Compliance Guide — Financial Services
FINRA Rule 3110 Employee Monitoring: Supervision Requirements for Broker-Dealers in 2026
FINRA employee monitoring compliance is governed by Rule 3110 (Supervision), which requires every registered broker-dealer to establish, maintain, and enforce a written supervisory system covering all registered persons' activities and communications. The Financial Industry Regulatory Authority (FINRA) — the self-regulatory organization overseeing more than 624,000 registered representatives at 3,400+ member firms in the United States — issues multi-million-dollar fines for supervision failures annually. This guide covers Rule 3110 requirements, electronic communications monitoring obligations from email to WhatsApp, SEC Rule 17a-4 records retention, the 2022-2023 off-channel communications enforcement sweep, and a practical supervision program framework for broker-dealer compliance in 2026.
7-day free trial. No credit card required.
Why Does FINRA Supervision Enforcement Cost Firms So Much?
FINRA issued $56.8 million in fines specifically for supervision violations in 2023. The average fine for a supervision failure case exceeds $500,000 — before legal fees, remediation costs, and reputational damage. But the 2022-2023 off-channel communications enforcement action reshaped how compliance professionals think about employee monitoring: FINRA and the SEC together fined 16 broker-dealers a combined $1.1 billion for failing to capture and retain business communications on WhatsApp, Signal, and other personal messaging platforms that firm policies technically prohibited.
The enforcement message was unambiguous. A prohibition policy without active monitoring controls is not a supervisory system. If employees use prohibited channels and the firm has no way to detect or demonstrate detection, the firm is liable for the failure — regardless of the written policy. For compliance officers, this means employee monitoring is not a nice-to-have: it is the evidentiary backbone of every supervision program.
Enforcement Data: FINRA's 2023 Annual Regulatory Oversight Report identified supervision failures as the #1 category of rule violation by number of enforcement cases filed. Firms of all sizes — from regional broker-dealers to major wirehouse branches — faced examination findings related to inadequate monitoring of electronic communications.
What Does FINRA Rule 3110 Actually Require?
FINRA Rule 3110 (Supervision) is the foundational supervision requirement for broker-dealers. Adopted in its current form in 2014, consolidating prior NASD Rules 3010 and 3012, Rule 3110 creates five interlocking obligations.
Rule 3110(a) — Written Supervisory Procedures
Every broker-dealer must establish and maintain written supervisory procedures (WSPs) that are reasonably designed to achieve compliance with applicable securities laws and FINRA rules. WSPs must be updated as regulations change, as the firm's business evolves, and as new communication channels become prevalent. FINRA examiners specifically test whether WSPs address current communication methods — including text messaging, social media, and collaboration platforms — and whether the actual supervision practice matches the written procedures.
A WSP that addresses email but not text messages is deficient in 2026. A WSP that addresses text messages but contains no evidence of actual review is a documented admission of non-compliance.
Rule 3110(b) — Supervision of Activities
The rule requires each registered person's activities to be supervised by a designated supervisory principal. This includes:
- Review of correspondence with customers and prospects
- Review of all electronic communications related to the firm's business
- Supervision of trading activity, customer account maintenance, and discretionary accounts
- Supervision of outside business activities (OBAs) reported by registered persons
- Special supervisory procedures for statistical sampling of customer accounts for registered persons who have a significant concentration of customer assets
The review frequency standard is "reasonable" given the volume and nature of activity. FINRA has consistently held that risk-based approaches — focusing more review resources on higher-risk individuals and activities — satisfy the reasonable standard, provided lower-risk communications are still sampled systematically.
Rule 3110(c) — Internal Inspections
Each OSJ (Office of Supervisory Jurisdiction) must be inspected at least annually. Each non-OSJ branch office must be inspected at least every three years. FINRA examiners review inspection reports during firm examinations and assess whether the inspections actually tested supervision effectiveness or were checklist exercises.
Rule 3110(d) — Supervision of Supervisors
The rule requires that supervisory principals themselves be supervised. A principal who supervises 15 registered representatives cannot be unsupervised — a senior principal or designated officer must oversee the principal's supervisory performance. This creates an escalation chain that FINRA traces during investigations involving multiple levels of supervisory failure.
Rule 3110(e) — Investigation of Applicants
Firms must conduct reasonable investigation of prospective employees, including review of Form U4 disclosures and prior disciplinary history. While primarily a hiring-stage requirement, the rule interacts with ongoing monitoring: firms with registered persons who have prior disciplinary history are expected to apply heightened supervisory procedures to those individuals, a point FINRA examiners specifically test.
Which Employee Communications Must Broker-Dealers Monitor in 2026?
The scope of FINRA supervision has expanded dramatically with communication technology. In 2026, FINRA-regulated firms must supervise a communication landscape that would have been unrecognizable when the original supervision rules were written.
Email — The Established Standard
Company email has been subject to FINRA supervision since the earliest electronic communications guidance. All email on firm systems is subject to Rule 3110 supervision and Rule 4511 retention. This includes email sent from firm-provided accounts to external recipients, internal email between registered persons, and email involving customer account matters. Firms that allow business email on personal email accounts must supervise those communications if evidence shows they are being used for business purposes — the platform ownership is not a supervisiory escape hatch.
Text Messages — Explicitly Required
FINRA has issued explicit guidance that broker-dealers must supervise text message communications when registered persons use them for business purposes. This applies to SMS messages, iMessage, and any text-based medium. The 2022-2023 enforcement sweep demonstrated that "we have a no-text policy" is not a defense when examiners find evidence employees were texting clients regardless. Firms must either:
- Implement a capture and archive solution for business text communications, or
- Demonstrate through active monitoring controls that no business texts are being sent — not merely assert that policy prohibits them
Several firms now issue firm-managed mobile devices with compliant text archiving to registered persons with significant client contact, eliminating the personal device supervision problem for that communication channel.
WhatsApp, Signal, and Personal Messaging Applications
The 2022-2023 off-channel communications enforcement actions produced the largest supervision fines in FINRA and SEC history. Firms including J.P. Morgan Securities ($125 million to SEC and CFTC), Deutsche Bank ($75 million), and 14 others paid a combined $1.1 billion for failing to preserve business communications sent via WhatsApp and other personal messaging apps. The key findings:
- Firm employees — including senior personnel — routinely used WhatsApp to discuss client accounts, trading activity, and securities recommendations
- Firm policies prohibited such use, but the prohibition was not monitored or enforced
- When regulators requested records of certain communications, the firms could not produce them because the messages were never captured
- The failure to retain these communications itself constituted a separate Rule 4511 violation independent of the supervision failure
For compliance officers, the practical takeaway is that active monitoring of application usage — specifically detecting the presence and usage of off-channel communication apps during work hours — is now a standard expectation for registered broker-dealer environments. eMonitor's activity logging and screen monitoring capabilities provide the usage visibility that enables compliance teams to detect and document off-channel communication activity.
Social Media — LinkedIn, Twitter/X, and Others
FINRA Regulatory Notice 17-18 (Social Media and Digital Communications) and prior notices establish that social media communications must be supervised when used for business purposes. The framework distinguishes:
- Static content (blog posts, pre-approved LinkedIn articles, website content): subject to pre-approval requirements under FINRA Rule 2210
- Interactive content (real-time messages, LinkedIn InMail, Twitter/X direct messages, comment responses): subject to the same supervision as correspondence with customers
A registered representative who uses LinkedIn messaging to discuss a client's portfolio is generating a business record that must be retained under Rule 4511 and supervised under Rule 3110. FINRA examiners now routinely request social media archives during examinations of retail broker-dealer branches.
Video Calls — Zoom, Microsoft Teams, and Webinars
Video call communications involving customer account discussions, securities recommendations, or solicitation activity are business communications subject to supervision. FINRA regulatory guidance and enforcement precedent establish that firms must either record and retain these communications or implement documented alternative controls. Many firms now require that all client-facing video calls use firm-issued platforms with native recording and automatic retention features. Where employees use personal Zoom accounts for client meetings, the compliance exposure is equivalent to using personal email — the content cannot be supervised.
Collaboration Platforms — Teams, Slack, and Persistent Chat
The growth of persistent chat platforms in financial services has created a supervision challenge that many firms are still addressing. Microsoft Teams, Slack, and Bloomberg IB messaging between registered persons discussing client accounts, trading ideas, or securities recommendations generate records that must be captured and retained. Several major broker-dealers have implemented approved communication channel policies requiring all internal collaboration to use firm-managed platforms with native archiving — prohibiting consumer Slack workspaces for any business purpose.
What Are the Recordkeeping Requirements Under FINRA Rule 4511 and SEC Rule 17a-4?
FINRA Rule 4511 and SEC Rule 17a-4 establish the retention framework for broker-dealer records. These rules are the foundation upon which any supervision and monitoring program rests — if communications cannot be retained in compliant format, they cannot be produced for regulatory examination, and production failures constitute independent violations.
FINRA Rule 4511 — General Recordkeeping
Rule 4511 requires broker-dealers to make and preserve books and records in accordance with FINRA rules and applicable federal securities laws. The rule applies to all business records regardless of the medium in which they are created — paper, email, text, chat, or voice recording. Rule 4511 incorporates the SEC Rule 17a-3 and 17a-4 retention schedules by reference, meaning FINRA members must meet all SEC recordkeeping standards as a baseline.
SEC Rule 17a-4 — The Technical Standard
SEC Rule 17a-4 sets the technical and retention period requirements for broker-dealer electronic records. Key provisions:
| Record Category | Retention Period | Format Requirement |
|---|---|---|
| Blotters, ledgers, securities records | 6 years (first 2 years accessible) | WORM storage required |
| Customer account records | 6 years | WORM storage required |
| Communications with customers | 3 years | WORM storage required |
| General business correspondence | 3 years | WORM storage required |
| Order tickets and trade confirmations | 3 years | WORM storage required |
| Complaints files | 4 years | Accessible and producible |
| Net capital computations | 6 years | WORM storage required |
| Supervisory review records | 3 years | Accessible and producible |
The WORM (Write Once, Read Many) storage requirement under Rule 17a-4(f) means that retained electronic records must be non-rewriteable and non-erasable. Standard file storage systems — whether on-premise or cloud — do not automatically satisfy this requirement. Compliant vendors offering SEC Rule 17a-4(f)(3)(i) attestation letters confirm that their platforms meet the technical standard. When deploying employee monitoring software in a FINRA-regulated environment, the monitoring data and audit logs must be stored in a manner that satisfies 17a-4 requirements if they constitute business records.
What Monitoring Records Must Be Retained?
The Rule 4511 retention obligation applies to:
- Copies of all reviewed communications with their supervision evidence (who reviewed, when, any actions taken)
- Supervision review logs documenting the scope and frequency of communications review
- Exception reports generated by automated monitoring systems — including both the exception and the resolution
- Records of escalations from front-line supervisors to principals and compliance
- Annual Rule 3120 testing documentation and senior principal certifications
- OSJ and branch inspection reports and related working papers
What Does FINRA Rule 3120 Add to the Supervision Framework?
FINRA Rule 3120 requires broker-dealers to test and verify their supervisory control system on an annual basis and certify the results to senior management. Where Rule 3110 creates the supervision obligation, Rule 3120 creates the obligation to prove the supervision is working.
Annual Testing Cycle
Each year, the firm must designate one or more principals to test the written supervisory procedures. Testing must cover at least a sample of each category of supervisory procedure — including procedures for electronic communications monitoring, trading supervision, customer account review, and outside business activity oversight. Test results must be reported in writing to senior management, which must review and approve the findings.
What Examiners Look For in Rule 3120 Documentation
FINRA examiners specifically look for three failure patterns in Rule 3120 testing:
- Superficial testing: Testing that confirms procedures exist rather than testing whether they actually work. A test that verifies the email monitoring policy is written, but does not verify that any email monitoring actually occurs, is a common finding.
- Unresolved deficiencies: Test findings that identify supervision gaps but are not remediated before the following year's test. Repeated findings for the same deficiency are treated as aggravating factors in enforcement.
- Senior management non-review: Documentation where the required senior principal signature is present but evidence suggests no substantive review occurred. Examiners interview senior principals on the content of certification reports to assess this.
For employee monitoring technology, the Rule 3120 annual test should include: a sample review of whether the monitoring system is actually capturing the communications it is supposed to capture; a test of whether exception alerts are being generated and reviewed within expected timeframes; and a verification that monitoring system audit logs and supervision records are being retained in compliant format.
How Do You Build a FINRA-Compliant Supervision Program From Scratch?
A supervision program that withstands FINRA examination is not a single document — it is an integrated system of written procedures, technology controls, trained personnel, and documented evidence. Here is the six-step framework that covers all Rule 3110 and Rule 3120 obligations.
Step 1: Map All Communication Channels Used by Registered Persons
Before procedures can be written, compliance must know every channel through which registered persons communicate with customers or conduct business. This mapping exercise should cover:
- All firm-issued communication platforms (email systems, internal chat, video conferencing)
- All customer-facing platforms used by registered persons (LinkedIn, firm website chat, client portals)
- All personal devices and personal accounts used for any business purpose, even occasionally
- All third-party platforms mandated by institutional clients (Bloomberg IB, specific trading platforms)
eMonitor's activity logging provides direct visibility into which applications registered persons are using during work hours — giving compliance a factual baseline rather than relying on self-reporting. A firm that discovers registered persons are using a collaboration platform never mentioned in the mapping exercise faces a supervision gap it can address proactively rather than during an examination.
Step 2: Implement Systematic Monitoring for Each Channel
For each identified channel, implement a monitoring control appropriate to the channel's risk level and technical capabilities:
- Email: Automated keyword scanning with human review of flagged communications; risk-based sampling of unflagged communications
- Text messages: Archive-and-review solution or firm-managed devices with native archiving
- Social media: Social media archiving platform capturing all business communications; pre-approval workflow for static content
- Video calls: Recording and retention for client-facing calls; meeting summary review as minimum for platforms without recording
- Off-channel detection: Application usage monitoring to detect the presence of prohibited communication apps during work hours on firm-issued devices
Step 3: Designate Supervisory Principals With Appropriate Scope
Each registered person must have a designated supervisory principal with responsibility for their activities and communications. Principal designations must be documented in writing and reviewed when personnel changes occur. Principals must have the practical capacity to perform their supervision — a principal responsible for 200 registered representatives who cannot practically review a representative sample of their communications is a documented supervision failure waiting for an examination.
Step 4: Implement Documented Review Procedures
Written supervisory procedures for electronic communications review should specify:
- Review frequency for different risk tiers of registered persons and communication types
- Keywords and patterns that trigger escalation for immediate principal review
- The review documentation format — how supervisors record their review and findings
- Escalation thresholds to compliance, senior management, and FINRA reporting
- Procedures for preserving evidence of potential rule violations for regulatory reporting
Step 5: Configure Keyword Alerting for Prohibited Topics
Automated keyword alerting is not a substitute for review, but it is an essential triage tool for high-volume communications environments. FINRA examiners expect to see keyword libraries that reflect the actual risk profile of the firm's registered persons. A retail branch with elderly clients should have keywords focused on suitability, guaranteed returns, and senior financial exploitation. A trading desk should have keywords focused on material non-public information, front-running, and spoofing. Common keyword categories include:
- Prohibited representations: "guaranteed," "can't lose," "risk-free," "sure thing," "[specific dollar amount] return"
- Outside business activities: personal securities discussions unrelated to firm business, references to other investment accounts
- Complaint indicators: "unhappy," "lost money," "want my money back," "call my attorney"
- Regulatory risk terms: "off the record," "delete this," "don't put this in writing," "personal email"
eMonitor's screen monitoring and activity logging capabilities allow compliance teams to configure detection for prohibited application usage alongside keyword-level communication review — providing a dual-layer supervision control.
Step 6: Conduct Annual Rule 3120 Testing and Document Results
The annual testing cycle should be structured to test whether the supervision system actually works, not merely whether it exists. Testing should include:
- Pull a random sample of electronic communications from each supervised channel and verify they were reviewed within the required timeframe
- Verify that keyword alert exceptions were generated for communications that should have triggered alerts
- Confirm that all required supervisory review records are retained in compliant format and are producible within the timeframe FINRA specifies
- Assess whether the supervision technology is capturing communications from all identified channels — not just the channels it was configured for when originally deployed
- Interview a sample of supervisory principals on the substance of their review procedures to confirm practice matches the written procedures
How Does eMonitor Support FINRA Broker-Dealer Supervision?
FINRA broker-dealers need monitoring capabilities that generate the evidentiary record FINRA examiners request. eMonitor provides the activity visibility, audit trail depth, and access controls that compliance programs for registered broker-dealers require.
Activity Logging for All Communication Applications
eMonitor's activity logs capture which applications registered persons are using during work hours — including communication applications, trading platforms, and off-channel messaging apps. This gives compliance teams factual evidence of whether registered persons are using firm-approved channels or accessing prohibited applications on firm-issued devices. When FINRA examiners ask how the firm monitored for off-channel communication app usage, the activity log provides a complete, timestamped record of application access.
Screen Monitoring for Supervision Evidence
eMonitor's screen monitoring capabilities create visual supervision evidence that supplements communication archive review. For compliance activities requiring visual proof — such as verifying that a registered person was logged into an approved platform, not an off-channel app, during a specific client interaction — screen captures provide the supervisory documentation Rule 3110 requires. Configurable capture frequency allows firms to balance supervision depth with data volume management.
Tamper-Proof Audit Trails
All eMonitor activity logs, access records, and monitoring events are stored with tamper-evident logging. Every access to monitoring data by a supervisory principal is recorded with timestamps, user identity, and action taken. When FINRA examiners request supervision records for a specific registered person over a specific time period, the export demonstrates both what was monitored and who reviewed it — the dual-element documentation Rule 3110 requires.
Keyword Alerting for Prohibited Topics
eMonitor's alert configuration allows compliance teams to define keyword and pattern-based triggers that generate immediate alerts when detected in monitored channels. Compliance officers can configure alerts for prohibited representations, complaint indicators, and off-channel communication references — ensuring high-priority supervision events receive immediate review rather than waiting for scheduled sampling cycles.
Export for Regulatory Examination
When FINRA initiates an examination or requests production of specific records, eMonitor's export functionality generates structured, documented records exportable in formats suitable for regulatory production. The export includes metadata (timestamps, user identities, application context) alongside event content — satisfying the Rule 17a-4 requirement that electronic records be "capable of being produced promptly" during examination.
For broader financial services compliance requirements, see also eMonitor's support for SOX compliance, HIPAA compliance, and SOC 2 compliance. The financial services employee monitoring overview covers the full regulatory landscape for financial sector employers.
What Are the Supervision Obligations for Remote Registered Persons?
The COVID-19 pandemic accelerated remote work adoption in financial services, and FINRA has addressed the supervision implications through guidance and examination priorities. In 2026, remote registered representatives present persistent supervision challenges that compliance programs must address explicitly.
OSJ Structure and Remote Work
FINRA guidance confirms that a registered person's home office is not automatically an OSJ or branch office solely because they work from home. However, firms must ensure remote registered persons remain within the supervisory structure of a properly designated OSJ with an appropriately assigned supervisory principal. Remote work has not altered the obligation — it has changed only the logistics of delivering it.
Supervision Heightened by Home Work Environment
Remote work creates supervision challenges absent in the office environment:
- Registered persons have easier access to personal devices and personal communication accounts during work hours
- Physical separation from supervisors reduces the informal observation that office environments provide
- Personal and work activity can intermingle on a single device if firm-issued devices are not provided
- Client meetings via video call are harder to monitor in real time than in-office meetings
FINRA's 2023 and 2024 examination priorities specifically identified remote supervision as an area of elevated scrutiny. Firms with large remote registered representative populations should have explicitly addressed remote supervision in their WSPs, including how electronic communications monitoring applies to remote workers and whether any supplemental controls are in place.
Firm-Issued Devices for Remote Registered Persons
The most defensible approach to remote supervision for higher-risk registered persons is providing firm-issued devices configured with compliant communication archiving and monitoring software. When all business activity occurs on a firm-managed device with appropriate monitoring controls, the supervision exposure from off-channel communication on personal devices is substantially reduced. This is the approach several wirehouse firms have adopted following the 2022-2023 enforcement sweep.
Frequently Asked Questions: FINRA Employee Monitoring Compliance
What does FINRA Rule 3110 require for employee monitoring?
FINRA Rule 3110 requires every registered broker-dealer to establish, maintain, and enforce a written supervisory system covering the activities of all registered persons. This includes monitoring electronic communications, customer account activity, trading patterns, and order handling. Supervisory procedures must be reasonably designed to achieve compliance with applicable securities laws. FINRA enforcement actions make clear that firms must demonstrate active, documented review of employee communications — not merely that policies exist.
Does FINRA Rule 3110 require monitoring of text messages?
Yes. FINRA has issued explicit guidance that broker-dealers must supervise text message communications when registered persons use them for business purposes. FINRA Rule 4511 requires retention of all business communications regardless of medium. A firm cannot prohibit text messaging without implementing controls to detect violations — prohibition without monitoring is insufficient where evidence shows the prohibition is not being followed. Firms must either capture and archive text messages or implement effective controls demonstrating no business texts are sent.
What is the difference between FINRA Rule 3110 and Rule 3120?
FINRA Rule 3110 establishes the requirement to have a written supervisory system. Rule 3120 requires firms to test and verify that supervisory system annually and provide a senior principal certification. Under Rule 3120, firms must designate principals to test supervisory procedures, document results, and certify to senior management. The annual testing cycle means supervision failures that are identified but not remediated create compounding liability in subsequent years.
What records must broker-dealers retain under SEC Rule 17a-4?
SEC Rule 17a-4 requires broker-dealers to retain electronic records in WORM (Write Once, Read Many) non-rewriteable, non-erasable format. General business records must be retained for 3 years, with the first 2 years accessible. Records relating to blotters, ledgers, securities records, and customer account communications must be retained for 6 years. Rule 17a-4(f) requires electronic records to be capable of being produced promptly for regulatory examination.
What social media monitoring does FINRA require?
FINRA Regulatory Notice 17-18 establishes that social media communications must be supervised when used for business purposes. LinkedIn messages, Twitter/X direct messages, and posts discussing securities or soliciting customers are business communications subject to Rule 3110 supervision and Rule 4511 retention. Firms must distinguish between static content subject to pre-approval and interactive content subject to correspondence supervision requirements.
Can broker-dealers prohibit WhatsApp and personal messaging apps?
Broker-dealers may prohibit WhatsApp and personal messaging applications, but prohibition alone is insufficient if evidence indicates employees use those channels for business despite the policy. The 2022-2023 enforcement sweep fined 16 firms a combined $1.1 billion for off-channel communications on WhatsApp and Signal — even where firm policies prohibited such use. Firms must combine policy prohibition with active monitoring controls to detect violations.
How often must supervisors review registered representative communications?
FINRA Rule 3110(b) requires review at a frequency appropriate to the volume, nature, and risk of each registered person's activity. For high-risk activities — new accounts, discretionary trades, complaints — daily or near-real-time review is expected. For standard electronic communications, most firms implement keyword alerting for immediate escalation and risk-based sampling for routine review. FINRA examiners request review logs showing what was reviewed, by whom, and when.
What are FINRA's typical fines for supervision failures?
FINRA issued $56.8 million in fines for supervision violations in 2023 alone. The average fine for a supervision failure case exceeds $500,000. The 2022-2023 off-channel communications sweep resulted in fines exceeding $1.1 billion across 16 firms by FINRA and the SEC combined. Supervision failures involving harm to customers, fraudulent activity, or senior investor exploitation trigger the highest penalties.
What is a supervisory principal under FINRA Rule 3110?
A supervisory principal is a registered principal designated under Rule 3110 to supervise the activities and communications of registered persons within their responsibility scope. Principal designations must be documented, and each principal must have the authority and resources to carry out supervisory responsibilities. Principals may not supervise their own activities — the firm's OSJ structure defines how principals are assigned to registered persons.
Does FINRA supervision apply to video calls discussing customer accounts?
Yes. FINRA regulatory guidance establishes that video call communications involving customer account discussions, securities recommendations, or solicitation activity must be supervised. Firms must either record and retain video call content or implement documented alternative controls. For platforms that do not support native recording, third-party capture solutions meeting Rule 17a-4 WORM storage requirements are available and expected by examiners.
How does eMonitor help broker-dealers meet FINRA supervision requirements?
eMonitor supports FINRA broker-dealer supervision through activity logging of all communications applications, tamper-proof audit trails exportable for regulatory examination, keyword alerting for prohibited topics including guarantees and specific securities, screen capture for supervision evidence, and role-based access controls ensuring only designated supervisory principals can review individual registered representative data. The platform generates the documentation trail FINRA examiners request during examinations.
What is an OSJ and how does it affect supervision requirements?
An OSJ (Office of Supervisory Jurisdiction) is a location where one or more principals are responsible for supervising the activities of registered persons under FINRA Rule 3110. Each OSJ must have at least one designated supervisory principal. Remote work has complicated OSJ structures — FINRA guidance confirms that working from home does not automatically convert a residence into an OSJ, but firms must ensure remote registered persons remain properly supervised under the existing structure.
Related Compliance Guides
SOX Compliance
Sarbanes-Oxley Section 302 and 404 monitoring obligations for public company compliance programs.
Read guide →HIPAA Compliance
Employee monitoring in healthcare settings — HIPAA Security Rule, Business Associate requirements, and workforce supervision.
Read guide →SOC 2 Compliance
How employee monitoring supports SOC 2 Trust Services Criteria and audit evidence requirements.
Read guide →Also relevant: Financial services employee monitoring · Activity logs feature · Screen monitoring feature
Legal Disclaimer
The information on this page is provided for general informational purposes only and does not constitute legal advice. FINRA rules, SEC regulations, and related guidance are subject to amendment, and enforcement positions evolve through regulatory guidance letters, examination findings, and adjudicated proceedings. Broker-dealers should consult qualified securities counsel and a Chief Compliance Officer before implementing any supervision or employee monitoring program. This guide reflects publicly available regulatory information as of April 2026 and is not a substitute for professional legal and compliance advice specific to your firm's registration categories, business model, and existing supervisory structure. References to enforcement actions and fines are drawn from publicly available FINRA and SEC press releases and AWC documents.