Introduction
Most financial firms, fintechs, and crypto companies operating in the US securities space know FINRA exists — but struggle to identify which rules apply to them, when registration is actually required, and what a functional compliance program needs to look like.
That uncertainty is expensive. FINRA imposed $59.8 million in fines in 2024, and the violations behind those penalties — weak supervision, inadequate AML programs, poor recordkeeping, and communication failures — are exactly the gaps that emerging firms tend to underestimate.
This guide covers what FINRA is, who must register, the five core rules every member firm needs to understand, the most common violations, and how to build a program that holds up under examination.
TLDR
- FINRA is the SEC-authorized self-regulatory organization overseeing broker-dealers and their registered representatives in the US.
- Any firm that effects securities transactions for others must register with FINRA before conducting business.
- Five rules form the compliance backbone: Rule 1210, Rule 2210, Rule 3110, Rule 3310, and Rule 4511 — covering registration through recordkeeping.
- Non-compliance carries real consequences: fines, license revocation, and enforcement actions that become permanent public record.
What Is FINRA and What Does It Do?
FINRA — the Financial Industry Regulatory Authority — is a private, not-for-profit self-regulatory organization (SRO) authorized by the SEC to regulate broker-dealers in the US. It operates under Section 15A of the Securities Exchange Act of 1934, meaning its legal authority flows from federal statute rather than government agency status. FINRA is not a government entity, but it operates under SEC supervision and its rules require SEC approval.
What FINRA Actually Does
FINRA's core functions span the full scope of broker-dealer oversight:
- Writes and enforces rules governing how member firms and their representatives conduct business
- Administers qualification exams — the SIE, Series 7, Series 79, and others — for individuals entering the securities industry
- Conducts routine examinations of member firms to assess compliance with its rulebook
- Brings disciplinary actions against firms and individuals who violate its rules
- Monitors markets for manipulative or fraudulent trading activity
According to FINRA's 2026 Industry Snapshot, there were 639,723 registered representatives in 2025, with 40,000 to 45,000 new entrants joining the industry annually.
FINRA vs. the SEC
The SEC and FINRA are distinct — their jurisdictions don't overlap, they stack. The SEC is a federal government agency with broad authority over all US securities markets: investment advisers, exchanges, and public companies. FINRA's scope is narrower, covering broker-dealers and their registered personnel specifically.
In practice, the SEC sets overarching securities law while FINRA handles day-to-day rule enforcement for broker-dealers. Firms that violate FINRA rules face FINRA disciplinary action. When violations escalate to securities fraud or systemic market abuse, the SEC steps in.
Who Must Comply With FINRA?
FINRA compliance is activity-based, not label-based. Whether you call your platform a "trading app," a "robo-advisor," or a "digital asset exchange" matters less than what the platform actually does.
The Legal Trigger
The Securities Exchange Act defines a broker as any person engaged in the business of effecting transactions in securities for the account of others. A dealer buys and sells securities for its own account as a regular business. Either activity triggers registration requirements under Exchange Act Section 15(a)(1) — and registration with the SEC means becoming a FINRA member.
Examples of activities that likely require FINRA membership:
- Operating a securities trading platform that routes customer orders
- Soliciting investors to purchase specific securities
- Receiving transaction-based compensation for securities introductions
- Running an investment app that executes trades on behalf of users
Individual Registration Requirements
Individual registration requirements apply alongside firm-level obligations. Registered representatives working at FINRA member firms must:
- Pass the Securities Industry Essentials (SIE) exam plus an appropriate "top-off" exam (such as the Series 7 for general securities representatives)
- Maintain continuing education requirements annually under Rule 1240
- Register under the correct category aligned with their specific role
The Fintech and Crypto Risk Zone
This is where many emerging companies get caught. An investment app, a robo-advisor, or a digital asset platform offering securities-like instruments may cross the broker-dealer threshold without realizing it. The SEC has been explicit: operating a securities trading platform or intermediating investor transactions triggers broker registration issues no matter how the platform is built or branded.
The SEC's 2023 enforcement action against Bittrex — which resulted in a $24 million settlement for operating an unregistered exchange, broker, and clearing agency — shows that registration isn't a technicality. It's a live legal exposure.
Key FINRA Compliance Rules and Requirements
Five rules form the operational core of any FINRA member firm's compliance program — covering registration, communications, supervision, AML, and recordkeeping.
Rule 1210 — Registration and Licensing
Every individual performing investment banking or securities functions at a member firm must register in the appropriate category. Registration requires passing the SIE exam and a role-specific top-off exam. Common examples:
- Series 7 — General Securities Representative
- Series 79 — Investment Banking Representative
- Series 24 — General Securities Principal (supervisory)
Under Rule 1240, the Regulatory Element of continuing education must be completed annually by December 31 for each registration category. Firms must also maintain a written Firm Element training plan.
Rule 2210 — Communications With the Public
All firm communications — social media posts, research reports, advertising, client emails — must be fair, balanced, and not misleading. Key requirements:
- No unsubstantiated claims about investment returns or product performance
- Material facts cannot be omitted if their absence makes a communication misleading
- Retail communications recommending securities must disclose any financial interest the firm or associated person holds in the issuer
- Supervisory pre-approval is required for certain categories of retail communications
Rule 3110 — Supervision Requirements
Rule 3110 is the backbone of any compliance program. It requires firms to establish, maintain, and enforce a Written Supervisory Procedures (WSP) manual tailored to their specific business activities. Core requirements include:
- Designating a registered principal responsible for each business line
- Assigning supervisors to each registered person
- Conducting periodic reviews of transactions and correspondence
- Inspecting Office of Supervisory Jurisdiction (OSJ) locations and branches
- Maintaining written records of all supervisory reviews
FINRA's own WSP guidance treats these documents as "living": they must be updated whenever rules change or business activities evolve.
Rule 3310 — Anti-Money Laundering Compliance Program
Every FINRA member must implement a written AML program approved by senior management. The program must be reasonably designed to comply with the Bank Secrecy Act and must include:
- Customer Identification Program (CIP) and customer due diligence procedures
- A designated AML Compliance Officer with day-to-day operational responsibility
- Ongoing employee training tailored to the firm's business and risk profile
- Annual independent testing of the AML program
- A SAR filing mechanism to detect and report suspicious activity to FinCEN under 31 U.S.C. 5318(g)
Rule 4511 — Books and Records
Firms must make and preserve accurate, legible, and retrievable records of all business activities. Retention periods vary by record type: FINRA rules default to a six-year minimum for records without a specified period, while SEC rules create separate three-year and six-year categories depending on the record type.
Commonly required records include:
- Transaction confirmations
- Customer account documents
- Order tickets
- Written correspondence
Examination focus area: FINRA's 2026 oversight report identified off-channel communications — personal devices and unapproved apps — as a top examination priority.
Common FINRA Compliance Violations
FINRA's enforcement data tells a clear story about where firms fail. In 2024, FINRA recorded 730 new disciplinary actions and ordered $75.6 million in combined fines and disgorgement. In 2025, that figure rose to $99.6 million across 625 actions.
The Most Frequently Cited Problem Areas
- Supervision failures — firms that grew quickly without updating their WSPs, or that have supervisory procedures on paper but no evidence of actual reviews
- AML program deficiencies — missing or inadequate SAR filing processes, no designated AML Officer, and training that hasn't been updated to reflect current risk
- Recordkeeping gaps — off-channel communications, missing transaction records, and records that can't be retrieved in an examination
The Robinhood enforcement action in 2025 tied all of these together. Robinhood Financial and Robinhood Securities accepted a $26 million joint-and-several fine — with the AWC citing violations of Rules 2210, 3110, 3310, and 4511 simultaneously. Fast-growing fintech firms don't usually fail in one area; they fail across several at once.
Conflict-of-Interest Disclosure Failures
Rule 2210 — one of the four cited in the Robinhood action — covers communication standards, but it also reaches conflict-of-interest disclosure. When a firm or individual has a personal financial interest in a recommended transaction but doesn't disclose it, FINRA treats that as a direct investor harm. Common examples: undisclosed compensation arrangements, proprietary product conflicts, and referral fees that never made it into the disclosure record.
The Unregistered Broker Problem
For fintech and crypto firms specifically, the most dangerous gap is often the most fundamental: not recognizing that their product requires FINRA membership at all. Conducting securities business without the required registration is a standalone enforcement trigger, not a technical deficiency. The Bittrex case is the clearest recent example of that exposure at scale.
Best Practices for Maintaining FINRA Compliance
Build Your WSP First
The WSP manual is the first document FINRA examiners will request. It should document who is responsible for each compliance function, how employee activities are monitored, and what escalation procedures exist for potential violations. Critically, it must be tailored to your specific business — a generic template won't satisfy an examiner who's reviewing your actual operations.
Schedule quarterly WSP reviews and update the document whenever rules change or your business adds new products or markets.
Treat AML as Architecture, Not Administration
For fintechs and crypto firms especially, AML compliance built into the product from the start is far easier to maintain than a program retrofitted later. Practical steps:
- Designate a qualified AML Officer with clear operational authority
- Build customer due diligence and CIP workflows into onboarding
- Establish SAR escalation procedures with documented decision trails
- Conduct independent AML program testing annually
Firms that need outside support for these steps should look for partners whose directors hold both FINRA licenses (Series 7, 24, 63) and ACAMS certifications — credentials that reflect direct broker-dealer examination experience, not just classroom training.
Conduct Internal Audits Before FINRA Does
Periodic gap assessments — reviewing employee communications, transaction records, and supervisory logs — catch problems before they become findings. Use audit results to update your WSP and training materials. FINRA expects firms to demonstrate that their compliance program functions, not just that it exists on paper.
Invest in Training That Sticks
Audits routinely surface training gaps — which means your training calendar should reflect what your assessments actually find. At minimum, train at onboarding, annually, and after every significant rule change.
Effective training goes beyond what the rules require. Explain why they exist and what individual liability looks like for non-compliance. Employees who understand the stakes are far more likely to flag issues before they escalate.
Consider Fractional Compliance Leadership
For seed-stage and growth-stage firms, a full-time Chief Compliance Officer may not be the right first hire, particularly when the compliance program is still being built. Fractional models provide director-level CCO, BSA Officer, and AML compliance leadership without the full-time cost, which typically runs $25,000+ per month for a senior executive hire.
Fraxtional structures engagements this way: the assigned director can serve as a named officer in filings, regulatory submissions, and investor documentation, with full operational authority rather than outside-advisor status. Engagements run across advisory, subscription, and fractional models, typically three to nine months, with a clear path to transition when the firm is ready for a permanent hire.
Frequently Asked Questions
What does FINRA stand for?
FINRA stands for Financial Industry Regulatory Authority. It is a private, not-for-profit self-regulatory organization authorized by the SEC under Section 15A of the Securities Exchange Act to oversee broker-dealers and protect investors in the US market.
What does FINRA do?
FINRA writes and enforces rules for broker-dealers, administers qualification exams (SIE, Series 7, Series 79, and others), conducts examinations of member firms, and disciplines those who violate its rules.
Who must comply with FINRA?
Any firm that effects securities transactions for the account of others — or buys and sells securities as a regular business — must register as a broker-dealer and become a FINRA member. Individual registered representatives at those firms must also register and pass applicable qualification exams.
What are the main FINRA regulations?
The five core compliance pillars are: Rule 1210 (registration and licensing), Rule 2210 (communications with the public), Rule 3110 (supervision and Written Supervisory Procedures), Rule 3310 (AML compliance program), and Rule 4511 (books and records).
What is the difference between FINRA and the SEC?
The SEC is a federal government agency with broad authority over all US securities markets — exchanges, investment advisers, public companies, and broker-dealers. FINRA is an independent, SEC-authorized SRO whose jurisdiction covers broker-dealers specifically. FINRA handles day-to-day rule enforcement for its members; the SEC sits above it, approving FINRA's rules and providing overarching oversight.
Does FINRA oversight apply to crypto firms?
If a crypto firm effects transactions in securities — including certain digital tokens classified as securities — broker-dealer registration is required. The SEC's enforcement action against Bittrex makes this clear: calling yourself a "crypto exchange" did not prevent a $24 million settlement for operating as an unregistered broker.
