9.1 Supervisory Controls, Annual Testing, and CEO Certification

1. The Three-Tiered Supervisory Hierarchy: Rules 3110, 3120, and 3130

To understand internal broker-dealer governance, candidates must distinguish among the three interrelated FINRA rules that govern firm oversight:

1. FINRA Rule 3110 (Supervisory System): Mandates that every member firm establish and maintain a supervisory system, including Written Supervisory Procedures (WSPs), designated supervisory personnel, and assigned Offices of Supervisory Jurisdiction (OSJs). Rule 3110 represents the operational layer—the day-to-day supervisory activities designed to prevent and detect rule violations by associated persons.
2. FINRA Rule 3120 (Supervisory Control System): Mandates that member firms establish a supervisory control system that tests and verifies whether the Rule 3110 supervisory procedures are functioning as intended. Rule 3120 represents the quality assurance and testing layer.
3. FINRA Rule 3130 (Annual CEO Certification): Mandates that executive leadership, specifically the Chief Executive Officer (CEO), formally certify annually that the firm has in place operational processes to establish, maintain, review, test, and modify compliance and supervisory policies. Rule 3130 represents the executive accountability layer.

---

2. FINRA Rule 3120 Supervisory Control System

Requirement to Test and Verify

Under FINRA Rule 3120, each member firm must designate one or more principals who will establish, maintain, and enforce a system of supervisory control policies and procedures. The core mandate of this system is to:

• Test and verify that the member's written supervisory procedures are reasonably designed with respect to the activities of the member and its registered persons to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules.
• Create additional or amended supervisory procedures where the need is identified by such testing and verification.

Testing cannot be an ad hoc or casual exercise. The designated principal must formulate an annual testing methodology that samples transactions, reviews supervisory logs, inspects branch office documentation, and evaluates customer account handling across all product categories.

The Rule 3120 Annual Report to Senior Management

At least annually (on a calendar year or rolling 12-month basis), the designated supervisory control principals must generate and submit a written report to the member firm's senior management. Under Rule 3120, the annual report must detail:

• A comprehensive summary of the test results from the supervisory control procedures conducted during the preceding year.
• Any significant supervisory exceptions or deficiencies identified during the testing cycle.
• The additional or amended supervisory procedures recommended or established in response to the test results to eliminate identified vulnerabilities.

This report serves as the evidentiary foundation for firm-wide operational enhancements and forms a critical component of the regulatory materials reviewed by FINRA during statutory cycle examinations.

---

3. Additional Rule 3120 Content for Large Firms

A member that reported $200 million or more in gross revenue on its FOCUS reports in the prior calendar year must add specified content to the annual report, to the extent applicable to its business. The report includes:

1. a tabulation of the customer-complaint and internal-investigation reports the member made to FINRA during the preceding year; and
2. a discussion of the preceding year's compliance efforts, including procedures and educational programs, in trading and market activities, investment banking, antifraud and sales practices, finance and operations, supervision, and anti-money laundering.

The threshold changes required report content; it does not excuse smaller firms from risk-based supervisory-control testing.

4. High-Risk Controls: Supervisory Personnel, Transmittals, and Account Changes

Three areas historically present heightened risks of conflicts, misappropriation, or concealed account changes. Rule 3110(b)(6) addresses the supervision of supervisory personnel, and Rule 3110(c)(2) requires each office inspection report to test the firm's procedures for transmittals and for changes to customer account information:

Supervision of Producing Managers

A producing manager is a branch manager or supervisory principal who, in addition to supervisory duties, directly handles customer accounts and executes securities transactions for personal commission revenue. Because a producing manager generates revenue, a severe structural conflict of interest arises if the manager is permitted to supervise their own customer activity or if their supervisor's compensation is tied to their production.

Rule 3110(b)(6)(C) and (D) require procedures that prohibit supervisory personnel from supervising their own activities or reporting to, or having their compensation or continued employment determined by, a person they supervise, and that keep the supervisory system from being compromised by conflicts such as the supervised person's position, the revenue the person generates, or compensation the supervisor derives from that person:

• Independent Oversight: The producing manager must be supervised by someone senior or otherwise independent of the producing manager.
• Prohibition on Reciprocal Oversight: Two producing managers at equivalent levels cannot supervise each other's retail customer accounts.
• Compensation Conflicts: Procedures must keep supervision from being compromised by compensation the supervisor derives from the producing manager's business, for example by assigning review to someone whose pay does not depend on that production.
• Limited Size and Resources Exception: If independent supervision is not possible because of the firm's size or supervisory structure, the firm must document the factors used and how its alternative procedures comply with the rule. The exception is not automatic permission for self-review.

Transmittal of Customer Funds and Securities

Misappropriation of customer assets frequently occurs through unauthorized fund transmittals. Rule 3110(c)(2)(A)(iv) requires inspections to test procedures for transmittals of funds or securities:

• Transmittals of customer funds (checks, wire transfers, Automated Clearing House [ACH] transfers) or securities from customer accounts to third-party accounts.
• Transmittals from customer accounts to outside entities, such as banks or investment companies.
• Transmittals from customer accounts to locations other than the customer's primary address of record (e.g., a post office box, an "in care of" account, or an alternate address).
• Transmittals between customers and registered representatives, including the hand-delivery of checks.
• Documented confirmation: Under Rule 3110(c)(2)(B), the procedures must include a means or method of customer confirmation, notification, or follow-up that can be documented; the firm may use reasonable risk-based criteria to judge whether transmittal instructions are authentic.

Customer Changes of Address and Investment Objectives

Under Rule 3110(c)(2)(A)(v) and (C), the procedures for changes of customer account information, including address and investment-objective changes, must include for each change a documented means of customer confirmation, notification or follow-up that complies with SEC Rule 17a-3(a)(17). That rule requires notice of a name or address change to the customer's old address (or to each joint owner) and to the responsible associated person within 30 days, and a copy of the updated account record within 30 days after an investment-objective change (Section 7.1).

The principal should authenticate the change, preserve the instruction and notification, and investigate a rapid change followed by liquidation or disbursement, especially when a representative entered the change on an account the representative services.

---

5. FINRA Rule 3130 Annual CEO Compliance Certification

Core Legal Mandate

Under FINRA Rule 3130, each member firm's Chief Executive Officer (CEO) (or equivalent executive officer) must certify annually that the broker-dealer has in place processes to establish, maintain, review, test, and modify written compliance policies and written supervisory procedures reasonably designed to achieve compliance with applicable federal securities laws, SEC rules, MSRB rules, and FINRA conduct rules.

Mandatory Preparation of the Annual Compliance Report

The firm must prepare a report that details the processes it has in place to establish, maintain, review, test and modify written compliance policies and WSPs and describes the manner in which those processes are evidenced. The CEO, CCO and any other officers the firm considers necessary review the report as part of the certification process. The report should identify significant problems and the corrective process without implying that the CCO alone owns every compliance duty.

The Mandatory CEO-CCO Pre-Certification Conference

The CEO cannot sign the Rule 3130 certification in isolation or treat it as a ministerial formality. Rule 3130 establishes strict procedural prerequisites:

• Mandatory Meeting: The CEO must meet with the CCO at least once during the preceding 12-month period to discuss the compliance operations, the findings of the CCO's annual compliance report, and any material regulatory risks confronting the firm.
• Board Submission: The final report evidencing these processes must be submitted to the member firm's Board of Directors and Audit Committee (or equivalent governing bodies) at or prior to their next scheduled meeting, or within 45 calendar days of the execution of the certification, whichever is earlier.
• Certification Execution: The CEO executes the written certification based upon the discussions during the mandatory meeting and the representations contained in the CCO's report. The certification must be executed annually (no later than 12 months following the date of the previous year's certification).

Legal Scope and Evidentiary Standard

The Series 26 principal must recognize the exact legal standard of the Rule 3130 certification:

• The certification does not mean that the CEO personally guarantees that zero violations of securities laws occurred during the year.
• Rather, the CEO certifies that the broker-dealer has established, tested, maintained, and enforced comprehensive, reasonable processes designed to achieve compliance and detect violations.

---

Applying the Framework

Rule 3120 is not a second copy of the WSP manual. Supervisory control procedures test and verify that the Rule 3110 system is reasonably designed and functioning, identify gaps, and create or amend procedures in response. The annual report goes to senior management and describes the testing performed, results, significant exceptions and additional procedures created.

For a member reporting at least $200 million in gross revenue in the prior calendar year, the annual report includes the required FINRA-report tabulation and discussion of compliance efforts in the applicable trading, investment-banking, antifraud and sales-practice, finance-and-operations, supervision and AML areas. The threshold is not a substitute for risk-based testing by smaller firms.

Rule 3130 certification concerns the firm's processes. It does not represent that no violation occurred, nor does it transfer the CCO's duties to the CEO. The CEO must have a reasonable basis, including the required meeting with the CCO during the preceding 12 months, the annual compliance report and evidence that deficiencies were addressed.

High-risk controls should prevent a producing manager from being the sole reviewer of the manager's own activity. Transmittals to third parties or non-primary addresses, changes of address or investment objective, and overrides by senior producers deserve independent sampling and data-driven testing. Findings remain open until the corrective change is implemented and validated.