AML Risk in DVP Purchases Backed by a Letter of Free Funds

Updated October 2026.

A Letter of Free Funds (LOFF) answers one question: does the customer's cash account at the receiving broker hold enough money to pay for this purchase? It doesn't say where the money came from, who owns it, or why the customer is buying. Those are anti-money laundering (AML) questions. On a delivery-versus-payment (DVP) purchase, two firms share them, and each one sees only part of the trade.

What the Letter Does

Regulation T gives a cash-account customer until the end of the payment period to pay. That period is the standard settlement cycle plus two business days, which has meant T+3 since the U.S. moved to T+1 on May 28, 2024. Under 12 CFR 220.8(c)(1), the account is frozen for 90 days if the firm delivers the security to another broker or dealer before the customer pays. The exception in 220.8(c)(2)(ii) covers delivery to another broker or dealer for deposit in a cash account that holds enough funds to pay for the security. The executing broker may rely on that firm's written statement, accepted in good faith. That statement is the LOFF. Our 2026 guide to Regulation T 220.8 and the Letter of Free Funds covers the exchange and the records it leaves.

Who Sees What on a DVP Purchase

The executing broker takes the order and books the purchase in a cash account on its own books. The money sits at the custodian, which in a LOFF exchange is itself a broker-dealer. On settlement date the executing broker delivers the shares, and the custodian pays on receipt. Each side sees a different half of the trade:

The executing broker sees the order, the security, the size, the account name, the settlement instructions, and the custodian's answer to its LOFF request.
The custodian sees the cash: who funded the account, from where, and what leaves it afterward. Before settlement, the LOFF request is often its first sign that the trade exists.

An executing broker that uses a clearing firm has a third firm in the picture, because the firm that clears and settles the trade is the one that sends the letters. Our post on moving to self-clearing covers who sends the LOFF in each arrangement.

Each firm runs its own AML program. FINRA Rule 3310 requires a member's program to include policies that "can be reasonably expected to detect" suspicious transactions and cause them to be reported. It also requires customer due diligence: understanding each customer relationship well enough to build a risk profile, and monitoring the account on an ongoing basis. A LOFF that comes back clean settles the Regulation T question and nothing else.

A DVP Account Is Still the Firm's Account

The SEC made this point in its March 28, 2018 order against Aegis Capital Corp., in which Aegis admitted the facts. The case involved DVP/RVP accounts used to sell low-priced stock: customers deposited shares at other firms and sold them through Aegis. One customer, a private Swiss bank, traded through an omnibus arrangement "on behalf of the Swiss bank's underlying clients who were unknown to Aegis." For the whole period, Aegis's surveillance didn't analyze the DVP/RVP trades in the order. It had an upgrade that could, and didn't switch that feature on until April 2015. Its clearing firm sent AML alerts about the trading anyway.

Aegis didn't file SARs on hundreds of suspicious transactions, and it paid a $750,000 penalty. The order states the rule plainly: "The fact that Customer A's account was a DVP/RVP account did not relieve Aegis of its SAR filing obligations with respect to that account." Those were sales. A DVP purchase runs through the executing broker the same way, and the same obligation applies to it.

Where Regulation T and AML Overlap

"Accepted in good faith" has a definition. Under 12 CFR 220.2, the firm accepting a statement must be "alert to the circumstances surrounding the credit." If it has information that would make a prudent person ask questions before accepting the statement, it "investigates and is satisfied that it is correct." That's a Regulation T duty, separate from the SAR rule. The facts that trigger it often matter to both. A statement that names a different account holder than your records do is a reason to ask before you rely on it. If the answer suggests someone is hiding who owns the account, it's an AML question too.

Red Flags From Notice 19-18 That Fit a DVP Purchase

FINRA published its list of AML red flags in Regulatory Notice 19-18 on May 6, 2019. The notice says a red flag "is not necessarily indicative of suspicious activity," and that a firm that detects one "should consider whether additional investigation, customer due diligence measures or a SAR filing may be warranted." The table quotes the flags from the notice that fit DVP purchases best. The notice doesn't discuss DVP trades, so the middle column is our reading of where each flag shows up.

Red flag (Notice 19-18)	How it can show up on a DVP purchase	Who sees it first
"The customer appears to be acting as an agent for an undisclosed principal, but is reluctant to provide information."	An adviser, bank, or foreign financial institution buys for clients it won't name. The Swiss bank in the Aegis order is an example.	Executing broker
"The customer refuses to identify a legitimate source of funds or information is false, misleading or substantially incorrect."	The LOFF says the money is there. Only the custodian knows how it got there.	Custodian
"The customer makes high-value transactions not commensurate with the customer's known income or financial resources."	A DVP account opened for small trades starts buying in size. The LOFF request may be the custodian's first sign of it.	Both
The customer "engages in pre-arranged or other non-competitive securities trading, including wash or cross trades, with no apparent business purpose."	A DVP purchase matches a sale of the same security, in the same size and at about the same time, by a related account.	Executing broker, if both trades are on its books
"Wire transfers or payments are made to or from unrelated third parties (foreign or domestic), or where the name or account number of the beneficiary or remitter has not been supplied."	Payment should come from the custodian at settlement. When a DVP trade fails and the customer offers to pay by wire from someone else, that payment lands at the executing broker.	Executing broker
"The customer makes a funds deposit followed by an immediate request that the money be wired out or transferred to a third party, or to another firm, without any apparent business purpose."	Money arrives at the custodian just before the LOFF request, or leaves soon after the position is sold.	Custodian

The notice also lists, as a red flag of its own, a notice from the firm's clearing firm that it has found potentially suspicious activity. That's what Aegis received and didn't act on.

What Each Firm Does Next

A red flag starts a review. The SAR rule, 31 CFR 1023.320, decides whether it ends in a filing. A broker-dealer must report a transaction of at least $5,000 conducted or attempted through it when it "knows, suspects, or has reason to suspect" that the transaction involves funds from illegal activity, is designed to evade Bank Secrecy Act requirements, "has no business or apparent lawful purpose," or "involves use of the broker-dealer to facilitate criminal activity." The SAR is due within 30 calendar days of initial detection. If no suspect has been identified, the firm can take up to 60.

Three provisions fit a trade that runs through two firms:

Each broker-dealer involved has its own duty to report. The rule requires only one SAR per transaction among them, as long as it contains all the relevant facts, so the executing broker and the custodian can file jointly.
A SAR is confidential, but the rule lets a firm share the underlying facts, transactions, and documents with another financial institution to prepare a joint SAR.
Before anything is filed, the two firms can compare notes under Section 314(b) of the USA PATRIOT Act. 31 CFR 1010.540 protects that sharing when both firms have a current notice on file with FinCEN (each notice lasts one year) and each has taken reasonable steps to confirm the other's. The information can be used only to identify and report possible money laundering or terrorist activity, to decide on an account or a transaction, or to meet Bank Secrecy Act obligations.

Keep a record of the review even when it ends without a filing. In the Aegis order, the SEC found that the firm closed some accounts at least partly because of suspicious activity, yet "did not create written analyses or compile other records indicating that it had considered filing SARs."

What the LOFF Record Adds

The letter workflow doesn't detect anything. What it leaves behind is evidence an AML analyst can use: which custodian confirmed the funds, for which account, when, and who at each firm handled it. Freefunds Verified Direct (FVD) keeps every LOFF request, the custodian's response, each status change, and the user who made it, with timestamps and the trade details on the letter, in write-once storage for eight years. FVD does no transaction monitoring or pattern detection. Spotting a red flag and deciding what it means stay with each firm's AML program.

This page is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.