FINRA Rule 3310: AML programs for small broker-dealers

Rule 3310 is a FINRA rule, so it binds FINRA member firms: broker-dealers, whatever their size. A firm of three registered people that introduces accounts to a clearing firm needs a written program just as a large self-clearing firm does. What changes with size is how much the program has to say, because most of its parts are risk-based: they scale with the products, the customers and the ways money moves through the firm.

A stand-alone investment adviser is not a FINRA member, so Rule 3310 does not reach it; this guide covers the broker-dealer side only. Where AML sits among a member firm's other duties (supervision, communications, books and records, reporting) is mapped in FINRA compliance for small broker-dealers.

The duty to run an AML program comes from the Bank Secrecy Act, through FinCEN's rule for broker-dealers, 31 CFR 1023.210. Rule 3310 is FINRA's version of that same program, and the federal rule points back to it: a broker-dealer's program must also comply with “the rules, regulations, or requirements of its self-regulatory organization governing such programs”. So a member firm writes one program that meets both. Read side by side, the two texts list nearly the same parts. The one figure FINRA adds is the testing calendar.

Two practical points follow. First, an examiner reading your program will read it against both texts, so cite both where they meet. Second, the cadence of the independent test is a FINRA figure: the federal text asks for testing but sets no interval.

Rule 3310 says the program “shall, at a minimum” do six things, lettered (a) to (f). Each one becomes a chapter of your written program. The right-hand line is what a small firm usually has to write down to show the part exists; it is our reading, not rule text.

Part (f) is the newest. FINRA added it in 2018 to conform the rule to FinCEN's customer due diligence rule (Regulatory Notice 18-19), and the current text has applied since May 11, 2018. It asks for “appropriate risk-based procedures for conducting ongoing customer due diligence”, including understanding “the nature and purpose of customer relationships for the purpose of developing a customer risk profile” and ongoing monitoring that, on a risk basis, maintains and updates customer information, beneficial owners of legal entity customers included.

Card 02

Most small firms do not start from a blank page. FINRA lists an AML template for small firms on its compliance tools page, and the template's own page says it provides “text examples, instructions, relevant rules” and other resources for developing an AML plan for a small firm. That page shows updates dated July 18, 2018 and September 8, 2020. A template is a starting point, not a program: until it describes your accounts, your products and your people, and senior management has approved it, it is someone else's.

The order matters because the first step sets the size of every other one. A firm that sells only mutual funds on application, with no customer cash passing through its own hands, writes a shorter monitoring chapter than a firm whose customers wire money in and out. Both still write every chapter.

Part (a) of Rule 3310 asks for procedures that can be reasonably expected to “detect and cause the reporting of transactions required under 31 U.S.C. 5318(g)”. The reporting itself is FinCEN's rule for broker-dealers, 31 CFR 1023.320. A transaction must be reported when it is conducted or attempted by, at or through the firm, “involves or aggregates funds or other assets of at least $5,000”, and the firm “knows, suspects, or has reason to suspect” that the transaction, or a pattern it belongs to, meets one of four descriptions.

The clock starts at “the date of the initial detection”, so your procedures should say what counts as detection in your firm: an alert reviewed, a rep's escalation, a clearing firm's question. When several broker-dealers are involved in one transaction, the duty rests with each of them, though one report containing all relevant facts is enough. Keep a copy of each SAR and the supporting documentation “for a period of five years from the date of filing the SAR”.

A SAR does not replace FINRA reporting. The federal rule says filing one “does not relieve a broker-dealer from the responsibility of complying with any other reporting requirements” of the SEC or a self-regulatory organization, so an event listed in Rule 4530 still goes to FINRA on its own clock; see the Rule 4530 reporting guide. Firms that monitor trading activity with software compare the options in trade surveillance software.

Three federal duties sit under this heading, and the program has to cover each. The customer identification program (CIP) comes first: FinCEN requires a broker-dealer to keep a written CIP “appropriate for its size and business”, and says the CIP “must be a part of” the AML program. Its procedures must let the firm “form a reasonable belief that it knows the true identity of each customer”.

The firm then verifies identity “within a reasonable time before or after the customer's account is opened”, by documents, by non-documentary methods or both, and the CIP says which and when. It also checks whether the customer appears on any government list of known or suspected terrorists or terrorist organizations designated by Treasury, and gives customers adequate notice that it is asking for information to verify their identities. A small introducing firm may lean on its clearing firm's systems here; the rule allows reliance on another financial institution only on the conditions it sets, so write those conditions into the program rather than assuming them.

In all other respects those records follow Exchange Act Rule 17a-4, the same rule that sets the format of the rest of your books; see SEC Rule 17a-4 and WORM storage.

Beneficial owners of legal entity customers

The second duty applies when the customer is a company, partnership or similar entity. The firm identifies its beneficial owners when a new account is opened, unless the rule excludes the customer or exempts the account, and verifies each one's identity on risk-based procedures. A beneficial owner is each individual who owns “25 percent or more of the equity interests”, directly or indirectly, and the one “single individual with significant responsibility to control, manage, or direct” the entity, such as a chief executive, a managing member or a general partner. By our reading, that puts at least one control person on file for every covered legal entity account, even where no one reaches 25 percent.

Ongoing customer due diligence

The third duty is Rule 3310(f): understand “the nature and purpose of customer relationships for the purpose of developing a customer risk profile”, then monitor to identify and report suspicious transactions and, on a risk basis, keep customer information current. The risk profile is the link between the two halves of the program. A customer whose activity fits the profile raises nothing; activity that does not fit is what the monitoring chapter is there to catch. The suitability and Regulation Best Interest profile your reps already collect overlaps with it, which is covered in the Rule 2111 suitability guide.

Part (d) asks the firm to designate “an individual or individuals responsible for implementing and monitoring the day-to-day operations and internal controls of the program” and to identify them to FINRA. That person “must be an associated person of the member”, and the firm gives “prompt notification to FINRA regarding any change in such designation(s)”.

Supplementary Material .02 adds that each member must “identify, review, and, if necessary, update” that information in the manner Rule 4517 prescribes. Put the review on the same calendar as the rest of your FINRA contact information, and check Rule 4517 itself for its timing.

The rule ends that sentence: “in which case such ‘independent testing’ is required every two years (on a calendar-year basis)”. So the test is yearly for any firm that executes customer transactions, holds customer accounts or introduces them: any firm with customer accounts, held or introduced. The two-year cycle is for firms with no customer accounts in any of those senses. Supplementary Material .01 adds that all members “should undertake more frequent testing than required if circumstances warrant”: a new product line, a new way of opening accounts, or findings from the last test.

Who tests is the harder question in a small firm. The tester must have “a working knowledge of applicable requirements under the Bank Secrecy Act and its implementing regulations”, and three people are ruled out.

In a firm where the owner is the principal, the compliance officer and the AML compliance person, and the two other staff report to that one person, those exclusions can leave no one inside the firm who may test. That is why the rule allows “a qualified outside party”. Try your own case:

When you buy the test, ask the provider who on its side runs it and whether that person also wrote or runs any part of your program. The FINRA compliance consultants compared page reads each firm's own pages for an AML independent test column, alongside branch inspections and the annual reports. A test the rule allows is not automatically a good one: agree the scope in writing (each of the six parts, a sample of accounts and alerts, the SAR decisions) before it starts.

Part (e) is one line: “Provide ongoing training for appropriate personnel.” FinCEN's rule asks for ongoing training for “appropriate persons”. Neither text sets a frequency, a length or a syllabus, so the program sets them and then follows them. A workable reading for a small firm: everyone who opens accounts, moves money or securities, or reviews alerts is appropriate; each is trained on the red flags of the firm's own business and on the confidentiality of SARs; and the record shows who attended, when, and what was covered.

A program is judged by what it leaves behind. These are the records it produces, with the rule behind each and the retention period where a rule states one. Rule 3310 itself sets no retention period, so for the first four rows ask your compliance counsel how your firm's books and records duties apply; the Rule 4511 guide and the retention calculator are the place to start.

Software helps with parts of this file: monitoring alerts and their review, customer records, training attendance. It does not write the program or stand in for the independent tester. Broker-dealer platforms are compared in broker-dealer compliance software, and the full rule text is on FINRA's Rule 3310 page. None of this is legal advice; your compliance counsel is the one to sign off on how the program fits your firm.