FINRA Proposes Longer Senior Investor Holds and New Fraud Delay Rule 2166 for All Customers

Key Takeaways

• FINRA has filed a proposed rule change (SR-FINRA-2026-018) that would extend the maximum Rule 2165 temporary hold from 55 to 145 business days.
• It would also create new Rule 2166, a safe harbor allowing delays of up to 10 business days on suspected fraud for customers of any age, and would make Rule 4512 trusted contact flexibility changes.
• Compliance teams should begin assessing procedure, training, and system impacts now, because the SEC is soliciting comments and the final text and effective date are not yet set.

Deep Dive

Key changes.** Rule 2165 currently allows holds of 15 to 25 business days, with one 30-business-day extension (55 total) when the matter has been reported to a state authority. The proposal adds three 30-business-day extensions, for a new maximum of 145 business days. Each extension requires reasonable follow-up with the relevant authority, no substantive response (automated acknowledgments do not count), and a continuing reasonable belief of exploitation. The first extension beyond 55 days requires notice, which may be oral, to all parties authorized to transact on the account and to trusted contact persons. The notice must cover the reason and the potential 90-business-day duration, with exceptions for unavailable parties or suspected abusers. Initial hold notices must also explain how the firm can be contacted. Firms may continue holds beyond these periods if a federal or state authority or a court requests it. References to authorities would be expanded to include federal regulators and agencies.

**New Rule 2166 and Rule 4512.** Rule 2166 would create a separate safe harbor, modeled on Rule 2165, permitting a delay of up to 10 business days on disbursements or transactions when the firm reasonably believes fraud is occurring, regardless of customer age or capacity. Rule 0150 would be amended to conform. Under Rule 4512, firms could optionally use the term "emergency contact" in place of "trusted contact person." They could also seek customer authorization to apply one contact across all existing and future accounts, provided customers are offered account-by-account designation. The rule would also clarify that firms may obtain more than one trusted contact. An obsolete transitional provision would be deleted.

**Timelines.** FINRA filed on August 20, 2026, and the SEC published notice on September 3, 2026. Comments are being solicited, but the excerpt provided does not state the comment deadline or an effective date. Teams should check the full Federal Register notice and FINRA's filing text for both, and for the details of Rule 2166's requirements, which were not included in the excerpt.

**Recommended actions.** - Gap-assess the hold workflows, written supervisory procedures (WSPs), and training materials, including the requirement that WSPs state that "emergency contact" and "trusted contact person" carry the same obligations. - Build processes to document follow-up efforts (dates, methods, communications received) and the lack of response. - Update customer notice templates and case-management tracking for extension milestones. - Determine how to use the 10-business-day Rule 2166 delay across fraud, AML, and operations teams, and establish escalation and review criteria. - Consider submitting a comment letter and revising account-opening and update forms for the trusted contact options.

**Risk implications.** Longer holds reduce exploitation losses but raise customer complaint, liquidity-access, and litigation risks if documentation or reasonable-belief support is weak. The safe harbor protects firms only if they follow the conditions. Rule 2166 widens exposure to inconsistent application across customers, so firms should have objective criteria, governance, and recordkeeping. Context cited by FINRA includes FBI IC3 reported fraud losses of USD $20.877 Billion in 2025 and USD $7.7 Billion for those over age 60.

Source: Financial Industry Regulatory Authority