FINRA Cautions Firms On Outsourcing

FINRA reminded firms of their obligation to maintain a sufficient supervisory system for activities outsourced to third-party vendors. FINRA highlighted exam findings and examples of disciplinary actions arising from supervisory lapses.

FINRA encouraged firms to review:

• their supervisory obligation for outsourced activities, which if performed directly by a member would be subject to FINRA Rule 3110 ("Supervision");
• whether vendors meet registration requirements under FINRA Rule 1220 ("Registration Categories");
• that their cybersecurity programs and controls are consistent with SEC Regulation S-P Rule 30 ("Procedures to safeguard customer records and information; disposal of consumer report information"); and