Best FINRA compliance consultants for small broker-dealers
Five compliance consulting firms read against the work FINRA's rules put on a small member firm: written supervisory procedures, branch inspections, the annual 3120 report and CEO certification, the AML independent test, Rule 4530 reporting, exams and new-member applications. Each cell says what the firm's own pages state, including whether it will put a registered principal in your CCO or FINOP seat. No fees are shown; send each firm the same scope, which the builder below writes.
Reviewed October 2026
Best overall for a small member firm
Quadrant Regulatory Group
Its broker-dealer page names every recurring duty in the table: WSPs, branch inspections, the 3120 and 3130 reports with a draft CEO certification, and an independent AML test.
Read the review of Quadrant Regulatory GroupBest for a firm that needs a principal in the seat
CRC Oyster
It furnishes licensed people to serve as your Series 24 CCO and Series 27 financial and operations principals, registered with your firm, beside full new-member application work.
Read the review of CRC OysterBest for a technology-led firm applying for membership
InnReg
Its broker-dealer pages run from the new-member application, Form BD and U4 filings to the supervisory procedures FINRA reviews, then outsourced principals once you are approved.
Read the review of InnReg
The comparison table
| Vendor | WSP drafting and updates3110(b) | Branch office inspections3110(c) | 3120 report and CEO certification3120; 3130(b) | AML independent test3310(c) | Event and complaint reporting4530 | FINRA exam support | New-member applications | Registered CCO or principals3130(a) | Former regulators on the team |
|---|---|---|---|---|---|---|---|---|---|
Quadrant Regulatory GroupRIA and BD consultants | Meets Drafts and amends WSPs | Meets Inspections with a written report | Meets Both reports; drafts CEO cert | Meets Run by Quadrant Audit Group | Partial U4 and complaint disclosures | Meets Simulated exams, exam management | Meets NMA and CMA prepared | Partial FINOP, PFO, POO; CCO not named | Meets Former SEC and FINRA regulators |
CRC OysterBD and RIA consultants | Meets WSP maintenance on retainer | Partial 3110 assessments; inspections unnamed | Partial 3120 and 3130 assessments | Partial Coordinates independent testing | Check with vendor Regulatory filings, unspecified | Meets Routine and for-cause exams | Meets Full NMA and CMA management | Meets Series 24 CCO, Series 27 PFO, POO | Meets Former CCOs and regulators |
InnRegFintech compliance consultants | Meets Supervisory systems, procedures | Not stated Not stated on the pages read | Not stated Not stated on the pages read | Partial Builds AML programs; test unnamed | Check with vendor Filings and ongoing reporting | Meets Exam prep, FINRA requests | Meets NMA, CMA, Form BD, U4 | Meets Outsourced principals | Partial 30+ experts; former regulators not stated |
ACA GroupGlobal compliance consultancy | Meets WSP development and reviews | Meets Branch office inspections | Not stated Not named on the BD page | Meets AML testing, independent audits | Check with vendor “Regulatory filing commitments” | Meets Exam prep, mock exams, remediation | Partial New BDs; NMA not named | Partial OCCO offered; not BD-specific | Meets Founded “by five former regulators” |
Core ComplianceOutsourced compliance firm | Meets WSP development | Meets Branch office audits | Partial Annual reviews; 3130 unnamed | Not stated BD page silent; AML page for RIAs | Not stated Not stated on the BD page | Meets FINRA exam preparation | Partial Membership application updates | Meets Serves as your CCO | Partial “In-house and regulatory experience” |
What FINRA's rules ask, service by service
A FINRA compliance consultant sells hours, but most of those hours go to duties a FINRA rule puts on the member firm. Most of the table's columns map to a FINRA rule; exam support and new-member applications are services built around FINRA's own processes, and the CCO seat has its own section below. Read this before a first call, so the engagement letter follows the rule rather than the consultant's package names.
The rule behind each service
| Service | What the rule asks | FINRA Rule |
|---|---|---|
| Written supervisory procedures | Establish, maintain and enforce them, and amend them “promptly” when rules or the supervisory system change | 3110(b)(1), (b)(7) |
| Branch office inspections | OSJs each calendar year, other branches at least every three years, each “reduced to a written report” | 3110(c)(1)-(2) |
| 3120 report | Test the supervisory controls and report to senior management “no less than annually” | 3120(a)(2) |
| CEO certification | The CEO certifies the compliance processes each year and confirms meeting the CCO in the past 12 months | 3130(b) |
| AML independent test | Each calendar year, by member staff or “a qualified outside party” | 3310(c) |
| Event and complaint reporting | Listed events within 30 calendar days; complaint statistics each quarter | 4530(a), (d) |
| Exam support and new-member applications | Services firms buy around FINRA's own processes; no rule cited here asks for outside help | None |
FINRA Rules 3110, 3120, 3130, 3310, 4530
The WSPs come first because everything else is tested against them. The rule asks each member to keep written procedures “to supervise the types of business in which it engages and the activities of its associated persons”, so a template bought off the shelf is a starting point, not a finished document. The FINRA Rule 3110 supervision guide walks through what the procedures, the reviews and the inspections have to cover.
That sentence is why a one-time WSP project is rarely enough. Ask whether the consultant's retainer covers rule-change updates, or whether each amendment is a new project. Of the five firms, CRC Oyster names “WSP maintenance” in its retainer and Quadrant names “periodically modifying” the procedures; the other three name development or review.
What a consultant can carry, and what stays with the firm
A consultant can draft, inspect, test and even sit in a role. The rules still name the member as the one that answers for it.
Three limits shape what you can hand over. First, the chief compliance officer is a principal: each member designates “one or more principals to serve as a chief compliance officer” on Schedule A of Form BD. An outsourced CCO therefore has to be registered with your firm, which is what CRC Oyster describes and what you should ask Core Compliance, ACA Group and InnReg to confirm. Second, the certification stays with the chief executive: the CEO certifies each year and must have met the CCO “in the preceding 12 months”. A consultant can draft it, as Quadrant offers, but cannot sign it.
Third, the AML test has an independence rule. It may not be run by “a person who performs the functions being tested” or by “the designated anti-money laundering compliance person”, nor by anyone who reports to either. If the same firm writes your AML procedures, runs them and tests them, ask who on its side does each job. The FINRA Rule 3310 AML program guide sets out the six parts the program needs. Branch inspections carry a similar rule: the inspector should not be “an associated person assigned to the location”, and a firm too small to avoid that documents why in the report. An outside inspector takes that question off the table.
A small member firm's year, by rule
A consultant's retainer for a small member firm is mostly a calendar. These are the recurring items the rules above put on the year, with the quarterly complaint dates worked out by our reading of Rule 4530(d) for calendar quarters (the rule says “by the 15th day of the month following the calendar quarter”):
Recurring FINRA items, by our reading of the rules
| What is due | When | FINRA Rule |
|---|---|---|
| Customer complaint statistics | By April 15, July 15, October 15 and January 15 | 4530(d) |
| Event reports (listed events) | No later than 30 calendar days after the firm knows or should have known | 4530(a) |
| Annual compliance meeting | No less than annually | 3110(a)(7) |
| Review of the businesses the firm engages in | Each calendar year | 3110(c)(1) |
| OSJ and supervising-branch inspections | Each calendar year | 3110(c)(1)(A) |
| Other branch office inspections | At least every three years | 3110(c)(1)(B) |
| 3120 report to senior management | No less than annually | 3120(a)(2) |
| CEO certification | Annually | 3130(b) |
| AML independent test | Each calendar year; every two years for firms without customer accounts, as the rule defines them | 3310(c) |
FINRA Rules 3110, 3120, 3130, 3310, 4530
Lay this list beside each consultant's proposal and mark what it covers. The Rule 4530 reporting guide lists the events that start the 30-day clock, and the RIA and FINRA compliance checklist turns the year into tasks you can assign. For the whole map of a small member firm's obligations, start with FINRA compliance for small broker-dealers.
Match the scope to your firm
A firm applying for membership needs different help from a member with three branch offices, and a firm with no customer accounts tests its AML program on a longer cycle. Tell the builder what is true of your firm; it lists the services the rules call for, with the timing of each, and reads the five firms' table rows against that list. Copy the scope and send the same text to every firm on your shortlist, so the quotes come back comparable. This is a starting scope, not legal advice; check the engagement letter with your compliance counsel.
- 01Draft our written supervisory procedures and amend them promptly when rules or our supervisory system change. (Rule 3110(b)(1), (b)(7))Ongoing
- 02Inspect our OSJs and branch offices on the rule's cycle and leave us a written report for each. (Rule 3110(c))OSJs each calendar year; other branches at least every three years
- 03Test our supervisory controls, prepare the 3120 report for senior management and draft the CEO certification. (Rules 3120(a)(2), 3130(b))Annually
- 04Run our AML independent test as a qualified outside party, by someone who does not perform the functions tested and is not our AML compliance person. (Rule 3310(c), 3310.01)Each calendar year
- 05Help us file Rule 4530 event reports and the quarterly customer complaint statistics. (Rule 4530(a), (d))Within 30 calendar days; quarterly by the 15th
- 06Prepare us for a FINRA examination and help answer the request list and any findings.When FINRA schedules one
Read against the five firms' own pages
PartialNone of the five names every service on this list.
- Quadrant Regulatory Group: ask about Event and complaint reporting
- CRC Oyster: ask about Branch office inspections; 3120 report and CEO certification; AML independent test; Event and complaint reporting
- InnReg: ask about Branch office inspections; 3120 report and CEO certification; AML independent test; Event and complaint reporting
- ACA Group: ask about 3120 report and CEO certification; Event and complaint reporting
- Core Compliance: ask about 3120 report and CEO certification; AML independent test; Event and complaint reporting
Read from their pages on October 22, 2026
If a reply leans on software rather than people, compare it with the compliance software for small broker-dealers: some member firms run their reviews on a platform and buy only the AML test and the inspections from outside. A firm with an advisory affiliate should read the RIA compliance consultants comparison beside this one, since four of these five firms appear there too.
What to ask for before you sign
No regulator vets consultants for you. FINRA does not approve compliance firms, and it retired its Compliance Vendor Directory effective March 19, 2024. A firm's experience and service list are its own claims, so ask for the work product itself. Each card above ends with the specific question for that firm; these six apply to all of them.
Documents to ask every consultant for
- A sample branch inspection report, names removedFINRA Rule 3110(c)(2)
- A sample 3120 report and draft CEO certificationFINRA Rules 3120(a)(2), 3130(b)
- Who runs your AML test, and how they stay independent of the programFINRA Rule 3310(c), 3310.01
- The name and licences of anyone they would register as your CCO or FINOPFINRA Rule 3130(a)
- Which filings the retainer covers, including Rule 4530 reportsFINRA Rule 4530(a), (d)
- What happens to your records and working papers when the engagement endsFINRA Rule 4511(a)
The last row matters more than it looks. FINRA's books and records rule says members “shall make and preserve books and records as required under the FINRA rules”, and an inspection report is one of them: the member keeps it on file “for a minimum of three years” in most cases. The FINRA Rule 4511 guide covers how those records must be kept, and the RIA and BD compliance consultants directory lists the other firms we have read. For the adviser side of a dual registrant, the question of when to bring in an outside CCO is covered in when a small RIA should hire an outsourced CCO.
Each consultant, read against the rules
Quadrant Regulatory Group
RIA and BD consultants- What it is
- A New York consultancy for broker-dealers and advisers. Its broker-dealer page says it “will perform the reviews required to prepare both the FINRA Rule 3120 and FINRA Rule 3130 reports” and “will prepare a draft of the CEO Certification”, and it lists Written Supervisory Procedures, branch office inspections with a written report, a simulated regulatory examination and CRD filings. Independent AML tests are run by Quadrant Audit Group LLC, “conducted by one or more Certified Anti-Money Laundering Specialists (CAMS)”.
- Who it fits
- A small member firm that wants the whole recurring calendar carried by one team: the home page says it works “with firms with only one compliance officer”, on an hourly, project or ongoing basis. It has “completed numerous NMA and CMA applications”, and its Series 27 and 28 staff can serve as FINOP, PFO or POO. A chief compliance officer is not offered by name.
- What the rule requires, and whether it meets it
- WSP drafting and updatesMeetsDrafts and amends WSPs
- Branch office inspectionsMeetsInspections with a written report
- 3120 report and CEO certificationMeetsBoth reports; drafts CEO cert
- AML independent testMeetsRun by Quadrant Audit Group
- Event and complaint reportingPartialU4 and complaint disclosures
- FINRA exam supportMeetsSimulated exams, exam management
- New-member applicationsMeetsNMA and CMA prepared
- Registered CCO or principalsPartialFINOP, PFO, POO; CCO not named
- Former regulators on the teamMeetsFormer SEC and FINRA regulators
- Not verified by us
- Whether it will register someone as your CCO; whether its CRD work covers Rule 4530 filings and the quarterly complaint statistics; and, if it also drafts your AML procedures, who on its side runs the independent test.
CRC Oyster
BD and RIA consultants- What it is
- A compliance and risk consultancy based in Wayne, Pennsylvania, with a New York office, that also sells compliance software. Its broker-dealer retainer covers “WSP maintenance, annual compliance meetings, CE administration, regulatory filings, electronic communications review, surveillance, and regulatory change management”; project work includes “FINRA Rules 3110/3120/3130 assessments”; its AML work includes “independent AML testing coordination”.
- Who it fits
- A firm that needs licensed people in required roles: it offers professionals “serving formally as your Series 24 CCO, Series 24 CEO, Series 27 Principal Financial Officer, and Series 27 Principal Operations Officer, registered with your firm”. New applicants get the full NMA: “business plan, Form BD, WSPs, principal staffing, membership interview, and approval”. Its team page names “Former CCOs. Former regulators.”
- What the rule requires, and whether it meets it
- WSP drafting and updatesMeetsWSP maintenance on retainer
- Branch office inspectionsPartial3110 assessments; inspections unnamed
- 3120 report and CEO certificationPartial3120 and 3130 assessments
- AML independent testPartialCoordinates independent testing
- Event and complaint reportingCheck with vendorRegulatory filings, unspecified
- FINRA exam supportMeetsRoutine and for-cause exams
- New-member applicationsMeetsFull NMA and CMA management
- Registered CCO or principalsMeetsSeries 24 CCO, Series 27 PFO, POO
- Former regulators on the teamMeetsFormer CCOs and regulators
- Not verified by us
- Whether its 3110 assessments include on-site branch inspections with the written report Rule 3110(c)(2) asks for, whether it runs the AML independent test itself or arranges an outside tester, and which filings its retainer covers.
InnReg
Fintech compliance consultants- What it is
- A compliance consulting and outsourcing team “serving financial services companies since 2013”, aimed at fintech firms. Its broker-dealer registration page offers “Full-scope support for preparing and submitting a New Membership Application (NMA) or Continuing Membership Application (CMA) with FINRA, including business plan drafting, document preparation, supervisory procedures, and response coordination”, plus Form BD, Form U4 and FINRA pre-approval interview preparation.
- Who it fits
- A technology-led firm on its way to membership that wants the same team afterwards: its broker-dealer page builds “supervisory systems, written policies and procedures”, prepares for exams, and provides “outsourced principals”. It was founded by a former chief compliance officer. Branch inspections and the annual 3120 and 3130 work are not named on the pages we read.
- What the rule requires, and whether it meets it
- WSP drafting and updatesMeetsSupervisory systems, procedures
- Branch office inspectionsNot statedNot stated on the pages read
- 3120 report and CEO certificationNot statedNot stated on the pages read
- AML independent testPartialBuilds AML programs; test unnamed
- Event and complaint reportingCheck with vendorFilings and ongoing reporting
- FINRA exam supportMeetsExam prep, FINRA requests
- New-member applicationsMeetsNMA, CMA, Form BD, U4
- Registered CCO or principalsMeetsOutsourced principals
- Former regulators on the teamPartial30+ experts; former regulators not stated
- Not verified by us
- Which principal roles it will register with your firm (CCO, FINOP), whether it runs a Rule 3310(c) independent AML test for broker-dealers, and whether ongoing support includes branch inspections and the 3120 report.
ACA Group
Global compliance consultancy- What it is
- A global governance, risk and compliance firm (consulting, managed services and software) “founded in 2002 by five former regulators”. Its broker-dealer page lists “Written Supervisory Procedures (WSPs) development and reviews”, branch office inspections, “Anti-money laundering (AML) program development and testing”, “Independent AML audits”, mock exams and help with “regulatory inquiries and deficiency letters”. Hardin Compliance and Cipperman web addresses now lead to ACA.
- Who it fits
- A larger member firm, or a dual registrant, that wants consulting, staff and software from one firm. The page counts 14 former FINRA regulators and 30 former SEC regulators on the team. It offers to help “Launch a New Broker Dealer” but does not name the new-member application, and the 3120 and 3130 work is not named.
- What the rule requires, and whether it meets it
- WSP drafting and updatesMeetsWSP development and reviews
- Branch office inspectionsMeetsBranch office inspections
- 3120 report and CEO certificationNot statedNot named on the BD page
- AML independent testMeetsAML testing, independent audits
- Event and complaint reportingCheck with vendor“Regulatory filing commitments”
- FINRA exam supportMeetsExam prep, mock exams, remediation
- New-member applicationsPartialNew BDs; NMA not named
- Registered CCO or principalsPartialOCCO offered; not BD-specific
- Former regulators on the teamMeetsFounded “by five former regulators”
- Not verified by us
- Whether it prepares the 3120 report and a draft 3130 certification, whether its outsourced CCO can be registered as your firm's principal, and how the AML testing team is kept apart from the team that built your program.
Core Compliance
Outsourced compliance firm- What it is
- A San Diego compliance firm with offices in Cedar Rapids and Detroit. Its broker-dealer page lists WSP development, “Performing Annual Compliance Reviews, Gap Analysis, & Testing”, “Conducting Branch Office Audits”, “Serving as Your Chief Compliance Officer”, “FINRA Examination Preparations & Assistance”, and advertising and sales literature reviews.
- Who it fits
- An existing member firm with an empty CCO seat that wants inspections and exam help from the same team. For established firms it offers help “requiring updates to membership applications”. Its AML package is written for investment advisers; the broker-dealer page does not mention AML.
- What the rule requires, and whether it meets it
- WSP drafting and updatesMeetsWSP development
- Branch office inspectionsMeetsBranch office audits
- 3120 report and CEO certificationPartialAnnual reviews; 3130 unnamed
- AML independent testNot statedBD page silent; AML page for RIAs
- Event and complaint reportingNot statedNot stated on the BD page
- FINRA exam supportMeetsFINRA exam preparation
- New-member applicationsPartialMembership application updates
- Registered CCO or principalsMeetsServes as your CCO
- Former regulators on the teamPartial“In-house and regulatory experience”
- Not verified by us
- Whether it runs a Rule 3310(c) independent AML test for broker-dealers, whether its annual reviews produce the 3120 report and a draft 3130 certification, and whether it handles Rule 4530 reporting.
How we read these vendors
Questions firms ask
Can an outside consultant be our broker-dealer's chief compliance officer?
The rule asks each member to “designate and specifically identify to FINRA on Schedule A of Form BD one or more principals to serve as a chief compliance officer.” So the person has to be a principal of your firm, named on your Form BD, whoever pays their salary. Ask any consultant offering the role how that person will be registered with you, and check the arrangement with your compliance counsel. Supervision itself does not move: “Final responsibility for proper supervision shall rest with the member.”
FINRA Rule 3130(a); FINRA Rule 3110(a)
Who is allowed to run our AML independent test?
Member staff or “a qualified outside party”, every calendar year for most firms (every two years for a firm that does no customer business, as the rule defines it). The tester needs “a working knowledge of applicable requirements under the Bank Secrecy Act” and may not be your AML compliance person, someone who performs the functions being tested, or anyone who reports to either. A consultant that also runs your AML program day to day should use a separate team for the test.
FINRA Rule 3310(c); FINRA Rule 3310.01
How often do our branch offices have to be inspected?
An OSJ, and any branch that supervises non-branch locations, “at least annually (on a calendar-year basis)”. Other branch offices “at least every three years”. Non-branch locations on a regular schedule, with “a general presumption that a non-branch location will be inspected at least every three years”. Each inspection “must be reduced to a written report”, so ask a consultant for a sample.
FINRA Rule 3110(c)(1)-(2); FINRA Rule 3110.13
Can the consultant sign our annual CEO certification?
No. The rule has the member's “chief executive officer(s) (or equivalent officer(s)) certify annually”, including that the CEO “has conducted one or more meetings with the chief compliance officer(s) in the preceding 12 months”. A consultant can test the controls, write the 3120 report the certification rests on and draft the certification; the CEO signs.
FINRA Rule 3130(b); FINRA Rule 3120(a)(2)
Is there an official list of FINRA-approved compliance consultants?
No. FINRA does not approve consultants or vendors, and it retired its Compliance Vendor Directory effective March 19, 2024. Treat any “FINRA approved” wording in a proposal as a claim to check, and ask for the work product instead: a sample inspection report, a sample 3120 report, an AML test report.
finra.org/industry/cvd