FINRA Requests Comment on Proposed Rule Regarding Supervision of Third-Party Service Providers

April 07, 2011

FINRA is requesting comment on proposed FINRA Rule 3190 which would impose new restrictions and obligations on clearing and carrying member firms with respect to their outsourcing arrangements with third-party service providers. The proposed rule would also codify existing guidance regarding the supervisory responsibilities of all member firms with respect to outsourced activities.1 The comment period expires on May 13, 2011.

Proposed FINRA Rule 3190 codifies and broadens much of the guidance from Notice to Members 05-48 (“NtM 05-48”) (July 2005). NtM 05-48 was issued following a joint survey conducted by NASD and NYSE in October 2004 on members’ outsourcing activities. After concluding that many members lacked written procedures regarding the supervision of outsourced activities, NASD issued NtM 05-48 to inform members of their obligations when they outsourced certain activities. NtM 05-48 further stated that, in cases in which third-party service providers were conducting activities or functions requiring registration or qualification under NASD rules, they would be deemed associated persons of the member and be required to have the proper registrations and qualifications.2

FINRA noted, however, that it continues to receive inquiries about member firms’ obligations including questions regarding which specific functions a clearing or carrying member can outsource, and whether particular functions may be outsourced to an unregistered third-party service provider. The notice and proposed rule addresses these issues.

Proposed FINRA Rule 3190

A. Reiterations of Member Firms’ Responsibilities for Outsourced Activities and for Activities Requiring Registration and Qualification

Proposed FINRA Rule 3190(a)(1) restates previous FINRA guidance that a member retains ultimate responsibility for complying with all applicable securities laws and regulations as well as FINRA and MSRB rules whenever it outsources activity to a third-party service provider.3 The rule codifies the language in NtM 05-48 that “the member has a continuing responsibility to oversee, supervise and monitor the service provider’s performance of the [outsourced] activities.”4 The proposed rule prohibits a member from delegating its responsibilities relating to, or control over, any outsourced functions. Proposed FINRA Rule 3190(a)(3) codifies existing guidance that persons are prohibited from engaging in any functions or activities which require registration or qualification under the FINRA rules absent actually being registered or properly qualified.

B. Development and Maintenance of a Supervisory System and Supervisory Procedures Regarding Outsourced Activities; Due Diligence of Third-Party Service Providers

Proposed FINRA Rule 3190(a)(2) expressly requires members to establish and maintain a supervisory system and written procedures “reasonably designed to comply with the securities laws and regulations and applicable FINRA and MSRB rules” for any outsourced activities. The proposed rule takes a broader approach than NtM 05-48 which required the member to include procedures regarding outsourced “covered activities.”5 

Under the rule proposal, to the extent a member outsources any activities or functions, the member’s supervisory procedures must address oversight of the third-party service provider.

Proposed Rule 3190(b) specifically requires that the member’s supervisory procedures include initial and ongoing due diligence of each third-party service provider to determine, at minimum, whether:

  • The third-party service provider is capable of performing the activities being outsourced;
  • Whether “the member can achieve compliance with applicable securities laws and regulations and FINRA and MSRB rules” with respect to any outsourced activities or functions.

The requirement for ongoing due diligence is generally consistent with past guidance in NtM 05-48. That said, the notice and the proposed rule suggest FINRA will now look even more closely at the time and effort firms are putting into due diligence, and firms will need to be able to provide records and information documenting these efforts.

C. Additional Obligations With Respect to Clearing and Carrying Members

Most of the new requirements in proposed FINRA Rule 3190 fall on clearing and carrying members. The new rule would require clearing and carrying members to “vest an associated person of the member with authority and responsibility” for three functions (movement of cash and securities, preparation of net capital and reserve calculations, and adoption or execution of compliance and risk management system); add additional requirements for oversight of third-party service providers by clearing or carrying member firms; and require clearing and carrying members to file notifications of outsourcing arrangements with FINRA. As drafted, these requirements would apply both to firms that clear for introducing brokers, as well as firms that are self-clearing. Only introducing brokers (who do not carry or clear accounts) would be exempt from these requirements.

1. Clearing and Carrying Member Firms’ Restrictions Applicable to Certain Activities

Proposed FINRA Rule 3190(c) requires a clearing or carrying member firm to vest an associated person of the firm with both the authority and responsibility for three activities:

  • the movement of customer or proprietary cash or securities;
  • the preparation of net capital or reserve formula computations; and
  • the adoption or execution of compliance or risk management systems.

To the extent any of these functions require registration or qualification,6 the clearing or carrying member would, pursuant to proposed FINRA Rule 3190(a)(3), have to vest authority and responsibility with a properly registered or qualified associated person of the member firm. The message here is clear: the person responsible for these functions must be subject to the direct supervision and control of the carrying or clearing member firm.

Proposed Supplementary Material .02 (Posting to Books and Records) does allow for limited outsourcing of the recordkeeping related to the movement of funds or securities. It allows a third-party service provider (including any sub-vendor) to post items to a member’s books or records, provided that the member reviews each posting prior to the close of the business day following the posting. Regulatory Notice 11-14 also notes that FINRA would generally permit the clearing or carrying member to perform the supervisory review by substantiation of financial balances and spot-check reviews of individual entries as opposed to requiring an actual review and sign-off on every entry.7

Similarly, with respect to preparing net capital or reserve formula computations, FINRA would allow the performance of calculations in aid of the preparation of the computations to be outsourced. However, a registered associated person of the clearing or carrying member must review and understand the computation and be able to explain the mechanics and rationale of the computations to FINRA staff.8 

FINRA also provides clearing and carrying members some leeway with respect to the use of outsourced compliance or risk management systems as part of its compliance or risk management program. When doing so, the clearing or carrying member must: (1) adopt and implement the services or systems in a manner that is consistent with regulatory requirements; (2) retain control over the implementation and use of the services and systems; and (3) make an independent determination that the services and systems comply with applicable securities law and FINRA and MSRB rules. FINRA further clarifies that, while the third-party service provider may perform basic calculations, logging and maintaining lists that are preparatory to creating books and records and reviewing system outputs, to the extent analysis is required or conclusions drawn regarding the data, would have to be performed by an associated person of the firm.

2. Oversight Requirement for Clearing or Carrying Member Firms Who Outsource Functions

In addition to the general supervisory obligations set forth in proposed FINRA Rule 3190(a), proposed FINRA Rule 3190(d) sets forth additional supervisory procedures for clearing and carrying members that would: (1) enable the firm to take prompt corrective action where necessary to achieve compliance with applicable securities laws and regulations as well as applicable FINRA and MSRB rules, and (2) require the firm to approve the transfer of duties from a third-party service provider to a sub-vendor.

3. Notification to FINRA by Clearing or Carrying Members

Proposed FINRA Rule 3190(e) sets forth another new requirement that a clearing or carrying member provide notification to FINRA within 30 calendar days when it outsources any function or activity related to the firm’s business as a regulated broker-dealer to a third-party service provider or sub-vendor. Although the proposed rule does not specify the exact form the notification must take, it does explain that the notification must include: 1) the function(s) being performed by the third-party service provider, 2) the identity and location of the third-party service provider, 3) the identity of the third-party service provider’s regulator (if any), and (4) a description of any affiliation between the firm and the third-party service provider.  Member firms must also retain copies of the notification to FINRA as well as the underlying written agreement(s) in accordance with the requirements of SEA Rule 17a-4.

In a footnote to the Regulatory Notice, FINRA invites clearing and carrying members to consider submitting prospective outsourcing arrangements to FINRA for review prior to entering into such outsourcing arrangements. To the extent members decide to submit such agreements, they should allow sufficient lead time for FINRA to review the documentation prior to entering into the agreement with the third-party service provider. The proposed rule will require clearing and carrying members to notify FINRA of all outsourcing arrangements within three months of the rule’s effective date.

4. Exceptions From Proposed FINRA Rule 3190

Proposed FINRA Rule 3190(f) sets forth two limited exceptions. Proposed FINRA Rule 3190(f)(1) provides that the rule provisions do not apply to ministerial activities performed on behalf of the member, provided however that the activities are not otherwise prohibited by applicable securities laws or regulations or applicable FINRA or MSRB rules.

The second exception states that the rule provisions shall not restrict any activities performed pursuant to a carry agreement approved under FINRA Rule 4311.9 This is consistent with the guidance in Regulatory Notice 10-25 that in an introducing/clearing relationship, a covered person would not be considered an associated person of both the introducing and clearing firms based solely on functions performed pursuant to a carrying agreement approved under FINRA Rule 4311.


For firms who are not clearing or carrying members, the new rule will codify NtM 05-48, and remind them to review their policies and procedures to ensure that they address the supervision and monitoring of all activities outsourced to third-party service providers. Those policies and procedures should be designed to verify that third-party service providers are complying with the specific terms of outsourcing agreements and, on an ongoing basis, that they are living up to their contractual obligations. Additionally, firms should verify that they are not outsourcing activities which require qualification or registration since, as both NtM 05-48 and the proposed rule makes clear, such activities must be performed by an associated person of the member.

If a firm outsources functions requiring registration or qualification, they must be aware that the third-party service provider will be deemed an associated person of the member, potentially raising collateral issues under current FINRA rules (e.g., associating with a statutorily disqualified individual.)

The proposed rule’s greatest impact will be on clearing or carrying member firms. Clearing and carrying member firms will have to review, and possibly amend, their policies and procedures to delineate the functions that can be outsourced and the functions that must be assigned to (in some cases, properly registered) associated persons of the firm. Clearing and carrying members may also need to amend their outsourcing agreements to require prompt notification to the member of instances where corrective action is necessary and of plans by the third party to further outsource particular tasks. Finally, clearing and carrying members will need procedures in place for the submission and retention of the FINRA outsourcing notifications anticipated by the rule.

Please direct questions to any of the listed lawyers or to any other Bingham lawyer with whom you ordinarily work on related matters.

Michael R. Weissmann, Partner, Broker-Dealer, 617.951.8705

David C. Boch, Partner, Broker-Dealer, 617.951.8485

Amy Natterson Kroll, Partner, Broker-Dealer, 202.373.6118

Roger P. Joseph, Practice Group Leader, Investment Management; Co-chair, Financial Services Area, 617.951.8247

Edwin E. Smith, Partner, Financial Restructuring; Co-chair, Financial Services Area, 617.951.8615

Tim Burke, Practice Group Leader, Broker-Dealer Group; Co-chair, Financial Services Area, 617.951.8620

1  FINRA Regulatory Notice 11-14 (March 30, 2011). The complete text of the proposed rule is set forth in Attachment A to the Regulatory Notice.

2  NASD also issued an Interpretive Letter on August 15, 2006, in response to questions regarding the scope of the guidance in NtM 05-48.

3  Proposed Supplementary Material .01 defines the term “third-party service provider” (including any sub-vendor) to include any person controlling, controlled by or under common control with a member, unless otherwise determined by FINRA.

4  FINRA’s statements reminding members that they retain ultimate responsibility for supervisory functions dates back to Notice to Members 99-45 (June 1999).
5  Examples of “covered activities” included “order taking, handling of customer funds and securities, and supervisory responsibilities under NASD Rules 3010 and 3012.”  NtM 05-48, n. 2

6  FINRA’s rule proposal to register Operations Professionals will require all of these functions be supervised by registered persons. See FINRA Regulatory Notice 10-25 (Registration and Qualification Requirements for Certain Operations Personnel); Proposed Rule Change to Establish a Registration Category, Qualification Examination and Continuing Education Requirements for Certain Operations Personnel, and Adopt FINRA Rule 1250 (Continuing Education Requirements) in the Consolidated FINRA Rulebook, SR-FINRA-2011-13, 76 F.R. 15012 (March 18, 2011). See also, Bingham Alert, FINRA Proposes to Require Registration of Back Office and Operations Professionals (June 3, 2010) and Bingham Alert, FINRA Files Operations Professional Registration Rule Proposal With The SEC (Mar. 21, 2011).

7  Members who allow persons regular access to the keeping, handling or processing of securities, money or original books and records relating to securities or money are required to be fingerprinted pursuant to Rule 17f-2 under the Securities Exchange Act of 1934.  Regulatory Notice 11-14, n. 7.

8  It is not clear why this applies solely to clearing and carrying members, or that FINRA means to suggest an introducing firm does not need to have a registered associated person who understands and can explain these same issues to the FINRA staff.

9  FINRA Rule 4311 replaces NASD Rule 3230 and NYSE Rule 382, although FINRA has yet to announce an effective date for the rule.

This article was originally published by Bingham McCutchen LLP.