FINRA Rule 3310 requires every member broker-dealer to adopt and implement a written anti-money laundering program, approved in writing by senior management, that does five things: establishes policies and internal controls reasonably designed to detect and cause the reporting of suspicious transactions under the Bank Secrecy Act, provides for independent testing of the program, designates an AML compliance officer and identifies that person to FINRA, delivers ongoing training to appropriate personnel, and performs risk-based customer due diligence consistent with FinCEN’s rules.1Financial Industry Regulatory Authority. 3310 Anti-Money Laundering Compliance Program Each piece has specific content requirements, and the program has to be tailored to the actual business the firm runs.
The Written Program and Senior Management Approval
The program must be written, and a member of senior management must approve it in writing. That approval requirement exists so the compliance function cannot operate detached from executive accountability. The program also has to be “reasonably designed to achieve and monitor” the firm’s compliance with the Bank Secrecy Act and its implementing Treasury regulations, which means it has to fit the firm.1Financial Industry Regulatory Authority. 3310 Anti-Money Laundering Compliance Program
A clearing firm that holds customer assets faces different money-laundering exposure than an introducing broker that routes orders elsewhere. A firm handling penny stocks, foreign securities, or private placements carries different risks than one trading only listed equities. The written program should reflect those differences in its controls, its monitoring, and the depth of its due diligence. A generic template adopted without that tailoring is one of the first problems regulators flag.
Internal Policies to Detect and Report Suspicious Activity
The operational heart of Rule 3310 is a set of internal policies, procedures, and controls capable of identifying and causing the reporting of suspicious transactions. These controls can be automated surveillance, manual review of large or atypical transactions, or a combination. Their sophistication should scale with the firm’s size and product complexity.
Customer Intake Feeds the Monitoring
Before any account opens, the firm must run a Customer Identification Program under 31 C.F.R. 1023.220. For individuals, that means collecting name, date of birth, address, and taxpayer identification number. For non-U.S. persons, acceptable alternatives include a passport number, alien identification card number, or another government-issued document with a photograph. The CIP must also include procedures for checking customers against government-provided lists of known or suspected terrorists.2eCFR. 31 CFR 1023.220 – Customer Identification Programs for Broker-Dealers
For legal entity customers, FinCEN’s Customer Due Diligence Rule requires the firm to identify and verify each individual who owns 25 percent or more of the entity, plus at least one individual who controls it. The rule covers corporations, LLCs, partnerships, and similar structures.3Financial Crimes Enforcement Network. CDD Final Rule The information collected at intake builds a customer risk profile, and that profile is the baseline against which transaction monitoring measures later activity. The gap between what a customer said she would do and what she actually does is often the first signal the monitoring is supposed to catch.
Suspicious Activity Reports
When the firm knows, suspects, or has reason to suspect that a transaction involves illegal funds, is structured to evade BSA reporting, has no apparent lawful purpose, or facilitates criminal activity, it must file a Suspicious Activity Report with FinCEN. For broker-dealers, the reporting threshold is a transaction involving at least $5,000 in funds or assets.4eCFR. 31 CFR 1023.320 – Reports by Broker-Dealers of Suspicious Transactions
Timing is strict. The firm has 30 calendar days from the date it first detects facts supporting a filing. If no suspect has been identified by then, it gets an additional 30 days to do so, but total reporting time cannot exceed 60 calendar days from initial detection.4eCFR. 31 CFR 1023.320 – Reports by Broker-Dealers of Suspicious Transactions For continuing suspicious activity, FinCEN guidance uses a 120-day cycle: 90 days of continuing activity plus the 30-day filing window.5Financial Crimes Enforcement Network. Frequently Asked Questions Regarding the FinCEN Suspicious Activity Report (SAR)
Federal law prohibits tipping off the subject. No one at the firm may tell the customer that a SAR has been filed or disclose any information that would reveal the filing. In exchange, the firm and its employees receive a statutory safe harbor from civil liability for making the disclosure in good faith, even if the suspicion turns out to be unfounded.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
Red Flags the Program Should Catch
FINRA has published guidance listing patterns that firms should build into their monitoring. These are not proof of wrongdoing on their own, but they signal activity worth a closer look: customers providing unverifiable or contradictory identification, refusal to identify a legitimate source of funds, domicile in or regular transactions with jurisdictions known for weak AML enforcement, accounts held through shell entities with undisclosed principals, no apparent business purpose for using the firm’s services, politically exposed persons combined with other risk factors, multiple unexplained accounts in family or corporate names, and customers previously rejected or terminated by other financial firms.7Financial Industry Regulatory Authority. Regulatory Notice 19-18 – FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting Obligations The written program should identify which red flags are relevant to the firm’s business and spell out how employees escalate them. A red-flag list that lives only in the policy manual, with no connection to transaction monitoring or escalation procedures, is a gap regulators target during examinations.
The Designated AML Compliance Officer
Every member firm must designate at least one associated person to implement and monitor the AML program’s day-to-day operations. The firm has to provide FINRA with that person’s name, title, mailing address, email, phone number, and fax number through the FINRA Contact System, and must promptly update the information if anything changes.8Financial Industry Regulatory Authority. Anti-Money Laundering (AML)
The rule does not require a specific registration category or seniority level. It does require that the person be an associated person of the firm. In practice, the designee needs enough authority to enforce compliance, change procedures, and allocate resources. An AML officer who can spot problems but cannot do anything about them is an officer in name only, and regulators recognize that arrangement for what it is.
Independent Testing
Rule 3310(c) requires independent testing of the AML program every calendar year. Firms that do not execute customer transactions, do not hold customer accounts, and act only as introducing brokers may test every two years instead. The supplementary material to the rule encourages more frequent testing when circumstances warrant, so higher-risk firms should not treat the annual minimum as sufficient on its own.1Financial Industry Regulatory Authority. 3310 Anti-Money Laundering Compliance Program
“Independent” has a specific meaning. The tester cannot perform the AML functions being tested, cannot be the designated AML compliance officer, and cannot report to either. The tester must also have a working knowledge of the Bank Secrecy Act and its implementing regulations. Smaller firms often hire outside consultants or accounting professionals to satisfy both requirements at once. Larger firms can use internal audit staff who meet the independence criteria.
The test report should document scope, procedures, transactions sampled, and findings. Violations, policy exceptions, and deficiencies should be reported promptly to the board of directors or a designated board committee. When testing reveals that monitoring missed a category of activity it was built to catch, the firm is expected to fix it quickly. Examiners look not just at what testing found, but at how fast the firm responded.
Ongoing Training for Appropriate Personnel
Rule 3310(e) requires ongoing training for “appropriate personnel.” The rule deliberately does not list job titles. Who needs training depends on the firm’s business. Customer-facing staff and anyone processing transactions are obvious, but operations personnel handling account documentation, wire transfers, or trade settlement should usually be included too. The test is whether the person touches activity that could involve money laundering, not whether they hold a particular license.
Content should be tailored to the firm’s actual risks. Staff at a firm handling heavy international wire volume need different examples than staff at a domestic equities desk. Training should cover the red flags that fit the firm’s products, how to escalate concerns internally without alerting the customer, and what the SAR process looks like from an employee’s perspective. Firms should keep detailed records of each session: dates, attendees, materials used, and topics covered. Regulators review those logs during examinations, and sparse documentation reads as evidence that training is not happening or is not taken seriously. A program that has not been updated in years will draw scrutiny even if it was thorough when first adopted.
Recordkeeping and Retention
Records covered by BSA regulations must be retained for five years and stored so they are accessible within a reasonable time. Firms may keep them in whatever format they ordinarily use for business records; if the firm does not create a record in the ordinary course for a reportable transaction, it must prepare one in writing.9eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
The retention clock starts at different points depending on the record. SAR filings and all supporting documentation are kept for five years from the date of filing. Customer identification records are kept for five years after the account is closed. Records showing how the firm verified a customer’s identity are kept for five years from the date the record was created. A firm that destroys CIP records five years after account opening rather than five years after account closing is out of compliance, potentially for years before anyone notices.
What Non-Compliance Costs
Enforcement comes from multiple directions at once. FINRA can impose fines and sanctions. FinCEN can assess civil money penalties under the Bank Secrecy Act. The Department of Justice can bring criminal charges against individuals.
Willful BSA violations can trigger civil penalties up to the greater of $100,000 per transaction or $25,000. A pattern of negligent violations can add penalties up to $50,000 on top of the per-violation amount.10Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties Criminal penalties for willful violations reach $250,000 and five years in prison. When the violation occurs alongside other illegal activity involving more than $100,000 in a 12-month period, the maximum jumps to $500,000 and ten years.11Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties The Anti-Money Laundering Act of 2020 added forfeiture of any profit gained from a BSA violation and clawback of bonuses paid to officers or employees of financial institutions during the calendar year of the violation or the following year.
These are not theoretical ceilings. In March 2026, FinCEN assessed an $80 million civil penalty against Canaccord Genuity LLC for willful failures to maintain an adequate AML program, file accurate and timely SARs, and conduct proper due diligence on correspondent accounts for foreign financial institutions. FINRA and the SEC separately resolved with the firm for $20 million each, credited against the FinCEN total. FinCEN called it the largest penalty ever imposed against a broker-dealer for BSA violations. Required remediation included increased AML staffing, an overhauled transaction monitoring system, revised SAR processes, and retention of outside consultants for a comprehensive program review.12Financial Crimes Enforcement Network. Consent Order No. 2026-01 – Canaccord Genuity LLC For firms weighing what to spend on compliance, the Canaccord order sets a concrete benchmark for what underinvestment can cost.