Overview
Rules Notices Guidance
News Releases Investor Education Protection of financial and personal customer
information is a key responsibility and obligation of FINRA member firms. Under the SEC’s Regulation S-P, firms are required to have policies and procedures addressing the protection of customer information and records. This includes protecting against any anticipated threats or hazards to the security or integrity of customer records
and information and against unauthorized access to or use of customer records or information. The rule also requires firms to provide initial and annual privacy notices to customers describing information sharing policies and informing customers of their rights. Additionally, Regulation S-ID requires member firms that offer or maintain
covered accounts to develop and implement written identity theft prevention programs. Firms should be aware that customer information and records can be compromised in a variety of ways. This is especially true for firms that offer online, Web-based access to trading platforms and customer account information. Firms must understand and address the potential risks of brokerage account intrusions, whereby an unauthorized person gains access to a customer account and either steals available
assets or misuses the account to manipulate the market. Intrusions are generally accomplished through the theft of the login credentials of a customer or firm employee. Accounts have also been breached through fake electronic instructions (e.g., email requests for funds transmittals). Since this type of illicit activity can raise both investor protection and market integrity concerns, it is essential that firms use reasonable measures to protect customer information and assets.
FINRA Rule 3110 specifically requires firms to adopt procedures concerning transmittals of customer funds that include a means of customer confirmation. The Cybersecurity and Technology Governance and Anti-Money Laundering sections of the 2022 Report on FINRA’s Risk Monitoring and Examination Activities (the Report) informs member
firms’ compliance programs by providing annual insights from FINRA’s ongoing regulatory operations, including (1) relevant regulatory obligations and related considerations, (2) exam findings and effective practices, and (3) additional resources. FINRA's Office of General Counsel (OGC) staff provides broker-dealers, attorneys, registered representatives, investors and other interested parties with interpretative guidance relating to FINRA’s rules. Please see
Interpreting the Rules for more information. OGC staff contact: Related: Cybersecurity Distributed Denial of Service (DDoS) Attacks on Member Firms Fri, 06/19/2015 - 12:00 SEC Approves New Supervision Rules Wed, 03/19/2014 - 12:00 SEC Requests Broker-Dealers Make SARs and SAR Information Available to FINRA Fri,
02/10/2012 - 12:00 Verification of Emailed Instructions to Transmit or Withdraw Assets From Customer Accounts Thu, 01/26/2012 - 12:00 Verification of Instructions to Transmit or Withdraw Assets from Customer Accounts Fri, 11/13/2009 - 12:00 FINRA Clarifies Guidance Relating to SEC Regulation S-P
under Notice to Members 07-06 (Special Considerations When Supervising Recommendations of Newly Associated Registered Representatives to Replace Mutual Funds and Variable Products) Mon, 08/13/2007 - 12:00 SEC Approves Rule 2342 Setting Forth Requirements for Providing SIPC Information to Customers Fri, 06/08/2007 - 12:00 NASD
Reminds Members of Their Obligations Relating to the Protection of Customer Information Thu, 07/28/2005 - 12:00 Members' Responsibilities When Outsourcing Activities to Third-Party Service Providers Fri, 07/22/2005 - 12:00 Treasury Issues Final Suspicious Activity Reporting Rule for Broker/Dealers Mon, 08/12/2002 - 12:00If a Customer's Account or Data is Compromised
2022 Report on FINRA’s Examination and Risk
Monitoring Program
Contact OGC
Jeanette Wingler
FINRA, OGC
1735 K Street, NW
Washington, DC 20006
(202) 728-8000
2022 Report on FINRAs Examination and Risk Monitoring Program
The Anti-Money Laundering section of the 2022 Report on FINRA’s Risk Monitoring and Examination Activities (the Report) informs member firms’ compliance programs by providing annual insights from FINRA’s ongoing regulatory operations, including (1) relevant regulatory obligations and related considerations, (2) exam findings and effective practices, and (3) additional resources.
February 09, 2022
2022 Report on FINRAs Examination and Risk Monitoring Program
The Cybersecurity and Technology Governance section of the 2022 Report on FINRA’s Risk Monitoring and Examination Activities (the Report) informs member firms’ compliance programs by providing annual insights from FINRA’s ongoing regulatory operations, including (1) relevant regulatory obligations and related considerations, (2) exam findings and effective practices, and (3) additional resources.
February 09, 2022
2021 Report on FINRAs Examination and Risk Monitoring Program
The Anti-Money Laundering (AML) section of the 2021 Report on FINRA’s Risk Monitoring and Examination Activities (the Report) informs member firms’ compliance programs by providing annual insights from FINRA’s ongoing regulatory operations, including (1) relevant regulatory obligations and related considerations, (2) exam findings and effective practices, and (3) additional resources.
February 01, 2021
2019 Exam Findings Report
The Observations on Cybersecurity section of the 2019 Report on Exam Findings informs member firms’ compliance programs by describing recent findings and observations from FINRA’s examinations, and, in certain cases, also providing a summary of effective practices.
October 16, 2019
2017 Exam Findings Report
The Cybersecurity section of the 2017 Report on Exam Findings informs member firms’ compliance programs by describing recent findings and observations from FINRA’s examinations, and, in certain cases, also providing a summary of effective practices.
December 06, 2017
Guidance
FINRA is conducting an assessment of firms’ approaches to managing cyber-security threats. FINRA is conducting this assessment in light of the critical role information technology (IT) plays in the securities industry, the increasing threat to firms’ IT systems from a variety of sources, and the potential harm to investors, firms, and the financial system as a whole that these threats pose.
January 01, 2014
2021 Report on FINRAs Examination and Risk Monitoring Program
The Cybersecurity and Technology Governance section of the 2021 Report on FINRA’s Risk Monitoring and Examination Activities (the Report) informs member firms’ compliance programs by providing annual insights from FINRA’s ongoing regulatory operations, including (1) relevant regulatory obligations and related considerations, (2) exam findings and effective practices, and (3) additional resources.
Compliance Tools
What should your firm do after it discovers that customers’ accounts have been compromised?
Guidance
FINRA has created this page to educate member firms on “Firm Identity Theft”.
Guidance
The Red Flags Rule requires that each "financial institution" or "creditor" --which include most member firms--implement a written program to detect, prevent and mitigate identity theft in connection with the opening or maintenance of "covered accounts."
June 02, 2016
June 22, 2015
August 06, 2013
January 26, 2012
October 05, 2009
Investor Alert
Your brokerage firm has an obligation to safeguard your personal financial information. And every investor should take time to understand their firm’s cybersecurity procedures. But even the best procedures cannot prevent all instances of identity theft—especially if the vulnerability lies with you, the customer. Here are critical steps you can take to safeguard your financial accounts and help prevent identity theft.
Investor Alert
FINRA is updating this Alert to tell you about some of the latest online identify theft scams targeting financial sector customers and to provide tips for spotting and avoiding these scams.