I think his main mistake was using the same account for multiple trades.
Lesson from this case is you have to create new account every week or month, so even if caught they cannot prove that you have operated large-scale business.
Of course, use VPN and burner phone & SIM.
yeah as it was, he made himself low-hanging fruit. they can only establish that unlicensed activity has taken place after > $10k in money is transferred. since he was dealing below that threshold, multiple deals were necessary, so ditching his account regularly
may have prevented the agents from targeting him.
the problem is, it's hard to collect 5%+ premiums with good volume using new (no feedback) accounts.