The US Financial Industry Regulatory Authority has updated its Entitlement Program requirements to mandate identity verification through ID.me for users accessing sensitive FINRA-managed systems. The requirement is being rolled out in stages, with full enforcement for Super Account Administrators and Account Administrators scheduled for the 2026 Entitlement Certification Period beginning in May.
FINRA documentation specifies that users must complete identity verification to the NIST Identity Assurance Level 2 standard. An operationally significant requirement is strict name matching between a user’s legal name on their ID.me account and the corresponding FINRA Entitlement account. Discrepancies must be resolved before access is granted, underscoring the regulator’s emphasis on high-confidence identity binding for privileged roles.
The update reflects a broader shift in how financial regulators view third-party digital identity providers. Rather than positioning identity verification as a convenience layer, FINRA is treating it as a core control within access governance, particularly for administrative and oversight functions. The documentation also indicates that identity verification may be required during account recovery and at defined intervals, suggesting a move toward periodic re-verification rather than one-time proofing.
The change places identity assurance more squarely within the domain of access control and insider risk mitigation. It also sets a precedent that may influence other self-regulatory organizations as they reassess how identity proofing fits into entitlement management and privileged access frameworks.
Sources: FINRA
—
By Cass Kennedy
