Guidance

FINRA’s Examinations team has undertaken changes to create efficiencies before, during and after the exam process to continuously improve the program. On this episode, three senior leaders of the team join us to detail some of the recent changes, including the introduction of thematic reviews, changes to the post-exam closeout process and more.

As part of FINRA’s mission to protect investors and promote market integrity, we are focused on addressing the regulatory challenges presented by our member firms’ crypto asset activities. Crypto assets—also known as digital assets—are assets that are issued or transferred using distributed ledger or blockchain technology. They include, but are not limited to, so-called virtual currencies, coins, and tokens. A particular crypto asset may or may not meet the definition of a “security” under the federal securities laws.

FINRA's Membership Application Program serves as the entry point to FINRA membership for firms that meet 14 different standards for admission. On this episode, we hear how the group ensures members and would-be members adhere to these standards to safeguard the integrity of the market and ensure Americans can invest with confidence.

Last summer, we introduced listeners to FINRA’s Crypto Hub, an enterprise-wide strategy for keeping up with the evolving crypto asset regulatory landscape. On this episode, we have three members of the hub join us to provide an update on that work to dig into the results of a recent survey of member firms regarding their crypto asset touch points to tell us about the new spot Bitcoin ETP market and more.

The Cyber and Analytics Unit (CAU) within FINRA’s Member Supervision program highlights recent reports of a CrowdStrike service outage affecting Microsoft operating systems. FINRA continues to monitor the outage.

FINRA regulates a critical part of the securities industry – member brokerage firms doing business in the United States. In an effort to increase public awareness and understanding about the broad range of FINRA-registered firms and individuals, FINRA shares an annual snapshot of some of the data collected in the course of its work.

FINRA has implemented Form BR (Uniform Branch Office Registration Form) functionality enhancements for initial Form BR submissions that allow firms to de-select FINRA when establishing a new location designated as an RSL that needs to be registered or notice filed with a jurisdiction, the New York Stock Exchange (NYSE), or both, as a branch office. Further information on these functionality enhancements and how firms should complete an initial Form BR is available in the Frequently Asked Questions about Residential Supervisory Locations (RSLs). 

FINRA's Financial Intelligence Unit acts as a nerve center for information on emerging threats impacting the financial industry with the aim of providing actionable intelligence to firms, other regulators and law-enforcement to keep investors safe. On this episode, we learn how the group has grown in recent years and hear how they are evolving the way they share information.

Prohibited Independent Research in the Age of Artificial Intelligence: Don’t Do It, by Jennifer LaMont, Regional Manager, FINRA Southeast Region and other news.

On June 25, 2024, Progress Software released the MOVEit Transfer Critical Security Alert Bulletin (the Alert Bulletin) for CVE-2024-5806, a newly identified Critical Vulnerability, which was described as an Improper Authentication vulnerability in MOVEit Transfer, Secure File Transfer Protocol (SFTP) module and could lead to Authentication Bypass.

Financial social media influencers or finfluencers are growing in popularity as a cheap way to reach a new generation of investors. But using this newer form of advertising comes with risks. On this episode, we learn more about the regulatory requirements around the use of social media influencers and hear some best practices for firms looking to make use of “finfluencer” programs.

ONNX Store, a Phishing-as-a-service platform (PhaaS), is targeting Microsoft 365 (M365) accounts at FINRA member firms with an advanced social engineering attack known as quishing: a business email compromise (BEC) attack that uses QR codes in embedded PDF documents to redirect victims to phishing URLs.

FINRA understands that certain jurisdictions and SROs that require a branch office to be either “registered” or “notice filed,” using Form BR (Uniform Branch Office Registration Form) may not currently be able to recognize FINRA Rule 3110.19 (Residential Supervisory Location (“RSL”)). 

The Cyber and Analytics Unit (CAU) within FINRA’s Member Supervision program is highlighting recent updates to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0, which is a resource designed to help organizations manage and reduce cybersecurity risks, regardless of their degree of cybersecurity sophistication.

In late May, certain amendments to FINRA's margin rule, Rule 4210, went into effect to address a significant source of potential systemic risk and risk to FINRA member firms. The amendments introduced specific margin requirements related to covered agency transactions. On this episode, we learn more about the purpose of the change and what firms need to think about to ensure compliance.

The Cyber and Analytics Unit (CAU) within FINRA’s Member Supervision program is highlighting the SEC’s recent amendments to Regulation S-P.[1] On May 15, 2024, the SEC announced the adoption of amendments designed to modernize and enhance the protection of consumer financial information by broadening the scope of information covered by Regulation S-P’s requirements and requiring covered institutions to (1) adopt an incident response program and (2) notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

Protecting investors from harm is a top FINRA priority. And when it comes to specific individuals who may pose a risk, FINRA's High Risk Representative Program is on the case, identifying and monitoring individuals who pose an elevated risk of misconduct to protect investors and maintain the integrity of the market.

Every day, FINRA's Insider Trading Detection Program uses sophisticated technology and analytics to monitor 100% of trading in stocks, options and bonds for potentially suspicious activity around material news events, resulting in hundreds of referrals to the SEC and law enforcement every year. On this episode, we hear how the team connects trading data, information from public sources and from companies and FINRA firms to pull together actionable intelligence.

Frequently Asked Questions (FAQs) about the logistical aspects of the Remote Inspections Pilot Program, including the opt-in process.

FINRA’s Financial Intelligence Unit (FIU) and Vulnerable Adults and Seniors Team (VAST) are issuing this Threat Intelligence Product (TIP), which provides an overview of FINRA’s observations regarding the vulnerability of senior investors to investment scams, the devastating consequences for the victims and the importance of education about financial scams to prevent initial victimization and re-victimization.

Frequently asked questions regarding FINRA Rule 2210, filing requirements and the how to use the Advertising Regulation Electronic Filing (AREF) system.

On this episode, we hear from members of both the Vulnerable Adults and Seniors (VAST) Intake and Investigations teams to hear how the groups work with individual investors, firms, states and other regulators to prevent and detect financial exploitation of senior and other vulnerable investors.

On May 28th, U.S. markets are moving to a one-day settlement cycle, familiarly known as T+1. On this episode, we hear from four individuals across FINRA about what all market participants need to be thinking about and testing ahead of the transition.

This notification is to warn member firms of an ongoing phishing campaign that involves fraudulent emails purporting to be from FINRA and using the e-mail addresses “[email protected]” and “[email protected]”. The e-mail addresses and domain “data-finra.org” are not connected to FINRA, and firms should delete all emails originating from these domains. Member firms should be aware that they may receive similar phishing emails from other domain names in addition to those identified in this Alert.