870
US (FINRA Rules 2165 and 2166, proposed)	Set by Regulatory Notice after SEC approval	Rule 2165: Specified Adults; Rule 2166: all customers 18+	Rule 2165(b)(5): follow-up, no response, documentation; Rule 2166: customer notice in two business days	145 business days (2165); 10 business days (2166)	Same safe harbor; no private right of action
US states (NASAA Model Act)	34 states had hold laws by June 2021	Broker-dealers and investment advisers	Disbursement delay; 20 of the 34 states also allow transaction holds (86 FR 34084)	25 business days, which FINRA describes as aligned with the Model Act	Set by each statute, e.g. Delaware Code tit. 31, §3910
UK (HM Treasury, Payment Services Regulations 2017)	October 30, 2024 (SI 2024/1013)	Sterling payments within the UK, not payee-initiated	Regulation 86(2A): grounds to suspect fraud established by the end of the next business day	End of the fourth business day (regulation 86(2C))	Provider pays the customer’s charges and interest (regulation 94A)
Singapore (Police, Protection from Scams Act 2025)	July 1, 2025	Bank accounts and credit of a scam target	Section 4: officer has reason to believe money will go to a scammer	30 days plus up to five 30-day extensions (section 5)	Bank fine up to S$3,000 (section 6)

Sources: SR-FINRA-2026-018; SR-FINRA-2021-016; SI 2024/1013; Singapore Ministry of Home Affairs. Last updated: September 11, 2026.

The main difference is who decides. The UK pause is short and statutory, and Singapore’s is ordered by the police. Under FINRA’s model the firm decides. By our count, a 145-business-day hold starting October 1, 2026 would run to May 3, 2027, a total of 214 calendar days.

The UK’s payment-delay power is the closest foreign analogue to FINRA Rule 2166. Since October 30, 2024, regulation 86(2B) of the Payment Services Regulations 2017, inserted by SI 2024/1013, has let a payer’s payment provider hold back a sterling payment where, by the end of the next business day, it has “reasonable grounds to suspect” the order follows “fraud or dishonesty perpetrated by a person other than the payer.” The delay must be “no longer than necessary” and cannot run past the end of the fourth business day. The provider must tell the payer why, and under regulation 94A pays any charges and interest the delay causes, even if the payment is eventually made. FINRA’s 10-business-day delay is two and a half times as long, carries no equivalent rule on who bears the cost, and relies on a reasonable-belief standard that FINRA has declined to define further.

Singapore’s Protection from Scams Act 2025 can freeze accounts for a similar length of time, up to 180 days in total, but a police officer makes each decision and there is a statutory right of appeal. US state law sits between the two: FINRA describes the North American Securities Administrators Association (NASAA) Model Act as aligned with Rule 2165’s former 25-business-day maximum, which NASAA defended in 2019 and 2020.

“Financial exploitation investigations are often the most complex and time-consuming and there are many examples of cases being open for more than a year.”

— Jennifer Spoeri, Executive Director, National Adult Protective Services Association, June 12, 2025 letter to FINRA (quoted in SEC Release No. 34-106275)

Enforcement context: firms are already judged on how they respond to fraud

Regulators already penalise firms that fail to act on fraud red flags. On July 27, 2022 the SEC settled three cases under Rule 201 of Regulation S-ID, the Identity Theft Red Flags Rule: In the Matter of J.P. Morgan Securities LLC (Administrative Proceeding File No. 3-20936, $1.2 million penalty), UBS Financial Services Inc. (File No. 3-20937, $925,000) and TradeStation Securities, Inc. (File No. 3-20938, $425,000). The SEC found that from at least January 2017 to October 2019 the firms lacked reasonable policies to identify red flags and “to respond appropriately to detected identity theft red flags.” Each firm was censured.

FINRA’s own case against Robinhood points the same way. On March 7, 2025 it fined Robinhood Financial and Robinhood Securities $26 million and ordered $3.75 million in restitution. Its findings included anti-money-laundering programmes that failed to detect or report account takeovers by third-party hackers (our report on the Robinhood action). Account takeovers are exactly the scenario FINRA says Rule 2166 is meant to cover.

Firms face risk whichever way they go. Releasing funds despite a takeover red flag can bring S-ID or supervisory exposure, while holding them without a documented reasonable belief loses the safe harbor. As FINRA puts it, “a legal risk exists whether or not FINRA adopts the proposed rule.” The records Rule 2166 requires are the documents an examiner will ask to see.

What this means for broker-dealers, custodians and compliance teams

Retail broker-dealers. FINRA’s own assessment says the 10-day delay “may be more useful to member firms with full-service business models than to others,” and that firms already relying on contractual holds “may be indifferent.” Contractual holds, some already longer than 10 business days, remain available.

Clearing firms and custodians. Rule 2166 gives a safe harbor from Rule 11870, the account-transfer rule, but leaves the Automated Customer Account Transfer Service (ACATS) framework unchanged. Apex Clearing Corporation, which told FINRA it has “direct, day-to-day experience with the rising incidence of transfer related fraud and account takeover,” asked for suspected fraud to become a permitted basis for rejecting a transfer instruction. FINRA said that falls outside this proposal but that it is “separately considering” measures on account-opening and transfer fraud (see our coverage of Apex Clearing’s 2025 FINRA case). Firms custodying stablecoins need hold procedures that reach them too.

Compliance and legal teams. Written supervisory procedures must name, by title, who can place, extend or lift a hold. Proposed Rule 2165(c)(2)(B) would add staff in “a specialized senior investor protection or fraud prevention role.” Each extension needs a log of dates, methods and responses. Complaint reporting is still unresolved: SIFMA asked for holds to be exempted from Rule 4530 and Form U4 reporting, and FINRA has said only that it “will consider issuing guidance.” The Senior Safe Act gives firms immunity when they report suspected exploitation to authorities, but it gives them no power to hold funds.

Industry wanted more time. SIFMA’s March 9, 2026 letter, signed by Lisa J. Bleier, asked for 45-day extension intervals and argued that “ACH-related fraud matters may involve recall windows of up to 60 days; thus, it is our position that would be the most appropriate timeframe.” FINRA settled on 10 business days.

“By allowing firms to decline intervention even when credible red flags of exploitation are present, the rule shields members from liability while leaving elderly customers exposed. The permissive nature of the rule undermines its stated purpose of protecting senior investors.”

— Marc Fitapelli, founder, MDF Law PLLC, investor-side securities attorney (comment on Regulatory Notice 26-02, quoted in SR-FINRA-2026-018)

Fitapelli and the Public Investors Advocate Bar Association (PIABA) want holds to be mandatory when red flags appear. According to FINRA’s summary, the Pittsburgh Law Clinic warned of severe and disproportionate hardship for seniors on fixed incomes, and a commenter identified as ASA warned that holds could become de facto long-term freezes. FINRA rejected both camps.

What’s next: the SEC clock and the open questions

Under Section 19(b)(2) of the Securities Exchange Act of 1934, the SEC has until October 24, 2026 to approve, disapprove or institute proceedings. It can extend that period to December 8, 2026, or longer with FINRA’s consent. The last round took longer: the SEC instituted proceedings on the 2021 amendments on September 22, 2021 and approved them on January 25, 2022. If the rule is approved, FINRA will set the effective date in a Regulatory Notice.

Questions remain. FINRA will consider guidance on the “reasonable belief” standard only “if implementation experience reveals” a need, and has not said how a Rule 2166 delay converts into a Rule 2165 hold when a customer turns out to be vulnerable, which SIFMA asked about. The UK has run a four-business-day delay since October 2024 with the provider liable for costs; FINRA asks US investors to accept a longer pause without that protection.

FAQ

What is FINRA Rule 2165?

FINRA Rule 2165, in force since February 5, 2018, lets a member broker-dealer place a temporary hold on a disbursement or securities transaction from the account of a Specified Adult — someone aged 65 or older, or an adult with an impairment — when it reasonably believes financial exploitation has occurred, is occurring or will be attempted. The current maximum is 55 business days, and longer if a regulator or court asks.

How long could a Rule 2165 hold last under the 2026 proposal?

Up to 145 business days, unless a regulator, agency or court ends or extends it. SR-FINRA-2026-018 adds three 30-business-day extensions after the current 55 days. Each requires documented follow-up with the authority to which the matter was reported, no substantive response and a continuing reasonable belief of exploitation. The first extension also requires a notice warning that the hold could last another 90 business days.

Who does proposed Rule 2166 cover?

Any customer who is a natural person aged 18 or older, regardless of age or mental capacity. A firm may delay a transaction or disbursement for up to 10 business days if it reasonably believes a third party is running a deceptive scheme against the customer. It must notify the customer within two business days; notifying trusted contacts or other authorised parties is at the firm’s discretion.

Are broker-dealers required to place holds under these rules?

No. Rule 2165 and proposed Rule 2166 are permissive safe harbors. They protect firms from claims under FINRA Rules 2010, 2150 and 11870 when they act within the rules, but they do not require any hold and create no private right of action. FINRA rejected comments from Marc Fitapelli and PIABA calling for mandatory holds when red flags of exploitation appear.

How does FINRA’s approach compare with the UK?

The UK’s Payment Services Regulations 2017, amended by SI 2024/1013 from October 30, 2024, let payment providers delay suspicious outbound sterling payments to the end of the fourth business day after receipt. Grounds must be established by the end of the next business day, and the provider pays the customer’s resulting charges and interest. FINRA’s Rule 2166 allows 10 business days with no equivalent cost rule.

When could the new FINRA rules take effect?

Not before the SEC acts. The Commission has until October 24, 2026 to approve, disapprove or institute proceedings on the filing. It can extend that deadline to December 8, 2026, or longer with FINRA’s consent. If the SEC approves, FINRA will announce the effective date in a Regulatory Notice. The 2021 amendments took about seven months from Federal Register notice to approval.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.