In 2025 alone, FINRA Compliance Requirements filed 625 new disciplinary actions (the highest number since 2021) and mandated $99.6m worth of fines and disgorgement penalties on member firms and individuals (the highest number since 2022). These statistics are listed on FINRA’s ‘Key Statistics’ page.
These stats don’t just include major market institutions making big news – they cover all kinds of businesses ranging from small independent broker-dealer practices through to mid-market clearing firms. If you’re an SEC-registered organisation, then there’s a good chance your compliance programme isn’t working hard enough for you to be appearing on this list within months.
You’ll want to read our full review if you’re keen to learn more about these trends. Meanwhile, make sure to check out the annual regulatory oversight reports too because we released them last year and now FINRA has done the same again, publishing its 2026 Annual Regulatory Oversight Report back in December 2025. You can expect generative AI governance to become another exam focus area along with cybersecurity, supervision, records, AML & Reg BI. This guide maps each active FINRA compliance requirement to the governing rule, the 2026 examination findings, and what firms need to have in place.
2026 FINRA Rule Changes: What Is New and What Has Changed
Before getting into the standing requirements, let’s address some of the rule changes that went into effect in 2026. These affect WSPs, supervision procedures, and communication practices that many compliance programmes have not yet updated.
| Rule / Regulation | Change | Effective Date |
| FINRA Rule 3220 (Gifts) | Annual gift limit raised from $100 to $300 per recipient | March 30, 2026 |
| FINRA Rule 2210 (Communications) | Proposed amendment to permit performance projections in limited circumstances | Under SEC review as of June 2026 |
| FINRA Rule 3290 (Outside Activities) | New rule consolidating Rules 3270 and 3280; focuses on higher-risk OBA situations | Proposed, pending SEC approval |
| SEC Regulation S-P (Safeguards) | MFA required; expanded incident notification requirements | Dec 3, 2025 (large firms); June 3, 2026 (smaller firms) |
| Capital Acquisition Broker Rules | Amendments under FINRA Forward initiative | March 25, 2026 |
| Negative Consent (Bulk Transfers) | Pre-review process eliminated; negative consent permitted with documented procedures | April 1, 2026 |
Firms should check WSPs for any of these areas and update supervisory procedures that reference the prior gift limit, the old OBA rules, or the pre-2026 version of Regulation S-P.
The Core FINRA Compliance Requirements, Rule by Rule
Requirement 1: Registration and Licensing (FINRA Rules 1000 Series)
Every firm doing business with the public must register with FINRA by filing Form BD. Registered persons must pass qualification exams appropriate to their activities: SIE and Series 7 for a General Securities Representative, Series 24 for a General Securities Principal, Series 79 for an Investment Banking Representative. These requirements form a core part of FINRA compliance.
FINRA examiners check for registered persons acting outside their licensed scope, CE obligations not completed within the required window, and branch offices lacking properly assigned supervisory principals. The FINRA Forward initiative is reviewing whether certain registration requirements create unnecessary burdens, but current rules apply until formal changes are adopted.
Requirement 2: Written Supervisory Procedures (FINRA Rule 3110)
FINRA Rule 3110 is the backbone of a firm’s compliance architecture. It requires a supervisory system reasonably designed to achieve compliance with securities laws and FINRA rules, and a Written Supervisory Procedures manual that describes how supervision is actually implemented across each business line and activity type.
The 2026 Annual Regulatory Oversight Report’s most cited WSP failures were: procedures that referenced the Reg BI Care Obligation but did not describe how supervisors would identify whether a recommendation satisfied it; WSPs not updated after the March 2026 gift limit increase; procedures that excluded part-time CCOs and FINOPs from electronic correspondence review; and no exception reports configured to flag Reg BI issues at the transaction level.
A WSP that exists but is not enforced offers no regulatory protection. FINRA examiners compare written procedures with actual review logs, and the gap between them is the finding.
Practical Action Plan:
1. Gap Analysis Against 2026 Mandates: Cross-reference current manuals against new thresholds (e.g., Rule 3220 $300 limit) and technical mandates under amended Reg S-P.
2. Map Supervision to Real Output: Ensure every written policy designates a specific principal and defines the exact log, review frequency, or exception report generated as evidence.
3. Conduct Mock Vendor & Audit Stress Tests: Simulate examination requests on off-channel communications and third-party archiving feeds to ensure that someone can retrieve data immediately under security audit conditions.
Requirement 3: Books and Records (FINRA Rules 4511-4590 / SEC Rules 17a-3 and 17a-4)
Certain regulatory bodies require firms to keep certain books and records reflecting their business activities in specified formats over specific periods. The vast majority of such records require firms to retain them for three years, while keeping the first two within an easily accessible location. For electronic records specifically, these books and records should meet either the “WORM” (“Write Once, Read Many”) or audit trail requirements as provided by SEC Rule 17a-4(f).
The 2026 Report also highlighted several trends related to books and records violations. First, many firms were converting existing paper-based records into an electronic format but failed to ensure these new electronic records accurately represented and were readable from the originals. Second, firms relying on third-party recordkeeping vendors failed to test those vendors’ ability to provide documents when subjected to the simulated examination process. Finally, while surveillance of off-channel communications systems improved during this time period, the frequency of updates did not match the increasing importance of such data.
Requirement 4: Anti-Money Laundering (FINRA Rule 3310 / Bank Secrecy Act)
Adequate AML compliance in 2026 requires risk-based customer due diligence, independent testing that challenges the programme rather than simply reviewing the policy, monitoring that accounts for cyber-enabled fraud patterns the 2026 report identified, and documented rationale for SAR decisions including decisions not to file.
Requirement 5: Regulation Best Interest and Form CRS (SEC Rule 17ad-5 / FINRA Rule 2111)
Reg BI requires that financial advisors make any recommendation to a retail customer in that customer’s best interest at the time it is made. The standard is satisfied through four obligations: disclosure, care, conflicts of interest, and compliance. Retailers must deliver Form CRS to customers at the beginning of the relationship and update it when material changes occur.
The compliance obligation is not simply about the quality of individual recommendations. Building a supervisory infrastructure that catches recommendations falling short of the standard and producing records that demonstrate the Care Obligation was applied requires effort. Regulators treated firms with no exception reports configured to flag potential Reg BI issues as having an inadequate programme, regardless of whether any individual recommendation harmed a customer.
Requirement 6: Cybersecurity and Technology Controls (Reg S-P / FINRA Rule 4370 / Rule 3110)
Cybersecurity moved to the top of FINRA’s 2026 examination priorities. The amended SEC Regulation S-P introduced mandatory MFA for login access to firm systems, including email and operational systems, and expanded the incident notification requirements to include notifying affected customers within 30 days of discovering a breach involving their data.
| Control | Requirement | Rule |
| Multi-Factor Authentication | Required for all firm system access | SEC Reg S-P (amended) |
| Incident Response Plan | Must be documented and tested | Reg S-P / FINRA Rule 4370 |
| Customer Breach Notification | Within 30 days of discovery | SEC Reg S-P (amended) |
| Third-Party Vendor Oversight | Due diligence on all vendors supporting key systems | FINRA Rule 3110 |
| Off-Channel Communications | Surveillance required; monitoring must be active | FINRA Rules 3110 / 4511 |
| Business Continuity Plan | Documented; annual review required | FINRA Rule 4370 |
FINRA’s 2026 report also noted a significant increase in cyberattacks on third-party vendors serving member firms, and that a single successful attack on a vendor could simultaneously impact a large number of firms. FINRA’s CORE programme is now actively sharing threat intelligence with potentially impacted firms.
Requirement 7: Communications with the Public (FINRA Rule 2210)
Rule 2210 states that all communication of firms must be fair, balanced, and not misleading – whether it’s correspondence, retail or institutional communications. Social media, websites, mobile app content, and emails are all within scope.
A proposed 2026 amendment would permit broker-dealers to include performance projections in limited circumstances, but it was under SEC review as of June 2026 and has not taken effect. Until formally adopted, projected returns may not appear in retail communications.
Requirement 8: Financial Responsibility (FINRA Rule 4000 Series / SEC Rule 15c3-1)
SEC Rule 15c3-1 requires broker-dealers to maintain minimum net capital based on their activities; clearing firms carry higher thresholds than introducing firms. Customer funds and securities must be properly segregated under SEC Rule 15c3-3. FOCUS reports must be filed quarterly with accurate figures. Regulators treat inaccurate FOCUS filings as books and records violations regardless of intent. FINRA Rule 4370 requires firms to review business continuity and emergency plans annually.
How Qualysec Helps Financial Firms Meet FINRA Compliance Requirements
Cybersecurity and third-party risk sit at the top of FINRA’s 2026 examination priorities, and the amended Regulation S-P has added specific technical controls that many broker-dealers have not yet fully implemented.
Cybersecurity Gap Assessment Mapped to FINRA and SEC Rules
Qualysec assesses cybersecurity controls against the specific items FINRA examiners check: MFA deployment, incident response plan documentation and test history, vendor security posture, off-channel communications monitoring, and BCP adequacy. Each identified gap maps to the applicable FINRA rule or SEC regulation, producing a remediation roadmap usable directly in examination preparation.
Penetration Testing for Broker-Dealer Technology Environments
Qualysec’s VAPT engagements cover trading platforms, customer portals, order management systems, and internal infrastructure. Every finding scores CVSS and links to the applicable regulatory control, producing documentation that satisfies the evidence standard FINRA examiners apply when reviewing a firm’s cybersecurity programme.
Third-Party Vendor Security Reviews
Many FINRA recordkeeping violations trace to vendors that fail under examination conditions. Qualysec reviews the security and compliance posture of vendors providing recordkeeping, communications archiving, AML systems, and cloud hosting, producing documented due diligence evidence that satisfies the FINRA Rule 3110 vendor oversight requirement.
Conclusion
FINRA compliance requirements are not static. The 2026 Annual Regulatory Oversight Report introduced GenAI governance as a new examination topic, the amended Reg S-P imposed binding MFA and notification requirements with a June 2026 deadline for smaller firms, and the FINRA Forward initiative has already produced rule changes affecting gifts, CAB rules, and outside activities. Firms that benchmark their compliance programmes against the prior year’s examination priorities are always one cycle behind.
In 2025, regulators imposed fines totalling $99.6m in 625 cases, generally involving supervision lapses, recordkeeping deficiencies, or AML shortfalls. A decent compliance programme should detect these factors. For every FINRA-registered firm, the bottom line is this: if someone asks you to show how your supervisory systems work and how you ensure you meet all requirements, do you have the appropriate infrastructural technology and records?
Schedule a consultation with Qualysec to strengthen your cybersecurity compliance position ahead of your next FINRA examination – Call Now!
Frequently Asked Questions
1. What are the FINRA compliance requirements for broker dealers?
They include:
- Registration and Licensing (Rule 1000 Series)
- Written Supervisory Procedures (Rule 3110)
- Books and Records (Rules 4511 – 4590 & SEC Rules 17a-3 & 17a-4)
- AML (Rule 3310)
- Regulation Best Interest and Form CRS
- Cybersecurity Controls as Amended Under Regulation S-P And Rule 4370
- Communications (Rule 2210)
- Financial Responsibility (4000 Series And SEC Rule 15c3-1).
2. What is the purpose of a FINRA compliance programme?
A FINRA compliance programme ensures the firm operates within applicable rules, identifies potential violations before they become findings, and protects customers and the firm from regulatory consequences. It is also the evidence base examiners rely on. Regulators treat a programme that cannot produce documentation of its supervisory activities as inadequate regardless of what the firm’s actual conduct was.
3. What are the penalties for FINRA non-compliance?
Penalties range from censure and formal warnings through fines, restitution orders, suspensions of individuals or firm activities, and expulsion from FINRA membership. FINRA ordered $99.6 million in fines and disgorgement in 2025 and filed 625 disciplinary actions, per the FINRA Key Statistics page. Individual registered persons can be suspended from specific activities or permanently barred from the industry. All disciplinary actions are publicly searchable through BrokerCheck and remain on the record indefinitely.
4. How often does FINRA examine member firms?
The regulator reviews firms according to a risk-based schedule. Higher-risk firms can undergo annual reviews while those posing less risk undergo examinations less frequently. FINRA will conduct ‘cause’ examinations if surveillance, complaints, tips, or referrals raise an issue. Branch examinations run separately from home office reviews. A firm cannot assume a recent clean examination reduces near-term examination risk.
