By Adam DiPaolo and Joelle Best
Action Required: FINRA Implementing Identity Verification for IARD Accounts with SSN Access
FINRA is rolling out a new identity verification requirement for FINRA Gateway – the platform through which investment advisers access IARD to file Form ADV, manage registrations, and perform other regulatory filings. Effective May 11, 2026, FINRA is phasing in identity verification through ID.me, with different account types subject to the requirement on different timelines.
What is This and Why Now?
Identity verification is a step beyond the existing multi-factor authentication (MFA) requirement. Rather than simply confirming that a user has access to a registered device, ID.me confirms that the person logging in is actually who the account says they are. FINRA’s stated rationale is to protectsensitive personal data against account takeover and fraud, with a focus on Social Security numbers (SSNs).
Who Is Affected at Investment Adviser Firms?
The full rollout covers Super Account Administrators (SAAs), Account Administrators (AAs), and users with access to sensitive data. For investment adviser firms specifically, the relevant sensitive data category is Social Security numbers. Fingerprint and criminal history data (applicable to broker-dealers) generally do not apply to IA-only firms.
The nine-month rollout for IA firms begins May 11, 2026. SAAs will be prompted to complete the verification first, followed by AAs, and then users with SSN access.
FINRA will send each affected user an email approximately one week before their account is activated for the requirement.
What Does Verification Actually Involve?
Users will be redirected to ID.me after logging into the FINRA platform. To complete verification, users will need a valid government-issued photo ID (driver’s license, passport, or state ID), a device with a camera, and their SSN. Users should set up an ID.me account using a personal email address, not a work email, so the account remains accessible if the person changes firms. Anyone who already has an ID.me account (e.g., for IRS or Social Security Administration access) should use the existing account rather than create a new one. Once verified, identity verification must be renewed every two years.
For SAAs: Additional Certification Obligation
Separately, FINRA’s 2026 Entitlement Certification period runs May 11 through September 11, 2026. SAAs for firms with more than one user or administrator account must certify that individuals have the appropriate level of access required to perform their job responsibilities. FINRA has extended the certification deadline to accommodate the identity verification rollout.
Practical Checklist
- Identify who holds SAA, AA and general user accounts for IARD at your firm
- Review which accounts have access to SSNs
- Remove SSN access from any account where it isn’t operationally required
- Ensure SAAs and AAs are prepared to complete ID.me verification when prompted – government-issued ID and personal email address required
- Complete the annual Entitlement Certification by the September 11, 2026 deadline
- Watch for FINRA’s one-week advance email before your account’s verification date.
Questions about your firm’s IARD entitlement structure or how to audit user access? Contact us.