12.2 Control Testing, CEO Certification and Access

FINRA Rule 3120 & Rule 3130: Controls, Testing & Executive Certification

While Rule 3110 governs day-to-day supervision, FINRA Rules 3120 and 3130 establish executive-level accountability and systematic verification of the supervisory structure itself.

FINRA Rule 3120: Supervisory Control System

Under FINRA Rule 3120, member firms must establish, maintain, and enforce a system of supervisory control policies and procedures that:

1. Test and Verify: Test and verify on an appropriate schedule that the broker-dealer's supervisory procedures under Rule 3110 are functioning effectively and achieving compliance with applicable securities laws and FINRA rules;
2. Create Additional Procedures: Formulate and implement additional or amended supervisory procedures where testing reveals gaps, weaknesses, or emerging operational risks; and
3. Annual Supervisory Controls Report: At least annually, designated principals must submit a formal written report to the firm's senior management under the rule; do not assume Rule 3120 independently mandates delivery to the board. The Rule 3120 report must detail:
   • A summary of the supervisory control testing conducted throughout the year;
   • Significant supervisory exceptions, procedural deficiencies, and operational failures identified; and
   • Recommended enhancements to WSPs and remedial actions taken to address identified deficiencies.

• Large Firm Requirements (Gross Revenue ≥ $200 Million): Firms reporting gross revenue of $200 million or more on their FOCUS reports must include comprehensive statistical tabulations and analyses in their Rule 3120 report, covering customer complaints, internal investigations, customer account activity, conflicts of interest, and the supervision of producing branch managers.

FINRA Rule 3130: Annual Certification of Compliance and Supervisory Processes

To ensure that top executive leadership takes personal responsibility for firm-wide compliance culture, FINRA Rule 3130 mandates an annual written certification by the firm's highest executive:

• CEO Written Certification: The broker-dealer's Chief Executive Officer (CEO) (or equivalent executive officer) must certify annually in writing that the firm has in place processes to:
  1. Establish, maintain, review, test, and modify written compliance policies and written supervisory procedures reasonably designed to achieve compliance with applicable FINRA rules, MSRB rules, and federal securities laws;
  2. Produce an annual report documenting these processes and testing methodologies; and
  3. Submit the annual compliance report to the firm's Board of Directors and Audit Committee.
• Mandatory CEO-CCO Meeting: Prior to executing the certification, the CEO must conduct one or more formal meetings with the firm's Chief Compliance Officer (CCO) within the preceding 12 months to review the firm's supervisory processes, discuss regulatory risk assessments, and evaluate testing findings.
• Submission to Governance: The process report is provided to the board and audit committee, if any, at the next scheduled meeting or within 45 days after certification, whichever is earlier, under the rule’s conditions. Do not confuse this with the Rule 3120 report to senior management.

Separation of Duties and Access Controls

Separation reduces the chance that one person can authorize, move and conceal customer assets. Combine independent approval, reconciliation and supervision according to the firm’s size and risks. Regulations do not universally prohibit every front-office person from every back-office activity, or prevent a properly registered employee from holding multiple roles. Assess actual duties, registrations, conflicts and compensating controls.

Under a maker-checker workflow, one person prepares a transaction and another authorized person independently reviews and releases it. High-risk transfers, sensitive account changes, manual journals and trade reallocations deserve appropriate independent controls. Follow the approved procedure; do not waive controls merely because a manager requests speed.

Information barriers protect material nonpublic information. Access follows need-to-know, with restrictions on use and trading. A restricted list and a confidential watch list have different purposes. The firm’s policy determines permitted/prohibited activity; not every listed security universally prohibits every customer order. Staff must not disclose a confidential watch-list entry to a salesperson.

Entitlements determine who can view, enter, approve, export or change information. Apply least privilege, individual credentials, periodic reviews and prompt changes after role transfers or departures. The frequency of entitlement review follows risk and policy; a universal quarterly statutory cycle is not imposed on every system.

Physical controls matter too: badge access, visitor logs, secured files, controlled vault access and protected disposal. A person with building access should not automatically have rights to export all customer account data. Likewise, an approved vendor needs only the data and access necessary for its service.

An employee creating a payee, entering a wire and approving the same payment has conflicting access. Revoke or separate the conflicting permission and investigate prior usage. A supervisor’s signature after a fraudulent wire has left is weaker than effective preventive authorization, although detective reconciliation remains necessary.

Maintain evidence of who approved, released and reconciled a transaction. Shared credentials destroy attribution and can compromise both security and recordkeeping. Emergency access should be authorized, limited, logged and reviewed, with controls restored after the emergency.

Sources checked 2026-10-20: FINRA supervision, FINRA annual certification, FINRA continuity.