9.4 Vendor Due Diligence and Record Access

Vendor Due Diligence & Third-Party Oversight

Modern broker-dealer operations increasingly rely on specialized third-party vendors for core technological and operational functions, including cloud data storage (e.g., AWS, Azure, Google Cloud), trade execution management systems (OMS/EMS), clearing and settlement platforms, market data pricing feeds, client reporting portals, and cybersecurity operations centers (SOC).

The Core Regulatory Rule: Non-Delegable Responsibility

Under FINRA Regulatory Notice 05-48 (Outsourcing) and Regulatory Notice 21-29 (Vendor Risk Management), broker-dealers may outsource operational tasks and technological infrastructure to third-party service providers. However:

Vendor Due Diligence & Risk Assessment Framework

Prior to entering into an outsourcing arrangement—and continuously throughout the relationship—a broker-dealer must execute structured vendor due diligence:

1. Financial Viability & Stability: Reviewing audited financial statements, credit ratings, and capital adequacy to confirm the vendor possesses the financial stamina to sustain continuous operations without insolvency risk.
2. Technical Capacity & Operational Resilience: Evaluating system capacity, processing redundancy, latency standards, and scalability to handle market volume spikes during periods of extreme volatility.
3. Internal Control Audits (SOC Reports): Reviewing annual System and Organization Controls (SOC 1 Type II and SOC 2 Type II) audit reports prepared by independent CPA firms. These reports provide evidence about the design and operating effectiveness of the vendor's internal accounting controls, data security, system availability, and confidentiality protocols over an extended testing period (typically 6 to 12 months).
4. Cybersecurity Defenses: Inspecting the vendor's cybersecurity architecture, including appropriate encryption for the data and architecture, multi-factor authentication (MFA), patch management cadence, penetration testing results, and vulnerability scanning routines.
5. Business Continuity Planning (BCP) & Disaster Recovery: Assessing the vendor's BCP procedures, disaster recovery infrastructure across geographically dispersed data centers, backup power supplies, and demonstrated Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

Contractual Protections & Service Level Agreements (SLAs)

Broker-dealers must secure robust contractual covenants within master service agreements:

• Service Level Agreements (SLAs): Establishing explicit, measurable performance metrics, including system uptime guarantees (e.g., 99.99% availability), trade processing latency caps, and help-desk response turnaround times, backed by financial penalties for non-compliance.
• Independent Audit Rights: The broker-dealer, its internal and external auditors, and regulatory examiners (SEC and FINRA) must have the unconditional legal right to audit the vendor's facilities, systems, operational procedures, and security controls.
• Data Confidentiality & Privacy (Regulation S-P): Mandating that the vendor maintain strict confidentiality of customer Non-Public Personal Information (NPI), adhere to SEC Regulation S-P data safeguarding rules, and isolate the broker-dealer's data in secure, tenant-segregated environments.
• Incident Response & Breach Notification: Requiring the vendor to maintain a formal incident response plan and contractually obligating the vendor to notify the broker-dealer promptly under applicable incident-notification requirements, including Regulation S-P’s service-provider oversight standard upon detecting any actual or suspected data breach, cyber intrusion, or unauthorized data exposure.
• Subcontractor Oversight ("Fourth-Party Risk"): Prohibiting the vendor from sub-outsourcing core operational functions to secondary subcontractors without prior written notification and approval from the broker-dealer.

Electronic Records and Regulatory Access

Rule 17a-4(f) permits compliant WORM or audit-trail systems and an appropriate designated third party or executive-officer access undertaking. Rule 17a-4(i) separately addresses records maintained by an outside service bureau, bank or other person, including a conditional alternative undertaking for certain electronic-service arrangements.

Determine which obligation applies to the actual service. A designated executive officer under paragraph (f) does not automatically remove a separate paragraph (i) obligation; nor does every cloud vendor have to become the designated access person. Verify independent access, ownership, retrieval and regulator-production arrangements before relying on the service.

Test export and recovery. A contract promising access is inadequate if the firm cannot obtain its records after termination or a vendor outage. Preserve required records, timestamps and audit history in a reasonably usable format. Vendor financial failure, subcontractor changes and service termination need an exit plan.

Reviewing Assurance Evidence

A SOC report is evidence within its stated scope and testing period, not a regulator’s approval of the broker-dealer’s outsourcing decision. Review exclusions, exceptions, subcontractors and required user controls. Follow up on deficiencies affecting the service actually used by the firm.

Sources checked 2026-10-20: FINRA communications, FINRA payments, SEC client commissions guidance.