Brokerage firm’s deficient customer identification program leads to $1 million penalty