Six Years, Thousands of Unread Complaints, and a $225,000 Reckoning: The Full Story of Merrill Lynch's FINRA Settlement

On Wednesday, June 11, 2026, the Financial Industry Regulatory Authority finalised a settlement with one of the most recognisable names in American finance. Merrill Lynch, Pierce, Fenner & Smith Incorporated — the brokerage arm of Bank of America and one of the largest wealth management organisations in the world, managing approximately $4.1 trillion in client assets — agreed to pay a $225,000 fine and accept a formal censure after FINRA concluded that the firm had failed to identify and report more than 1,600 customer complaints submitted through post-call surveys over a six-year period stretching from January 2018 through December 2023. The firm did not admit or deny the findings, a standard feature of FINRA settlements, but its acceptance of the penalty and censure without contest speaks to the unambiguous nature of the underlying facts.

The settlement is significant not primarily for the dollar amount — $225,000 is, by any measure, a rounding error in the quarterly financials of a firm the size of Merrill Lynch — but for what it exposes about how a firm with an enormous compliance infrastructure can systematically fail on a basic regulatory obligation for half a decade, and about what that failure means for the clients whose voices were effectively swallowed by an automated system designed for a different business entirely.

The Mechanics of the Failure: A Banking System Reviewing a Brokerage Problem

To understand what went wrong at Merrill Lynch, you have to understand the operational structure the firm had built for managing customer feedback. When clients called Merrill Lynch's call and support centres — whether about their Merrill Lynch Wealth Management accounts, their Merrill Edge self-directed brokerage accounts, or their Bank of America Private Bank relationships — they were routinely invited, at the end of the call, to complete a post-call satisfaction survey. The survey included a free-form written commentary section: an open text field where customers could write whatever they wished about their experience.

In 2023 alone, Merrill received more than 220,000 such survey responses. Across the full six-year period under examination, the volume of written responses was enormous. Those responses are not administrative data. Under FINRA's rules, any written customer complaint submitted through any channel — including survey free-text boxes, emails, text messages, and even social media posts — constitutes a reportable communication if it contains a grievance about the firm's activities. The obligation to capture and report such complaints is not discretionary.

Merrill Lynch's process for reviewing those responses relied on a lexicon-based automated screening system — essentially, a programmed set of search terms and criteria designed to flag language that might indicate a reportable complaint. The problem, as FINRA's settlement letter makes clear, is that the system had been developed for consumer banking products, not for brokerage operations. The lexicon was built around the terminology, concerns, and complaint categories typical of a bank customer complaining about a checking account, a credit card, or a mortgage — not around the vocabulary of an investor complaining about trade execution, account access, securities transactions, or the handling of investment funds.

The result was structural invisibility. When a Merrill brokerage client wrote in their post-call survey that they were unable to access their funds, that they could not obtain account statements or documents, that they had experienced technical failures on Merrill's online platform, or that a security incident had compromised their account — the automated banking lexicon did not flag the response. The complaint existed in Merrill's own system. It had been received, logged, and archived. But it was never reviewed for complaint content in a way that satisfied the legal requirements of FINRA Rule 4530(d), and it was therefore never reported.

In 2023 — the year for which FINRA has the most specific documented figures — Merrill identified and properly reported approximately 2,400 complaints from those survey responses. But it missed approximately 1,600 others. When the full six-year failure is considered, FINRA described the total unreported volume as thousands of customer complaints, a formulation that places the total number well above the specific 2023 figures and suggests a cumulative problem that dwarfs any single year's data.

What the Complaints Were Actually About

The nature of the missed complaints matters, both for understanding the severity of the failure and for assessing what harm may have resulted from the regulatory blind spot.

FINRA's settlement documentation notes that most of the complaints involved routine service issues — the everyday friction that any large financial services operation generates at scale. But the settlement also identifies specific categories of concern that go beyond routine inconvenience. Some complaints involved customers' inability to access their own funds. Others involved customers being unable to obtain account information and important documents. Additional complaints related to technical problems with Merrill's online systems, and some involved security incidents.

Taken individually, any of those complaint categories might seem manageable. But the regulatory purpose of FINRA Rule 4530(d) is precisely that FINRA should not have to rely on the firm's own assessment of whether individual complaints are individually significant. The rule requires firms to submit quarterly statistical and summary information about all written customer complaints, giving FINRA the aggregated picture it needs to identify emerging patterns, systemic problems, or concentrations of specific complaint types before they escalate into larger harm. When 1,600 complaints in a single year go unreported, FINRA cannot see the pattern. If a particular platform failure was generating a surge of complaints about fund access, or if a specific security vulnerability was driving reports of account incidents, the regulator would have been operating blind.

The censure imposed alongside the fine underscores that FINRA views this as an institutional failure rather than an isolated incident. A censure is a formal public reprimand recorded on FINRA's BrokerCheck database, where it is visible to anyone conducting due diligence on Merrill Lynch as a firm. It is not merely a financial penalty but a mark on the institution's regulatory record.

Understanding FINRA Rule 4530: The Obligation Merrill Violated

For readers unfamiliar with the regulatory architecture that governs American broker-dealers, a brief explanation of FINRA Rule 4530 is essential to appreciating why the settlement matters beyond its dollar amount.

FINRA Rule 4530 is one of the core compliance obligations of every broker-dealer that holds FINRA membership — which includes essentially every firm that buys and sells securities on behalf of American investors. The rule requires member firms to report two categories of information. The first is event-based reporting: specific events including settlements against the firm exceeding $25,000, findings of securities law violations, regulatory sanctions, criminal proceedings involving associated persons, and certain internal compliance conclusions must each be reported individually within 30 calendar days of the firm knowing or being able to reasonably know of their existence. The second, and the category at the centre of the Merrill Lynch settlement, is statistical and summary reporting: every quarter, by the 15th day of the month following the end of the calendar quarter, firms must submit comprehensive statistical and summary information about all written customer complaints received during that period.

The quarterly statistical report gives FINRA the macro-level view that individual event reports cannot provide. It tells the regulator how many complaints a firm received across each category of problem, at what rate, and with what distribution — information that analysts use to identify whether a firm's complaint profile is changing, whether particular product lines or adviser teams are generating unusual complaint concentrations, and whether systemic issues are developing that might warrant examinations or further investigation. Without complete and accurate data from firms, that supervisory function is compromised for every firm whose reporting is deficient.

FINRA has been explicit about this obligation for years. In regulatory guidance, FAQs published on the FINRA website, and examination risk monitoring reports, the regulator has consistently stated that firms must review all written customer communications — including emails, social media posts, text messages, and survey responses — for complaint language, not just formal complaint letters arriving through official channels. The rule captures any channel through which a customer might convey a grievance about the firm's activities, the conduct of associated persons, or the handling of their securities or funds. For Merrill Lynch to have maintained a post-call survey programme generating hundreds of thousands of written responses annually without a brokerage-appropriate review process was, on those facts, a clear violation of the supervisory requirements of Rules 3110(a) and (b) as well as the reporting requirements of Rule 4530(d).

Rule 2010, the third rule cited in the settlement, requires firms to adhere to high standards of commercial honour and just and equitable principles of trade. Its inclusion in complaint cases of this kind is standard FINRA practice for violations that involve a firm's failure to discharge its obligations to regulators and, by extension, to the investing public.

The Supervisory Failure at the Centre of the Case

Beyond the reporting violation itself, FINRA's settlement stresses that the core regulatory finding is a failure of supervisory system design. FINRA concluded that Merrill failed to establish a reasonable supervisory system to comply with its customer complaint reporting obligations — a finding under Rules 3110(a) and (b) that is distinct from simply saying the firm got the counting wrong in any given quarter.

A supervisory failure under Rule 3110 is more serious than a compliance execution error. It means the firm did not have in place a system that was reasonably designed to achieve compliance in the first place. In this case, the system failure had a specific and identifiable cause: Merrill repurposed a consumer banking review tool for a brokerage complaint screening function it was never designed to perform. The lexicon of search terms was calibrated for banking product complaints. Brokerage-specific complaint vocabulary — the language investors use when they cannot execute a trade, when they dispute the handling of their account, when they report security incidents related to investment platforms — was simply outside the system's designed scope.

This matters because it suggests the failure was not a momentary lapse or an understaffed quarter. It was built into the process architecture and persisted for six continuous years. That is not a supervisory stumble; it is a supervisory gap that no one within the firm's compliance function caught, corrected, or escalated for correction across a period spanning multiple annual compliance reviews, FINRA examinations, and firm-wide risk assessments.

In determining the financial penalty, FINRA's sanction guidelines consider factors including the length of the violation period, the number of customers affected, the extent of supervisory failure, and whether the firm cooperated during the investigation. Merrill Lynch's cooperation is presumably reflected in the relatively modest $225,000 fine — which, for a firm generating tens of billions of dollars in annual revenue, is functionally symbolic rather than financially punitive. The censure and the public regulatory record are the more enduring consequences.

A Firm With a Pattern: The Broader Compliance Context

The June 2026 settlement does not exist in isolation. It is the latest in a documented series of FINRA enforcement actions against Merrill Lynch and its Bank of America parent that, taken together, describe a firm with persistent challenges in maintaining adequately designed and adequately supervised compliance systems across multiple regulatory domains simultaneously.

In August 2024, FINRA fined Merrill Lynch and Bank of America Securities a combined $3 million for failing to properly detect manipulative trading practices including wash trading and prearranged trading. The root cause in that case was near-identical in structure to the current one: both entities had relied on automated third-party surveillance systems whose parameters were too narrowly calibrated to catch the trading patterns they were designed to identify. Merrill failed to detect wash trading or spoofing in low-priced securities and warrants between 2017 and 2018, in part because the firm had not purchased a necessary low-priced data feed from its third-party vendor. In that settlement, as in this one, neither firm admitted or denied the findings, and a censure was imposed alongside the financial penalty.

In September 2024, FINRA separately fined Merrill $425,000 for failures related to options position reporting and large trader identification. The following month brought a $350,000 fine for deficiencies in trade surveillance systems for options order handling. In October 2024, FINRA imposed a combined $2.3 million fine on Merrill Lynch and BofA Securities for reporting violations and failures to timely file amendments on registration forms. In May 2024, Merrill paid $825,000 for supervisory deficiencies related to equity order execution and recordkeeping, with senior management certification required as a condition of settlement.

Go further back in the record and the pattern is sustained across different categories. In May 2023, Merrill paid $1.4 million to FINRA and New Hampshire regulators for violations of the national Do-Not-Call registry — its second telemarketing violation in the same state. In December 2020, a $26 million settlement resolved a failure to supervise a single adviser engaged in churning, unauthorised trading, and unsuitable leveraged products. In 2016, the SEC imposed what was then its largest-ever customer protection settlement against Merrill Lynch for the improper use of customer cash in transactions that benefited the firm.

A forensic accounting of the firm's documented federal and state enforcement actions from 2014 through 2026 reaches approximately $18.7 billion in total penalties — though the vast majority of that figure reflects the $16.65 billion Department of Justice mortgage-backed securities settlement in 2014, which resolved pre-acquisition conduct at Countrywide and Merrill Lynch that Bank of America inherited when it acquired both institutions during the financial crisis. Excluding that settlement, the total is approximately $2 billion across the same twelve-year period — still a substantial figure for recurring regulatory violations across a firm that presents itself to clients as one of the most sophisticated and trustworthy financial institutions in the world.

The recurring pattern across these enforcement actions is the one that compliance observers find most instructive. In case after case, the root cause is a technology or process system that was either inadequately designed for the specific regulatory purpose, too narrowly calibrated to catch the full range of what it was supposed to detect, or repurposed from one context for use in a different regulatory domain without adequate adaptation. The $225,000 June 2026 settlement involves a banking complaint lexicon applied to a brokerage context. The $3 million August 2024 settlement involved third-party trading surveillance parameters that were too narrow. The options surveillance cases in September and October 2024 involved detection systems with inadequate scope. Across different product lines, different years, and different regulatory domains, the common thread is systems that were not reasonably designed.

What the Settlement Means for Investors

For current and prospective Merrill Lynch clients, the settlement raises a practical question: what happened to the 1,600 complaints that were not reported, and what happened to the clients who filed them? FINRA's settlement does not indicate that unreported complaints went entirely unaddressed. The distinction the settlement draws is between the firm's internal customer service response to a complaint — which may or may not have occurred in each case — and the firm's obligation to report the complaint to FINRA as part of the regulator's supervisory dataset. The two are separate. A firm can acknowledge and resolve a customer complaint internally while still failing to report it to FINRA as required.

Whether any of the 1,600 unreported complaints involved serious investor harm that should have triggered additional regulatory investigation — rather than merely contributing to a quarterly statistical report — is not addressed in the publicly available settlement documentation. The nature of the identified missed complaints, ranging from fund access issues to security incidents, suggests that at least some of those situations warranted more than routine customer service closure.

More broadly, the settlement is a reminder to investors that the complaint reporting system underpinning FINRA's supervisory function depends entirely on firms accurately capturing and reporting every qualifying complaint. When that reporting fails, FINRA's ability to identify systemic problems at the firm level before they affect larger numbers of clients is materially compromised. The regulator cannot investigate patterns it cannot see.

For compliance professionals at other broker-dealers, the most practically important lesson is the cross-product contamination risk: compliance systems built for one regulatory context do not automatically satisfy obligations in another, even when the underlying operational function — collecting and reviewing customer feedback — appears superficially similar. The Merrill Lynch case illustrates, in six years of documented failure, what can happen when that distinction is not actively managed.

A Merrill Lynch spokesperson declined to comment when approached by financial news outlets following the settlement announcement.

Sources

AdvisorHub — Merrill Fined $225K For Failing to Report More Than 1,600 Call Center Complaints: https://www.advisorhub.com/merrill-fined-225k-for-failing-to-report-more-than-1600-call-center-complaints/

ThinkAdvisor — Merrill to Pay $225K for Not Reporting Client Complaints: https://www.thinkadvisor.com/2026/06/12/merrill-to-pay-225k-for-not-reporting-client-complaints/

FX News Group — FINRA imposes $225k fine on Merrill Lynch: https://fxnewsgroup.com/forex-news/regulatory/finra-imposes-225k-fine-on-merrill-lynch/

El-Balad — Merrill Lynch Fined $225,000 Over Complaint Reporting Failures: https://www.el-balad.com/17019601

FINRA — Rule 4530 Frequently Asked Questions: https://www.finra.org/filing-reporting/regulatory-filing-systems/rule-4530-reporting-requirements/faq

FINRA — Rule 4530 Reporting Requirements (Official Rule Text): https://www.finra.org/filing-reporting/regulatory-filing-systems/rule-4530-reporting-requirements

InnReg — FINRA Rule 4530 Explained: Reporting Requirements: https://www.innreg.com/resources/finra-rules/4530-reporting-requirements

Global Relay — A Simple Guide to FINRA Rule 4530: https://www.globalrelay.com/resources/the-compliance-hub/rules-and-regulations/finra-rule-4530-guide/

LegalClarity — FINRA Complaint Reporting: Rule 4530 Requirements: https://legalclarity.org/finra-complaint-reporting-rule-4530-requirements/

Wealth Management — Merrill Pays $3M To Settle FINRA Claims of Poor Trading Surveillance (August 2024): https://www.wealthmanagement.com/regulation-compliance/merrill-pays-3m-to-settle-finra-claims-of-poor-trading-surveillance

Investment News — Bank of America, Merrill Lynch fined $3M over deficient supervision systems (August 2024): https://www.investmentnews.com/ria-news/bank-of-america-merrill-lynch-fined-3m-over-deficient-supervision-systems/256868

Compliance Week — FINRA fines Merrill Lynch, BofA Securities $2.3M for reporting, registration failures (October 2024): https://www.complianceweek.com/regulatory-enforcement/finra-fines-merrill-lynch-bofa-securities-23m-for-reporting-registration-failures/35441.article

White Law Group — Merrill Lynch Complaints: Regulatory Review (comprehensive history): https://whitesecuritieslaw.com/merrill-lynch-regulatory-history-review/

Commons LLC — The Fiduciary Reckoning, Part III: The Public Record on Merrill Lynch and Bank of America: https://www.commonsllc.com/insights/the-fiduciary-reckoning-part-iii-the-public-record-on-merrill-lynch-and-bank-of-america

GRC Report — Merrill Lynch and Bank of America Fined $3 Million by FINRA for Surveillance Failures: https://www.grcreport.com/post/merrill-lynch-bank-of-america-fined-3-million-by-finra-for-surveillance-failures