FINRA compliance for small broker-dealers

A small broker-dealer's compliance work keeps coming back to six areas. Each one has its own guide on this site; this page is the map. It says what each area asks of a firm with a handful of registered people, where the areas meet, and what falls due in a year.

FINRA rules bind FINRA member firms and the people associated with them. Several duties on this map come from SEC rules under the Exchange Act instead (the books-and-records rules 17a-3 and 17a-4, and Regulation Best Interest), and they bind a registered broker-dealer the same way. A stand-alone investment adviser is not a FINRA member and runs its program under the Advisers Act; that side is mapped in RIA compliance. A firm registered both ways keeps both programs.

The lead sentence above is the one to keep in mind throughout. A firm can buy software, hire a consultant or share work with its clearing firm, but the rule leaves the responsibility with the member.

Card 02

Supervision is the area every other one runs through. Rule 3110 asks for a system “reasonably designed to achieve compliance”; Rule 3120 checks that system; Rule 3130 has the chief executive put a name to it each year. Read them as one sequence.

The rule is written for firms of every size. Review procedures “must be appropriate for the member's business, size, structure, and customers”, and the extra content Rule 3120 requires in the annual report applies only to firms that “reported $200 million or more in gross revenue” in the prior year. A small firm still owes the report itself.

The point a small firm meets first is evidence. A review of correspondence must leave a record naming the reviewer, the item, the date and any action, and Rule 3110.07 adds that “merely opening a communication is not sufficient review.” That record is what an email archive with a review queue keeps for you. The full rule, with its inspection cycles and the home-office provisions, is in the Rule 3110 supervision guide.

Rule 2210 sorts every written communication into one of three kinds, and the kind decides who signs off before it goes out. The test is the audience: how many retail investors receive it in any 30 calendar days.

Two practical points follow. A post on an online interactive forum, and a retail communication that makes no recommendation and promotes no product or service, need no prior principal approval, but they are still supervised like correspondence. And the file has to show the work: the firm keeps each retail and institutional communication with its dates of first and last use and “the name of any registered principal who approved the communication and the date that approval was given.”

Some pieces are filed after the fact for every firm, “within 10 business days of first use or publication”, such as retail communications promoting a specific registered investment company. FINRA's rule text now also includes an exception for projections and targeted returns, subject to conditions. The detail, and social media, is in the Rule 2210 guide; firms routing approvals through a tool compare advertising review software.

Two standards cover a broker-dealer's recommendations, and FINRA's own rule decides which one applies. Rule 2111.08 reads: “This Rule shall not apply to recommendations subject to SEA Rule 15l-1 (‘Regulation Best Interest’).” By our reading of the two rules, that sorts recommendations like this:

Regulation Best Interest is met through four component obligations: disclosure, care, conflict of interest and compliance. Rule 2111, where it applies, is “composed of three main obligations: reasonable-basis suitability, customer-specific suitability, and quantitative suitability,” and a firm “cannot disclaim any responsibilities under the suitability rule.” Rule 2111 turns on the customer's investment profile, and Rule 17a-3(a)(35) has the firm keep “a record of all information collected from and provided to the retail customer” under Regulation Best Interest. The account record matters as much as the recommendation.

A firm with retail customers also delivers Form CRS “before or at the earliest of” a recommendation, an order or the opening of a brokerage account, records the delivery date, and keeps each Form CRS for six years after it is created. Our Form CRS builder drafts the summary; the obligations are set out in the Rule 2111 suitability guide.

The records area has two SEC rules and two FINRA rules, and each answers a different question. Rule 17a-3 says which records a broker-dealer makes: blotters, ledgers, order memoranda, confirmations, complaint records, the record of principal approval of communications and more. Rule 17a-4 says how long each is kept. FINRA Rule 4511 has members make and preserve books and records as the FINRA rules, the Exchange Act and its rules require, and Rule 4512 sets what every customer account record holds, including the “name of and contact information for a trusted contact person age 18 or older” for non-institutional accounts.

Rule 17a-4(a) and (b) state a length and an “easily accessible” window, but not the event the period runs from, so a firm's procedures should say how it counts. Our retention calculator runs these periods for a list of records, and the books and records checklist lists what to make.

That format is where storage choices come in: Rule 17a-4(f) sets the electronic recordkeeping standard, explained in Rule 17a-4 and WORM storage.

The rest of the FINRA side, including the six-year default for records with no stated period, is in the Rule 4511 guide.

The thresholds in (G) are a settlement, award or judgment “for an amount exceeding $15,000”, or “exceeding $25,000” when the member itself is the defendant or respondent. Internal discipline of an associated person is reported too when it involves withholding pay or fines above $2,500, a suspension, a termination or a significant limitation. FINRA's own findings under (A), (C) and (D) need no report.

Two duties sit behind the clock. Associated persons must “promptly report to the member” any (a)(1) event, so the firm needs a way for them to tell it. And paragraph (b) adds a second 30-day report once the firm “has concluded or reasonably should have concluded” that it or an associated person violated the rules; FINRA expects those only for conduct with “widespread or potential widespread impact” or a material systems failure.

Separately, every firm files statistical and summary complaint information “by the 15th day of the month following the calendar quarter in which customer complaints are received”. By our reading of the rule, for calendar quarters that is April 15, July 15, October 15 and January 15. The events, the filings under paragraph (f) and the complaint records behind them are in the Rule 4530 reporting guide.

The program “must be approved, in writing, by a member of senior management,” and it has six minimum parts. The AML compliance person must be an associated person of the member, named to FINRA, with prompt notice to FINRA of any change.

The tester must have “a working knowledge of applicable requirements under the Bank Secrecy Act” and cannot be the person who performs the functions being tested, the AML compliance person, or anyone who reports to either. In a three-person firm that can rule out everyone inside it, which is why the rule allows “a qualified outside party”; see FINRA compliance consultants. FINRA's compliance tools page lists an Anti-Money Laundering Template that gives “text examples, instructions, relevant rules, websites and other resources” to help small firms write the plan. The program, part by part, is in the Rule 3310 AML guide.

Most of the map above runs on a clock. Some duties come round every quarter or every calendar year, some on a longer cycle, and some start the moment something happens. The list below holds only duties whose timing the rule text states; tick the boxes that describe your firm and it drops what does not apply.

One annual item sits outside the six areas. Rule 4370 has a member of senior management, who must be a registered principal, approve the business continuity plan and conduct its annual review; the plan is also updated on any material change, and customers are told how it handles a significant business disruption at account opening, on the firm's website if it has one, and by mail on request. FINRA's compliance tools page lists a Business Continuity Planning Template beside the AML one.

The sentence at the top of this guide settles what outside help can do: it can do work, but it cannot take the duty. Within that, a small firm can split the load two ways. Software keeps what has to be kept and queues what has to be reviewed: the communications archive, the review record with reviewer and date, the trade review, the complaint log, the calendar. Those tools are compared in broker-dealer compliance software.

A consultant brings judgment the firm may not have in house: drafting or rewriting the written supervisory procedures, running the AML independent test as a qualified outside party, or acting as an outsourced compliance officer. Those firms are compared in FINRA compliance consultants, and the outsourcing question itself in outsourced chief compliance officer. Whichever you choose, reviews of correspondence are still conducted by a registered principal and evidenced in writing.

This guide maps the rules; it is not legal advice. Check your procedures against the full rule text in FINRA's rulebook and with your compliance counsel.