3110 vs 3120 vs 3130: What Each FINRA Supervision Rule Actually Requires

FINRA's supervision framework rests on three connected rules that are routinely confused because they govern the same subject at three different levels: Rule 3110 requires a firm to have a supervisory system, Rule 3120 requires the firm to test whether that system works, and Rule 3130 requires the CEO and CCO to certify annually that the whole cycle, establishing, maintaining, reviewing, testing, and modifying procedures, actually happened. Together the three rules form a regulatory scheme addressing the supervision of firms and their associated persons.

This article defines each rule precisely, shows how they connect, and gives a side-by-side comparison of what each one requires, who is accountable, and how often it recurs.

What does FINRA Rule 3110 require?

A supervisory system, in writing, sized to the firm's business.

Rule 3110 requires a firm to establish and maintain a system to supervise the activities of its associated persons that is reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules. The rule details requirements for reasonably designed written supervisory procedures, and it further sets requirements to designate and register branch offices and offices of supervisory jurisdiction, conduct internal inspections, and review transactions for insider trading. Firms must also adopt procedures for customer confirmation of certain transactions, including transmittal of customer funds, address changes, and changes in investment objectives.

In short, 3110 answers the question: does the firm have a documented, structurally sound way to supervise its people and their activity.

What does FINRA Rule 3120 require?

Proof that the 3110 system actually functions, tested at least annually.

Rule 3120 requires each member firm to designate one or more principals who establish, maintain, and enforce a system of supervisory control policies and procedures that test and verify the firm's supervisory procedures are reasonably designed to achieve compliance, and create or amend procedures where testing identifies a need. Rule 3120 goes a step further than 3110 by requiring firms to test whether their supervisory procedures actually work, and the designated principals must submit a report to senior management at least annually, summarizing the system of controls, the test results, and any significant exceptions. Firms above the $200 million revenue threshold add a tabulation of customer complaints and a discussion of compliance efforts across several business areas.

In short, 3120 answers the question: has the firm verified, with testing, that its supervisory system from 3110 works in practice.

What does FINRA Rule 3130 require?

A signed annual certification, at the top of the firm, that the entire supervisory cycle actually happened.

Rule 3130 requires the firm to designate a Chief Compliance Officer, and requires the CEO to annually certify that the firm has processes in place to establish, maintain, review, test, and modify its written compliance and supervisory procedures. The CEO must also attest to having held at least one meeting with the CCO during the prior twelve months, and the certification report must be submitted to the firm's board of directors and audit committee, or equivalent bodies, at the earlier of their next scheduled meeting or within 45 days of the certification.

In short, 3130 answers a different question than the other two: not whether procedures exist or were tested, but whether the firm's top officers are personally attesting, on the record, that the whole system is functioning.

How do the three rules connect?

Each rule builds on evidence the previous one produces, so a gap in one typically shows up as a defect in the next.

Rule 3110 creates the object being supervised: the written procedures and the structural elements (branch registration, inspections, transaction review) that support them. Rule 3120 tests that object and produces a report. Rule 3130 certifies, based substantially on the 3120 testing and report, that the whole cycle, establish, maintain, review, test, modify, ran as intended over the year. A firm cannot meaningfully satisfy 3130 without genuine 3120 testing behind it, because the CEO's certification is only as credible as the testing it rests on, and 3120 testing is only meaningful if it is measured against real 3110 procedures rather than a superficial WSP document.

Side-by-side comparison

Rule 3110 Rule 3120 Rule 3130 Core requirement Establish and maintain a supervisory system with written procedures Test and verify that the 3110 system is reasonably designed and working Certify annually that the establish/maintain/review/test/modify cycle occurred Who is accountable The firm, through its designated supervisors and WSPs Designated principal(s) identified to FINRA CEO and CCO Primary output Written supervisory procedures; branch and OSJ registration; inspection records Annual report to senior management with test results and exceptions Signed annual certification to the board or audit committee Frequency Ongoing, maintained continuously At least annually Annually Additional trigger for larger firms Not applicable Firms with $200M+ prior-year gross revenue add complaint tabulation and compliance discussion Not applicable New member timing Required at commencement of business First test and report due within 12 months of FINRA membership Follows the first 3120 cycle What an examiner is really checking Is the system structurally sound and documented Was the system actually tested, and does testing find and fix real issues Did top leadership genuinely engage with the results, not just sign a form

What is the most common mistake firms make across the three rules?

Get the checklist. If you're preparing your 3120 report or the 3130 certification that rests on it, we put together an 8-section checklist covering testing scope, remediation tracking, report contents, and the evidence trail that connects a 3120 report to a defensible 3130 certification. Email info@homersemantics.com with "3120 checklist" to get it.

Treating them as three separate paperwork exercises instead of one evidentiary chain.

The recurring examiner concern is a 3130 certification that rests on a thin or check-the-box 3120 report, which in turn tests 3110 procedures that were never meaningfully updated. FINRA has emphasized that testing must be meaningful, not a check-the-box exercise, and expects firms to demonstrate that annual testing actually improves supervisory effectiveness. Firms that treat the three rules as one continuous chain, procedures maintained, tested substantively, and certified with real engagement, produce a defensible record. Firms that treat each as an isolated annual task tend to produce three technically complete documents that do not actually support one another.

Summary

Rule 3110 requires the supervisory system itself: written procedures, registered supervisory structure, and inspection processes. Rule 3120 requires that system to be tested and verified at least annually, with results reported to senior management. Rule 3130 requires the CEO and CCO to certify annually, to the board, that the full cycle of establishing, maintaining, reviewing, testing, and modifying procedures actually took place. The three rules are sequential in substance even though each has its own separate text: 3110 creates what gets tested, 3120 tests it and documents the result, and 3130 puts the firm's most senior officers on record that the whole system works.

Frequently asked questions

Do all three rules apply to every FINRA member firm? Yes, the core obligations under all three apply broadly to member firms. Rule 3120 has an additional, revenue-triggered reporting requirement for firms above $200 million in prior-year gross revenue, and larger firms generally face more detailed expectations under 3120 and closer scrutiny under 3130.

Can a firm satisfy 3130 without a strong 3120 program? Not defensibly. The 3130 certification represents that the test-and-modify cycle occurred, and that representation is only as credible as the 3120 testing behind it. Examiners reviewing a 3130 certification routinely trace back into the supporting 3120 report.

Who signs what, and how often? The 3120 report goes to senior management at least annually, prepared by the designated supervisory control principal(s). The 3130 certification is signed annually by the CEO, with CCO involvement, and delivered to the board or audit committee within 45 days of certification or by the next scheduled meeting.

What is the practical difference between a WSP and a supervisory control policy? A written supervisory procedure, under 3110, describes how a given activity is supposed to be supervised. A supervisory control policy, under 3120, is the mechanism that tests whether that description holds up in practice. One is the plan; the other is the audit of the plan.

Preparing this cycle's 3120 report or 3130 certification? Email info@homersemantics.com with "3120 checklist" for the working checklist referenced above.

FinIntel by Homer Semantics maps obligations across all three rules in one connected system: 3110 procedures linked to the 3120 tests that verify them, and 3120 results feeding directly into the evidence a 3130 certification needs to stand on. Write to info@homersemantics.com to see the full chain on your next cycle.

This article is meant for informational purposes only and it should not be considered as legal or formal advice. Please cross-check everything you read on the internet.

Privacy Policy

This website may use essential and third-party cookies for embedded media, basic site functionality, and performance monitoring.