FINRA Compliance Obligations for Independent Broker-Dealers

In 2026, Independent brokerage firms must manage four overlapping rule shifts: FINRA's restructuring, SEC policing of Reg BI, amendments to the Regulation S-P privacy rule, plus a codified expectation for AI governance. The changes are hitting simultaneously at firms whose compliance teams are usually far leaner than those at national brokerage houses and major RIA networks subject to the same requirements. In FINRA's 2026 Industry Snapshot, the 331,802 dually registered professionals surpassed reps listed solely with broker-dealers, a milestone in which the same people carry both brokerage and advisory registrations. That development concentrates duties from both rulebooks on the same people, leaving independent firms with a stacked compliance burden.

FINRA released the 2026 Annual Regulatory Oversight Report in December of 2025, earlier than usual and specifically because member firms had asked for extra lead time. Launched in 2025, FINRA Forward, the program for reviewing and modernizing the rulebook through a quartet of cornerstone Regulatory Notices (25-04, 25-05, 25-06, 25-07), deepens that density. Changes flowing from that effort took effect as of March 25, 2026; firms must therefore monitor an active rulemaking pipeline on top of obligations already in force. Grasping obligations stacked this deep and shifting this quickly begins with seeing how each one lines up against what examiners really look for, and that is the mapping the remainder of this article works through, requirement by requirement.

Registration, licensing, and the FinOp requirement as the compliance foundation

These obligations reach well beyond routine filing work. If examiners flag these issues, the result can be immediate limits on operations, and a firm with registration holes has no sound base for defensible supervision, much like a contractor still waiting for the foundation to be poured.

Before serving public customers, a firm must submit Form BD to FINRA, while principals and representatives need credentials matched to their duties: General Securities Representatives take SIE with Series 7, General Securities Principals take Series 24, and Investment Banking Representatives take Series 79. FINRA reviews focus on whether registered persons are performing functions their licenses do not cover. When someone’s registered role does not line up with their real work, examiners can identify the issue with little difficulty.

Financial responsibility sits on a separate but just as foundational track. Under SEC Rule 15c3-1, the Net Capital Rule obliges firms to maintain liquid-asset minimums tied to liabilities, with calculation or recordkeeping mistakes often arising, especially where experienced financial staff are absent. Each broker-dealer also must appoint a Series 27 or Series 28 licensed Financial and Operations Principal to supervise financial compliance. Examiners will expect a designated FinOp every time, treating that role as a standard checkpoint in the review cycle.

Continuing education is one more thing examiners check every time. Representatives have to finish the Regulatory Element each year by December 31, and a representative's registration goes inactive if that date passes with the requirement still unmet. On top of that, FINRA Rule 1240 has required the Firm Element since January 1, 2023: a separate annual training program that firms design themselves, in addition to the Regulatory Element. This was a genuine structural shift from the old rules, because it turned the Regulatory Element into a yearly requirement and brought every registered person under the Firm Element, not merely some of them. Branch offices face the same kind of discipline in their own form. Each location needs properly assigned Supervisory principals, and gaps at this level often lead to wider findings of weak oversight throughout the firm.

Meeting the basics of Registration compliance and financial responsibility is just the starting point. Regulators truly test independent broker-dealers on the oversight frameworks layered atop those basics, starting with the supervisory procedures in writing discussed next.

Written Supervisory Procedures as the architecture everything else rests on

A written supervisory procedure may be in a file, but without follow-through, it gives the firm no real regulatory cover. FINRA staff look for mismatches between the firm's WSP narrative and the evidence in its review logs, and the mismatch becomes the exam issue.

In plain terms, the 2026 Annual Regulatory Oversight Report names the WSP breakdowns cited most often. Procedures cited Reg BI's Care Obligation yet gave supervisors no way to confirm that any single recommendation complied with it. The gift limit rose in March 2026, yet the WSPs were never updated to match. Electronic correspondence review never covered FINOPs or CCOs working part-time. No exception report was ever set up to surface Reg BI problems transaction by transaction. Every one stands alone as a breakdown, yet a common thread runs through them: each policy declares an intention without ever putting enforcement machinery behind it.

These findings rest on a supervisory expectation that goes beyond simply having procedures on paper. Each written policy must assign ownership to a principal and state what evidence, such as a log, review cycle, or exception report, shows that the supervisory step occurred. A WSP that uses passive phrasing and leaves control ownership unnamed creates an exam-ready deficiency.

With 2026 amendments now in force, firms must treat WSP upkeep as an active, year-round duty and keep returning to it over time. Under Rule 3220, the gift ceiling increased to $300 for each recipient on March 30, 2026. Reg S-P also added technical obligations for protecting data. On April 1, 2026, the negative consent revision also became operative. Taken together, those changes mean many firms still need to revise their WSPs. From there, firms should test the WSPs against all revised limits, assign every supervisory task to an identified principal with a defined deliverable, for example a dated register, exception summary, or inspection file, and run a mock exam demand covering off-channel messages and third-party archive feeds so retrieval is immediate on request.

In the 2026 Report, the WSP failure examiners cite most often concerns Reg BI implementation: policies that nod to its Care Obligation yet never establish any method for verifying adherence to it. That failure sits precisely at the spot regulators are currently targeting with enforcement.

Reg BI as the dominant enforcement pressure on independent broker-dealers

Regulation Best Interest cases centered on retail investors remain the top priority for SEC and FINRA enforcement, with scrutiny increasingly reaching individual representatives as well as firms. FINRA's Examination Division is still looking closely at how firms sell products, make recommendations, and satisfy the Care Obligation. Broker-dealers should respond by testing their sales practices, bolstering records for account and product advice, and checking that Form CRS gives full, correct information.

Among the disciplinary measures FINRA brought in March 2026 is a case showing how a Reg BI breakdown appears once regulators formally cite it. One firm never put in place written policies and procedures suited to meeting its Care Obligation duties, lacked any sound method for judging whether reps' advice met Reg BI, and had no reliable way to flag advice out of step with the profile each customer had on file. The firm's behavior was ruled a deliberate breach of Reg BI.

FINRA is no longer stopping at the firms themselves; it is increasingly bringing actions against the Chief Compliance Officers personally when their supervisory systems fall short. In recent settlements, CCOs have been hit personally with disciplinary measures tied to Reg BI violations. That means CCOs at indie broker-dealers now face real personal exposure, distinct from any penalty imposed on the firm.

Reg BI's Compliance Obligation requires broker-dealers to adopt, keep current, and carry out written supervisory processes that cover rule training. A firm misses that duty if its records do not identify the training provided, the topics addressed, the attendees, and the date, even where its representatives apply Reg BI correctly in day-to-day practice. Practical understanding still has to be backed by reviewable records. Because FINRA exams regularly pair Reg BI supervision problems with communications-recordkeeping weaknesses, examiners should view them as related risks.

Off-channel communications recordkeeping as a continuing FINRA enforcement priority despite the SEC's retreat

Plenty of compliance teams figure that the SEC pulling back from policing unapproved messaging lowers the danger linked to texting and similar unauthorized methods. They are mistaken. FINRA can still pursue such breaches under Rule 3110 covering oversight plus Rule 4511 governing recordkeeping, regardless of the SEC's current enforcement stance.

Following a multiyear wave that began in FY 2022, the SEC has largely wound down its off-channel cases, with today's Commission no longer pursuing the initiative. But FINRA has chosen a different path from the SEC's. FINRA has excluded at least one person from the member-firm industry over off-channel messaging, highlighting a sharp divergence from the SEC: that agency's prior campaign centered mainly on institutions, whereas FINRA now more often puts accountability on individuals themselves. Using a personal phone or other device for work messages may now expose its owner to individual liability, apart from any consequences for the firm.

In highlighting recordkeeping problems, The 2026 Oversight Report makes them a major finding and urges firms to run mock regulatory exams, police off-channel communications, and update surveillance keyword lists regularly. Firms need to supervise and retain chatbot exchanges under the same rules they apply to emails, texts, and other work-related messages. This obligation creates a new records challenge still missing from many firms’ WSPs, while tying into larger concerns over AI tool governance in a supervised business.

AML program requirements and the third-party vendor risk that amplifies them

Although AML compliance has long been a standard part of FINRA exams, the 2026 Report’s focus on outside AML reviews and diligence over third-party vendor relationships points to a changed exam focus. FINRA now wants proof that the systems behind AML compliance, outsourced technology included, work in practice, rather than only confirming that a written AML program is in place.

Firms ought to confirm that their WSPs place AML duties with whichever teams or people are most likely to detect activity that may be suspicious, and they should also set up independent testing of AML compliance plus regular reviews of exception reports and alerts to verify these systems perform as intended. FINRA has observed more cyberattacks and service disruptions involving outside service providers, cautioning that one such event could hit several firms simultaneously because so large a share of the industry depends on a small group of shared vendors. When an AML program leans on an outside provider's alert platform, its dependability is capped by how resilient that provider itself is, and that is why vendor due diligence belongs to AML and not only to IT.

In practice, firms must continuously screen every outside provider handling essential functions, including AML, cybersecurity, and IT, from onboarding onward. This means assessing their generative AI practices, ensuring agreements genuinely safeguard confidential information, and checking that security measures meet an acceptable threshold. Under FINRA, Rule 3110 now explicitly governs third-party oversight, requiring firms to document supervisory processes that extend beyond their own internal operations. Because independent broker-dealers rely on external vendors for more of their business than bigger firms typically do, that reliance creates a structural vulnerability.

Registered investment advisers now have until January 1, 2028, under the FinCEN AML rule, but firms should not treat that delay as an excuse to sit back: examiners already look for much of what the rule requires when they assess program effectiveness ahead of the 2028 deadline. Dual registrants, now most of the FINRA-registered population, should spend that extra time getting AML training up and running right away. And the vendor dependencies that generate AML risk are likewise behind the cybersecurity issues taken up next.

Cybersecurity and Regulation S-P compliance as the most immediate operational deadline

Regulation S-P, as amended by the SEC in May 2024, now puts broker-dealers under the nearest data security mandate. Because most independent firms in this space fall under the rule's smaller-entity category, they face a June 3, 2026 compliance date that demands infrastructure still unbuilt at many firms.

Reg S-P compliance is not its own separate cybersecurity program. Instead, it is embedded within a pair of FINRA requirements. Rule 3110 requires supervisory WSPs that tackle data protection directly, and Rule 4370 governs how firms restore operations and respond when disruptions occur under their Business Continuity Plans. Rather than standing apart, these digital safeguards share the supervisory framework and WSP structure already governing Reg BI alongside AML plus the retention of communications records.

Under the amended Reg S-P, firms must build certain technical requirements into the procedures they update: both multi-factor authentication and the broader duty to notify about incidents belong in the WSP text itself, not merely in a separate IT policy. For broker-dealers outside the big firms, facing a June 2026 compliance date and leaner compliance teams than larger rivals, the work is to build that infrastructure, write it into the WSP and confirm a designated principal has ownership of it ahead of the date.