In March 2011, FINRA issued Regulatory Notice 11-14, requesting comments on proposed new rule 3190 clarifying the scope of a member firm’s obligations and supervisory responsibilities for functions or activities outsourced to a third-party service provider.
FINRA Rule 3190 clarifies that:
- Outsourced functions of a broker-dealer to a third-party service provider does not relieve the firm of its obligation to comply with applicable securities laws and regulations
- The firm cannot delegate its responsibilities for, or control over, any outsourced functions or activities
- The firm must maintain supervisory procedures, including due diligence measures, reasonably designed to ensure that third-party service provider arrangements achieve compliance with applicable securities laws and regulations
- Additional restrictions and obligations apply solely to clearing and carrying member firms and third-party service provider arrangements
Comments Requested by May 13, 2011
Member Firms’ Responsibilities for Activities Outsourced to Third-Party Service providers and Activities Requiring Registration and Qualification
FINRA Rule 3190(a)(1) – member firm’s use of a third-party service provider (including any sub-vendor) to perform functions or activities related to the firm’s business as a regulated broker-dealer does not relieve the firm of its obligation to comply with applicable securities laws and regulations.
- Third-party service provider (including any sub-vendor) – defined to include any person controlling, controlled by or under common control with a member firm, unless otherwise determined by FINRA.
- Prohibits the firm from delegating its responsibilities for, or control over, any functions or activities performed by such provider
FINRA Rule 3190(a)(3) – proper registration and qualification required to engage in activities requiring such under FINRA rules
Member Firms’ Supervision and Due Diligence Analysis of Third-Party Service Providers
FINRA Rule 3190(a)(2) – requires firms to establish and maintain a supervisory system and written procedures reasonably designed to achieve compliance with applicable securities laws and regulations for any functions or activities performed by a third-party service provider
FINRA Rule 3190(b) – requires firms include in their WSPs an ongoing due diligence analaysis to determine, at a minimum, whether:
- the provider is capable of performing the activities being outsourced; and
- as to such activities, if the firm can achieve compliance that are reasonably designed to achieve compliance with applicable securities laws and regulations
Clearing or Carrying Member Firms’ Restrictions and Obligations Regarding Outsourced Activities
The proposed rule imposes heightened requirements on a clearing or carrying firm’s outsourcing arrangements designed to address concerns regarding the potential harm that could result from its third-party service providers’ non-compliance. FINRA believes the concerns are mitigated by limiting certain activities to persons directly subject to the control and supervision of the firm, having additional supervisory procedures to oversee third-party service providers and notify FINRA of its outsourcing arrangements.
FINRA Rule 3190(c) – requires a clearing or carrying member firm to vest an associated person of the firm with the authority, responsibility and necessary registrations and qualifications for the following activities:
- the movement of customer or proprietary cash or securities;
- the preparation of net capital or reserve formula computations; and
- the adoption or execution of compliance or risk management systems.
FINRA Rule 3190(d) – requires that a clearing or carrying member firm include additional supervisory procedures to:
- enable the firm to take prompt corrective action where necessary to achieve compliance with applicable securities laws and regulations; and
- require the firm to approve any transfer of duties by a third-party service provider to a sub-vendor.
FINRA Rule 3190(e) – requires a clearing or carrying member firm to notify FINRA within 30 days after entering into any outsourcing agreement and such notification must include:
- the function(s) being performed by the third-party service provider;
- the identity and location of the third-party service provider;
- the identity of the third-party service provider’s regulator (if any); and
- a description of any affiliation between the firm and the third-party service provider.
Further, the firm would be required to maintain a copy of each notification and underlying agreement in accordance with SEA Rule 17a-4(b).
Exceptions to Proposed FINRA Rule 3190’s Requirements
FINRA Rule 3190 excepts from its requirements ministerial activities performed on behalf of a member firm, unless otherwise prohibited, and clarifies it does not restrict activities performed pursuant to carrying agreement approved under FINRA Rule 4311.
Assuming the rule is approved, there is not a substantial change from the previously issued guidance in NTM 05-48, except for heightened restrictions on certain clearing and carrying member firms’ activities. However, please contact our firm if you need experienced legal representation and advice or if you need assistance updating your written supervisory procedures, providing comments to FINRA, or any other regulatory or arbitration related legal assistance at firstname.lastname@example.org.