Supervising
Every member firm is required to create and maintain a supervision system designed to achieve compliance with all applicable laws, rules, and regulations from any federal, state, or other regulatory authority with jurisdiction over the firm’s business lines. Regulators can write as many rules as they want, but final responsibility for supervising a member’s employees never rests with the regulator - it always rests with the member firm itself. This is what it means to be part of a self-regulatory organization: member firms regulate themselves, within the framework the regulators set.
The supervisory system has certain bare-minimum requirements; there’s more detail beyond this, but these are the most likely testable topics:
- The supervisory system must establish and maintain a written procedure as required by Rule 3110. There must be an appropriately licensed and registered principal, designated by the member with authority to carry out the supervisory responsibilities of the member for each line of business they engage in.
- The member firm must also designate offices as an office of supervisory jurisdiction OSJ, with these being the final supervisory authority in the geographic area. The specific geographic area and requirements are set by each member firm to follow the rules. These OSJs (an office, not a person) must be supervised by a principal. Branch offices may be supervised by a principal or registered rep. These supervisors, be they of OSJs, or branch offices, are designated by the member firms as well.
Each registered representative is to be supervised by either another qualified registered representative, or a registered principal. Those supervisors are supervised in turn, all the way up. The firms must use reasonable efforts to determine that the supervisory personnel are qualified. That qualification can be from training, experience, or both.
Part of the supervisory process is making sure representatives stay up to date on all regulation updates, and similar needed knowledge. Part of Rule 3110 is that each member firm must have each registered rep and principal participate, no less than annually, in a meeting of some sort, at which compliance matters relevant to the person are discussed. It may occur in conjunction with other matters, and is often part of the annual compliance, or other regular meetings with managers or trainers.
Each firm’s written supervisory procedures (WSPs) must require review of incoming and outgoing correspondence, to identify and handle customer complaints, instructions, funds and securities, and any communication whose subject matter requires review under FINRA rules or federal securities laws. This is routine review conducted under the firm’s WSPs, generally after the correspondence has already gone out. Retail communications are treated differently: because they go out to a wide audience, a registered principal must approve them before the earlier of their first use or filing with FINRA, rather than simply being reviewed after the fact.
Supervisory control system
The supervisory control system comes from FINRA Rule 3120, a separate rule from Rule 3110’s written procedures and office inspections. Each member must designate one or more principals who establish, maintain, and enforce the firm’s supervisory control policies and procedures.
- They must have ways of testing and verifying procedures are designed with respect to the member firm and their associated persons to follow all laws, rules, and appropriate regulations.
- They must also create or amend supervisory procedures when needed, as identified by the testing and verification procedures described above.
The designated principals must also submit to senior management, at least annually, a detailed report containing the system of supervisory controls explained, summary of test results and any identified problems in those tests, and any additional or amended procedures that were created in response to those identified problems.
For firms reporting $200 million or more in gross revenue for the previous calendar year, the annual report to senior management must also include:
A tabulation of the reports on customer complaints and internal investigations that the firm made to FINRA during the previous year, and
A discussion of the previous year’s compliance efforts, including procedures and educational programs, in each of the following areas:
- Trading and market activities,
- Investment banking activities,
- Antifraud and sales practices,
- Finance and operations,
- Supervision, and
- Anti-money laundering
Office reviews
Each firm must review its businesses at least annually, and Rule 3110 sets how often each of its locations must be inspected, based on the type of location:
- An OSJ, and any branch office that supervises one or more non-branch locations (a supervisory branch office), must be inspected at least annually, on a calendar-year basis.
- A branch office that supervises no non-branch locations (a non-supervisory branch office) must be inspected at least every three years. The firm must consider whether the office’s activities, volume of business, and number of associated persons call for inspecting it more often.
- A non-branch location must be inspected on a regular periodic schedule that the firm sets in its written procedures. FINRA presumes that schedule is at least every three years, and a firm that sets a longer one must document why.
For example, suppose a branch manager also supervises two reps who work from their homes, and each home qualifies as a non-branch location. The branch office supervises non-branch locations, so it’s a supervisory branch office and is inspected every year. The two home offices are inspected on the firm’s periodic schedule, presumed to be at least every three years.
Inspections are internal: the firm inspects its own offices. Each inspection is written up in a report the firm keeps for at least three years (or, for a non-branch location on a longer cycle, until the next inspection report is written). Where the location does these things, the report must test and verify the firm’s procedures for:
- Safeguarding customer funds and securities
- Maintaining books and records
- Supervising supervisory personnel
- Transmittals of funds or securities, such as to third-party accounts, to outside entities, to an address other than the customer’s primary residence, or between customers and their reps
- Changes of customer account information, such as address and investment objective changes
The person who conducts an inspection can’t be assigned to the location, and can’t be directly or indirectly supervised by, or otherwise report to, anyone assigned to it. A branch manager can’t inspect their own branch. A firm whose size or business model makes that impossible must document why in the inspection report. The firm also needs procedures to keep conflicts of interest, such as an inspector’s financial interest in the business being inspected, from compromising its inspections.
Supervisors working from home
Two additions to Rule 3110 in 2024 deal with supervisors who work from home:
- Residential supervisory location (RSL), effective June 1, 2024. A firm may treat a supervisor’s private residence where supervisory work is done as a non-branch location instead of an OSJ or branch office, so it’s inspected on the periodic schedule (presumed to be at least every three years) rather than every year. The residence must meet conditions, including: only one associated person (or members of one immediate family who live there) does business there, it isn’t held out to the public as an office, the person doesn’t meet customers there, no customer funds or securities are handled there, and the person’s email goes through the firm’s systems. A firm can’t designate RSLs while it’s a Taping Firm under Rule 3170 or a Restricted Firm under Rule 4111. A location can’t be an RSL if a supervisor there has less than one year of supervisory experience with the firm, is under a mandatory heightened supervisory plan, or is statutorily disqualified (unless FINRA has approved the person’s association). Before designating an RSL, the firm must conduct and document a risk assessment of the person assigned there, and it sends FINRA a list of its RSLs every quarter.
- Remote inspections pilot, effective July 1, 2024. A voluntary three-year pilot, running through June 30, 2027, lets an eligible firm that opts in inspect qualified branch offices (including OSJs) and non-branch locations remotely, without an on-site visit. Conditions include a documented risk assessment and quarterly data reports to FINRA. A firm that isn’t in the pilot can’t inspect remotely; the temporary remote-inspection relief from the pandemic ended June 30, 2024.
When a supervisor leaves, and work done by others
When a branch manager resigns, the firm must designate another qualified person to supervise the office, and report the change of designated supervisor to FINRA on Form BR within 30 days, as it does when it opens, closes, or moves a branch (FINRA By-Laws, Article IV, Section 8).
The firm also stays responsible for work it hands to others: outsourcing technology or back-office work to a vendor doesn’t relieve it of supervising that work (Regulatory Notice 21-29). An introducing firm’s agreement with the clearing firm that carries its customers’ accounts needs FINRA’s approval before it takes effect, and must assign each function, such as opening accounts, executing orders, extending credit, and sending confirmations. The clearing firm always safeguards customer funds and securities, and customers are told of the arrangement in writing when they open their accounts (FINRA Rule 4311).
Discretion
Discretionary accounts require extra supervision from the principal due to the risks of overtrading. Discretionary accounts refer to accounts where a registered representative, acting under FINRA Rule 3260, makes decisions as to what securities to buy or sell, whether to buy or sell, and how much to buy or sell, without needing to directly confirm with the client each time. This requires prior written authorization from the client, usually in the form of a limited power of attorney, plus written acceptance of the account by the firm.
The easiest way to remember what would require a discretionary account is this rule: if the client specifies all three A’s - Action, Asset, and Amount - the order is non-discretionary; if the client leaves any one of them to the rep’s judgment, the order is discretionary.
Action is the buy or sell, and likely is the hardest to hide, and will be stated each time.
Asset means a specific security, usually given as a company name or ticker symbol. As long as the security is identified down to a single, unambiguous choice, it counts - for example, “buy 100 shares of Disney” clearly names one company. A vague description like “buy 100 shares of the best entertainment stock” would not count, since reasonable people could disagree about which stock that is.
Amount is the amount of stock to buy or sell. It could be expressed in number of shares, or dollar amounts. It also could be percentages, either specific “sell half of my holdings”, which is 50%, or a little more hidden “sell all of my position”, that is selling 100% of what is owned.
Additional supervision required over discretionary accounts
Although there is no specific time frame stated in law, each member firm likely has their own specific interpretations. Supervisors or principals must review discretionary accounts frequently at regular intervals. Again, what those are specifically, is left to each member firm.
Every order entered using discretion must be marked as a discretionary order; an order the client fully specifies isn’t one, even in a discretionary account. If the client is missing one of the 3 A’s discussed earlier, if the registered rep calls the client, asks for clarification, and gets it, then the order isn’t missing any of the A’s anymore, the client has provided all of them, and that would not be a discretionary order. Each discretionary order must be approved promptly in writing by a principal; approval doesn’t need to happen before the trade, and typically happens the same day it’s executed.
The additional requirements on discretionary accounts can be grouped into three primary concerns:
- Mismanagement risk: the representative’s control over the client’s assets increases the chance of mistakes or poor decisions.
- Abuse risk: discretion makes it easier to churn an account for extra commissions, so the rep’s trust must be carefully monitored.
- Suitability of complex products: discretionary accounts may hold complex products, so supervision must confirm they’re handled appropriately.