FINRA 2024 Annual Regulatory Oversight Report: Impact on Digital Communications Practices

Jan 11th '24

As anticipated, Financial Industry Regulatory Authority (FINRA) has just published its 90-page annual oversight report — previously titled as FINRA Examination and Risk Monitoring Program— reflecting its supervisory, regulatory, and enforcement priorities for 2024. While it covers a wide variety of operational, financial management, and reporting areas, it also addresses digital communications practices, which we’ll highlight in this post.


Emphasis on new U.S. Securities and Exchange Commission (SEC) cyber rules

This includes proposed rules for member firms as well as finalized rules for public companies. Several areas of cyber are addressed that touch the firm’s systems to define and evaluate policies, including:


  • Technology management and supervisory controls to assess risks associated with third-party vendors, including change management and business continuity systems
  • Branch controls, including how firms are monitoring the use of personal technology


While firms are aware of cybersecurity risks, FINRA noted that many firms have not yet updated their written supervisory procedures (WSPs) or were not enforcing WSPs related to cyber. FINRA has noted that effective practices in this area include regularly updated lists of all vendors potentially impacting cyber risks, as well as frequent assessments of individual vendor risk.


Related considerations encompass the need for a repeatable process for incident and problem management tracking and reporting that’s coupled with the establishment of capabilities to effectively respond to incidents.


The impact

Given the proposed SEC Cybersecurity Risk Management rules, establishing and maintaining comprehensive cyber compliance policies and procedures, including incident response plans, will be crucial to compliance and governance programs in the upcoming year.


Artificial intelligence as an area of emerging risk

Noting potential concerns about accuracy, privacy, bias and intellectual property, FINRA cautions firms to be aware of how AI may be leveraged. FINRA reminds firms to consider the broader implications before deploying AI technologies. This includes potential impact on requirements covering books and records, supervision, communication with the public, cybersecurity, and model risk management. FINRA also warns firms to be mindful of explainability and transparency when integrating AI technology.


The impact

FINRA acknowledges that the regulatory obligations surrounding the use of artificial intelligence is likely to change, particularly regarding generative AI. However, the industry is moving quickly beyond a view of AI as one of “promising opportunities,” and into pilots and deployments to address risk and compliance processes as well as faster information delivery to the market. Firms will not be deterred in use of AI technologies and will need to monitor the outcome of continued sweeps from the SEC in these areas. This includes potential conflicts of interest as well as further U.S. agency developments following the Biden Administration Executive order from Q4 2023.


Crypto assets and surveillance

Following the lead from the SEC, FINRA launched a targeted exam of practices related to crypto in 2022 and continues to find a rate of non-compliance compared to any other product. As a result, their focus in 2024 has expanded and will center on how firms are communicating relevant crypto risks to investors (FINRA 2210). This includes if/how firm communications are fair and balanced, fails to disclose when crypto assets are offered by affiliates or third parties, as well as make false statements about how federal securities law and FINRA rules apply to crypto assets.


FINRA will also focus on the presence (or lack) of supervisory controls to ensure that firms are conducting the appropriate due diligence on crypto asset private placement recommendations to customers (FINRA 3110).


The impact

Crypto assets and securities will continue to be a topic for further legal court decision making in 2024. FINRA will continue to emphasize the application of existing rules that will require firms to maintain the appropriate recordkeeping and oversight systems as is required for any other category of financial product.


Outside business activities surfacing hidden risk

The side hustles and entrepreneurial endeavors continue rising in popularity. Firms must prioritize governance of outside business activities (OBAs) to meet FINRA’s escalating scrutiny. Deficient oversight of OBAs introduces substantial regulatory compliance risk regarding controls, supervision, and recordkeeping.


FINRA identified ongoing monitoring of registered persons’ communications, marketing content, online presence, customer complaints and financial records to uncover indications of undisclosed OBAs early as effective practices. Simultaneously, firms must watch for lifestyle changes or anomalies in production and performance that may signal unreported external ventures.


And a bit more on crypto, another emerging area of deficiency lies in evaluating whether crypto-asset transactions qualify as securities necessitating OBA protocols. Assumptions around crypto evading regulatory purview breed noncompliance.


The impact

Firms failing to regularly review information sources for irregularities indicating possible OBAs face regulatory violations. Overlooking crypto assets’ potential status as securities also invites noncompliance.


To align with FINRA guidance, firms should implement persistent surveillance procedures for early OBA detection combined with proper crypto asset supervision. Documenting oversight measures represents critical evidence of alignment with industry best practices for governance, supervision and recordkeeping.


Books and records

Of course, no annual FINRA priorities report would be complete without a section on recordkeeping. However, given the SEC off-channel enforcement activity of 2023, this report offers minimal practical guidance on how firms should be adjusting oversight practices. Instead, it seeks additional “effective practices” from member firms over the course of 2024.


What the report does highlight is the failure of some vendors to comply with books and records requirements (likely related to updated SEC 17a-4 letter of undertaking obligations) and failures to preserve certain types of email correspondence. FINRA does guide firms toward:


  • Updating policies and procedures
  • Updating training programs
  • Increasing surveillance focus of customer complaints
  • Increasing vigilance of changes in usage patterns of approved communications tools


The impact

As illustrated by the very small number of FINRA off-channel settlements in 2023, FINRA appears to rely upon continued enforcement leadership from the SEC and CFTC going into this year. While best practices continue to be elusive in addressing off-channel risks, we are observing changes in how firms are:


  • Modifying mobile capture strategies
  • Adjusting processes to assess the benefits vs risk of new channels
  • Modifying oversight protocols to improve visibility into areas that may indicate the use of prohibited networks


We will share these emerging areas of investment via our blog and industry forums over the course of 2024.


Communications with the public

Not surprisingly, FINRA rule 2210 will be an enforcement priority again in 2024 that — in addition to crypto securities — includes a strong emphasis on mobile applications. Based on its 2023 findings of false, misleading and inaccurate information in mobile apps, FINRA will be looking at promotional information sent via ‘nudges’ or push notifications, as well as the form-factor considerations to ensure that information displayed to customers is complete and accurate.


FINRA also calls out the commonly expressed challenge of monitoring for new tools and features, as well as the need to ensure that supervisory oversight is tuned to address the unique modalities that mobile content may possess.


The impact

FINRA is acknowledging that the mobile delivery of information to investors is a given. It highlights the fact that features, functions and enticements designed to attract hybrid office-working retail investors will continue to evolve. As a result, firms will need to account for every application that has a messaging feature and ensure that controls are effective and complete regardless of the delivery form factor.


What does the FINRA oversight report mean for 2024?

Digital communications remain a clear area of focus for FINRA in 2024, given:


  • The continued evolution of communications technology
  • The reality of licensed staff and investors remaining in hybrid work models
  • The inevitable rise of generative AI as a force within the industry


The compliance surface area has never been as large and dynamic, and the topics addressed in the 2024 Oversight Report indicate that the premium placed on proactive governance of digital communications has never been as critical as it will be this upcoming year.


  • Featured Brief: Off-Channel Communications Surveillance Download


Source: Smarsh. Author: Robert Cruz


Robert CruzVice President, Information Governance at Smarsh

Robert Cruz is Vice President, Information Governance for Smarsh. He has more than 20 years of experience in providing thought leadership on emerging topics including cloud computing, information governance, and discovery cost and risk reduction.


About us

LS Consultancy are experts in Marketing and Compliance, and work with a range of firms to assist with improving their documents, processes and systems to mitigate any risk.


We provide a cost-effective and timely bespoke copy advice and copy development services to make sure all your advertising and campaigns are compliant, clear and suitable for their purpose.


Our range of innovative solutions can be tailored to suit your unique requirements, no matter whether you’re currently working from home, or are continuing to go into the office. Our services can be deployed individually or combined to form a broader solution to release your energies and focus on your clients.


Contact us today for a chat or send us an email to find out how we can support you in meeting your current and future challenges with confidence.


Explore our full range today.


Contact us


Why Not Download our FREE Brochures! Click here.


Call Us Today on 020 8087 2377 or send us an email.



Connect with us via social media and drop us a message from there. We’d love to hear from you and discuss how we can help.


Facebook | Instagram | LinkedIn | X (formally Twitter) | YouTube


Contact us