Key Points:
- FINRA Rule 3110 requires firms to establish a supervisory system that can be demonstrated with evidence, not simply documented through policies.
- Effective supervision depends on clearly assigned responsibilities, documented reviews, branch inspections, and records that remain accessible throughout required retention periods.
- Understanding how Rule 3110 aligns with Rules 3120, 3130, and 4511 helps firms build a more complete supervisory and recordkeeping framework.
- Common compliance failures often result from fragmented records, undocumented supervisory activities, and difficulties retrieving evidence during examinations.
- Archon Data Store supports Rule 3110 compliance by helping firms preserve supervisory evidence in a governed, searchable, and defensible archive.
FINRA Rule 3110 supervision requirements are the standard every broker-dealer gets measured against, whether or not the firm feels ready for it. The rule does not care about intentions. It cares about proof.
Written procedures, named supervisors, real reviews, and a paper trail that shows the review actually happened. Firms that treat this as background paperwork tend to find out the hard way that it isn’t.
FINRA Rule 3110 is the primary supervisory rule governing broker-dealers. Every supervisory obligation under the rule ultimately comes down to demonstrating that reviews occurred, responsibilities were assigned, and records can withstand regulatory scrutiny.
Here is what the rule actually requires, who must comply, how it differs from related FINRA supervision rules, where firms typically fall short, and why archiving has become the quiet fix for many of those gaps.
What Is FINRA Rule 3110?
FINRA Rule 3110 requires every FINRA member firm to establish and maintain a supervisory system reasonably designed to achieve compliance with securities laws, FINRA rules, and applicable regulatory requirements before violations result in customer harm or regulatory action.
The rule applies to every FINRA member firm, regardless of size. While supervisory expectations are scaled to the firm’s business model, products, risks, and organizational structure, every firm must be able to demonstrate that its supervisory system is operating as intended.
Rule 3110 is not simply about maintaining written policies. It is about producing evidence, on request, that supervision is genuinely happening.
Rule 3110 vs. Rules 3120 and 3130: Understanding the Supervisory Framework
Rule 3110 does not operate on its own. FINRA designed it as part of a broader supervisory framework that combines operational supervision, independent testing, and executive accountability.
Together, FINRA Rule 3110 (Supervision), FINRA Rule 3120(Supervisory Control System), and FINRA Rule 3130(Annual Certification of Compliance and Supervisory Processes) establish an ongoing supervision program rather than a one-time compliance exercise.
Written supervisory procedures, supervisory reviews, annual testing, and executive oversight all need to operate as a continuous process supported by records that can be produced during a regulatory examination.
| Rule | Primary purpose | Key requirements | Primary responsibility |
|---|---|---|---|
| FINRA Rule 3110 | Establish and maintain the firm’s supervisory system | Written Supervisory Procedures (WSPs), designated supervisors, correspondence review, branch inspections, documentation of supervisory activities | Supervisory principals and the member firm |
| FINRA Rule 3120 | Test whether the supervisory system is effective | Annual supervisory control testing, documented findings, reporting to senior management | Personnel responsible for supervisory controls |
| FINRA Rule 3130 | Provide executive accountability | Annual CEO certification that the firm has processes to establish, maintain, review, test, and modify supervisory procedures | Chief Executive Officer |
Rule 3110 carries most of the operational burden because it governs the day-to-day supervisory activities firms perform throughout the year. Rules 3120 and 3130 build on that foundation by verifying the supervisory system works as intended and requiring executive oversight of the process.
The Core Elements Firms Must Cover
Every firm’s Written Supervisory Procedures (WSPs) need to address the same supervisory foundations, although the specific controls should reflect the firm’s business activities, products, services, and risk profile.
A supervisory system built for the actual business
Rule 3110(a) does not hand firms a template. A firm running municipal underwriting needs different controls than one running retail wealth management. Procedures copied from another firm’s manual or never updated to reflect current operations are among the easiest deficiencies for examiners to identify.
Written Supervisory Procedures (WSPs) that name names
WSPs need to specify who reviews what, how often reviews occur, how exceptions are escalated, and how supervisory activities are documented. Language like “management will periodically review communications” remains one of the most common deficiencies because it names no responsible individual and establishes no measurable supervisory expectation.
Designated principals for Offices of Supervisory Jurisdiction (OSJs) and branch locations
Every Office of Supervisory Jurisdiction (OSJ) requires a qualified principal responsible for supervising that location. Branch offices and non-branch locations remain subject to inspection requirements, although inspection frequency differs depending on FINRA’s supervisory framework and the firm’s risk profile. Firms with supervisors working remotely face additional supervisory considerations discussed later in this guide.
Review of electronic correspondence and internal communications
This is Rule 3110(b)(4), and it is where many firms encounter supervisory challenges. Business email, chat platforms, collaboration tools, and other electronic communications must be reviewed for compliance risks under procedures reasonably designed for the firm’s business.
FINRA has made it clear that simply opening a communication is not the same as reviewing it. Firms need evidence showing who performed the review, what was reviewed, when the review occurred, and what supervisory action followed. Mechanical review tasks may be delegated, but supervisory accountability remains with the designated principal.
Internal inspections on a defined schedule
Offices of Supervisory Jurisdiction require annual inspections. Other branch and non-branch locations are inspected on schedules established under FINRA’s supervisory requirements. Regardless of frequency, inspections must evaluate whether supervisory procedures are functioning effectively rather than merely confirming an office exists.
Verification of representative backgrounds
Firms are expected to verify information submitted on Form U4 through public records searches and other appropriate verification procedures. Although this may appear administrative, failures in this area have contributed to numerous enforcement matters involving registered representatives.
Maintaining supervisory records
In practice, firms should be able to retain Written Supervisory Procedures, communication review records, branch inspection documentation, supervisory approvals, exception records, review evidence, and documentation supporting supervisory decisions.
During a FINRA examination, these records collectively demonstrate that supervisory procedures were implemented consistently rather than existing only on paper.
A firm can have every one of these requirements written down correctly and still fail an examination, because writing procedures is not the same as proving they were followed. That gap between policy and evidence is where many supervisory findings actually emerge.
Where Rule 3110 Supervision Breaks Down in Practice
Ask a compliance officer where Rule 3110 gets difficult, and the answer is rarely confusion about what the rule says. It is almost always about keeping up with the volume of what needs reviewing.
Many FINRA enforcement actions do not stem from firms lacking supervisory procedures. They stem from firms being unable to demonstrate those procedures were consistently followed.
Off-channel communications
Communication that happens outside the firm’s approved systems remains one of the biggest supervisory challenges. When business gets conducted over personal messaging apps or collaboration platforms that were never captured by the firm’s compliance systems, there is nothing there to review.
That means firms cannot demonstrate that supervisory reviews were performed consistently, regardless of how well-written their Written Supervisory Procedures (WSPs) may be.
Regulators have repeatedly emphasized that firms are expected to capture, preserve, and supervise business communications conducted over approved channels. When those communications are missing or cannot be produced, firms may struggle to demonstrate that their supervisory obligations have been met.
Unclear supervisory ownership
Delegation is the second failure point, and a quieter one. Pushing review work down to junior staff or automated tools is allowed. Losing track of who is actually responsible for supervision is not.
FINRA has cited firms whose Written Supervisory Procedures failed to identify the individual responsible for reviewing archived communications or explain how supervisory reviews should be documented. While the financial penalties may vary, the underlying finding remains significant because it demonstrates a breakdown in accountability.
Documentation gaps
The third failure is a documentation gap that appears even in firms that genuinely perform supervisory reviews.
The proof of that review needs to be retrievable and tamper-proof, not sitting in someone’s inbox or a spreadsheet that disappeared when the reviewer changed roles. If the supervisory trail cannot be produced later, regulators may conclude the review cannot be demonstrated.
Inconsistent supervisory records
Another challenge is consistency. Supervisory reviews often span multiple business units, communication platforms, CRM systems, and legacy applications.
Reviews may be completed correctly, yet producing a complete supervisory record becomes difficult when evidence is scattered across disconnected systems rather than maintained as part of a single governed record.
Likewise, supervisory records should capture more than the communication itself. When a review identifies a potential compliance issue, firms should also retain documentation showing how the matter was escalated, investigated, resolved, and ultimately closed. That broader supervisory history often becomes just as important during an examination as the original communication.
If your written procedures cannot say, right now, who reviewed a specific message last month, when they reviewed it, and what action followed, that is not a paperwork gap. That is a finding waiting to be found.
Remote Supervision and Risk-Based Inspections
Remote supervision has added another layer of complexity to Rule 3110.
Supervisors working from a home office previously required that location to be registered as a full Office of Supervisory Jurisdiction, with an on-site inspection every year.
FINRA has since introduced a Residential Supervisory Location (RSL) designation that allows qualifying home offices to be inspected less frequently, along with a pilot program permitting certain firms to conduct remote inspections instead of always visiting locations in person.
The flexibility, however, comes with greater documentation expectations rather than fewer.
When a firm relies on remote inspections or defers an on-site visit, it should maintain a documented, risk-based justification supporting that decision. That assessment should consider factors such as the nature of business conducted at the location, disciplinary history, communication activity, customer complaints, prior examination findings, and other supervisory risk indicators.
A general policy statement is not enough. Regulators expect firms to demonstrate why a particular supervisory approach was appropriate for a particular location.
Meeting Rule 3110 Supervision Requirements Through Archiving
Every failure point above comes back to the same missing piece: the ability to capture, preserve, search, and produce supervisory evidence across whatever channel the business actually happens on. That capability has a name, and it is archiving.
Rule 3110 does not ask firms to buy software. It asks firms to demonstrate a working, evidence-backed supervisory system.
In practice, that means firms need to preserve business communications, document supervisory reviews, retain evidence of decisions and escalations, and keep those records accessible throughout applicable retention periods.
Without that evidence, supervision becomes difficult to demonstrate regardless of how well the underlying reviews were performed.
Rule 3110 establishes the supervisory obligation, while FINRA Rule 4511 and applicable SEC books-and-records requirements reinforce the need to preserve those records in a complete, accessible, and defensible manner.
Ultimately, archiving is valuable not because regulators expect firms to have it, but because it provides the evidence needed to demonstrate that supervisory procedures were actually followed.
Continue reading: How to Meet FINRA Record Retention Requirements When Legacy Application Decommissioning
How Archon Data Store Supports FINRA Rule 3110 Compliance
The supervisory obligations under Rule 3110 do not end once a review is completed. Firms also need to preserve the records behind that review in a way that remains accessible, reliable, and defensible throughout the required retention period.
That becomes more difficult as supervisory evidence accumulates across enterprise applications, business records, documents, and electronic communications. Each system may hold part of the picture, but responding to an examination often means bringing those pieces together into a single, coherent supervisory record.
Archon Data Storeis built to solve that problem. As an enterprise archiving platform, it provides a governed repository for preserving and managing records across the organization, helping firms maintain the evidence needed to support supervisory activities under Rule 3110.
Some capabilities that are particularly relevant include:
- Broad connector coverage that brings records from enterprise applications, databases, documents, and communication platforms into a single governed archive.
- Cross-application search that helps compliance teams retrieve related records without manually searching multiple systems.
- Immutable, tamper-evident storage, backed by cryptographic verification and trusted timestamps, helping preserve record integrity throughout required retention periods.
- Retention policy management and legal hold orchestration that support consistent governance across archived records.
- Comprehensive audit trails documenting record access, administrative activity, and the history of retained records.
Rule 3110 does not change because a firm has better technology. Supervisory responsibilities still belong to the firm’s designated principals. What Archon Data Store changes is the firm’s ability to preserve, retrieve, and demonstrate the records that support those supervisory responsibilities when regulators ask to see them.
FINRA Rule 3110 Compliance Checklist
Before your next FINRA examination, consider whether your supervisory program can answer “yes” to each of these questions.
| Supervisory Readiness Check | Status |
|---|---|
| Do your Written Supervisory Procedures clearly assign responsibility for every supervisory review? | |
| Can you identify who reviewed a communication, when it was reviewed, and what action was taken? | |
| Are business communications across approved channels consistently captured and preserved? | |
| Are supervisory exceptions documented, investigated, and resolved? | |
| Are branch inspections completed according to FINRA requirements and supported by appropriate documentation? | |
| Are remote supervisory locations supported by documented risk assessments where applicable? | |
| Can supervisory records be retrieved quickly during a FINRA examination? | |
| Are supervisory records protected from unauthorized alteration throughout their retention period? |
If several of these questions are difficult to answer confidently, the challenge often lies less with supervisory intent than with fragmented records, inconsistent documentation, or disconnected systems.
Closing Thoughts
Rule 3110 has never really been about paperwork. It has always been about whether a firm can look an examiner in the eye and say, with evidence in hand, that it knows what happened inside its own business. The standard has always been the same: written procedures, named accountability, consistent supervision, and a trail that holds up under scrutiny.
Firms still relying on manual reviews and scattered records are fighting a losing battle against volume, and recent enforcement trends make that clear. Archiving is not an add-on to compliance. It is the mechanism that turns Rule 3110 from a written policy into something a firm can actually prove, on demand, in the format regulators expect.
If your firm is still piecing supervisory evidence together by hand, it is worth a conversation before an examiner asks the question first.
Talk to us about strengthening your Rule 3110 readiness →
