FINRA Rule 3110: Supervisory Procedures, Inspections, and Penalties

FINRA Rule 3110 requires every broker-dealer registered with the Financial Industry Regulatory Authority to build and maintain a supervisory system that is reasonably designed to catch violations of federal securities laws and FINRA rules across all of its associated persons and business activities. In practice, that obligation breaks into seven concrete duties: write and update supervisory procedures, put qualified principals in charge of each business line, investigate people before registering them, classify every office correctly, inspect those offices on the required schedule, review correspondence and transactions, and handle customer complaints through a defined process. The rule applies to roughly 3,400 member firms and carries the force of federal regulation through FINRA’s status as a self-regulatory organization under SEC oversight.¹

The “Reasonably Designed” Standard

Rule 3110(a) does not prescribe a single supervisory structure. It requires a system “reasonably designed” to achieve compliance, and that phrase controls almost every judgment call under the rule.² FINRA does not demand perfection. It demands a system a thoughtful compliance team would recognize as adequate for the firm’s size, products, and client base.

A ten-person firm selling a narrow product set can satisfy the rule with a straightforward hierarchy and a concise procedures manual. A firm running investment banking, market making, and retail advisory operations needs layered supervision across departments. The complexity of the system has to match the complexity of the business.

At a minimum, every firm’s system must include written procedures, designated principals for each business type requiring broker-dealer registration, proper classification and registration of every office location, and assignment of each registered person to a supervisor. Every registered representative and principal must also participate in at least one annual compliance meeting or interview covering relevant regulatory topics.³

Written Supervisory Procedures

Rule 3110(b) requires written supervisory procedures, commonly called WSPs, that spell out exactly how the firm carries out its supervisory obligations. Each procedure has to identify who is responsible for the review, what supervisory activity that person will perform, how often it happens, and how the work is documented.⁴

WSPs are not a static document. When FINRA adopts a new rule, the SEC issues new guidance, or the firm changes its business model, procedures need to be updated. Every affected staff member must have access to the current version, and the firm must keep a record showing who received it. Under SEC Rule 17a-4, each version of the compliance and supervisory procedures manual must be preserved for at least three years after the firm stops using it.⁵

The most common deficiency FINRA finds during examinations is not the absence of WSPs but their disconnect from actual practice. A manual describing a robust review process means nothing if principals are not following it. Examiners compare what the WSPs say against what the firm’s records show, and gaps are treated as supervision failures.

Qualified Principals and Delegation

A supervisory system only works if qualified people run it. Rule 3110(a) requires the firm to designate appropriately registered principals with authority over each type of business the firm conducts. Each office of supervisory jurisdiction must have at least one registered principal assigned to it, and each non-OSJ branch office must have at least one registered representative or principal with supervisory authority.³

Registration means passing the appropriate qualification exams. A general securities principal typically needs the Series 24, while principals overseeing investment company and variable contract products need the Series 26.⁶ The firm must also use reasonable efforts to ensure supervisory personnel are qualified by experience or training for their specific assignments.

Some review functions can be delegated to non-registered employees. Under Supplementary Material .08 to Rule 3110, correspondence and internal communications review may be handled by a non-registered person, but the delegating principal remains ultimately responsible and must demonstrate overall supervisory control.² Handing off a function and walking away does not satisfy the rule.

Background Investigations Before Registration

Before registering any new associated person, the firm must investigate the applicant’s character, business reputation, qualifications, and experience. Rule 3110(e) makes this a gate that must be cleared before Form U4 is filed with FINRA. Firms are expected to search the Central Registration Depository for employment and disclosure history, review fingerprint results, and in many cases run private background checks and contact prior employers.⁷

The CRD system is FINRA’s central database for the securities industry, holding registration records for firms, branch offices, and individuals, along with exam history, employment timelines, and disclosures about regulatory actions, customer complaints, or criminal matters.⁸ Firms must also adopt written procedures to verify the accuracy and completeness of each applicant’s Form U4. Shortcutting this process is a common source of enforcement trouble, particularly when a problem broker’s prior history should have been a red flag.

Office Classifications

Inspection frequency and supervisory duties turn on how each location is classified under Rule 3110(f). Getting the classification wrong is one of the gaps FINRA examiners look for hardest.

Offices of Supervisory Jurisdiction

An OSJ is any location where higher-level functions take place. A location is an OSJ if it does any of the following:

Executes orders or makes markets
Structures public offerings or private placements
Holds custody of customer funds or securities
Approves new customer accounts
Reviews and approves customer orders
Gives final approval to retail communications (other than solely approving research reports)
Supervises associated persons at one or more other branch offices

OSJs face the most frequent inspection requirements and must have a registered principal assigned to them.²

Branch and Non-Branch Locations

Branch offices conduct securities business with customers but do not perform any OSJ-triggering functions. Non-branch locations handle limited activities that do not involve regular customer contact or supervisory functions.

Residential Supervisory Locations

Remote work created a classification problem: when a supervisor works from home, does the house become a branch office? Rule 3110.19 creates the residential supervisory location, or RSL, designation. An RSL is a private residence where an associated person performs supervisory functions but is treated as a non-branch location, so the firm does not need to register it as a branch.⁹

To qualify, the associated person must have at least one year of direct supervisory experience with the firm or an affiliate, must be assigned to a designated branch office identified on Form U4, and the firm must conduct and document a risk assessment for that individual at that location. Original or “gold source” records cannot be stored at an RSL in any form. A second or vacation residence can only be used for securities business for fewer than 30 business days per calendar year; exceeding that forces the firm to register the location as a branch within 30 days.⁹ Some state jurisdictions do not recognize the RSL designation, and firms must register or notice-file in those states regardless of FINRA’s classification.

Internal Inspection Schedule

Rule 3110(c) requires an annual review of the firm’s business reasonably designed to detect and prevent violations, plus minimum inspection frequencies for each office type:

OSJs and supervisory branch offices: at least once every calendar year.
Non-supervisory branch offices: at least once every three years, with more frequent visits when business type, product complexity, or headcount warrant it.
Non-branch locations: on a regular periodic schedule the firm sets based on activities and customer contact.

Each inspection produces a written report retained for at least three years. The report must cover testing and verification of the firm’s policies for safeguarding customer funds and securities, maintaining books and records, supervising supervisory personnel, monitoring fund and securities transfers to third parties or unusual addresses, and tracking changes to customer account information like addresses and investment objectives.²

The person conducting an inspection generally cannot be assigned to that location or supervised by anyone there. When a firm is too small to meet that independence requirement, it must document why and explain how the inspection still meets the rule’s objectives.

Remote Inspections Pilot

Historically, inspections required an on-site visit. FINRA launched a voluntary three-year Remote Inspections Pilot Program under Rule 3110.18, running from July 1, 2024 through June 30, 2027. Participating firms can satisfy inspection obligations without a physical visit if they conduct and document a risk assessment for each office and maintain WSPs covering their remote methodology.¹⁰

The risk assessment must weigh standard factors like firm size, product complexity, and business volume, along with pilot-specific factors such as customer complaint history, outside business activities, whether the location serves vulnerable adult investors, and any compliance or recordkeeping failures. Firms that do not participate must continue conducting on-site inspections. Pilot Year 3 required firms to opt in by December 27, 2025, with quarterly inspection data submissions due throughout 2026.¹⁰

Correspondence and Communications Review

Rule 3110(b)(4) requires procedures for reviewing all incoming and outgoing written correspondence, including electronic communications, related to the firm’s securities business. A registered principal must conduct or oversee the review, and it must be documented in writing.²

The review is designed to catch customer complaints, customer instructions regarding funds or securities, and communications touching on subjects that require review under FINRA rules or federal securities laws. In practice, that means flagging messages where a representative might be making guarantees about returns, misstating risk, or discussing transactions outside approved channels. Most firms use compliance software that scans emails and instant messages for keywords and patterns, then routes flagged messages to a principal for human review.

Internal communications between employees must be reviewed for the same categories of regulatory red flags. Reading every message at a modern firm is impractical, so the rule’s “reasonably designed” standard allows risk-based sampling and technology-driven surveillance, provided the approach is documented in the WSPs and genuinely capable of catching problems.

Transaction Surveillance

Rule 3110(d) adds a separate layer focused on securities transactions. The firm must maintain procedures reasonably designed to identify trades that may violate Exchange Act provisions, SEC rules, or FINRA rules against insider trading and market manipulation. The review must cover the firm’s proprietary accounts, accounts where an associated person has a beneficial interest or trading authority, employee outside accounts disclosed under Rule 3210, and covered accounts held by associated persons’ family members.³

When the review identifies a potentially problematic trade, the firm must promptly conduct an internal investigation. Firms engaged in investment banking face additional reporting: they must file quarterly written reports with FINRA describing each internal investigation initiated during the previous quarter, including the securities and accounts under review. If an investigation concludes that insider trading or market manipulation actually occurred, a separate report must be filed within five business days detailing the results, any internal discipline, and whether the matter was referred to FINRA, the SEC, or another regulator.³

Principals monitoring transactions look for patterns like excessive trading to generate commissions, trading ahead of a client’s large order, or suspicious timing between an employee’s personal trades and material non-public events at a company the firm covers. Rule 3210 supports this by requiring associated persons to obtain written consent from their firm before opening securities accounts at other institutions and to notify those outside institutions of their industry affiliation, letting the employer request duplicate confirmations and statements.¹¹

Customer Complaint Handling

Rule 3110(b)(5) requires the firm’s supervisory procedures to include a process for capturing, acknowledging, and responding to all written customer complaints, including those submitted electronically. FINRA expects a defined pipeline that ensures no complaint falls through the cracks.²

A separate rule, Rule 4530, sets reporting deadlines. Statistical and summary data on written customer complaints received in a calendar quarter must be reported to FINRA by the 15th day of the month following the end of that quarter. If the firm takes internal disciplinary action against an associated person, that action must be reported within 30 calendar days of when the firm knew or should have known of the triggering event.¹²

Examiners scrutinize complaint handling closely because the complaint log often reveals patterns pointing to deeper supervisory problems. A cluster of complaints about the same representative, the same product, or the same branch is the kind of signal a well-designed supervisory system should escalate before regulators find it.

Penalties for Supervision Failures

FINRA’s published Sanction Guidelines set the monetary fine ranges for supervision failures, scaled to firm size and severity:

Failure to supervise (individual incident): $5,000 to $77,000 for small firms; $10,000 to $200,000 for midsize or large firms. Individual supervisors face fines of $5,000 to $30,000.
Systemic supervisory failures: $10,000 to $310,000 for small firms; starting at $50,000 with no upper limit for midsize or large firms.
Deficient written supervisory procedures: $5,000 to $39,000 for small firms; $10,000 to $80,000 for midsize or large firms.

¹³

Those are baseline ranges. When aggravating factors dominate, FINRA can and does go higher. In 2025, FINRA fined Securities America $1 million and ordered $2 million in restitution after finding the firm failed to implement a system reasonably designed to supervise recommendations of Class A mutual fund shares across more than 1,000 fund switches and 2,000 short-term sales.¹⁴ Beyond fines, sanctions can include suspension or expulsion of the firm, bars against individual supervisors, and disgorgement of profits from the violative activity. Disciplinary actions are recorded in the CRD system and disclosed publicly through FINRA’s BrokerCheck tool.

1
Financial Industry Regulatory Authority. About FINRA
2
FINRA. FINRA Rule 3110 – Supervision
3
FINRA. FINRA Rule 3110 – Supervision
4
FINRA. Supervision
5
eCFR. 17 CFR 240.17a-4 – Records To Be Preserved by Certain Exchange Members, Brokers and Dealers
6
FINRA. Series 24 – General Securities Principal Exam
7
FINRA. Regulatory Notice 18-15
8
FINRA. Central Registration Depository
9
FINRA. Residential Supervisory Locations (RSLs)
10
FINRA. Remote Inspections Pilot Program
11
FINRA. FINRA Rule 3210 – Accounts At Other Broker-Dealers and Financial Institutions
12
FINRA. FINRA Rule 4530 – Reporting Requirements
13
FINRA. FINRA Sanction Guidelines
14
FINRA. FINRA Orders Securities America to Pay $2 Million in Restitution to Customers