FINRA Introduces Identity Verification Requirement Through ID.me for Entitlement Platform Access

The Financial Industry Regulatory Authority (FINRA) will introduce a new identity verification requirement through ID.me beginning May 11, 2026. This enhancement will apply to certain users accessing systems through the FINRA Entitlement Platform.

Why FINRA Is Implementing Identity Verification

FINRA continues to expand its security framework to protect highly sensitive regulatory data and reduce cybersecurity risks.

Identity verification is being introduced to:

• Protect sensitive information from unauthorized access
• Strengthen system security across FINRA platforms
• Address increasing cyber threats, including AI-related fraud
• Improve trust in regulatory systems and data access controls

FINRA selected ID.me as its verification provider. The identity verification platform already supports more than 20 federal agencies, including the Internal Revenue Service and the Social Security Administration, and provides 24/7 customer support for users.

For firms navigating new regulatory requirements and cybersecurity expectations, these updates may also intersect with broader FINRA compliance programs.

Which Accounts Will Require Identity Verification?

The first phase of the rollout will apply to specific FINRA Entitlement Platform users who have access to sensitive regulatory information.

Accounts that will require identity verification include:

• Super Account Administrators (SAAs)
• Account Administrators (AAs)
• Users with privileges to access sensitive data such as:
  • Social Security numbers
  • Fingerprint results
  • Reports and queues containing sensitive personal data

These users are referred to by FINRA as “in-scope users.”

Accounts that do not meet these criteria will not require identity verification. Excluded accounts include:

• Machine accounts
• FINPRO accounts
• Accounts without access to sensitive data entitlements

Each organization’s SAA received a report identifying which accounts fall within the scope of the new requirement.

When the Identity Verification Rollout Will Occur

The new verification requirement will begin May 11, 2026, with implementation occurring gradually.

FINRA will introduce the process in weekly rollout waves through September 14, 2026.

Because the rollout occurs in stages, users within the same organization may receive identity verification prompts on different dates.

This staggered approach is designed to reduce disruption while allowing organizations time to prepare.

How Users Will Verify Their Identity

When an in-scope user logs in to the FINRA Entitlement Platform, they will receive an on-screen prompt directing them to complete identity verification through ID.me.

The process will involve:

1. Logging into the FINRA Entitlement Platform
2. Following a screen prompt to the ID.me verification page
3. Completing identity verification through the ID.me system

Users must successfully complete the verification process before accessing FINRA systems.

How Account Administrators Should Prepare

AAs should work closely with their SAAs to review which accounts within their organization will be subject to identity verification.

Preparation Recommendations:

Review and Remove Unnecessary Entitlements

Organizations should evaluate whether users still require access to entitlements that trigger identity verification.

If a user no longer needs certain permissions, removing those entitlements may eliminate the verification requirement.

Confirm Service Provider Accounts

If external service providers maintain FINRA Entitlement accounts on behalf of your organization, those accounts should:

• Be assigned to specific individuals
• Contain accurate first and last names
• Avoid generic or shared account credentials

Notify Affected Users in Advance

Firms should communicate the upcoming requirement to users who will fall within scope so they understand what to expect when logging into FINRA systems.

FINRA’s Communication Timeline

FINRA will communicate directly with in-scope users leading up to the rollout.

The communication schedule will go as follows:

March

• Initial notification to users about the new identity verification requirement

April

• Reminder emails regarding the upcoming launch

May

• Final notification prior to the start of the rollout

May – September

• Individual users will receive an email one week before their account activation date notifying them of the requirement

These notifications are designed to ensure users have ample time to prepare for the new process.

Why Firms Should Take Action Now

Although the rollout begins in May, firms should begin preparing early to avoid disruptions in system access.

Preparation may include:

• Reviewing entitlement access permissions
• Identifying users who will require verification
• Communicating expectations internally
• Confirming account ownership and accuracy of user information

Contact Us

Contact Quadrant Regulatory Group if you have questions about how FINRA’s identity verification requirement may impact your firm’s access controls or compliance procedures.