The fix protocol has a logon message, but I can't find anything on how those accounts are created and verified.
Is there some other out of band mechanism for those accounts to be created?
Yes. It's out of band.
The way that accounts or users are managed is dependent upon the application's implementation and the organization's practices.