FINRA Rule 3120 Compliance: Requirements, Annual Testing, and What Examiners Check

FINRA Rule 3120 requires every member firm to designate one or more principals responsible for a system of supervisory control policies and procedures that test and verify the firm's supervisory procedures, and to report the results to senior management at least annually. Where Rule 3110 requires a firm to have supervisory procedures, Rule 3120 requires the firm to prove those procedures actually work.

This article covers what the rule requires in plain terms, what belongs in the annual report, how testing scope is typically determined, and what examiners look for when they review a firm's 3120 program.

What does FINRA Rule 3120 actually require?

Two obligations, both resting on designated principals.

Under Rule 3120(a), each member firm must designate and specifically identify to FINRA one or more principals responsible for establishing, maintaining, and enforcing a system of supervisory control policies and procedures. Those policies and procedures must do two things: test and verify that the firm's supervisory procedures are reasonably designed to achieve compliance with applicable securities laws, regulations, and FINRA rules, and create or amend supervisory procedures where testing identifies a need.

The designated principals carry the obligation forward annually: a Rule 3120 report must be prepared and submitted to the firm's senior management no less than annually, detailing the firm's system of supervisory controls, a summary of test results, and any significant exceptions identified, along with whether the firm implemented or amended procedures in response.

A second, narrower obligation applies only to larger firms. Firms that reported gross revenues of $200 million or more on their FOCUS report in the preceding calendar year must add two elements to the report: a tabulation of customer complaints and internal investigations reported to FINRA during the year, and a discussion of the year's compliance efforts across trading and market activities, investment banking, antifraud and sales practices, finance and operations, supervision, and anti-money laundering. Firms below that revenue threshold file the core report without the tabulation and discussion sections.

How is 3120 testing different from having written supervisory procedures?

Rule 3110 requires the procedures to exist. Rule 3120 requires proof that they work.

A firm must maintain written supervisory procedures under Rule 3110, and separately must have supervisory control policies and procedures under Rule 3120 that test and verify, at least annually, that those written procedures are reasonably designed to achieve compliance. This is the distinction firms most often get wrong: a complete, well-written WSP manual satisfies 3110 on its own terms, but says nothing about whether the procedures function in practice. Rule 3120 exists specifically to close that gap, and a firm's testing function is judged separately from the quality of its written procedures.

How should testing scope and methodology be determined?

Through risk-based scoping, not exhaustive review of every procedure every year.

Risk-based methodologies and sampling may be used to determine the scope of testing, and the testing exists to ensure supervisory procedures are reviewed and amended regularly as the business and regulatory environment changes. In practice this means prioritizing testing toward the areas of greatest regulatory and litigation risk for the firm's specific business mix, rather than spreading fixed effort evenly across every procedure regardless of materiality. Testing serves a second purpose beyond the rule requirement: it surfaces business, product, and compliance concerns, and directs attention toward the areas of greatest risk.

FINRA has been explicit that the exercise is substantive rather than procedural. FINRA has emphasized that testing must be meaningful rather than a check-the-box exercise, and expects firms to demonstrate that annual testing actually improves supervisory effectiveness. A testing program that reliably finds nothing wrong, on the same procedures, year after year, is a common examiner flag rather than a mark of a well-run firm.

What does an examiner typically check in a 3120 review?

Get the checklist. We built an 8-section 3120 Annual Report Checklist covering designation, testing scope, remediation tracking, report contents, the $200M revenue trigger, and the evidence trail examiners look for first. Email info@homersemantics.com with "3120 checklist" and we'll send it over.

Four things beyond the report's existence: designation, substance, follow-through, and currency.

Designation. That the responsible principal or principals were actually identified to FINRA and hold the authority the rule contemplates, not just a title on an org chart.

Substantive testing, not just documentation. Whether the testing performed could plausibly detect a real supervisory failure, given the firm's actual business, rather than restating the written procedures back as a compliance narrative.

Remediation follow-through. Firms are expected to track and document the remediation of deficiencies identified during testing, so an exception noted in one year's report with no visible resolution by the next is a natural point of examiner interest.

Currency with a changing business. Firms must test whether supervisory controls remain effective as business conditions change, including in remote and hybrid operating environments, and larger firms are expected to provide more comprehensive detail on the scope and results of their testing. A testing program built for the firm's business three years ago, unchanged since, invites the question of whether it still covers what the firm actually does today.

When must a firm complete its first 3120 test?

Within one year of becoming a FINRA member. For a newly approved firm, the first testing and 3120 report must be completed within 12 months of becoming a FINRA member, which places the obligation early in a new firm's operating life, well before its first full annual compliance cycle might otherwise suggest.

Summary

FINRA Rule 3120 requires a designated principal, a system of supervisory control policies that tests and verifies whether the firm's supervisory procedures actually work, and an annual report to senior management documenting the results, with additional tabulation and discussion requirements for firms above the $200 million revenue threshold. Testing scope is risk-based and expected to be substantive, not a restatement of existing procedures, and examiners focus on whether testing could plausibly catch a real failure, whether remediation is tracked to completion, and whether the program keeps pace with a changing business. The rule's core distinction from 3110 is simple and easy to lose sight of under deadline pressure: having procedures and proving they work are two different obligations, and 3120 is the one that requires proof.

Frequently asked questions

Does Rule 3120 apply to all FINRA member firms? Yes. The core testing and annual report obligation applies to every member firm. The additional tabulation and compliance-discussion requirements apply only to firms that reported $200 million or more in gross revenue on their FOCUS report the preceding year.

Can a firm use sampling instead of testing every procedure? Yes. Risk-based methodologies and sampling are an accepted way to scope testing, provided the scope reflects the firm's actual risk profile rather than being arbitrarily narrow.

What happens if testing finds a deficiency? The firm's supervisory control policies must create or amend procedures where testing identifies a need, and that remediation should be tracked and documented, since an unresolved finding recurring in a later report is a common examiner concern.

Is Rule 3120 the same as Rule 3130 certification? No. Rule 3120 is the testing and reporting obligation. Rule 3130 is a separate annual certification, by the CEO and CCO, that the firm has processes in place to establish, maintain, review, test, and modify its compliance procedures, and it draws on the 3120 testing as supporting evidence.

Want the working checklist that goes with this? Email info@homersemantics.com with "3120 checklist" and we'll send the full 8-section version, built to mirror everything above, section by section.

FinIntel by Homer Semantics runs 3120 testing as a continuous, evidence-linked process: obligations mapped to supervisory procedures, testing scoped by risk, exceptions tracked to remediation, and the annual report assembled from records generated as testing runs rather than reconstructed at deadline. Write to info@homersemantics.com to pilot it before your next 3120 cycle.

This article is for information purpose only and should not be considered as legal or formal advice. Please double-check everything you read on the internet !

Privacy Policy

This website may use essential and third-party cookies for embedded media, basic site functionality, and performance monitoring.