AML Risk in Done-Away Trades: The Gap Between Two Firms

Updated October 2026.

A done-away trade is a trade executed by a broker-dealer other than the firm that holds the customer's account. The trade settles into that account at the firm that carries it: a custodian bank or broker-dealer through delivery versus payment (DVP), a prime broker, or a wrap program sponsor. The execution itself is ordinary. What's "away" is the account. Our post on step-out trades and trades away compares the terms.

An earlier version of this page defined done-away trades as transactions executed outside conventional trading systems, and it addressed insurance brokers. Both were wrong. This version covers the anti-money laundering (AML) gap that a done-away trade opens between the executing broker and the carrying firm, mostly in DVP accounts. The prime brokerage version, including who may rely on whom for customer identification, is on a separate page: AML obligations in prime brokerage.

Two Firms, Two Halves of the Customer

The executing broker has the order: who placed it, when, how it was worked, and the fill. The carrying firm has the account: the cash that paid for the trade, the securities that were delivered, how they got there, and everything else the customer did with them. Each firm runs its own AML program, and each one's suspicious activity reporting (SAR) duty covers transactions "conducted or attempted by, at, or through" it (31 CFR 1023.320 for broker-dealers).

A pattern that needs both halves can pass both firms. Shares can be deposited at the custodian, which then sees only a delivery out against payment, and sold through the executing broker, which never sees where they came from.

A Case: Aegis Capital, 2018

That pattern is what the SEC described in its March 28, 2018 order against Aegis Capital Corporation. In Aegis's DVP/RVP accounts, "the customer deposited their shares at another firm in a custodial account, and the sale transactions were effected through Aegis." Several of those customers were foreign financial institutions trading for underlying customers "who were unknown to Aegis."

• The trade review system Aegis used didn't analyze DVP/RVP transactions. An upgraded version could, but Aegis didn't turn that on for DVP/RVP accounts until April 2015, so those trades were flagged green and batch approved.
• One customer, a private Swiss bank trading through an omnibus arrangement, sold 8.2 million shares of a low-priced OTC stock from December 2012 to March 2013, for about $2.4 million and more than 8.8% of the issuer's outstanding shares, during a promotional campaign.
• Aegis's clearing firm began sending it AML alerts in January 2013. Aegis didn't file SARs on the transactions they described.

Aegis admitted the facts, and the SEC found it willfully violated Exchange Act Section 17(a) and Rule 17a-8 by failing to file SARs on hundreds of transactions from late 2012 through early 2014. It paid a $750,000 penalty and agreed to retain a compliance expert. The SEC's press release notes a separate $550,000 FINRA penalty and settled orders against the firm's CEO and a former AML compliance officer.

What the Executing Broker Still Owes

A DVP account can look like someone else's customer from the executing broker's side. The rules don't treat it that way.

• Customer identification. For CIP purposes, an account is any formal relationship with a broker-dealer to effect securities transactions (31 CFR 1023.100), so a DVP account counts, and the person who opens it is a customer unless an exclusion applies. Regulated financial institutions, banks, government bodies, and certain listed companies are excluded. A private fund or a foreign broker isn't.
• Foreign institutions. An account a U.S. broker-dealer opens for a foreign financial institution to effect securities transactions is a correspondent account under 31 CFR 1010.605. Section 1010.610 requires a due diligence program for it: a risk assessment based on the institution's business, the account's purpose and expected activity, and its home country's AML regime, then risk-based monitoring with periodic reviews. Enhanced due diligence applies to certain foreign banks, including those with offshore licenses.
• Suspicious activity. The SAR duty "rests with each broker-dealer involved in the transaction." That the money and the shares sit elsewhere doesn't take the executing broker out.

A Letter of Free Funds doesn't fill the gap. For a DVP trade in a cash account delivered to a broker-dealer custodian, the executing broker may rely on that firm's written statement that the account holds enough funds to pay for the trade (our Regulation T guide explains when). The letter answers a Regulation T question. It says nothing about where the funds came from.

Red Flags That Split Across Firms

FINRA's Regulatory Notice 19-18 (May 6, 2019) lists red flags that broker-dealers should monitor for. Several of them, read against a done-away trade, depend on data the other firm holds.

• The notice's deposit red flags (its section II) are visible where the shares are deposited, at the carrying firm. Its trading red flags (section III), such as a customer's activity making up a significant proportion of the daily trading volume in a thinly traded or low-priced security, are visible where the order was executed.
• Mirror trades and offsetting trades can be split across brokers, with each leg looking routine where it was executed.
• The flag for two or more unrelated accounts trading an illiquid or low-priced security suddenly and simultaneously is written for accounts "at the firm." Spread across several executing brokers, the same pattern doesn't show up at any one of them.
• Notifications from a broker-dealer's clearing firm about a customer's activity are red flags in their own right (section VI). In the Aegis case, they were the part of the system that worked.

Closing the Gap

1. Register for section 314(b) sharing. Under 31 CFR 1010.540, financial institutions may share information with each other to identify and report possible money laundering or terrorist activity. Each must file a notice with FinCEN and renew it every year, and must take reasonable steps to verify that the other has filed before sharing. The information can be used only for limited purposes and has to be kept secure. A firm that follows those steps has a safe harbor from liability for the sharing.
2. Use joint SARs where both firms see it. The broker-dealer SAR rule lets one report cover a transaction for every broker-dealer involved, if it contains all the relevant facts, and lets a firm share the underlying facts with another financial institution to prepare a joint SAR.
3. Monitor DVP/RVP accounts with the same scenarios as every other account, and test that they do. A surveillance feed that leaves out DVP trades fails the way Aegis's did, quietly. Our post on what AML monitoring can't see covers how to check the feeds.
4. Log each alert from a clearing firm or a counterparty with the date, what was reviewed, and the decision, including a decision not to file.
5. For each DVP account, record the custodian, whether it's a bank or a broker-dealer, and whether the account holder is a foreign financial institution. Those facts decide whether a Letter of Free Funds applies and whether correspondent account due diligence applies.