The $50 million protection headline sits inside a $1 billion shared pool

Brokerage protection pages tend to lead with the largest number available. Robinhood says its additional insurance is limited to a combined return of $50 million per customer. Charles Schwab publishes a $150 million per-customer limit. Webull’s fully disclosed arrangement through Apex lists $37.5 million for one customer’s securities. Read alone, those figures can look like dedicated limits standing behind every eligible account. They are not. Each sits inside an aggregate policy pool shared across covered customers, and in three disclosures examined by FXBrokers.ai the pool is only four to 20 times the stated per-customer ceiling.[1][2][3]

Robinhood’s page says the policy provides up to $1 billion in aggregate and a combined return of up to $50 million per customer, including $1.9 million of uninvested cash. Dividing the aggregate cap by the headline customer cap gives 20. Schwab publishes $600 million in aggregate protection and a $150 million combined customer limit, including up to $1.15 million of cash: a ratio of four. Webull’s fully disclosed Apex arrangement has a $150 million aggregate cap and a $37.5 million securities limit for one customer, also a ratio of four before considering the separate $900,000 cash sublimit.[1][2][3]

Those ratios are not forecasts of how many claims an insurer would pay, and they should not be interpreted as a queue in which the twenty-first Robinhood customer or fifth Schwab customer receives nothing. Customer property recovered from the failed broker, SIPC advances, the composition of claims, policy terms, sublimits and the distribution of losses would all affect an actual liquidation. The ratios establish a more basic point: the maximum shown beside one customer is not a separately reserved pot for every customer. It is a ceiling within a finite shared contract.[1][2][3][4]

Excess insurance is not SIPC itself

The first conceptual error is the label. SIPC is a congressionally created non-profit corporation that works to restore missing cash and securities when a member brokerage fails financially. Standard statutory protection is generally limited to $500,000 per separate customer capacity, including a $250,000 cash limit. “Excess SIPC” is private insurance purchased by a broker or clearing firm to respond after SIPC limits are exhausted. SIPC says it does not offer, regulate or mandate those private policies and is not involved in administering them.[1][2][5][6][4]

That distinction changes what the published numbers mean. A brokerage page can accurately describe a policy as supplementing SIPC, but the insurer—not SIPC—sets the excess contract’s aggregate limit, per-customer limits, exclusions and claims mechanics. The policy generally addresses missing eligible property in a broker failure. It does not insure a portfolio against a fall in market value, a bad investment decision or ordinary trading losses. Robinhood, Schwab, Webull, Fidelity and E*TRADE all state some version of that limitation.[1][2][3][5][6]

It also means the relevant legal entity matters. Robinhood’s disclosure names Robinhood Markets, Robinhood Financial and Robinhood Securities under a group policy. Schwab’s page concerns Charles Schwab’s brokerage protection. E*TRADE’s page says Morgan Stanley maintains a $1 billion aggregate firmwide policy covering Morgan Stanley Smith Barney clients. Webull’s protection changes with the clearing arrangement: an omnibus relationship with Apex is covered by one structure, while fully disclosed accounts rely on an Apex-purchased policy with different limits. A customer cannot safely compare the largest numbers without first identifying which broker-dealer and clearing model holds the account.[1][2][3][6]

The disclosures are structurally different

Fidelity illustrates why a simple ratio cannot always be calculated. It publishes $1 billion of aggregate excess coverage, no per-customer dollar limit for securities and a $1.9 million per-customer cash limit. “No securities limit” does not mean unlimited insurance. The $1 billion aggregate still constrains the entire policy, and the amount recoverable would also depend on eligible net equity and the policy terms. Morgan Stanley’s E*TRADE page similarly states a $1 billion firmwide aggregate cap and a $1.9 million per-client limit for uninvested cash without publishing a securities ceiling on that page.[5][6]

Webull’s two arrangements show another source of confusion. Under its omnibus clearing relationship, the company states an aggregate limit of $100 million, a $1.9 million cash limit for one customer and no securities sublimit. For fully disclosed accounts at Apex, it states a $150 million aggregate, a $37.5 million securities limit and a $900,000 cash limit. A Webull customer therefore needs to know the account’s clearing arrangement before applying the protection page. The brand name alone does not resolve the contract.[3]

Cash terminology creates a further trap. The excess-policy cash sublimit applies to cash awaiting investment within the brokerage-protection framework. Cash swept to programme banks may instead be eligible for FDIC insurance, subject to bank, ownership-category, capacity and recordkeeping rules. A customer’s app may display one overall cash balance even though its legal protection changes after a sweep. This investigation compares only the excess-brokerage policy disclosures; it does not combine those private limits with separate bank-deposit insurance.[1][5][6]

Why the aggregate is not a hidden defect

A shared aggregate cap is not evidence that a broker has misrepresented its protection or that the policy is inadequate. Insurance contracts commonly use both occurrence or customer limits and an aggregate ceiling. The responsible conclusion is disclosure-based: a consumer should be shown both numbers with equal prominence because neither is intelligible alone. A $150 million customer ceiling can sound stronger than a $50 million ceiling, while the corresponding aggregate pools of $600 million and $1 billion create a very different relationship between the two limits.[1][2]

The practical exposure is also remote and contingent. Securities held correctly in customer name or segregated under the customer-protection rules are not supposed to become general assets available to the broker’s creditors. SIPC and private excess insurance become relevant when a failed brokerage has missing customer property and the recovery process leaves a shortfall. The protection should therefore be understood as a backstop to custody and segregation, not a substitute for them.[2][6][4]

That is why the aggregate-to-limit ratios are best treated as a disclosure diagnostic rather than a solvency stress test. Robinhood’s ratio of 20, Schwab’s ratio of four and Webull’s fully disclosed securities ratio of four identify how much larger the shared policy is than one published ceiling. They do not estimate the number or size of future claims. To do that would require the private policy wording, the distribution of eligible customer net equity, recoveries of customer property, SIPC treatment and the facts of a specific liquidation—information not supplied by these public pages.[1][2][3][4]

A clearer standard for broker comparison

Broker comparison tables should separate at least six fields: the SIPC member legal entity; the standard SIPC limit; the excess-policy aggregate; the securities limit per customer, if any; the cash sublimit; and the clearing arrangement to which the policy applies. They should also state that market losses are excluded and avoid adding SIPC’s statutory maximum to the private aggregate as though both were guaranteed cash pools. The policies respond sequentially and conditionally, not as a marketing sum.[1][2][3][5][6][4]

The central finding is therefore not that a particular broker’s protection is unsafe. It is that the dominant headline—“up to $50 million,” “up to $150 million” or “no per-customer securities limit”—is only one side of the contract. The aggregate pool is the other. Publishing both allows customers to compare like with like and prevents a maximum individual limit from being mistaken for money ring-fenced separately behind every account.[1][2][3][5][6]

Customer count changes the practical meaning of the pool

An aggregate policy is shared, so its usefulness in an extreme failure depends on the number and size of eligible shortfalls, not merely on the highest account value. Twenty Robinhood customers each reaching the published $50 million combined limit would exhaust a $1 billion aggregate. Four Schwab customers each reaching $150 million would exhaust a $600 million aggregate. Those are mechanical illustrations of the disclosed ratios, not forecasts of claims or statements that claims would be paid at the maximum.[1][2]

Real liquidations would be more complex. SIPC first seeks to return customer property and applies its statutory limits to missing assets. Excess coverage then operates under policy definitions, exclusions, valuation rules and an aggregate cap. Many customers may have no eligible shortfall because securities are located and returned. Others may have claims far below the headline maximum. The ratio therefore reveals concentration capacity under an extreme assumption; it does not predict recovery in an actual insolvency.[1][2][3][5][6][4]

The disclosure problem is that per-customer numbers are cognitively salient while aggregate limits are easy to overlook. A broker saying “up to $150 million” can be technically accurate and still leave a reader with the impression of a dedicated $150 million reserve for their account. A better presentation would place the per-customer and firmwide numbers in the same sentence and explain that all covered customers share the aggregate.[2][3]

Different custody arrangements can change which policy applies

Webull’s disclosure illustrates another complication. Fully disclosed accounts carried by Apex and omnibus accounts can fall under different excess policies and sublimits. The legal account structure—not just the Webull brand—determines the relevant coverage. A customer needs to know the carrying broker, the account registration and whether assets sit in a fully disclosed or omnibus arrangement before selecting the correct limits.[3]

The same principle applies more broadly when an introducing broker changes clearing firms, acquires a custodian or offers products through several affiliates. Cash sweep deposits, crypto assets, futures, advisory accounts and securities accounts can have different protection regimes. SIPC membership does not turn every product visible in one application into a SIPC-protected security, and excess SIPC does not expand coverage to market losses.[1][2][3][5][6][4]

The disclosure standard customers need

Every protection page should answer six questions together: the SIPC statutory limit; the excess aggregate; the per-customer securities limit; the cash sublimit; the legal entities and account types covered; and the principal exclusions. It should also say whether the policy has a separate deductible or other conditions relevant to customer recovery. None of these figures should be presented as a guarantee by the broker itself.[1][2][3][5][6][4]

The investigation’s conclusion remains narrow. The examined brokers publish real additional insurance, and the aggregate caps do not prove that the policies are inadequate. They do show that the largest customer-level headline cannot be interpreted in isolation. In a multi-customer failure, the shared pool is the binding outer boundary. That fact deserves equal prominence with the number most likely to appear in marketing.[1][2][3][5][6]

An aggregate cap is not the same as insurer assets

The published aggregate is the maximum available under the excess policy, not a statement that cash equal to that amount is ring-fenced at the broker. Payment depends on the insurer, policy terms and an eligible customer-property shortfall after the statutory process. Customers should therefore avoid describing the aggregate as a segregated reserve or as part of the broker’s own regulatory capital.[1][2][3][5][6][4]

That separation also prevents a second analytical error. A broker can be well capitalised and still purchase excess coverage; the insurance does not prove weakness. Conversely, a large policy does not replace net-capital, custody and segregation rules designed to reduce the chance and size of a shortfall in the first place. Protection is layered, and each layer addresses a different failure mechanism.[1][2][3][5][6][4]

Report an error or submit an update