Best compliance software for small broker-dealers
Six platforms read against the supervision and record duties a FINRA member carries, not against feature lists. Three run supervision work, two are archives with review built in, and one is a suite that does some of both. Each cell says what the vendor's own pages state about broker-dealer compliance, and where they are silent.
Reviewed October 2026
Best overall
Hadrius
Its own pages name FINRA Rules 3110, 3120 and 3130, schedule branch exams by Rule 3110, review email, chat and social, and keep 17(a)-4/WORM records.
Read the review of HadriusBest for a firm that files ads with FINRA
Red Oak
Configurable review workflows with document stamping and a full audit trail, direct filing with FINRA, and records it calls SEC 17(a)-4/WORM compliant.
Read the review of Red OakBest for supervising customer accounts and trades
Docupace ComplianceEdge
Daily trade and blotter review for suitability, conflicts and registration, with review queues, escalation and audit trails across brokerage and advisory accounts.
Read the review of Docupace ComplianceEdge
The comparison table
| Vendor | Written procedures and review workflowFINRA 3110(a)-(b) | Internal inspectionsFINRA 3110(c) | Correspondence and internal-communications reviewFINRA 3110(b)(4) | Records per 17a-4: audit trail or non-rewriteable17a-4(f)(2)(i) | Trade and account surveillanceFINRA 3110(b)(2), (d) | Exam document production17a-4(j) |
|---|---|---|---|---|---|---|
HadriusSupervision platform | Meets Program built from your WSPs; names 3110, 3120, 3130 | Meets Branch exams scheduled per Rule 3110 | Meets Email, chat, social; each review time-stamped | Meets 17(a)-4/WORM retention | Meets Trades routed by risk; Reg BI flags | Meets One-click exam exports |
Red OakAd review and supervision | Partial Review workflows for ads; WSPs not stated | Not stated | Partial Online content: reviewer, date, action logged | Meets SEC 17(a)-4/WORM compliant | Not stated | Partial Retrieval stated; exam exports not named |
Docupace ComplianceEdgeAccount surveillance | Partial Supervisory approval workflows; WSPs not stated | Not stated | Not stated | Check with vendor Audit trails on reviews; 17a-4 not stated | Meets Daily trade and blotter review | Partial Audit-ready supervision reports |
ComplyCompliance suite | Partial Policies and procedures kept current; 3110 not named | Not stated | Partial Capture and review; evidence fields not stated | Meets WORM-compliant format for communications | Partial Employee trades only | Partial Audit trail exports |
Global RelayMulti-industry archive | Not stated | Not stated | Meets Lexicon tools; proof-of-review reports | Meets WORM-compliant archive | Not stated Communications surveillance only | Partial Evidentiary export; no exam named |
SmarshFinancial-services archive | Not stated | Not stated | Partial Review workflows; evidence of review not stated | Meets WORM and audit-trail methods named | Not stated Communications surveillance only | Meets PST, EML, HTML, XML |
The duties behind the six columns
A small broker-dealer buys compliance software to carry the supervisory system FINRA Rule 3110 asks every member to run. The rule puts the duty on the firm, not the tool: “Final responsibility for proper supervision shall rest with the member.” Software helps in two ways. It runs the workflow (who reviews what, and when), and it keeps the evidence an examiner asks to see. The six columns of the table come from that split.
Each FINRA duty and the column that carries it
| Duty | What the rule asks | How often | Column |
|---|---|---|---|
| Written supervisory procedures3110(b)(1), (b)(7) | Establish, maintain and enforce them; amend promptly when rules or the firm change | Ongoing | Written procedures |
| Transaction review3110(b)(2) | A registered principal reviews all transactions, evidenced in writing | Ongoing | Surveillance |
| Insider-trading trade review3110(d) | Review firm, associated-person and covered accounts; investigate promptly | Ongoing | Surveillance |
| Correspondence and internal communications3110(b)(4), .06-.07 | Reviewed by a registered principal, evidenced in writing | Risk-based | Correspondence |
| Retail communications2210(b)(1)(A) | A qualified registered principal approves each one before use or filing | Before use | Written procedures |
| Office inspections3110(c)(1)-(2) | OSJs and supervising branches yearly; other branches at least every 3 years; report kept 3 years | By office type | Inspections |
| Review of the businesses3110(c)(1) | At least annually, on a calendar-year basis | Yearly | Written procedures |
| Supervisory control report3120(a)(2) | Test results and amended procedures, to senior management | Yearly | Exam production |
| CEO certification3130(b) | Certify the processes behind policies and written supervisory procedures | Yearly | Exam production |
| Customer complaint statistics4530(d) | Reported to FINRA by the 15th of the month after each quarter | Quarterly | Exam production |
| Communications records17a-4(b)(4) | Kept three years, the first two in an easily accessible place | Ongoing | 17a-4 records |
FINRA Rules 3110, 2210, 3120, 3130, 4530; 17 CFR 240.17a-4(b)
Two duties sit outside any vendor column. Events under Rule 4530(a), such as a written complaint alleging theft or forgery, are reported to FINRA “not later than 30 calendar days” after the firm knows of them; our FINRA Rule 4530 reporting guide walks through the list. And the anti-money laundering program needs independent testing every calendar year for a firm that executes customer transactions, holds customer accounts or introduces them, and every two years otherwise (Rule 3310(c), in our FINRA Rule 3310 AML guide). For the full map of a member's duties, start with FINRA compliance for small broker-dealers.
One suite or a stack
Read the table down the inspections column and one thing stands out: only one vendor's pages say they schedule branch exams by Rule 3110. Read it down the surveillance column and the archives drop out. Most small firms end up with a stack: a supervision or review tool for the procedures and the work, and an archive for the communications record. The archives here, Smarsh and Global Relay, are compared on email alone in the best email archiving software, and surveillance tools on their own in the best trade surveillance software.
Pick the duties you want software to carry. The builder reads the same rows as the table and shows which single platform states all of them on its own pages, and which pairs do between them.
One platform
Hadrius, Comply
Two vendors together
- Red Oak with Docupace ComplianceEdge
- Correspondence review: Red OakPartial
- 17a-4 records: Red OakMeets
- Trade and account surveillance: Docupace ComplianceEdgeMeets
- Exam document production: Red OakPartial
- Docupace ComplianceEdge with Global Relay
- Correspondence review: Global RelayMeets
- 17a-4 records: Global RelayMeets
- Trade and account surveillance: Docupace ComplianceEdgeMeets
- Exam document production: Docupace ComplianceEdgePartial
- Docupace ComplianceEdge with Smarsh
- Correspondence review: SmarshPartial
- 17a-4 records: SmarshMeets
- Trade and account surveillance: Docupace ComplianceEdgeMeets
- Exam document production: SmarshMeets
Read from the comparison table above: vendors' own pages, October 22, 2026
Reviewing correspondence and approving ads
FINRA splits a member's written communications by audience. Correspondence is any written or electronic communication sent to 25 or fewer retail investors within any 30 calendar-day period; a retail communication reaches more than 25. The two follow different review paths, and the software follows the rule.
Not every piece of correspondence has to be reviewed before it is sent, and outside the subjects the rule names a firm decides by risk-based principles how far to review it. So the tool that matters is the review queue and its evidence: reviewer, message, date and action, with the warning that “Merely opening a communication is not sufficient review.” The correspondence column reads Meets only where the vendor names the review and its record together. The whole duty, with its supplementary material, is in FINRA Rule 3110 supervision for small firms.
Retail communications work the other way round: a qualified registered principal approves each one “before the earlier of its use or filing” with FINRA's Advertising Regulation Department. The record keeps a copy, the dates of first and last use, and “the name of any registered principal who approved the communication and the date that approval was given”. That is what an ad-review workflow such as Red Oak's is for, and why its card asks whether the stamp records both. Rule 2210's filing windows are explained in our FINRA Rule 2210 guide, and the review tools compared in the best advertising review software.
Records, and what you take with you when you switch
FINRA's own books-and-records rule sends every member back to the SEC's: records made under FINRA rules are kept “in a format and media that complies with SEA Rule 17a-4” (Rule 4511(c), covered in our FINRA Rule 4511 guide). Since the 2022 amendments, an electronic system meets Rule 17a-4(f) in one of two ways: a complete time-stamped audit trail of every change and deletion, or storage that preserves the records “exclusively in a non-rewriteable, non-erasable format”. The records column reads Meets where a vendor names either. The trade-offs are in Rule 17a-4 and WORM storage, explained.
The system must also be able to download a record and its audit trail “in both a human readable format and in a reasonably usable electronic format”. Where the vendor owns and operates the servers, it files a written undertaking with the SEC that the records “are the property of the member, broker, or dealer” and “will be surrendered promptly on request” (17a-4(i)). Of the six vendors here, only Smarsh's pages offer letters of undertaking.
Those two duties matter most on the day you leave a vendor. A compliance platform holds records with their own clocks, and several run on after the record stops being used:
Export these before the old contract ends
| Record | Kept for | Rule |
|---|---|---|
| Written supervisory procedures, every version | 3 years after the manual stops being used | 17a-4(e)(7) |
| Inspection reports | At least 3 years | FINRA 3110(c)(2) |
| Record of supervisory designations | 3 years, first 2 easily accessible | FINRA 3110(b)(6)(B) |
| Communications and their approvals | 3 years, first 2 easily accessible | 17a-4(b)(4) |
| Exception reports on unusual customer-account activity | 18 months after the report | 17a-4(e)(8) |
| Reports a regulator asked for, and exam reports | 3 years after the report date | 17a-4(e)(6) |
17 CFR 240.17a-4(b), (e); FINRA Rule 3110
Rule 17a-4 states a length and an easily accessible window for each record but not always the event the period runs from, so agree the start dates with your compliance counsel. The books and records retention calculator works out a keep-until date for each record type.
What “FINRA compliance software” can mean
Search for FINRA compliance software and most pages read as if a product could be approved. None can. FINRA retired its Compliance Vendor Directory effective March 19, 2024, and neither FINRA nor the SEC endorses vendors. “FINRA-aligned” and “17a-4 compliant” are the vendor's words; the duties stay with the member. What a small firm can do is ask for the documents that make a claim checkable, and keep the answers with its due diligence file.
Documents to ask every vendor for
- Which 17a-4(f) mode holds your records: audit trail or non-rewriteableIn writing17a-4(f)(2)(i)
- The undertaking, where the vendor runs the serversFiled with the SEC17a-4(i)(1)
- Export of a record and its audit trailNamed formats17a-4(f)(2)(iv)
- Evidence kept with each review: reviewer, item, date, actionPer reviewFINRA 3110.07
- Approving principal's name and approval date on each adPer adFINRA 2210(b)(4)(A)
A firm that would rather hand the program to people than to software can compare outsourced help in the best FINRA compliance consultants. This page is a reading of vendors' own pages, not legal advice; check any setup with your compliance counsel.
Each vendor, read against the rule
Hadrius
Supervision platform- What it is
- A supervision and compliance platform “Built for SEC- and FINRA-regulated firms”, in modules for testing, marketing review, people oversight, communications, account surveillance and branches. Its broker-dealer line reads “Prove 3110/3120/3130”, with “17(a)-4/WORM retention and immutable timelines”. The Branches module schedules “each location’s exam cadence in accordance with Rule 3110” and writes every exam action to a WORM audit trail.
- Who it fits
- A broker-dealer that wants supervision, branch exams and communications review in one system of record. It names broker-dealers, RIAs, private funds and compliance consultants, and its demo form's smallest firm-size choice is 1-50 people. It also names “multi-branch supervision, OSJ structures”.
- What the rule requires, and whether it meets it
- Written procedures and review workflowMeetsProgram built from your WSPs; names 3110, 3120, 3130
- Internal inspectionsMeetsBranch exams scheduled per Rule 3110
- Correspondence and internal-communications reviewMeetsEmail, chat, social; each review time-stamped
- Records per 17a-4: audit trail or non-rewriteableMeets17(a)-4/WORM retention
- Trade and account surveillanceMeetsTrades routed by risk; Reg BI flags
- Exam document productionMeetsOne-click exam exports
- Not verified by us
- Which 17a-4(f) mode your account uses and the third-party undertaking under 17a-4(i), the export formats of its exam packs, and the list of channels its communications module captures.
Red Oak
Ad review and supervision- What it is
- Compliance software built around advertising review, with disclosure management, registration management, internet supervision and social media modules. Its ad-review page lists document stamping, a full audit trail and “SEC 17(a)-4/WORM Compliant” records, and automates “the direct filing with FINRA process”. Its internet supervision logs “who reviewed the content, when it was reviewed, and any comments or actions taken”. Its site says Red Oak and MirrorWeb are combining.
- Who it fits
- A broker-dealer that produces retail communications and files them with FINRA. Its site names broker-dealers, RIAs, banks and insurance firms. It also sells consulting alongside the software.
- What the rule requires, and whether it meets it
- Written procedures and review workflowPartialReview workflows for ads; WSPs not stated
- Internal inspectionsNot stated
- Correspondence and internal-communications reviewPartialOnline content: reviewer, date, action logged
- Records per 17a-4: audit trail or non-rewriteableMeetsSEC 17(a)-4/WORM compliant
- Trade and account surveillanceNot stated
- Exam document productionPartialRetrieval stated; exam exports not named
- Not verified by us
- Whether the document stamp records the approving principal's name and the approval date, its written supervisory procedures and inspection features (not stated), and its 17a-4(i) undertaking.
Docupace ComplianceEdge
Account surveillance- What it is
- The compliance and surveillance product of Docupace's wealth operations platform. ComplianceEdge runs “Daily monitoring of transactions for suitability, conflicts of interest and registration compliance”, with review queues, comment tracking and escalation, plus “Workflow-based supervisory approvals” and “Automated reviews with clear audit trails”.
- Who it fits
- A firm whose risk sits in customer accounts: it names broker-dealers, RIAs and hybrid firms, and bank trust companies, and monitors “across advisory and brokerage accounts”. It is not a communications archive.
- What the rule requires, and whether it meets it
- Written procedures and review workflowPartialSupervisory approval workflows; WSPs not stated
- Internal inspectionsNot stated
- Correspondence and internal-communications reviewNot stated
- Records per 17a-4: audit trail or non-rewriteableCheck with vendorAudit trails on reviews; 17a-4 not stated
- Trade and account surveillanceMeetsDaily trade and blotter review
- Exam document productionPartialAudit-ready supervision reports
- Not verified by us
- How its records are kept under 17a-4(f) (its page names only integrated document management), the custodian and clearing feeds it reads, and the export format of its supervision reports.
Comply
Compliance suite- What it is
- One vendor with two product lines: Comply Platform (formerly ComplySci) and Comply for RIA (formerly RIA in a Box). The platform covers policies and procedures, a compliance calendar, employee trade monitoring from direct broker feeds, attestations, and communications captured, reviewed and stored “in a WORM-compliant format”, including iMessage and WhatsApp.
- Who it fits
- A broker-dealer whose people trade personal accounts or text clients. Its platform page names RIAs, wealth managers, broker dealers, private funds, investment banks and insurance companies. FINRA rules are not named on the pages read.
- What the rule requires, and whether it meets it
- Written procedures and review workflowPartialPolicies and procedures kept current; 3110 not named
- Internal inspectionsNot stated
- Correspondence and internal-communications reviewPartialCapture and review; evidence fields not stated
- Records per 17a-4: audit trail or non-rewriteableMeetsWORM-compliant format for communications
- Trade and account surveillancePartialEmployee trades only
- Exam document productionPartialAudit trail exports
- Not verified by us
- Whether each communications review records the reviewer, the message, the date and the action, its customer-account surveillance (only employee trades are stated), and its 17a-4(i) undertaking.
Global Relay
Multi-industry archive- What it is
- A multi-industry communications archive with supervision. Its pages say content is stored “in a WORM-compliant, tamper-proof format”, that it monitors conversations “using AI and lexicon tools”, and that its reports cover “proof of review, policy coverage, supervised users, keyword coverage, and reviewer activity”.
- Who it fits
- The archive and review layer beside a supervision tool, for a broker-dealer whose principals must show their correspondence reviews. Its industry list leads with finance but does not name broker-dealers.
- What the rule requires, and whether it meets it
- Written procedures and review workflowNot stated
- Internal inspectionsNot stated
- Correspondence and internal-communications reviewMeetsLexicon tools; proof-of-review reports
- Records per 17a-4: audit trail or non-rewriteableMeetsWORM-compliant archive
- Trade and account surveillanceNot statedCommunications surveillance only
- Exam document productionPartialEvidentiary export; no exam named
- Not verified by us
- Its 17a-4(i) undertaking, the evidentiary export formats it means, and whether WORM storage is on for every connector your firm uses.
Smarsh
Financial-services archive- What it is
- A capture, archive and supervision platform for financial firms. Its 17a-4 page says it supports “both WORM and audit-trail retention methods” and offers to “Provide letters of undertaking to applicable regulatory bodies”. Exports are named as PST, EML, HTML and XML.
- Who it fits
- The archive and review layer for a broker-dealer that needs email, texts and social in one place. Its navigation names broker-dealers and dual BD and RIA firms, with pages for small firms.
- What the rule requires, and whether it meets it
- Written procedures and review workflowNot stated
- Internal inspectionsNot stated
- Correspondence and internal-communications reviewPartialReview workflows; evidence of review not stated
- Records per 17a-4: audit trail or non-rewriteableMeetsWORM and audit-trail methods named
- Trade and account surveillanceNot statedCommunications surveillance only
- Exam document productionMeetsPST, EML, HTML, XML
- Not verified by us
- The undertaking letter for your designated examining authority, which storage mode your account uses, and whether each review keeps the reviewer, date and action with the message.
How we read these vendors
Questions firms ask
Does FINRA approve or certify compliance software?
No. FINRA retired its Compliance Vendor Directory effective March 19, 2024, and neither FINRA nor the SEC approves vendors. A vendor's “FINRA-aligned” or “17a-4 compliant” wording is its own claim. Under Rule 3110(a), “Final responsibility for proper supervision shall rest with the member.”
finra.org/industry/cvd; FINRA Rule 3110(a)
How often must a small broker-dealer inspect its offices?
Every OSJ, and any branch office that supervises non-branch locations, at least annually on a calendar-year basis. A branch office that supervises none, at least every three years. A non-branch location on a regular periodic schedule, with “a general presumption that a non-branch location will be inspected at least every three years”.
Each inspection is reduced to a written report and kept on file for a minimum of three years. That is the record the inspections column asks a vendor to hold.
FINRA Rule 3110(c)(1)(A)-(C), 3110.13, 3110(c)(2)
Does a broker-dealer have to keep records in WORM storage?
No. Since the 2022 amendments, an electronic recordkeeping system can either keep a complete time-stamped audit trail of every change and deletion, or “Preserve the records exclusively in a non-rewriteable, non-erasable format”. Either mode meets Rule 17a-4(f)(2)(i), which is why the records column reads Meets where a vendor names either one.
17 CFR 240.17a-4(f)(2)(i)(A)-(B)
Does a principal have to read every email?
No. Outside the subjects Rule 3110(b)(4) names, a member decides by risk-based principles how far to review correspondence. What is reviewed must be reviewed by a registered principal, and the evidence must name the reviewer, the message, the date and any action taken. “Merely opening a communication is not sufficient review.”
FINRA Rule 3110(b)(4), 3110.06, 3110.07
Which yearly reports should the software help produce?
Three come from the supervision rules. The annual review of the businesses the firm engages in (3110(c)(1)). The designated principal's report to senior management, “no less than annually”, on the supervisory control system and its test results (3120(a)(2)). And the chief executive officer's annual certification that the firm has processes for its compliance policies and written supervisory procedures (3130(b)). A platform that keeps tests, exceptions and amended procedures in one place makes the second and third much easier to write.
FINRA Rules 3110(c)(1), 3120(a)(2), 3130(b)
How long do we keep our old procedures after we switch platforms?
Compliance, supervisory and procedures manuals, including every update, are kept “until three years after the termination of the use of the manual.” Export the full version history of your written supervisory procedures before the old contract ends.
17 CFR 240.17a-4(e)(7)