FINRA BrokerCheck: Intelligence Source Guide

BrokerCheck is the public window onto the registration and disciplinary system every US securities broker and brokerage firm passes through. It tells you whether a person selling investments is licensed, and what regulators and customers have already said about them.

At a glance

Source	FINRA BrokerCheck
Category	Corporate, Ownership & Legal Records › Securities Filings & Regulators
Homepage	https://brokercheck.finra.org/
Machine interface	`https://api.brokercheck.finra.org/`
Format	`JSON`
Access	Open — no account required
Disciplines	Financial Intelligence
Mission domains	Financial Crime, Fraud & Identity

Broker/firm disciplinary records. — as catalogued in the platform’s own source registry.

BrokerCheck is a free public lookup service run by the Financial Industry Regulatory Authority that publishes registration, employment and disciplinary information about brokerage firms, their registered representatives, and many former registrants. The underlying data is not collected by BrokerCheck itself. It comes from the Central Registration Depository, the registration system FINRA operates jointly with state securities regulators and the Securities and Exchange Commission, into which firms and individuals file a standard set of uniform forms: Form BD to register a broker-dealer, Form BDW to withdraw it, Form U4 to register or amend the record of an individual representative, and Form U5 when that individual's association with a firm ends. Those forms contain identity information, employment history, qualification examinations passed, the states and self-regulatory organisations in which the person is registered, and a long series of yes-or-no disclosure questions covering criminal charges, regulatory actions, customer complaints and arbitrations, civil judicial proceedings, terminations, bankruptcies, unsatisfied judgments and liens, and pending investigations. Where the answer to a disclosure question is yes, a disclosure reporting page describes the event. BrokerCheck renders a curated subset of that record as an interactive profile and as a downloadable PDF report, and the site is backed by a JSON service that returns the same profile data in structured form. Firm profiles carry the firm's CRD number, its SEC file number, main office, year and state of formation, direct and indirect owners in summary, business lines, affiliations, branch office count, and the firm's own disclosure history.

The analytical job BrokerCheck does that nothing else does is to link a named human being to a regulated financial role, across employers, over time, with a permanent identifier. That identifier is the CRD number. It is assigned once, it is not reused, it survives name changes and firm changes, and it is the hinge on which most US financial-adviser investigations turn. Adverse media will tell you that someone was accused; a court docket will tell you that someone was sued; only the registration record tells you whether they were licensed to do the thing they were doing, at which firm, on which dates, and whether the industry has already sanctioned them for it. That makes BrokerCheck the standard opening move in three distinct kinds of work. In fraud and elder-financial-abuse investigations it separates the unregistered impostor from the registered adviser who went bad, which are two different cases with two different referral pathways. In due diligence on an investment firm or a counterparty it reveals the pattern that individual complaints do not: a firm whose representatives arrive disproportionately from a small set of previously expelled firms, or a branch that generates customer disputes at many times the rate of its peers. And in the growing category of investment-fraud work involving impersonation, it lets you check a claimed identity against the record in seconds, which is why regulators point retail victims here first. For FININT work on retail-facing financial crime this is a primary collection route, and it is one of the very few US regulatory sources that is person-centric by design rather than entity-centric.

Who publishes it, and why that matters

FINRA is not a government agency. It is a private, not-for-profit self-regulatory organisation, registered with and overseen by the SEC, funded principally by assessments on the broker-dealer firms it regulates and by the fines it collects from them. That structure is the single most important thing to understand about the source. FINRA's members are the firms whose conduct it discloses, and its rules on what BrokerCheck shows, for how long, and under what circumstances information can be removed, are made through a process in which those firms participate and comment. The result is a disclosure regime that is genuinely useful and genuinely narrower than the underlying record. Regulators, and firms conducting pre-hire due diligence, can obtain a fuller CRD snapshot than the public sees. Investor advocacy organisations, notably the Public Investors Advocate Bar Association, have published sustained criticism of the gap, particularly on the expungement of customer dispute information. None of this makes the data unreliable in the sense of being false. Filings are made under regulatory obligation, amendments are required within tight deadlines, and a materially false Form U4 is itself a sanctionable offence. It makes the data incomplete in a directional way: the omissions favour the registrant and the firm, not the customer. Longevity is not a concern. The CRD system predates BrokerCheck by decades, the disclosure obligation is embedded in FINRA rules and state law, and there is no plausible scenario in which the service disappears. Interface and field changes, however, are routine and unannounced.

Provenance is the first question to ask of any dataset and the one most often skipped. Who collects it, what their incentive is, whether they publish a methodology, and whether they correct the record when they get something wrong all bear directly on how much weight a finding drawn from it can carry.

What a record actually contains

The fields you will be working with, what each one means, and whether it is something you can pivot on. Read the meanings carefully — more analysis is wrecked by misreading a field than by failing to find one, and a field that looks like an observation is often an inference.

Field	Type	What it means	Pivot value
`individual_crd_number`	int	The Central Registration Depository number for a natural person. Assigned once on first registration, never reused, and carried across every firm the person ever registers with. It is the only durable identifier in the US retail securities workforce and it does not change when the person changes their name.	Investment Adviser Public Disclosure records, state securities regulator orders, FINRA arbitration awards, SEC administrative proceedings, and any firm profile listing the person.
`firm_crd_number`	int	The CRD number of a registered broker-dealer. Distinct namespace from individual CRD numbers, so a bare number without context is ambiguous and mis-joining the two is a common ingest error.	The full roster of registered persons at the firm, its branch offices, its SEC file number, and its regulatory action history.
`sec_file_number`	string	The SEC registration file number for the firm, conventionally beginning with an 8- prefix for broker-dealers. It is the identifier the SEC's own systems use, and it is how you cross from FINRA's view of a firm to the Commission's.	SEC filings, administrative proceedings and examination-related publications keyed on the file number.
`other_names`	array	Names the individual has used, as reported on Form U4. Includes maiden names, anglicised forms and nicknames used in business. Self-reported, so it is a lead generator rather than a complete alias list.	Corporate registries, litigation dockets, property records and adverse media searches under the alternative names.
`employment_and_registration_history`	array	The firms with which the individual has been registered, with start and end dates and the registration categories held at each. The public view is a limited window rather than the complete lifetime record held in CRD, and non-securities employment is reported only in part.	Each prior firm's own profile and disclosure history, which is where the cohort pattern of a problem firm becomes visible.
`examinations`	array	Qualification examinations passed, with dates. The Securities Industry Essentials exam and the numbered Series exams define what the person is permitted to sell and supervise. A principal-level qualification means supervisory responsibility, which changes their exposure in any misconduct case.	The scope of permitted activity, and therefore whether conduct alleged against them was even within their licence.
`registrations_by_state_and_sro`	array	The jurisdictions in which the person or firm is currently registered, and with which self-regulatory organisations. Registration is state by state, so a person may be licensed in one state and not the next-door one.	The state securities regulator with jurisdiction, which is usually the fastest referral route for a retail complaint.
`disclosure_events`	array	The structured record of reportable events. Categories include customer disputes, regulatory actions, criminal matters, civil judicial matters, employment separations after allegations, financial events such as bankruptcies and liens, and pending investigations. Each carries a date, an initiating party, allegations, amounts where applicable and a disposition.	Arbitration awards, court dockets, regulatory orders and news coverage of the same underlying event.
`disclosure_status`	enum	The disposition of a disclosure event: pending, settled, denied, withdrawn, closed with no action, award issued, or similar. The distinction between settled and denied is the single most misread field on the site, because a settlement is not a finding and a denial is not exoneration of the conduct.	The underlying award or order document, which states what was actually decided.
`settlement_amount`	int	The monetary amount of a settled or awarded customer dispute, where reported. Firms may settle below the reporting threshold, and the amount reflects the firm's litigation calculus rather than the size of the harm.	Comparison across a representative's disclosure history and against the firm's aggregate dispute record.
`firm_business_types`	array	The lines of business a firm reports conducting, from Form BD. Reveals whether a firm is a retail brokerage, a market maker, a private placement shop, a clearing firm or a shell with a licence, which is often the first useful signal about what it is actually for.	The regulatory regime and examination priorities that apply, and the products a complaint is likely to concern.
`direct_and_indirect_owners`	array	Summary ownership and control persons of a registered firm, as reported on Form BD. Names holding companies and controlling individuals, which is the bridge from a broker-dealer to a wider corporate structure.	Corporate registries, SEC EDGAR filings for any listed parent, and beneficial ownership work under CORPINT.
`branch_office_count_and_locations`	array	Registered branch offices and offices of supervisory jurisdiction. Independent-contractor models produce very large branch counts with thin supervision, and the ratio of branches to principals is a supervision-risk indicator in its own right.	Geographic concentration of complaints, and the specific office named in a dispute.
`report_generation_timestamp`	timestamp	When the PDF report or JSON response was produced. It is not the date the underlying record was last amended, and it is the only date on the artefact you download, which makes unqualified citation of a BrokerCheck PDF a recurring evidential weakness.	None. Record it alongside the retrieved record and re-pull before relying on it.

Coverage — and what is not in it

Coverage is the US securities brokerage industry and nothing else. Every broker-dealer registered with FINRA and every natural person registered as an associated person of such a firm is in scope, together with a defined window of former registrants. Geographically this means the United States and its territories, plus foreign firms and individuals to the extent they register to do business with US customers. The disclosure history attached to a person can reach back decades where the events are of a category that remains permanently displayable, while the employment history shown in the public report is a bounded recent window rather than a full career. Firm records include entities that have ceased operating, expelled firms and withdrawn registrations, which is analytically valuable because the failed firms are where the interesting cohorts come from. Updating is continuous rather than batched. Firms are required to amend Forms U4 and U5 promptly after a reportable event, typically within thirty days, and regulatory actions are added as they are finalised, so the practical latency between an event occurring and appearing is weeks rather than days, and can be much longer where the event is a customer complaint that the firm disputes. The service is a lookup rather than a feed: there is no published change stream, so monitoring means re-querying known records on a schedule and diffing.

Known blind spots

Absence of evidence here is not evidence of absence. These are the conditions under which FINRA BrokerCheck will not show you something that is nevertheless real:

It only covers people and firms who registered. The unregistered person running an investment scheme, the finder taking a commission without a licence, and the offshore boiler room with no US registration are all invisible here, and a clean BrokerCheck result on a name that does not appear at all is not a clean bill of health – it usually means you are looking at the wrong system entirely.
Investment advisers and their representatives are a separate regime. A person who dropped their broker registration and now works as an investment adviser representative sits in the Investment Adviser Public Disclosure system, and someone who checks only BrokerCheck will conclude they left the industry.
Commodities, futures and forex professionals are regulated by the CFTC and the National Futures Association, and their registration and disciplinary record lives in NFA BASIC. Insurance-only agents sit with state insurance departments. A person can be barred in one regime and active in another.
Customer dispute information can be removed. Expungement through FINRA arbitration, confirmed by a court, permanently deletes the event from CRD and therefore from BrokerCheck. A record that shows no customer disputes may be a record from which disputes were removed, and the removal itself is not disclosed.
Non-reportable settlements do not appear. Firms settle small customer claims below reporting thresholds and settle informally without a written complaint, and none of that reaches the record. A representative with a long history of quiet make-goods looks identical to one with no complaints at all.
The Form U5 termination narrative is written by the departing firm, which faces defamation exposure for saying too much and regulatory exposure for saying too little. The resulting language is often deliberately uninformative, and permitted to resign is doing a great deal of work in a great many records.
Pending events lag. A regulatory action under investigation, a customer complaint not yet filed, and an internal review that has not concluded are all real and all absent. The most dangerous window in a broker's record is the one you are looking at.
The public report is a subset of CRD. Regulators and firms conducting pre-hire checks see more. Building a picture from BrokerCheck and assuming it is the whole registration record will produce confident conclusions that a regulator with the full snapshot would not share.
There is no beneficial-ownership depth. Firm ownership is reported in summary and stops at the first layer of holding companies, so the person actually controlling a broker-dealer through a chain of entities is frequently not named here at all.

Write the blind spot into the product. A statement that something “was not observed in FINRA BrokerCheck” is defensible; a statement that it “did not happen” is not, and the difference is what survives cross-examination.

Access, licensing and what you may do with it

Access model: Open — no account required

The public interface is the BrokerCheck website, which requires no account and imposes no registration. Every profile can be rendered as a PDF report, and that PDF is the artefact you should retain for casework because it is dated, paginated and self-describing in a way that a screenshot is not. The site is a single-page application backed by a JSON service on a dedicated API host, and that service returns individual and firm search results and profile bodies in structured form without a key. It is the site's own backend rather than a published, versioned, supported public API, which has three practical consequences: field names and response shapes change without notice, the terms of use governing the website govern your use of it, and you should not build anything you cannot afford to have break. FINRA separately operates a developer programme with documented, credentialed APIs over its published datasets, and where a documented product covers your need it is the right choice over the site backend. For a small number of lookups the website is entirely sufficient and building anything is a waste of effort. For systematic work over thousands of representatives, read the terms of use first and consider approaching FINRA directly, because bulk automated collection against a site backend is exactly the pattern those terms are written to prohibit.

Licence

The data is published by a private self-regulatory organisation, not by a government, so it is not in the public domain and the usual assumption that US regulatory information is freely reusable does not hold. FINRA's website terms of use govern access and have historically restricted automated collection, scraping, redistribution and commercial reuse of BrokerCheck content, and have asserted rights over the compilation. Those terms have been revised more than once. Read the current version before designing anything that stores, republishes or resells the content, and be aware that the answer for a one-off due diligence check and the answer for a commercial screening product are different answers. Separately, individual disclosure records are personal data about identifiable people. Even where FINRA's terms permit your use, data protection law in the jurisdiction where you operate or where the data subject resides may impose its own constraints on retention, accuracy and onward disclosure, and the fact that information is publicly accessible does not exempt it. Where you need contractual certainty for a commercial product, licensed redistribution of registration data is available through FINRA's own data programmes; that is the path to take rather than reasoning about whether scraping is defensible.

Rate limits and fair use

No published limit applies to interactive use of the website, and no published limit governs the JSON backend because it is not a published API. Treat that absence as a reason for restraint rather than permission. Sensible practice for legitimate research is single-threaded requests with a delay of at least a second between them, an identifiable user agent with a contact address, retrieval limited to the records you actually need rather than enumeration of the identifier space, and immediate backoff on any error or throttling response. Do not attempt to walk the CRD number range: it is enumerable in principle, it is unambiguously bulk collection in practice, and it will be both noticed and, correctly, blocked. Cache aggressively. A representative's record changes on the order of a few times a year at most, so a refresh cadence of monthly for a watchlist and quarterly for a background population is more than adequate and reduces your footprint by an order of magnitude. If your use case genuinely requires the whole population, the correct response is a licensing conversation, not a faster scraper.

Licensing changes, and it changes without warning. A dataset that was free for research this year may not be free for commercial or evidential use next year. Confirm the current terms before you build a dependency on it, and record the terms you relied on alongside the data — the licence in force at the time of collection is part of the provenance.

Collecting it

How FINRA BrokerCheck is actually pulled, in the order you would set it up. Prefer the bulk or export interface over per-item lookups wherever one exists: it is kinder to the publisher, faster for you, and gives a reproducible snapshot rather than a series of point-in-time answers you cannot reconstruct later.

Method	Format	Cadence	Notes
Interactive lookup and PDF report	HTML	Per query, as needed	The default and, for most casework, the only method required. Generate the PDF report rather than screenshotting the page: it is dated, it states its own scope, and it survives as an exhibit.
Site JSON backend	JSON	Per query, low volume	Returns search results and profile bodies in structured form without authentication. Unversioned and unsupported. Suitable for modest, well-behaved automation against a known list of CRD numbers; unsuitable as the foundation of a product.
Watchlist re-query and diff	JSON	Monthly	Hold a list of CRD numbers of interest and re-pull on a schedule, storing each response and comparing against the previous one. New disclosure events are the signal; everything else is noise. This is the only way to get change detection, because there is no published feed.
Firm roster expansion	HTML	Quarterly	Walk from a firm's profile to its registered persons to build a cohort, then check that cohort against prior-firm history. Cohort analysis is where BrokerCheck stops being a background check and becomes an investigative source.
FINRA documented data programmes	JSON	As published	FINRA's developer programme exposes credentialed APIs over published datasets. Where your requirement is covered by a documented product, use it: it is versioned, supported and licensable, and the site backend is none of those things.
Cross-regime manual check	HTML	Per subject	For any subject of consequence, repeat the lookup in the investment adviser and futures registration systems. This is manual, it is tedious, and skipping it is the most common single failure in adviser due diligence.

Ingesting it into the platform

Every step below is idempotent and cursor-based: interrupt one and it resumes from where it stopped rather than duplicating rows or losing progress. Collection is recorded per source, so a feed that quietly stops publishing shows up as a stale timestamp instead of silently thinning your coverage.

Register BrokerCheck as a source with an explicit access policy — sources.php records it as a lookup source rather than a feed, with the fetch cadence, the terms-of-use position and the contact user agent recorded alongside it, so that the collection policy is visible to anyone auditing how a record was obtained.
Normalise the two identifier namespaces separately — ingest.php stores individual CRD and firm CRD as distinct typed identifiers. They are both bare integers and they overlap, so a single crd field is a defect that will eventually join a person to a firm and produce a confident, wrong link in link-analysis.php.
Model disclosure events as dated child records — Each disclosure becomes its own record with a category, an event date, an initiating party, a disposition and an amount, attached to the person. Flattening disclosures into a count on the person destroys the only thing that matters, which is what happened and when.
Preserve the retrieved artefact — import.php stores the PDF report and the raw JSON response with the retrieval timestamp. The record on the site changes; your evidence should not. Casework that cites a live URL cites something that may no longer say what you said it said.
Resolve people to platform entities without over-merging — resolve-everything.php links the registration record to an existing person entity where the CRD number matches an already-known identifier, and creates a candidate link rather than a merge where only the name matches. Common names in a population of hundreds of thousands of registrants guarantee collisions.
Link individuals to firms and firms to corporate entities — Registration periods become dated relationships between the person and the firm on entity.php, and the firm's reported owners become candidate links to corporate records for org-profile.php, which is where the securities record joins the wider ownership graph.
Run change detection on the watchlist — cron.php re-queries the watched CRD list on the configured cadence and alerts.php fires only on new or changed disclosure events, not on any response difference. The backend reorders and re-labels fields, so a naive diff produces continuous false alerts and the alert channel dies within a week.
Surface the record where the question is asked — The person's registration and disclosure summary appears on entity.php and feeds financial-crime.php and worst-offenders.php, so that an analyst working a retail fraud case sees the registration position without leaving the case.

Registered sources and their last-collected state are listed in sources.php, and the scheduled chain that keeps them current is in automation.php.

How it is wrong, and how to tell

Every dataset is wrong in characteristic ways. Knowing which ways is the difference between using a source and being used by one, and it is the part of source evaluation most often skipped because it is the part that takes work.

Judged as a record of what was filed, BrokerCheck is high quality. The filings are made under regulatory compulsion by supervised entities, amendment deadlines are short and enforced, and filing a materially inaccurate Form U4 is itself an offence for which people are regularly sanctioned. Identity fields, registration dates, examination records and the existence and disposition of regulatory actions can be relied on. Judged as a record of what happened, it is systematically incomplete, and the incompleteness is not random. Every mechanism that removes information from the record – expungement, non-reportable settlements, negotiated U5 language, thresholds – operates in the direction of a cleaner record for the registrant. Nothing operates in the opposite direction, because there is no process by which unproven allegations are added. The correct posture is therefore asymmetric: a disclosure event on a record is strong evidence that something happened, while the absence of disclosure events is weak evidence that nothing did. Beyond that, the free-text narrative fields vary enormously in quality because they are written by different firms under different legal advice, and the allegation text in a customer dispute is the customer's characterisation, not a finding. Amounts are reliable where present. Dates are reliable but ambiguous in kind: the date of a customer dispute may be the date of the conduct, the date of the complaint or the date of the filing, depending on the event type, and reading them as a single consistent series is a mistake.

Characteristic false positives

Name collision. There are hundreds of thousands of registrants and common names recur constantly. Matching on name alone will attach one person's disciplinary history to another with the same name, and this is by a wide margin the most frequent error made with this source. Only the CRD number identifies a person.
Reading a settlement as a finding of wrongdoing. Firms settle customer disputes for commercial reasons including cost, insurance terms and the desire to avoid discovery, and a settlement in the record does not establish that the representative did anything. Reporting it as proven misconduct is defamatory and wrong.
Reading a denial or a closed-no-action as exoneration. A firm denying a customer complaint means the firm denied it. A regulator closing a matter without action may mean the conduct did not occur, or that it could not be proven, or that it fell below a prosecution threshold. The record does not distinguish these.
Treating an empty record as a clean record. Expungement, sub-threshold settlements and the simple fact that a person may be registered in a different regime all produce blank or missing profiles for people with substantial histories.
Mistaking a former registrant for a current one, or the reverse. Registration status changes and the profile reflects the current state; an analyst who retrieved the record six months ago and reasons from it today may be asserting a licence that no longer exists.
Conflating the firm's disclosure history with the individual's. A representative at a firm with dozens of regulatory actions has not personally been sanctioned, and firm-level events attached to a person in an ingest pipeline produce a person who appears far worse than the record supports.
Over-reading financial disclosures. A personal bankruptcy or a tax lien is a reportable event and a legitimate supervisory concern, and it is also something that happens to people for reasons having nothing to do with client money. It is a flag for further work, not a finding.
Assuming the disclosure narrative is complete. The disclosure reporting page summarises; the underlying arbitration award, regulatory order or court document says what actually happened, and they often differ in emphasis in ways that change the conclusion.

None of these make the source unusable. They make it a source that requires corroboration before an assertion built on it goes into a product, which is true of every source and admitted by few.

Ageing

Registration status is the fastest-decaying field. A person can leave a firm, be terminated, or have a registration lapse in a single day, and a stored record asserting current registration ages into a factual error within weeks. Treat any registration statement older than thirty days as a claim requiring re-verification before it goes into a report. Disclosure events age differently: an event, once recorded, is a historical fact and does not change, but its disposition does. A pending customer dispute in your stored copy may since have been settled, denied or expunged, and a pending regulatory action may since have produced a bar. A stale record therefore looks like this: correct on the events that exist, wrong on their outcomes, and wrong on whether the person is currently licensed. Employment history ages by scrolling, because the public window is bounded, so a record retrieved years ago may contain firms that the current profile no longer shows – which makes your archived copy more informative than the live one, and worth keeping for that reason alone. Firm records age slowly except at the moment they age completely, when a firm withdraws or is expelled and its entire representative population disperses to other firms within a quarter. That dispersal event is analytically rich and entirely invisible if you refresh only annually.

What this source feeds

A source is only worth what it lets you conclude. These are the disciplines that collect through it, the mission domains it serves and the data points it yields — every one is a tag, so you can follow any thread from here into the rest of the library.

Collected by these intelligence disciplines

Financial Intelligence

Serves these mission domains

Yields these data points

How each sector uses FINRA BrokerCheck

The same dataset is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The records are shared — the constraints, thresholds and outputs are not.

🎖 Military and defence

The relevance is personnel security and counter-fraud rather than operations. Service members are a documented target population for investment fraud, affinity fraud and unsuitable insurance and securities products marketed near installations, and the registration record is the fastest way for a legal assistance office or a financial readiness programme to establish whether a person soliciting members is licensed at all and what has been said about them. For security clearance and insider-risk work, the financial disclosure categories – bankruptcies, unsatisfied judgments, liens – overlap directly with adjudicative financial considerations, though the record covers only registered persons and is a supplement to, not a substitute for, the formal investigative process. Where a defence contractor's principals hold or have held securities registrations, the record supplies a disciplinary history that ordinary corporate due diligence will miss.

🕵 National intelligence

Two uses. First, as identity and role confirmation in financial networks: the CRD number is a hard identifier for a named individual in a regulated role, with dated employment at named firms, which is materially better than the inference available from corporate registries alone. Second, as a structural map of the US retail brokerage layer, which is where a great deal of laundering, sanctions-evasion placement and fraudulent capital-raising touches the regulated system. Firm profiles showing thin capitalisation, exotic business lines, rapid representative turnover and ownership through opaque holding structures identify the institutions worth attention. The source is unclassified, citable and shareable with partners, which makes it useful as a common reference in liaison work. Its limitation for intelligence purposes is that it is entirely US-facing and person-centric, and it tells you nothing about beneficial ownership beyond the first layer.

👮 Law enforcement

This is a core source for securities fraud, elder financial exploitation, affinity fraud and Ponzi investigations, and it does two jobs at the charging stage. It establishes the licensing position, which is often itself an element: acting as an unregistered broker, or continuing to sell while barred, are chargeable in their own right in many jurisdictions and are trivially demonstrated from the record. And it establishes pattern, because a representative with prior customer disputes alleging the same conduct at a prior firm converts an isolated incident into a course of conduct. The disclosure record also names the arbitration awards and regulatory orders that document prior findings, which are obtainable in full and are far better evidence than the summary. Coordinate early with the state securities regulator named in the registration record: they frequently hold examination material, prior complaints and investigative history that is not public, and in many states they have their own criminal or administrative authority.

🔍 Private investigation and corporate security

For any engagement touching a financial adviser, a brokerage, a private placement or an investment introducer, this is the first check and it takes two minutes. The high-value pattern for private investigators is the employment trail: a representative who has moved through four firms in six years, two of which were later expelled, has a profile that no single record shows and that the sequence makes obvious. For asset and background work, the disclosure categories covering judgments, liens and bankruptcies provide dated, filed financial events that are otherwise expensive to establish. Two disciplines matter. Verify by CRD number, never by name, before anything goes into a client report. And remember that a settled customer dispute is not a finding of fraud; writing it up as one exposes both you and your client, and clients under pressure will read it that way unless you say so explicitly in the report.

📰 Journalism and OSINT media

Registration records are the backbone of investment-fraud reporting because they are on the record, attributable to a named regulator and checkable by anyone reading the story. The strongest journalistic use is aggregate rather than individual: counting disclosure events across a firm's representative population, tracking where the representatives of a collapsed firm went next, or measuring the concentration of disputes in particular branches or product lines. That work has repeatedly produced findings that individual profiles do not reveal. Handle expungement carefully and explicitly, because it is both a legitimate remedy for genuinely false allegations and a documented route by which real complaints disappear, and reporting either half alone is inaccurate. Never characterise a settled dispute as proven misconduct, always seek comment with the specific event dates and case numbers, and give the person the CRD-level detail so their response can be specific.

🌍 NGO, humanitarian and human rights

Financial-exploitation casework, particularly with older adults and with immigrant and faith communities targeted by affinity fraud, begins with the question of whether the person taking a client's money was licensed. BrokerCheck answers it free, immediately, and without any need for the client to disclose anything. The referral pathway matters more than the analysis: a licensed representative is complainable to FINRA and to the state securities regulator, an unlicensed one is a matter for the state regulator and law enforcement, and the two routes have different timelines and different remedies. Advocacy organisations also use the aggregate record to identify firms and products disproportionately harming vulnerable clients, which supports policy submissions with evidence rather than anecdote. Keep the client's own information out of any external query; you are looking up the adviser, and you never need to name the client to do it.

🎓 University and research

The registration record is one of the better-known natural experiments in the misconduct literature, and published work has used it to study the persistence of adviser misconduct, the reallocation of disciplined brokers between firms, geographic and demographic concentration of complaints, and the effect of disclosure on consumer behaviour. Its virtues for research are a permanent individual identifier, dated employment histories permitting panel construction, and a structured misconduct measure. Its defects are selection at every stage – complaints depend on customers complaining, disclosure depends on reporting thresholds, and expungement removes observations non-randomly – and the public view is a truncated version of the regulatory record, which limits reproducibility against the fuller data some researchers have obtained under agreement. Terms of use constrain bulk collection, so the honest path for a large-N study is to approach FINRA rather than to scrape, and to state the truncation and expungement biases explicitly in the limitations section.

Playbook: working FINRA BrokerCheck end to end

A repeatable sequence from first pull to finished product. Each phase states what you are trying to establish, not merely what to click — the objective is a defensible chain of reasoning, not a completed checklist.

Phase 1 — Decide which regulatory regime you are actually in

Before searching, establish whether the subject sold securities, gave investment advice, sold insurance, sold futures or forex, or sold nothing regulated at all. Each has a different registration system and BrokerCheck covers exactly one of them. Analysts who skip this step and find nothing conclude the person is unregistered, when in fact they are registered somewhere else. The product being sold is usually the fastest way to tell.

Phase 2 — Resolve the identity to a CRD number and stop using the name

Search by name to find candidates, then fix on a CRD number using employment history, location and dates, and use only the number thereafter. Where two candidates cannot be separated, record both and say so rather than picking. Everything downstream – the disclosure history, the firm links, the arbitration awards – is worthless if it is attached to the wrong person, and this is the step at which that goes wrong.

Phase 3 — Read the registration status as of the relevant date, not today

The question is almost never whether the person is licensed now. It is whether they were licensed when they did the thing. Reconstruct the registration timeline from the employment history and check that the conduct date falls inside a registered period at the firm the client dealt with. Conduct outside a registration period, or at a firm other than the registered one, is a different and usually more serious matter.

Phase 4 — Separate the individual record from the firm record

Pull both, and keep them apart. A representative with a clean personal record at a firm with a substantial regulatory history is a supervision question; a representative with a personal history at a clean firm is an individual question. Merging the two produces a hybrid that describes nobody. Note in particular whether any firm-level action concerned supervision, because that reframes every individual complaint at the firm.

Phase 5 — Classify each disclosure by category before reading the narrative

Regulatory actions, criminal matters, customer disputes, terminations, civil judicial matters and financial events carry very different evidential weight. A final regulatory action is a finding by a regulator. A customer dispute is an allegation. A bankruptcy is a life event. Sorting them first prevents the common error of treating a pile of disclosures as a single quantity of badness.

Phase 6 — Build the employment sequence and look at the joins

List the firms in order with dates and look at the gaps and the destinations. Short tenures, gaps immediately following a disclosure event, and moves into firms with their own regulatory histories are the pattern that matters. Then check what happened to each prior firm: expulsion or withdrawal of a firm shortly after the subject left is a strong lead, and it is only visible if you pull the firm records too.

Phase 7 — Go to the underlying documents

The disclosure page is a summary written for a retail audience. The arbitration award, the regulatory order, the court docket and the SEC administrative proceeding are the real evidence and they are almost always obtainable. Retrieve at least the ones you intend to rely on. The difference between the summary and the source document has changed conclusions in enough cases that treating the summary as sufficient is a professional failing.

Phase 8 — Run the cross-regime checks

Check the investment adviser registration system, the futures and forex registry, the state securities regulator's own orders, and where relevant the state insurance department. A person barred from one regime commonly reappears in another, and the disciplinary systems do not fully share disclosure. This is a short, mechanical sequence and it produces findings often enough to justify running it every time.

Phase 9 — Test for the things the record cannot show

Ask explicitly whether an expungement is plausible, whether the harm alleged would have crossed a reporting threshold, and whether the conduct might have occurred entirely outside the registered activity – selling away, private placements, or an unregistered side business. Write the answer into the assessment. A finding that says the public record shows nothing and here is why it might not is worth far more than one that says the record is clean.

Phase 10 — Establish the corporate context of the firm

Take the firm's reported owners and control persons out to corporate registries and, for any listed parent, to securities filings. Broker-dealers sit inside groups, and the interesting questions – who capitalises this, who else do they control, what happened to their other regulated entities – are answered outside the registration system. This is the point at which FININT work joins CORPINT work.

Phase 11 — Fix the record and date the evidence

Save the PDF report and the underlying documents with retrieval timestamps and store them with the case. The live profile will change; expungements will remove events; the firm may cease to exist. An assertion in a report that rests on a URL rather than a retained dated artefact cannot be defended six months later, and in this source specifically the thing you saw may genuinely no longer be there.

Phase 12 — Set up monitoring only for what you will act on

Put the small number of subjects that matter on a monthly re-query and alert on new or changed disclosure events. Resist the temptation to monitor a population: it generates volume, most of it inconsequential, and it turns a valuable alert channel into background noise. The discipline is to define in advance what change would cause you to do something, and to alert on nothing else.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

What to pair it with

No single source carries a finding. These are the datasets that corroborate, extend or contradict this one — and a source that contradicts is worth more than one that agrees, because it is the only thing that will tell you when you are wrong.

Source	Relationship	What it adds
Investment Adviser Public Disclosure	prerequisite	The parallel registration and disclosure system for investment advisers and their representatives, drawing on Form ADV. Anyone checked in BrokerCheck must also be checked here, because the two regimes overlap and diverge and a person may hold either, both or neither.
NFA BASIC	extends	The National Futures Association's registration and disciplinary lookup for commodities, futures and retail forex professionals. Covers a regime BrokerCheck does not touch, and the population overlaps enough that skipping it is a real gap.
State securities regulators	extends	Registration is state by state and the state regulators hold their own enforcement orders, examination findings and complaint histories, much of which never reaches the federal disclosure record. Usually the fastest and most responsive referral route for a retail victim.
FINRA arbitration awards	corroborates	The full text of arbitration awards, which is what a customer dispute disclosure summarises. The award states the claims, the panel's reasoning where given and the disposition, and it routinely contains detail the disclosure page omits.
SEC litigation and administrative proceedings	corroborates	Commission enforcement actions against individuals and firms, in full text with the complaint or order. Where a regulatory disclosure names an SEC action, this is the document behind it.
SEC EDGAR	extends	Where a broker-dealer sits under a listed parent, or where the products sold were registered offerings, the filings supply ownership, financial condition, related-party detail and the offering documents themselves.
Corporate registries and beneficial ownership records	extends	Firm ownership in the registration record stops at the first layer. Company registries carry the chain above it, which is where control of a problem broker-dealer usually resides.
Court dockets and judgment records	corroborates	Civil judicial disclosures, liens and judgments reference proceedings whose full records are obtainable and which contain the facts the disclosure summarises in a sentence.
Investor.gov	prerequisite	The SEC's investor education service, which explains the disclosure categories and the complaint routes in plain terms. Useful when handing a finding to a non-specialist, and the correct thing to point a victim at.

Legal, ethical and operational constraints

BrokerCheck contains personal data about identifiable individuals, much of it concerning allegations rather than findings, and the legal exposure runs in two directions. Downstream, republishing or characterising a disclosure event carries defamation risk in most jurisdictions if the characterisation goes beyond what the record says: a settled customer dispute is an allegation that was resolved without adjudication, and describing it as fraud is actionable. Data protection law adds its own layer where the subject or the processor is in a jurisdiction with an omnibus regime, and public accessibility is not a lawful basis by itself; retention, accuracy and the right of the subject to contest are live obligations even for public-source data. Upstream, the terms of use are contractual and restrict automated collection and redistribution, so systematic harvesting can be a breach of contract and, depending on jurisdiction and method, may raise computer-misuse questions independent of the data protection position. Where the check is being run as part of a decision about a person – hiring, credit, insurance, tenancy – consumer reporting law in the United States and its analogues elsewhere may apply to you as a furnisher or user of the information, with notice, accuracy and adverse-action obligations attached. That is a materially different legal regime from investigative use, and the distinction is about the purpose, not the source. Finally, use for the purpose of contacting or soliciting the individuals listed is a different activity again and is constrained both by the terms and by marketing law.

Operational security

Queries are unauthenticated and go to FINRA infrastructure. Interactive lookups are indistinguishable from the very large volume of routine investor and compliance traffic the service exists to serve, so a small number of searches is effectively unobservable at the level of who is asking. What is observable is volume and pattern: repeated, automated, or enumerating requests from a single address are visible to the operator, identifiable as collection, and likely to be blocked and retained in logs. There is no public evidence that FINRA notifies registrants of lookups, and the sensible assumption is that it does not, but the sensible planning assumption for adversarial work is that a request from your corporate network associates your organisation with an interest in a named person. For work where that association matters, query from infrastructure that does not identify the client and do not use a corporate email address in any user agent you set. The larger exposure is not technical. Broker-dealer compliance departments monitor for signs that a representative is under investigation, and a subject who learns they are being looked at through a chain that begins with your enquiry to their firm, their former colleague, or a state regulator has been alerted by you rather than by the website. Sequence external enquiries accordingly, and complete all public-record collection before making any contact.

Two rules that hold regardless of jurisdiction. Collection that is lawful is not automatically proportionate, and a dataset assembled for one purpose does not carry consent for another. Where the records concern identifiable people, the question is not only whether you may hold the data but whether holding it serves the purpose you are accountable for.

Is it earning its place?

Sources accumulate. Feeds get added during an incident and are never reviewed again, and a decade later the pipeline is carrying dead weight that nobody dares remove. These are the measures that show whether FINRA BrokerCheck is contributing anything, and they are worth baselining now so the answer is available later.

Proportion of subjects in a case population that resolve to a CRD number rather than remaining a name-only match, which is the honest measure of whether your identity resolution is working.
Rate at which cross-regime checks against the adviser and futures registries change the conclusion, which tells you whether the cross-check step is earning its cost or merely being performed.
Number of investigations in which a disclosure event led to retrieval of the underlying award or order, versus those that stopped at the summary, as a direct measure of evidential discipline.
Latency between a regulatory action being finalised and appearing in your stored copy, which measures your refresh cadence against reality rather than against your intentions.
False-match rate discovered during quality review, tracked specifically for name-only joins, because this is the source's characteristic failure and it will not surface unless you count it.
Share of monitored subjects that generated at least one actionable alert over a year, which is the test of whether a watchlist is a tool or a habit.
Frequency with which a firm-level cohort analysis produced a lead that individual profile review did not, which is the measure of whether you are using the source as a background check or as an investigative source.

Beware of volume. Indicator counts rise easily and say almost nothing. Unique contribution — findings this source produced that no other source in your stack would have — is the measure that matters, and it is usually far lower than anyone expects.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

The CRD number is the record. Names are search terms, nothing more. Any analytical statement about a person that is not anchored to a CRD number is provisional, and should be marked as such in the case file rather than in your head.
Absence is a finding to be explained, not a result to be reported. Say which systems you checked, what a blank result in each of them can mean, and what would have had to be true for a real event to be missing. That sentence is often the most useful one in the assessment.
Sequence matters more than count. Four disclosures spread over thirty years at one firm is a different picture from four in eighteen months across three firms, and a count collapses them into the same number. Always render the history as a timeline.
Read the firm's fate, not just its record. What happened to the firms a subject left is frequently the strongest signal available, and it requires a separate lookup that most analysts skip because the subject's own profile looks unremarkable.
Distinguish the three dates in every customer dispute: when the conduct is alleged to have occurred, when the complaint was made, and when it was resolved. They are routinely years apart and conflating them produces a chronology that will not survive contact with the underlying award.
Expungement is a hypothesis you should test rather than a conspiracy you should assert. If a subject's record is unexpectedly clean, look for the arbitration award, the court confirmation, the news coverage and the customers – they exist independently of the registration record, and finding them is ordinary work.
Supervision is the question the record answers best and analysts ask least. Who was the principal, what did the firm's own procedures require, and did the firm have prior actions about supervision – these turn an individual case into an institutional one, which is usually where the recovery is.
Keep the artefact, not the link. Records change and events are removed. A dated PDF in the case file is defensible; a URL in a footnote is a claim about the past made from a page that describes the present.
Never let a settlement become a finding in the prose. Write the disposition in the same sentence as the allegation, every time, even when it makes the sentence clumsy. This is the discipline that keeps investigative reporting and client reports out of court.

Questions analysts actually ask

Is a broker with no disclosure events actually clean?

It means no reportable event was recorded and none has been removed. Expungement, settlements below reporting thresholds and informal resolutions all produce blank records for people with real histories, and a person may simply be registered in a different regime. Treat a blank record as the absence of evidence and say so in those words.

Can I rely on the JSON backend for a production system?

No. It is the website's own service, not a published or versioned API, and it changes without notice. It is also governed by terms of use that restrict automated collection. For anything beyond modest research volumes, use FINRA's documented data programmes or licence the data, and design on the assumption that scraping will break and may breach the terms.

Why does someone appear in BrokerCheck but not in the adviser system, or the reverse?

Because they are two regimes. Brokers effect transactions and are registered with FINRA; investment advisers give advice for a fee and register with the SEC or a state. Many people hold both, many hold one, and a person who drops one registration disappears from that system while remaining active in the other. Always check both.

How current is the information?

Continuous but lagged. Firms must amend the record after a reportable event within a short deadline, typically measured in days to a month, and regulatory actions appear when finalised. Practical latency is weeks. There is no published change feed, so if you need to know about changes you must re-query and diff.

What is the difference between the public report and what a regulator sees?

The public report is a defined subset of the Central Registration Depository record, governed by FINRA's disclosure rule. Regulators, and firms conducting pre-hire due diligence, obtain a fuller snapshot including information the public view withholds. Build your conclusions knowing you are working from an abridged version, and say so where it matters.

A customer dispute is marked settled with an amount. What can I say about it?

That a customer alleged specified conduct, that the matter was settled, and for how much, on the dates shown. Not that the conduct occurred. Firms settle for reasons unrelated to merit, and the representative is often not a party to the settlement decision. State the allegation and the disposition together and let the reader draw the inference.

How do I find every representative associated with a suspect firm?

Start from the firm profile and enumerate its registered persons, then pull each individual record and their prior firms. That cohort view is what turns the source from a background check into an investigative tool, because the pattern of where a firm's people came from and where they went is often more diagnostic than any single profile.

Is BrokerCheck data free to reuse in a commercial product?

Do not assume so. FINRA is a private organisation, the content is not a US government work in the public domain, and the terms of use have restricted redistribution and commercial reuse. Read the current terms and, for a product, take the licensing route. This is a place where the usual instinct about US regulatory data is wrong.

The person I am investigating was never registered anywhere. Is the source useless?

The opposite. Confirmed absence from every registration system, documented and dated, is itself a finding, and in many jurisdictions acting as an unregistered broker or adviser is an offence in its own right. Record precisely which systems you searched, with what terms, on what date, because that becomes the evidence of the negative.

Standards, formats and interoperability

What this source speaks natively, and what it has to be translated into before a partner can consume it. Work that arrives in a recognised format is easier to defend, easier to hand over and easier to automate against:

The uniform registration forms – U4, U5, BD and BDW – which define the field structure of the entire record and are jointly maintained by FINRA, the SEC and state regulators through NASAA.
The Central Registration Depository identifier, which functions as the de facto national identifier for individuals and firms in the US securities industry and is referenced by state orders, arbitration awards and SEC proceedings.
FINRA Rule 8312, which governs what information is released through BrokerCheck, for whom and for how long, and is the authoritative answer to any question about why something is or is not displayed.
FINRA Rule 2080 and the associated arbitration procedures governing expungement of customer dispute information, which require a court order confirming the arbitration award before information is removed from CRD.
The Securities Exchange Act registration regime, which is the statutory basis for broker-dealer registration and for FINRA's authority as a registered national securities association.
SEC file numbering for broker-dealers, which is the identifier that joins the FINRA view of a firm to Commission records.
State securities registration under the Uniform Securities Act as adopted in each state, which is why registration is jurisdiction-by-jurisdiction and why a state regulator is often the right referral route.

References

Primary documentation and authoritative references for this source. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

FINRA BrokerCheck — Financial Industry Regulatory Authority. The service itself. Start here for any individual or firm lookup and generate the PDF report rather than working from the page.
FINRA — Financial Industry Regulatory Authority. The organisation's site, covering its structure, authority, enforcement actions and investor resources. Read the governance material before forming a view on why disclosure works the way it does.
FINRA Rules and Guidance — Financial Industry Regulatory Authority. The rulebook, including the disclosure and expungement rules that determine exactly what BrokerCheck shows. The authoritative answer to scope questions, and worth reading rather than paraphrasing from memory.
Registration, Exams and Continuing Education — Financial Industry Regulatory Authority. Documentation of the CRD system, the registration categories and the qualification examinations, which is what you need to interpret the registration and exam fields correctly.
FINRA Arbitration and Mediation — Financial Industry Regulatory Authority. The dispute resolution forum and the route to award documents. The awards behind customer dispute disclosures are where the actual facts are.
Investment Adviser Public Disclosure — US Securities and Exchange Commission. The parallel system for investment advisers and their representatives. Mandatory second lookup for any subject, and the reason many apparently unregistered people turn out to be registered.
Investor.gov — SEC Office of Investor Education and Advocacy. Plain-language explanation of the disclosure categories, the registration regimes and the complaint routes. The right thing to hand a victim or a non-specialist client.
North American Securities Administrators Association — NASAA. The organisation of state and provincial securities regulators, and the route to the state regulator with jurisdiction. State regulators hold material that never reaches the public federal record.
National Futures Association — NFA. Registration and disciplinary information for futures, commodities and retail forex professionals, covering a population BrokerCheck does not.
SEC Litigation and Administrative Proceedings — US Securities and Exchange Commission. Full text of Commission enforcement actions. Where a regulatory disclosure cites an SEC matter, this is the underlying document.
FINRA API Developer Center — Financial Industry Regulatory Authority. FINRA's documented, credentialed API programme over its published datasets. The supported route for programmatic access, and the correct alternative to scraping the website backend.
Public Investors Advocate Bar Association — PIABA. Investor-side bar association that has published sustained research on expungement and on gaps in the disclosure regime. Read it to understand what the record does not show and why.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this source: it resolves subjects to CRD numbers rather than names, stores dated copies of the registration record so that later removals are visible as changes, links representatives to firms and firms onward to corporate ownership, and alerts on new disclosure events for the small set of subjects that warrant monitoring.. Browse the full source catalogue, or follow any tag above into the rest of the library.