FINRA Rule 3110: supervision for small firms

Rule 3110 is a FINRA rule, so it binds FINRA member firms: broker-dealers and the people associated with them. A stand-alone investment adviser registered with the SEC is not a FINRA member and runs its program under the Advisers Act instead, chiefly the compliance-program rule covered in our guide to Rule 206(4)-7. A firm registered both ways keeps both programs, with 3110 governing the broker-dealer side.

The rule is short on prescriptions and long on outcomes. The standard is a system “reasonably designed to achieve compliance”, and “final responsibility for proper supervision shall rest with the member.” For a firm of three to twenty registered people that means the owner cannot hand the duty to a vendor or a consultant. Software can capture and flag; a registered principal still decides, and the firm still answers for the result. The rest of FINRA's rulebook for a small firm is mapped in FINRA compliance for broker-dealers.

Paragraph (a) lists what the system must provide at a minimum. Most of it is a register of names and places: who supervises which business, which offices are OSJs or branches, and who reports to whom. Every other control hangs off that register, so it is the first thing to get right.

The annual meeting is the one item with a stated cadence in paragraph (a): it is held “no less than annually, in an interview or meeting conducted by persons designated by the member at which compliance matters relevant to the activities of the representative(s) and principal(s) are discussed.” Keep the agenda, the attendance list and the date. Those three papers are what proves the meeting happened.

Rule 3110 has no small-firm exemption. It has four provisions that give a small firm room, three by naming size or business model and one by allowing risk-based review. Each one works only if the firm writes down why. The written reason is the whole allowance: without it, the general rule applies.

The owner-principal is the case most small firms meet first. When the only principal is also the top producer, paragraph (b)(6)(C) is where the firm explains how that person's own business is reviewed. One answer is a second principal for that review; another is an outside reviewer. Either way the explanation lives in the procedures, not in anyone's head. Outside help is compared in FINRA compliance consultants.

The verbs carry the weight: establish, maintain, and enforce. A purchased template establishes. Updating it when the firm adds a product or a channel maintains it, and paragraph (b)(7) says that update happens “promptly”, both when rules change and “as changes occur in its supervisory system.” Enforcing means the reviews the manual describes actually leave records. A manual that says “the principal reviews all outgoing email daily” when the log shows weekly sampling is worse than a manual that says weekly sampling.

Two retention points sit next to the manual. The record of who was designated as supervisory personnel, and when, is kept for three years. Each superseded version of the manual is kept too: Exchange Act Rule 17a-4(e)(7) keeps compliance, supervisory and procedures manuals “until three years after the termination of the use of the manual.” Our retention calculator runs those periods for a list of records.

Card 02

Two streams are covered. Correspondence goes to customers and the public; under FINRA Rule 2210 it is a written communication sent to “25 or fewer retail investors within any 30 calendar-day period”, and “all correspondence is subject to the supervision and review requirements of Rules 3110(b) and 3110.06 through .09.” Internal communications are the messages between your own people. The words “including electronic” reach every channel the firm lets people use for business, which is why texting and chat apps belong in the procedures (see off-channel communications).

The review has a job. For correspondence it must “properly identify and handle in accordance with firm procedures, customer complaints, instructions, funds and securities, and communications that are of a subject matter that require review under FINRA rules and federal securities laws.” For internal communications it must identify the ones whose subject matter requires review. A rep promising a customer a return, a customer asking to move money, an unhappy reply that is really a complaint: those are what the review exists to catch.

Before use, or after with surveillance

The rule does not require every message to be approved before it is sent. Supplementary Material .06 lets a firm decide by risk how far to review correspondence beyond the subjects above. But if the procedures do not require pre-use review of all correspondence, they must provide for training, documentation of that training, and “surveillance and follow-up”. In practice that is the lexicon and sampling setup in your archive. The archives that capture texts and email are compared in FINRA-compliant texting and email archiving software.

What a review record must show

Reviews “must be conducted by a registered principal and must be evidenced in writing, either electronically or on paper.” Supplementary Material .07 names the four things the evidence must identify. The log below is an invented example for a small firm, laid out field by field.

A principal may hand parts of the work to people who are not registered, such as an assistant who clears false-positive flags. Supplementary Material .08 allows it, but the principal “remains ultimately responsible for the performance of all necessary supervisory reviews.” Write down who does what, and keep the principal's sign-off in the record.

The messages themselves are kept under Supplementary Material .09: “for the period of time and accessibility specified in SEA Rule 17a-4(b)”, and the names of the people who prepared outgoing correspondence and who reviewed it “shall be ascertainable from the retained records.” Storage format is a separate question, covered in Rule 17a-4 and WORM storage.

Correspondence gets the attention, but paragraph (b) asks for two more reviews, and paragraph (d) adds a third.

• Every transaction, reviewed by a principalProcedures for “the review by a registered principal, evidenced in writing, of all transactions relating to the investment banking or securities business of the member.”FINRA Rule 3110(b)(2)
• Every written complaint, captured and answeredProcedures “to capture, acknowledge, and respond to all written (including electronic) customer complaints.” Complaints also feed FINRA reporting: quarterly statistics by the 15th of the month after the quarter, and a 30-day report for complaints alleging theft, misappropriation or forgery. See FINRA Rule 4530 reporting.FINRA Rule 3110(b)(5); 4530(a)(1)(B), (d)
• Trades that may break insider-trading or manipulation rulesA process to review trades in firm accounts, associated persons' accounts and covered accounts, and “each member must conduct promptly an internal investigation into any such trade.” How firms run that review is in our trade surveillance guide.FINRA Rule 3110(d)(1)-(2)

A firm that does investment banking also files quarterly reports under paragraph (d)(3), “within ten business days of the end of each calendar quarter.” A firm with no investment banking business can say so in its procedures, so the next reader knows the clause was considered.

Supervision starts before someone joins. Paragraph (e) says “each member shall ascertain by investigation the good character, business reputation, qualifications and experience of an applicant”. The procedures “shall, at a minimum, provide for a search of reasonably available public records”. The check of the applicant's Form U4 runs to a deadline: “no later than 30 calendar days after the form is filed with FINRA.”

Paragraph (c) has two layers. The firm reviews its businesses: “at least annually (on a calendar-year basis), of the businesses in which it engages.” It also inspects its locations, on a cycle set by what each location is. A one-office firm whose office is an OSJ inspects it every calendar year. A rep working from a location the firm classes as non-branch still has to be inspected on a regular schedule.

Each inspection “must be reduced to a written report and kept on file by the member for a minimum of three years”. Where a non-branch cycle runs longer than three years, the report is kept “at least until the next inspection report has been written.” Whatever else it covers, the report must test and verify the firm's procedures for five things.

1. 01Safeguarding of customer funds and securities(c)(2)(A)(i)
2. 02Maintaining books and records(c)(2)(A)(ii)
3. 03Supervision of supervisory personnel(c)(2)(A)(iii)
4. 04Transmittals of funds or securities(c)(2)(A)(iv)
5. 05Changes of customer account information(c)(2)(A)(v)

The person inspecting should not be assigned to the location or supervised by someone who is. In a firm of five that may not be possible, and paragraph (c)(3) accepts it when it is “not possible either because of a member's size or its business model”, provided the reason is written into the inspection report.

Records also have a physical address. Exchange Act Rule 17a-4(l) says “records for the most recent two year period required to be made pursuant to § 240.17a-3(f) and paragraphs (b)(4) and (e)(7) of this section which relate to an office shall be maintained at the office to which they relate”, unless the firm can produce them promptly on request. An inspector checking books and records should test that the office's correspondence and its copy of the manual can be produced. The full broker-dealer record set is in FINRA Rule 4511.

A rep's home is not automatically a branch office. Under paragraph (f)(2)(A)(ii) a residence is excluded from the branch-office definition when its conditions are met, among them:

• “Only one associated person, or multiple associated persons who reside at that location and are members of the same immediate family, conduct business at the location”
• “The location is not held out to the public as an office and the associated person does not meet with customers at the location”
• “Neither customer funds nor securities are handled at that location”
• “Electronic communications (e.g., e-mail) are made through the member's electronic system”

FINRA Rule 3110(f)(2)(A)(ii)

The last condition ties the home office back to the review section: if business email runs through a personal account, the residence fails the test and the messages sit outside the firm's review.

Two later changes concern supervisors who work from home. Per FINRA Regulatory Notice 24-02 (January 23, 2024), Rule 3110.19 (Residential Supervisory Location) took effect June 1, 2024. It treats “a private residence at which an associated person engages in specified supervisory activities” as a non-branch location, inspected “on a regular periodic schedule (presumed to be at least every three years)”, if the firm and the person meet the rule's conditions; the firm must “conduct and document a risk assessment”. Rule 3110.18 started a “voluntary, three-year remote inspections pilot program” on July 1, 2024, joined by an opt-in notice; a participating firm must give FINRA data and information, including quarterly data, for each pilot year. The notice's schedule runs to June 30, 2027.

Rule 3110 sits beside two rules that check it. Under Rule 3120, designated principals run a system that tests and verifies that the supervisory procedures are reasonably designed, and amends them “where the need is identified”. Once a year at least, they report to senior management.

Firms that “reported $200 million or more in gross revenue” in the prior year add more to that report; a small firm below the line does not. Rule 3130 then has the firm name a chief compliance officer on Schedule A of Form BD, and has the CEO certify each year that the firm has processes to establish, maintain, review, test and modify its written compliance policies and supervisory procedures, “and that the chief executive officer(s) has conducted one or more meetings with the chief compliance officer(s) in the preceding 12 months”. In a two-principal firm the CEO and the CCO may be the only people at that meeting; minute it anyway.

Firms that want the calendar and the evidence in one system compare broker-dealer compliance software. This guide explains the rule; it is not legal advice, and your compliance counsel should check your procedures against the full rule text on FINRA's Rule 3110 page.