I. Introduction

On April 14, 2023, the Financial Industry Regulatory Authority, Inc. (“FINRA”) filed with the Securities and Exchange Commission (“Commission”) the proposed rule change SR-FINRA-2023-007 pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Exchange Act”) ^[1] and Rule 19b-4 ^[2] thereunder, to adopt a voluntary, three-year remote inspections pilot program to allow eligible member firms to elect to fulfill their obligation under paragraph (c) (Internal Inspections) of FINRA Rule 3110 (Supervision) by conducting inspections of eligible branch offices,^[3] offices of supervisory jurisdiction (“OSJ”),^[4] and non-branch locations ^[5] remotely without an on-site visit to such locations,^[6] subject to specified safeguards and limitations (the “Pilot”).^[7] The proposed rule change was published for public comment in the Federal Register on May 4, 2023.^[8] The Commission received thirteen comment letters in response to the Notice.^[9] On June 7, 2023, FINRA consented to an extension of the time period in which the Commission must approve the proposed rule change, disapprove the proposed rule change, or institute proceedings to determine whether to approve or disapprove the proposed rule change to August 2, 2023.^[10] On ( printed page 82465) August 1, 2023, FINRA filed an amendment to modify the proposed rule change (“Amendment No. 1”).^[11] On August 2, 2023, the Commission published a notice of filing of Amendment No. 1 and an order instituting proceedings to determine whether to approve or disapprove the proposed rule change, as modified by Amendment No. 1 (hereinafter, the “proposed rule change” unless otherwise specified).^[12] The Commission received ten comment letters in response to the notice of Amendment No. 1 and order instituting proceedings.^[13] On August 29, 2023, FINRA responded to the comment letters received in response to the Notice.^[14] On September 22, 2023, FINRA consented to an extension of the time period in which the Commission must approve or disapprove the proposed rule change to December 30, 2023.^[15] On October 25, 2023, FINRA responded to comments received in response to the notice of Amendment No. 1 and order instituting proceedings.^[16]

This Order approves the proposed rule change.

A. Description of the Proposed Rule Change

FINRA stated that technological advancements and an emerging remote workplace prompted FINRA to further study the effectiveness of remote inspections as part of a reasonably designed supervisory system.^[17] As a result of this evaluation, FINRA determined the Pilot would provide it “the opportunity to gauge the effectiveness of remote inspections as part of a modernized, reasonably designed supervisory system that reflects the current work environment and availability of technologies that did not exist when the on-site inspection originally was conceived.” ^[18] After describing the current regulatory framework and FINRA's stated reasons for proposing the Pilot, the Commission describes the proposed rule change.

B. Background

1. FINRA Rule 3110 (Supervision)

FINRA Rule 3110(a) (Supervisory System) requires a member firm to establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations, and applicable FINRA rules (hereinafter, a “reasonably designed supervisory system”).^[19] As part of a reasonably designed supervisory system, FINRA Rule 3110(c) (Internal Inspections) requires a member firm to conduct a review, at least annually, of the businesses in which it engages in a manner reasonably designed to assist the member firm in detecting and preventing violations of, and achieving compliance with, applicable securities laws and regulations, and with applicable FINRA rules. FINRA Rule 3110(c) also requires a review of the activities of each of the member firm's locations, including a periodic examination of customer accounts to detect and prevent irregularities or abuses, and each member firm also must retain a written record of the date upon which each review and inspection is conducted.^[20]

FINRA Rule 3110(c) sets forth three main components for conducting internal inspections. First, a member firm must conduct an inspection of each location on a designated frequency. The designated frequency varies depending on the classification of the location and the nature of the securities activities for which each location is responsible: OSJs and supervisory branch offices must be inspected at least annually; ^[21] non-supervisory branch offices must be inspected at least every three years; ^[22] and non-branch locations must be inspected on a periodic schedule, presumed to be at least every three years.^[23] FINRA has interpreted the rule to require that inspections take place on-site, irrespective of the type of office.^[24]

Second, a member firm must make and retain a written record of each inspection. Specifically, a member firm must retain a written record of the date upon which each review and inspection occurred; ^[25] reduce each location's inspection to a written report; ^[26] and keep each inspection report on file either for a minimum of three years or, if the location's inspection schedule is longer than three years, at least until the next inspection report has been written.^[27] If applicable to the location being inspected, the inspection report must include the testing and verification of the member firm's policies and procedures, including supervisory policies and procedures, in specified areas.^[28]

Third, a member firm must address potential conflicts of interest related to inspections of its locations. For example, a member firm must: (1) have procedures reasonably designed to prevent the effectiveness of the inspections from being compromised due to the conflicts of interest that may be present with respect to the location; ^[29] and (2) ensure that the person conducting the inspection is not an associated person assigned to the location or is not directly or indirectly supervised by, or otherwise reporting to, ( printed page 82466) an associated person assigned to that location.^[30]

FINRA Rule 3110.12 describes the components of a reasonable review. In particular, the rule requires a member firm to establish and maintain supervisory procedures that take into consideration, among other things, the member firm's size, organizational structure, scope of business activities, number and location of the member firm's offices, the nature and complexity of the products and services offered by the member firm, the volume of business done, the number of associated persons assigned to a location, the disciplinary history of registered representatives or associated persons, and any indicators of irregularities or misconduct ( i.e., “red flags”).^[31]

2. FINRA's Stated Reasons for the Proposed Rule Change

FINRA has identified, among others, three factors supporting consideration of this Pilot. First, in response to the COVID pandemic, FINRA adopted Rule 3110.17 to provide member firms the option, subject to specified conditions, to complete remotely their calendar year inspection obligations without an on-site visit to their locations.^[32] Under FINRA Rule 3110.17, member firms generally have been performing remote inspections to satisfy their inspection obligations since 2021.^[33] FINRA stated that during this period, the variance between member firms' rates of inspection findings through an on-site process and findings through a remote process were not material.^[34] This relief was extended on several occasions, and is currently scheduled to last until the earlier of June 30, 2024, or the effective date of the Pilot.^[35]

Second, FINRA stated that “developments in technology have enhanced firms' overall and ongoing supervision and monitoring of the activities occurring at branch offices and non-branch locations” such that an on-site visit may not be required as part of every inspection.^[36] Specifically, recordkeeping, correspondence, opening customer accounts, placing trades, and transmitting customer funds and securities are increasingly done electronically.^[37] As such, a large portion of inspection work can be conducted electronically, prior to any on-site visit to the location, and electronic reviews of many locations have become one component of a member firm's overall supervisory system of associated persons and locations.^[38]

Third, FINRA stated that, in general, the U.S. workforce has demanded greater workplace flexibility and the securities industry is subject to the same national pressures as it aims to recruit and retain diverse, talented, and qualified employees.^[39] For example, FINRA stated that member firms have conveyed that the flexibility of hybrid work has made a positive impact in attracting more diverse talent and retaining existing talent.^[40] However, retaining the hybrid workplace model means that more locations are subject to inspections and, but for this Pilot, those locations would have to be physically inspected. According to FINRA, “a system of risk-based on-site and remote inspections will allow firms to more efficiently deploy compliance resources and to use an on-site component only when appropriate.” ^[41]

With the confluence of advances in compliance technology and the shift to a remote or hybrid work environment made more pronounced by the pandemic, FINRA stated that the optimal use of on-site inspections deserves further consideration.^[42]

C. The Proposed Rule Change

As stated above, FINRA Rule 3110(c)(1) currently provides that an inspection of a location must occur on a designated frequency that varies depending on the classification of the location as an OSJ, branch office, or non-branch location.^[43] FINRA is proposing to amend FINRA Rule 3110 to adopt a voluntary, three-year pilot program to allow eligible member firms to elect to fulfill their inspection obligations under FINRA Rule 3110(c) by conducting inspections of eligible OSJs, branch offices, and non-branch locations remotely without an on-site visit to such locations, subject to specified safeguards and limitations (such member firms hereinafter referred to as “participating member firms”). To help mitigate the potential risks associated with not conducting an on- ( printed page 82467) site inspection of every location, the proposed rule change would establish safeguards that limit eligibility to participate in the Pilot to certain member firms and locations based on criteria designed to minimize risk.^[44] These safeguards and limitations would: (1) exclude certain member firms from participating in the Pilot; (2) exclude certain locations of participating member firms from participating in the Pilot; (3) impose certain conditions that a participating member firm and its eligible locations would be required to meet prior to participating in the Pilot; and (4) require any participating member firm to provide specified data to FINRA on a regular basis.^[45] These safeguards and limitations, as well as others, are discussed in more detail below.

1. Length of Pilot

Proposed Rule 3110.18(a) would permit participating member firms to perform required inspections of OSJs, branch offices, and non-branch locations remotely under the applicable provisions of FINRA Rule 3110(c)(1), subject to specified safeguards and limitations. The proposed Pilot would automatically sunset on a date that is three years after its effective date.^[46]

2. Member Firm-Level Requirements

Proposed Rule 3110.18(f) would establish: (1) a list of criteria that would render a member firm ineligible to participate in the Pilot; and (2) a list of conditions to which participating member firms would be required to adhere to during the Pilot.^[47]

a. Member Firm-Level Ineligibility Criteria

Under proposed Rule 3110.18(f)(1), a member firm would be ineligible to conduct remote inspections of any of its locations if at any time during the Pilot the member firm: (1) is or becomes designated as a Restricted Firm under FINRA Rule 4111 (“Restricted Firm”); ^[48] (2) is or becomes designated as a Taping Firm under FINRA Rule 3170 (“Taping Firm”); ^[49] (3) receives a notice from FINRA pursuant to FINRA Rule 9557 regarding compliance with FINRA Rule 4110 (Capital Compliance), Rule 4120 (Regulatory Notification and Business Curtailment), or Rule 4130 (Regulation of Activities of Section 15C Members Experiencing Financial and/or Operational Difficulties); ^[50] (4) is or becomes suspended from membership by FINRA; ^[51] (5) had its FINRA membership become effective within the prior 12 months based on the date in the Central Registration Depository (“CRD”); ^[52] or (6) is or has been found within the past three years by the Commission or FINRA to have violated FINRA Rule 3110(c).^[53]

b. Member Firm-Level Conditions

i. Recordkeeping System

Proposed Rule 3110.18(f)(2)(A) would require each participating member firm to have a recordkeeping system that: (1) makes, keeps current, and preserves records required to be made, kept current, and preserved under applicable securities laws and regulations, FINRA rules, and the participating member firm's own written supervisory procedures under FINRA Rule 3110; (2) ensures such records are not physically or electronically maintained and preserved at the location subject to remote inspection; and (3) gives the participating member firm prompt access to such records.^[54]

ii. Surveillance and Technology Tools

Proposed Rule 3110.18(f)(2)(B) would require each participating member firm to determine that its surveillance and technology tools are appropriate to supervise the types of risks presented by each remotely supervised location. Proposed Rule 3110.18(f)(2)(B) would also set forth a non-exclusive list of surveillance and technology tools a participating member firm may use, including: (1) firm-wide tools, such as electronic recordkeeping systems, electronic surveillance of email and correspondence, electronic trade blotters, regular activity-based sampling reviews, and tools for visual inspections; (2) tools specifically applied to such location based on the activities of associated persons, products offered, restrictions on the activity of the location (including holding out to customers and handling of customer funds or securities); and (3) system security tools, such as secure network connections and effective cybersecurity protocols.

3. Location-Level Requirements

Proposed Rule 3110.18(g) would establish: (1) a list of criteria that would render a location of a participating member firm ineligible for remote inspection; and (2) a list of conditions a location would be required to satisfy to be eligible for remote inspection.

a. Location-Level Ineligibility Criteria

Under proposed Rule 3110.18(g)(1), a participating member firm's location would not be eligible for a remote inspection if at any time during the Pilot: (1) one or more associated persons at such location is or becomes subject to a mandatory heightened supervisory plan under the rules of the Commission, FINRA, or a state regulatory agency; ^[55] (2) one or more associated persons at such location is or becomes statutorily disqualified, unless such disqualified person (A) has been approved (or is otherwise permitted pursuant to FINRA rules and the federal securities laws) to associate with a member firm and (B) is not subject to a mandatory heightened supervisory plan described in proposed Rule 3110.18(g)(1)(A) or otherwise as a condition to approval or permission for such association; ^[56] (3) the member firm ( printed page 82468) is or becomes subject to FINRA Rule 1017(a)(7) as a result of one or more associated persons at such location (hereinafter, a “continuing membership review”); ^[57] (4) one or more associated persons at such location has an event in the prior three years that required a “yes” response to any item in Questions 14A(1)(a) and (2)(a), 14B(1)(a) and (2)(a), 14C, 14D and 14E on Form U4 (Uniform Application for Securities Industry Registration or Transfer Registration) (“Form U4”); ^[58] (5) one or more associated persons at such location is or becomes subject to a disciplinary action taken by the participating member firm that is or was reportable under FINRA Rule 4530(a)(2); ^[59] (6) one or more associated persons at such location is engaged in proprietary trading, including the incidental crossing of customer orders, or the direct supervision of such activities; ^[60] or (7) the location handles customer funds or securities.^[61]

b. Location-Level Conditions

Proposed Rule 3110.18(g)(2) would require a specific location of a participating member firm to satisfy certain conditions to be eligible for a remote inspection. These conditions are: (1) electronic communications would be required to be made through the participating member firm's electronic system; (2) the associated person's correspondence and communications with the public would be required to be subject to the participating member firm's supervision in accordance with FINRA Rule 3110; and (3) no books or records of the participating member firm required to be made and kept current, and preserved under applicable securities laws and regulations, FINRA rules, and the participating member firm's own written supervisory procedures under FINRA Rule 3110, can be physically or electronically maintained and preserved at such location.^[62]

4. Risk Assessment

Proposed Rule 3110.18(b)(1) (Standards for Reasonable Review) would require that prior to electing a remote inspection for a location, a participating member firm would be required to develop a reasonable risk-based approach to using remote inspections and conduct and document a risk assessment for that location. The risk assessment would require the participating member firm to document the factors considered, including the factors set forth in FINRA Rule 3110.12 and would require the participating member firm take into account any higher-risk activities that take place at, or higher-risk associated persons that are assigned to, that location.^[63] Proposed Rule 3110.18(b)(2) (Other Factors to Consider for Risk Assessment) sets forth a non-exhaustive list of factors that a participating member firm would be required to consider and document as part of the risk assessment for each location, including: (1) the volume and nature of customer complaints; (2) the volume and nature of outside business activities, particularly investment-related; (3) the volume and complexity of products offered; (4) the nature of the customer base, including vulnerable adult investors; (5) whether associated persons are subject to heightened supervision; (6) failures by associated persons to comply with the participating member firm's written supervisory procedures; and (7) any recordkeeping violations.^[64] In addition, proposed Rule 3110.18(b)(2) states that participating member firms should conduct on-site inspections or make more frequent use of unannounced, on-site inspections for high-risk locations or locations where there are red flags.^[65] Amendment No. 1 modified proposed Rule 3110.18(b)(2) to add that, consistent with FINRA Rule 3110(a), a participating member firm's supervisory system would be required to take into consideration any red flags when determining whether to conduct a remote inspection of a location.^[66]

5. Written Supervisory Procedures for Remote Inspections

As originally proposed, Rule 3110.18(c) would have required a participating member firm to adopt written supervisory procedures regarding remote inspections that are reasonably designed to detect and prevent violations of, and achieve compliance with, applicable securities laws and regulations, and with applicable FINRA rules. Under the proposed provision, reasonably designed procedures for conducting remote inspections of locations would be required to address, among other things: (1) the methodology, including technology, that may be used to conduct remote inspections; (2) the factors considered in the risk assessment made for each applicable location; (3) the procedures specified in proposed Rules 3110.18(h)(1)(G) ^[67] and (h)(4) ^[68] of the data and information collection section of the proposed rule; and (4) the use of other risk-based systems employed generally by the participating member firm to identify and prioritize for review those areas that pose the greatest risk of potential violations of applicable securities laws and regulations, and of applicable FINRA rules.^[69] Amendment No. 1 modified proposed Rule 3110.18(c) to state that a participating member firm would be required to “establish, maintain, and enforce” ( printed page 82469) written supervisory procedures regarding remote inspections rather than solely “adopt” such procedures.^[70]

6. Effective Supervisory System

Proposed Rule 3110.18(d) (Effective Supervisory System) states that the requirement to conduct inspections of locations is one part of the member firm's overall obligation to have an effective supervisory system, and therefore a member firm would be required to maintain its ongoing review of the activities and functions occurring at all locations, whether or not the member firm conducts inspections remotely. Proposed Rule 3110.18(d) additionally states that a participating member firm's use of a remote inspection of a location would be held to the same standards for review applicable to on-site inspections as set forth in FINRA Rule 3110.12 (Standards for Reasonable Review), which requires that the review must be reasonably designed to assist in detecting and preventing violations of, and achieving compliance with, applicable securities laws and regulations and with FINRA rules, and that the member firm shall establish and maintain supervisory procedures that must take into consideration, among other things, any red flags.^[71] Finally, proposed Rule 3110.18(d) would provide that where a participating member firm's remote inspection of a location identifies any red flags, the participating member firm may need to impose additional supervisory procedures for that location or may need to provide for more frequent monitoring or oversight of that location, including potentially a subsequent physical, on-site visit on an announced or unannounced basis.^[72]

7. Documentation Requirement

Proposed Rule 3110.18(e) would require a participating member firm to maintain and preserve a centralized record for each Pilot Year ^[73] in which it participates that separately identifies: (1) all locations that were inspected remotely; and (2) any locations for which the participating member firm determined to impose additional supervisory procedures or more frequent monitoring, as provided in proposed Rule 3110.18(d). Further, proposed Rule 3110.18(e) would require a participating member firm's documentation of the results of a remote inspection for a location to identify any additional supervisory procedures or more frequent monitoring for that location imposed as a result of the remote inspection, including whether an on-site inspection was conducted at such location.^[74]

8. Data and Information Collection Requirement

a. Data and Information During Pilot

As originally proposed, proposed Rule 3110.18(h)(1) would have required a participating member firm to collect and provide to FINRA on a quarterly basis and in the manner and format determined by FINRA the following data and information:^[75] (1) the total number of locations with an inspection completed during each calendar quarter; ^[76] (2) the number of locations from that total quarterly number that were inspected remotely; ^[77] (3) the number of those locations from that total quarterly number that were inspected on-site; ^[78] (4) the number of those locations in each calendar quarter that were subject to an on-site inspection because of a finding; ^[79] (5) the number of locations for which a remote inspection was conducted in the calendar quarter that identified a finding, the number of those findings, and a list of the most significant findings; ^[80] and (6) the number of locations for which an on-site inspection was conducted in the calendar quarter that identified a finding, the number of those findings, and a list of the most significant findings.^[81] Amendment No. 1 modified proposed Rule 3110.18(h)(1) to change the requirement to provide a list of “significant findings” by deleting the word “most” from the phrase “most significant findings.” ^[82]

In addition, at the time a participating member firm first delivers the quarterly data described above, it would also be required to provide to FINRA the following written supervisory procedures for conducting remote inspections: (1) procedures for escalating significant findings; (2) procedures for new hires; (3) procedures for supervising brokers with a significant history of misconduct; and (4) procedures related to outside business activities and “doing business as” designations.^[83]

b. Additional Data and Information for Pilot Year 1, if Less Than Full Calendar Year

As originally proposed, if the first year of the Pilot (“Pilot Year 1”) ^[84] would cover a period of time that is less than a full calendar year, the proposed rule change would have required a participating member firm to collect and provide to FINRA the following data and information no later than December 31 of Pilot Year 1:^[85] (1) the number of locations with an inspection completed during the full calendar year of Pilot Year 1; ^[86] (2) the number of locations referenced in item (1) that were inspected remotely during the full calendar year of Pilot Year 1; ^[87] and (3) the number of locations referenced in item (1) that were inspected on-site ( printed page 82470) during the full calendar year of Pilot Year 1.^[88]

Rule 3110.18(h)(2) as originally proposed did not divide data and information collection and reporting into inspections that occurred prior to, and after, the effective date of the Pilot, but rather would have required reporting for the full calendar year of Pilot Year 1. Amendment No. 1 amended proposed Rule 3110.18(h)(2) so that participating member firms would be required to collect and provide information under this provision for the time period between January 1 of Pilot Year 1 and the day before the effective date of the Pilot, in addition to the other data requirements set forth in the Pilot.^[89] More specifically, if Pilot Year 1 covers a period of time that is less than a full calendar year, the proposed rule change, as modified by Amendment No. 1, would require a participating member firm to collect and provide to FINRA the following data and information no later than December 31 of Pilot Year 1:^[90] (1) the number of locations with an inspection completed between January 1 of Pilot Year 1 and the day before the effective date of the Pilot; ^[91] (2) the number of locations referenced in item (1) that were inspected remotely between January 1 of Pilot Year 1 and the day before the effective date of the Pilot; ^[92] and (3) the number of locations referenced in item (1) that were inspected on-site between January 1 of Pilot Year 1 and the day before the effective date of the Pilot.^[93]

In addition, Amendment No. 1 modified proposed Rule 3110.18(h)(2) to impose two new obligations for participating member firms to collect and provide to FINRA certain data and information. Specifically, if Pilot Year 1 covers a period of time that is less than a full calendar year, the proposed rule change would require a participating member firm to collect and provide to FINRA the following additional data and information no later than December 31 of Pilot Year 1: (1) the number of locations referenced in item (2) above where findings were identified, the number of those findings, and a list of the significant findings; ^[94] and (2) the number of locations referenced in item (3) above where findings were identified, the number of those findings, and a list of the significant findings.^[95]

c. Additional Data and Information for Calendar Year 2019

As originally proposed, Rule 3110.18(h)(3) would have required a participating member firm to collect and provide to FINRA the following calendar year 2019 data and information (“2019 data”) no later than December 31 of Pilot Year 1: ^[96] (1) the number of locations with an inspection completed during calendar year 2019; ^[97] and (2) the number of locations referenced in item (1) where findings were identified, the number of those findings, and a list of the most significant findings.^[98] Amendment No. 1 modified the proposed rule change to require a participating member firm to “act in good faith using best efforts” to collect and provide to FINRA such data, as FINRA rules in general only require that member firms preserve these records for a period of three years.^[99] Amendment No. 1 also clarified the data and information requirement to require that participating member firms provide a list of “significant findings” by deleting the word “most” from the phrase “most significant findings.” ^[100]

d. Written Policies and Procedures

Proposed Rule 3110.18(h)(4) would require a participating member firm to establish, maintain, and enforce written policies and procedures that are reasonably designed to comply with the data and information collection, and transmission requirements of proposed Rule 3110.18(h).^[101]

9. Election To Participate in Pilot

In general, proposed Rule 3110.18(i) would require a participating member firm, at least five calendar days before the beginning of a Pilot Year,^[102] to provide FINRA an opt-in notice in the manner and format determined by FINRA. The proposed rule states that by providing such opt-in notice to FINRA, the member firm agrees to participate in the Pilot for the duration of such Pilot Year and to comply with the requirements of Rule 3110.18.^[103] A member firm that provides an opt-in notice for a Pilot Year would be automatically deemed to have elected and agreed to participate in the Pilot for subsequent Pilot Years until the Pilot expires.^[104] To opt out, proposed Rule 3110.18(i) would require a participating member firm to provide FINRA with an opt-out notice in the manner and format determined by FINRA at least five calendar days before the end of the then current Pilot Year.^[105] The proposed rule change also states that FINRA may, in exceptional cases and where good cause is shown, waive the applicable timeframes for the required opt-in or opt-out notices.^[106]

10. Failure To Satisfy Conditions

Proposed Rule 3110.18(j) states that a member firm that fails to satisfy the conditions of Rule 3110.18, including the requirement to timely collect and submit the data and information to FINRA as set forth in proposed Rule 3110.18(h), would be ineligible to participate in the Pilot and would be required to conduct on-site inspections of each location on the required cycle in accordance with FINRA Rule 3110(c).^[107]

11. Determination of Ineligibility

Proposed Rule 3110.18(k) would authorize FINRA to make a determination in the public interest and for the protection of investors that a participating member firm is no longer eligible to participate in the Pilot if the participating member firm fails to comply with the requirements of Rule 3110.18.^[108] In such instances, FINRA would provide written notice to the participating member firm of such determination and the participating member firm would no longer be eligible to participate in the Pilot and ( printed page 82471) would be required to conduct on-site inspections of required locations in accordance with FINRA Rule 3110(c).^[109]

II. Discussion and Commission Findings

After careful review of the proposed rule change, the comment letters, and FINRA's responses to the comments, the Commission finds that the proposed rule change, as modified by Amendment No. 1, is consistent with the requirements of the Exchange Act and the rules and regulations thereunder that are applicable to a national securities association.^[110] Specifically, the Commission finds that the proposed rule change is consistent with Section 15A(b)(6) of the Exchange Act, which requires, among other things, that FINRA rules be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, and, in general, to protect investors and the public interest.^[111]

Pursuant to FINRA Rule 3110, member firms must “establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules.” ^[112] Rule 3110 provides that “[e]ach member shall establish and maintain supervisory procedures that must take into consideration, among other things, the firm's size, organizational structure, scope of business activities, number and location of the firm's offices, the nature and complexity of the products and services offered by the firm, the volume of business done, the number of associated persons assigned to a location, the disciplinary history of registered representatives or associated persons, and any indicators of irregularities or misconduct ( i.e., `red flags'), etc.” ^[113] Importantly, Rule 3110 provides that “[f]inal responsibility for proper supervision . . . rest[s] with the member.” ^[114] A reasonably designed supervisory system must include an inspection of each location subject to supervision.

The Pilot is consistent with these obligations, permitting a participating member firm the flexibility to consider whether remote inspections of its eligible locations would be consistent with the member firm's broader obligation to establish and maintain a reasonably designed supervisory system. At the same time, to help mitigate the potential risks associated with not conducting an on-site inspection of certain locations, the proposed rule change would establish safeguards that limit eligibility to participate in the Pilot to certain member firms and locations and that impose on member firms electing to participate in the Pilot affirmative obligations tailored to the risks. Similarly, the Pilot would mandate the collection of data and information that should help FINRA make well-informed decisions about improvements to, and the prudence of, any permanent rule changes. Accordingly, as explained in more detail below, the Commission finds that the Pilot is consistent with Section 15A(b)(6) of the Exchange Act.

A. Member Firm-Level Requirements

The proposed rule change would impose various safeguards and limitations that preclude certain member firms from participating in the Pilot. The Commission addresses the safeguards and limitations, and any related comments, in turn.

1. Member Firm Ineligibility Criteria

As stated above, under proposed Rule 3110.18(f)(1), a member firm would be ineligible to participate in the Pilot if at any time during the pilot period the member firm is subject to any of six firm-level ineligibility criteria.^[115] FINRA stated that these proposed ineligibility criteria “would appropriately limit the potential population of pilot program participants to those firms that may be better positioned to conduct remote inspections.” ^[116] For example, FINRA stated that “a member firm that is experiencing issues complying with its capital requirements or has been suspended from membership by FINRA is more likely to face significant operational challenges that may negatively impact the firm's inspection program.” ^[117] Additionally, FINRA stated that new member firms are often still implementing business plans and “may not have sufficient experience to develop a sufficiently robust inspection program.” ^[118] Moreover, firms with recent FINRA Rule 3110(c) (Internal Inspections) violations have demonstrated challenges in developing or maintaining robust inspection programs and should not be able to participate, according to FINRA.^[119]

Three commenters offered general support for the firm-level ineligibility criteria, each expressing the idea that these ineligibility criteria “would help to ensure that firms and locations that present higher risks to investors would remain subject to in-person inspection requirements, thereby helping to protect investors from unnecessary risks under the pilot program.” ^[120] No commenter opposed these firm-level ineligibility criteria.

FINRA reasonably determined to exclude a member firm from participation in the Pilot if the member firm is subject to any of the six proposed firm-level ineligibility criteria. Each of these criteria identifies—and excludes—member firms with characteristics that may indicate increased risk of non-compliance. Specifically, Restricted ( printed page 82472) Firms have a history of misconduct or a high concentration of registered persons with a significant history of misconduct that gave rise to the designation,^[121] while Taping Firms are subject to heightened regulatory oversight because they employ a “significant number of registered persons [who] previously worked for firms that have been expelled from the industry or have had their registrations revoked for inappropriate sales practices.” ^[122] Moreover, if the Commission or FINRA has found that a member firm has violated FINRA Rule 3110(c) within the past three years, the member firm has demonstrated a recent difficulty implementing a compliant inspection program.^[123] Member firms covered by these exclusions therefore have a history of non-compliance or have registered representatives who have a history of (or come from a member firm with a history of) non-compliance. It is therefore reasonable for FINRA to determine that member firms that fall into these categories are not eligible for participation in the Pilot and the flexibility that it provides in designing their supervisor systems.

Furthermore, Rule 9557 notices are sent to member firms that are experiencing financial or operational difficulties.^[124] Additionally, suspension of a member firm by FINRA would be based on FINRA's determination that the member firm has failed to comply with its regulatory requirements or suspension is needed for the safety of investors, creditors, or other members because of the member firm's financial or operational difficulties.^[125] Such member firms raise concerns about their ability to comply with their obligations and may present risk to others. As such, it is reasonable to conclude that these member firms should not be eligible for the proposed rule change that is designed to afford member firms greater flexibility in designing their supervisory systems.

Moreover, member firms that have been FINRA members for less than 12 months may need additional time to develop their supervisory and compliance systems to effectively comply with applicable securities laws and rules.^[126] This time period also provides FINRA and other regulators with time to conduct inspections of new member firms to determine their compliance with their regulatory obligations before they may be eligible for the flexibility provided in the proposed rule.^[127] It is therefore reasonable for FINRA to determine that firms must be operating for a certain amount of time before they can be eligible for participation in the Pilot. One year provides a reasonable balance between providing member firms with the flexibility for supervision allowed in the proposed rule and concerns that member firms need to develop experience operating before they are given such flexibility. In sum, these proposed ineligibility criteria limit Pilot participation to certain member firms without indicia that their business operations, supervisory system, or inspection programs may lack the maturity or safeguards to fully address the potential risks associated with remote inspections are reasonable.^[128]

2. Member Firm Conditions for Eligibility To Participate in the Pilot

a. Firm Recordkeeping System

As stated above, proposed Rule 3110.18(f)(2)(A) would require a participating member firm to meet certain requirements regarding its recordkeeping system, including that it have a recordkeeping system and that the participating member firm have prompt access to the records required by that system and that those records are not physically or electronically maintained at remotely inspected locations.^[129] One commenter expressed support for this provision, stating that it is responsive to concerns about a participating member firm's access to and control over records and “will better enable firms to supervise their associated persons.” ^[130] No commenter objected to this provision of the proposed rule change.

The proposed rule change's recordkeeping conditions are reasonable. A key component of remote—as opposed to on-site—inspection is prompt access to the records of the remotely inspected location from an alternative location. Because the proposed rule change couples this prompt-access requirement with a prohibition of the storage of a remotely inspected location's records at the location itself, the member firm need not conduct an on-site visit to gather and review records during an inspection. The proposed rule change therefore should facilitate timely and effective remote inspection of locations participating in the Pilot and decrease, though not always eliminate, the need for on-site inspections. For these reasons, the proposed condition is reasonable.

b. Surveillance and Technology Tools

As noted above, proposed Rule 3110.18(f)(2)(B) would require that each participating member firm determine that its surveillance and technology tools are appropriate to supervise the types of risks presented by each remotely inspected location. These tools may include, but are not limited to, firm-wide electronic tools, tools specifically applied to a location, and system security tools.^[131] FINRA stated ( printed page 82473) that it believes that the absence of “adequate surveillance and technology tools would raise questions about the reasonableness of remote inspections” and therefore proposed the non-exhaustive list to help set regulatory expectations for remote inspections.^[132]

One commenter opposed the principle-based nature of the proposed condition by stating that the listed technology and surveillance tools should be “mandatory, rather than permissive.” ^[133] This commenter stated that the listed technologies are “critical,” should be “standard features of all risk assessments and remote inspections,” and are the “bare minimum necessary for a firm to participate safely.” ^[134] In particular, this commenter pointed to videoconferencing and related technology as “crucial to a rigorous inspection.” ^[135] Similarly, another commenter who opposed the Pilot expressed skepticism in particular about FINRA's reliance on the increased use of technology to support approval of the proposed rule change, stating that remote inspections would leave “considerable opportunity for advisors to skirt the rules.” ^[136]

In response, FINRA stated that, while the proposed condition would require that a member firm must determine that its surveillance and technology tools are appropriate, it believes that flexibility among the use of specific tools that may be used for remote inspections is appropriate because these tools may vary among member firms depending upon their business activities, size, and structure.^[137] FINRA also stated that the proposed list of surveillance and technology tools is non-exhaustive in order to account for ongoing advances in technologies.^[138] For these reasons, FINRA declined to modify the proposed rule change. However, while FINRA did not mandate video conferencing technology or portable cameras, as suggested, it did include “visual inspection tools” as a general description of this technology in its non-exhaustive list of tools.^[139]

FINRA further noted that the proposed rule change would separately require a participating member firm to adopt reasonably designed written supervisory procedures that must include, among other things, a description of the methodology, including the technology, that a participating member firm may use to conduct remote inspections.^[140]

Given variances in firm size, business models, and risk, and the rapid development and use of technology among member firms, FINRA reasonably determined to provide flexibility to each participating member firm to determine that its surveillance and technology tools are appropriate to supervise the types of risks presented by each remotely inspected location. Requiring a member firm to determine that its existing surveillance and technology tools are appropriate to supervise the types of risks presented by each remotely inspected location before participating in the Pilot is reasonable and should help ensure that participating member firms employ appropriate tools to manage the potential risks posed by the remote inspection of eligible locations. The Commission acknowledges the commenter's request to require that participating member firms use the technology tools identified by FINRA to perform remote inspections. Indeed, a number of commenters indicated that they already rely extensively on technology to supervise their associated persons, and FINRA relied broadly on technological developments in the securities industry in support of this proposal.^[141]

However, while the proposed rule change takes a principle-based approach rather than mandating specific surveillance tools, it does set expectations for the supervision of locations participating in the Pilot. First, a participating member firm must determine that its surveillance and technology tools are appropriate, starting by taking stock of the methodology, including the technology, that the participating member firm may use to conduct remote inspections and incorporating it into its written supervisory procedures. Second, FINRA identifies surveillance and technology tools that a participating member firm may consider, including firm-wide electronic tools, tools specifically applied to a location, and system security tools, which will help clarify FINRA's expectations and assist participating member firms with operationalizing the rules. These requirements, combined with other safeguards and limitations, along with a participating member firm's overarching obligation under FINRA Rule 3110(a) to maintain an effective supervisory system, serve a crucial gatekeeping role for member firms to participate in the Pilot. Furthermore, even a participating member firm with state-of-the art tools may ultimately determine that an unannounced on-site inspection, or more frequent inspections, are appropriate to discharge its obligation to reasonably supervise that location.^[142] For the reasons set forth above, the proposed condition is reasonable.

B. Location-Level Requirements

1. Location-Level Ineligibility Criteria

As noted above, proposed Rule 3110.18(g)(1) would prohibit remote inspections for any location subject to any of seven location-level ineligibility criteria. Six of these seven location-level ineligibility criteria address locations with associated persons who: (1) are subject to a mandatory heightened supervisory plan; (2) are statutorily disqualified; (3) have caused the participating member firm to undergo a continuing membership review pursuant to FINRA Rule 1017(a)(7); (4) are required to make disclosures about certain criminal and regulatory actions; (5) are subject to certain disciplinary actions taken by the participating member firm; or, (6) are engaged in proprietary trading. The seventh criteria ( printed page 82474) would make locations that handle customer funds or securities ineligible for the Pilot.^[143] FINRA stated that these seven location-level ineligibility criteria are “events or activities of an associated person of the member firm that . . . [are] more likely to raise investor protection concerns based on the individual's record of specified regulatory or disciplinary events.” ^[144] FINRA stated that it believes that “these objective categorical restrictions will provide safeguards that will help ensure that firms maintain effective supervisory procedures during the pilot period.” ^[145]

Two commenters offered general support for these exclusions.^[146] As discussed in more detail below, one commenter recommended that FINRA expand the exclusion for locations with associated persons that are required to make disclosures about certain criminal and regulatory actions set forth in proposed Rule 3110.18(g)(1)(D),^[147] and another asked FINRA to clarify the exclusions for locations that engage in proprietary trading or handle customer funds or securities as set forth in proposed Rules 3110.18(g)(1)(F) and (G).^[148] No commenter offered specific support for, or opposition to, any of the remaining ineligibility criteria.

a. Criminal Convictions and Adjudicated Regulatory Actions

Proposed Rule 3110.18(g)(1)(D) would exclude a location from the Pilot where one or more associated persons at such location is required to disclose certain criminal convictions or regulatory actions on Form U4.^[149] One commenter recommended that FINRA expand this ineligibility criterion to include locations with associated persons who: have a “substantial number” of customer complaints; are subject to pending regulatory investigations; have been terminated for cause; or have “significant” judgments or liens.^[150] The commenter stated that such associated persons are “problematic” and thus the locations at which they work should be subject to on-site inspections, which offer greater scrutiny.^[151]

In response, FINRA declined to expand the location-level ineligibility criteria, stating that, as currently proposed, the ineligibility criteria are based on clear, objective factors.^[152] Nonetheless, FINRA agreed with the commenter that the presence of such disclosures would be factors a participating member firm should consider as part of its required risk assessment.^[153] FINRA concluded that the risk assessment, along with other provisions of the proposed rule change, such as the requirement that a participating member firm establish, maintain, and enforce written supervisory procedures for remote inspections, would provide the appropriate safeguards related to whether a particular location should be eligible to undergo a remote inspection.^[154]

An individual with certain regulatory or criminal-action disclosures on Form U4 has a history of criminal conviction(s) or regulatory finding(s) that may indicate an increased risk of non-compliance. Because of the heightened risks associated with such registered persons, it is reasonable for the proposed rule change to exclude locations from the Pilot where one or more associated persons at such location is required to disclose certain criminal convictions or regulatory actions on Form U4. The Commission also recognizes, however, that there may be other indicators of heightened risk.

Customer complaints, investigations, terminations, and judgments or liens may, in certain circumstances, indicate heightened levels of risk. However, they are not formal investigations or proceedings initiated by a regulator charged with enforcing securities laws, regulations, and rules. For example, they may be overly broad in scope or lack the factual development of a comparable regulatory action. Because assessing the risk associated with customer complaints, investigations, terminations, and judgments or liens may require investigation and a consideration of the totality of the circumstances, FINRA reasonably determined that—in lieu of creating a blanket exclusion for such locations—these factors could be considered in the mandatory risk assessment of each location to determine whether a remote inspection is appropriate. Specifically, it is reasonable for participating member firms to gauge the level of risk of a location by, among other things, requiring participating member firms to: (1) consider the “volume and nature of customer complaints” in the mandatory risk assessment prior to inspecting a location remotely; and (2) take into consideration any red flags when determining whether to conduct a remote inspection of a location. For these reasons, the proposed ineligibility criteria are reasonable.

b. Proprietary Trading and Handling Customer Funds or Securities

As stated above, locations that engage in proprietary trading or handle customer funds or securities would be excluded from the Pilot.^[155] One supportive commenter requested that FINRA provide a clearer definition of the types of trading activities that would trigger these exclusions, fearing that certain common activities could be interpreted in a way that would result in eliminating a significant number of branches from eligibility for remote inspections.^[156]

In response, FINRA stated that these two ineligibility criteria are based on “significant activities potentially impacting the operations and financial stability of the firm and, as a result, may also significantly impact customers and the markets generally.” ^[157] In reference to the proprietary trading exclusion, FINRA stated that providing an exhaustive list of the types of trading activities that would trigger this exclusion “is not practicable” because the analysis is fact-specific, but would consider providing additional guidance, ( printed page 82475) as appropriate.^[158] With regard to the handling of customer funds and securities, FINRA stated that in addition to having the potential for significant impact on customers, this ineligibility criteria is derived from one of several existing conditions that a member firm must satisfy in order to deem a primary residence as a non-branch location.^[159]

Proprietary trading activities can rapidly and adversely impact the operational and financial stability of a member firm, and the resulting instability can pose a significant risk of harm to the member firm's customers. In light of this risk, FINRA reasonably determined that a location conducting propriety trading should remain subject to on-site inspection and not be permitted to participate in a temporary pilot program designed to evaluate the prudence of a permanent remote-inspection program. For this reason, the proposed exclusion is reasonable.^[160]

Similarly, a member firm handling its customers' funds or securities increases, among other things, the risk of loss of those customers' assets. In light of that risk, FINRA reasonably determined that a location handling customer funds or securities should remain subject to on-site inspection and not be permitted to participate in a temporary pilot program designed to evaluate the prudence of a permanent remote-inspection program. For this reason, the proposed exclusion is reasonable.

c. Other Location-Level Ineligibility Criteria

The proposed rule change would also prohibit remote inspections for any location with an associated person who: (1) is subject to a mandatory heightened supervisory plan under the rules of the Commission, FINRA, or a state regulatory agency; (2) is statutorily disqualified, unless such disqualified person (A) has been approved (or is otherwise permitted pursuant to FINRA rules and the federal securities laws) to associate with a member firm and (B) is not subject to a mandatory heightened supervisory plan under item (1), above, or otherwise as a condition to approval or permission for such association; (3) causes the member firm to undergo a continuing membership review pursuant to FINRA Rule 1017(a)(7); or, (4) is subject to certain disciplinary actions by the participating member firm.^[161] FINRA stated that these location ineligibility criteria are necessary to address the indicia of increased risk posed by some locations and represent appropriate controls and conditions regarding participation in the Pilot.^[162] No commenter offered specific support for, or opposition to, any of these exclusions.

FINRA reasonably determined to exclude each of these locations from the Pilot given the increased risk each category of person could pose. First, if a regulator has imposed a heightened supervisory plan on a specific associated person, the regulator has determined that they require additional supervision to help ensure their compliance with securities laws, regulations, and rules. Second, an individual subject to a statutory disqualification has engaged in violative conduct that may indicate an increased risk of non-compliance.^[163] Third, an individual who has triggered a continuing membership review pursuant to FINRA Rule 1017(a)(7) is seeking to become an owner, control person, principal, or registered person of the member firm and has, in the previous five years, one or more “final criminal matters” or two or more “specified risk events.” ^[164] Fourth, an individual who is subject to a reportable disciplinary action initiated by a member firm has necessarily engaged in misconduct that warranted the member firm's imposition of significant discipline.^[165] Because each of these proposed exclusions identifies a category of person who has a history of law violations, misconduct, or non-compliance with laws and rules designed to protect investors, the proposed rule change reasonably requires an on-site inspection for each location from which such associated persons operate, rather than allowing those locations to be inspected remotely. Therefore, FINRA reasonably determined to exclude such locations from eligibility in the Pilot.

2. Location-Level Conditions

a. Location-Level Recordkeeping System

The proposed rule change would require a participating location to make all electronic communications through the participating member firm's electronic system, subject all communications with the public to the firm's supervision, and preclude books and records from being physically or electronically maintained and preserved at the location.^[166] FINRA stated that it believes this provision “appropriately conveys a reasonable set of conditions related to communications of associated persons and the creation and preservation of books and records at a specific office or location.” ^[167] No commenter expressly supported or objected to these proposed changes.

The proposed rule change's location-level recordkeeping conditions are ( printed page 82476) reasonable. As discussed above, a key component of remote—as opposed to on-site—inspection is prompt access to the records of the remotely inspected location from an alternative location. The proposed location-level recordkeeping conditions strengthen this component of the Pilot. Prompt access should help provide the participating member firm with the necessary insight into the location's operations, both at the outset and on an ongoing basis. Mandating the use of the participating member firm's electronic system for the location's electronic communications and requiring the firm to supervise the location's correspondence and communications help to ensure that the participating location's activities lend themselves to remote inspection. Because the proposed conditions prohibit the storage of a participating location's records at the location itself, the participating member firm need not conduct an on-site visit to gather and review records during an inspection. The proposed rule change therefore should facilitate timely and effective remote inspection of locations participating in the Pilot and decrease, though not always eliminate, the need for on-site inspections.

C. Risk Assessment

The proposed rule change would require a participating member firm to conduct and document a risk assessment for each location prior to choosing to conduct a remote inspection for that location.^[168] The risk assessment would require that a participating member firm take into account any higher risk activities at, or higher risk associated persons assigned to, that location, as well as mandate consideration of a non-exhaustive list of factors, including: (1) the volume and nature of customer complaints; (2) the volume and nature of outside business activities, particularly investment-related; (3) the volume and complexity of products offered; (4) the nature of the customer base, including vulnerable adult investors; (5) whether associated persons are subject to heightened supervision; (6) failures by associated persons to comply with the participating member firm's written supervisory procedures; and (7) any recordkeeping violations.^[169] According to FINRA, the inclusion of this non-exhaustive list would help ensure that participating member firms consider certain high risk criteria when determining whether to conduct a remote inspection.^[170] FINRA further stated that it “expects that higher risk factors at a particular location would cause a firm to conduct on-site inspections of such location.” ^[171]

Five commenters generally supported the proposed risk assessment.^[172] Three of these commenters stated that the requirement to conduct risk assessments for each location would promote investor protection.^[173] A fourth commenter stated that the use of a risk assessment would enable a participating member firm to dedicate more resources to specialized inspections targeting higher risk areas.^[174] The fifth commenter expressed general support for the provision.^[175]

Two of the five supporting commenters also suggested modifications to the proposed rule change.^[176] One commenter expressed concern that FINRA would use the benefit of hindsight to evaluate a participating member firm's determination to conduct a remote inspection where one of the listed risk factors is present.^[177] In response, FINRA disagreed, emphasizing that “the `reasonably designed' standard requires that the supervisory system, of which an inspection program is a part, `be a product of sound thinking and within the bounds of common sense, taking into consideration the factors that are unique to a member's business[.]' ” ^[178] FINRA also noted that the presence of one particular enumerated factor or others may not be dispositive as to whether an on-site or remote inspection of a location is appropriate, and such factors should be reviewed in their totality under the facts and circumstances.^[179]

The second commenter sought additional conditions to the risk assessment. First, this commenter stated that a participating member firm should be required to conduct and document a risk assessment after identifying red flags and fully consider any significant change in circumstances that may warrant higher scrutiny.^[180] In the alternative, this commenter stated that FINRA should revise proposed Rule 3110.18(b)(1) to require a risk assessment for each location before “each” remote inspection of that location. The commenter explained its concern that participating member firms may ignore red flags and rely on a previous risk assessment to continue inspecting a location remotely because the rule would require that a risk assessment be conducted “prior to electing a remote inspection.” ^[181]

Second, this commenter stated that a participating member firm should be required to provide FINRA with documentation of all risk assessments conducted after identifying red flags during the Pilot. The commenter reasoned that it would “maintain accountability” to require a participating member firm to articulate a sound basis for its decisions upon identifying red flags.^[182] Moreover, this commenter stated that the data would aid FINRA's and the Commission's understanding of risk assessment practices and consider the merits of any potential policy changes around remote inspections.^[183]

To address this concern, FINRA amended the proposed rule change to expressly require that, consistent with FINRA Rule 3110(a), a participating member firm “take into consideration any red flags when determining whether to conduct a remote inspection of an office or location.” ^[184] FINRA stated, “[w]here there are indications of problems or red flags at any office or location, FINRA expects members to investigate them as they would for any other office or location subject to FINRA Rule 3110(c), which may include an unannounced, on-site inspection of the office or location.” ^[185] FINRA also noted that red flags “would be required to be considered not only when an office or location is first determined to be ( printed page 82477) appropriate for a remote inspection but, consistent with Rule 3110(a)'s overall obligation for a firm to establish and maintain a reasonably designed supervisory system, as part of a firm's ongoing determination to conduct subsequent inspections of the office or location remotely.” ^[186] One commenter expressed support for this amendment, stating that it “strengthen[ed] the Pilot's safeguards.” ^[187]

FINRA declined to amend the proposed rule change to require participating member firms provide FINRA the risk assessments conducted after identifying red flags. FINRA stated that the Pilot already requires submission of comprehensive data and information to FINRA that is sufficient for FINRA to conduct its assessment.^[188] FINRA also noted that it could obtain such assessments during a FINRA examination, which should provide sufficient accountability.^[189]

As stated above, the proposed rule change's ineligibility criteria, safeguards, and limitations prohibit member firms and locations from participating in the Pilot in certain higher-risk circumstances. However, other factors not explicitly identified among the exclusions can, in certain circumstances, indicate heightened levels of risk either before or after determining whether a remote inspection is appropriate. The risk assessment required by the proposed rule change will help to mitigate residual risk not addressed by the ineligibility criteria and the affirmative conditions imposed to participate in the Pilot. Specifically, the proposed rule change would require a participating member firm to consider certain indicia of risk for each candidate location for remote inspection, including the volume and nature of customer complaints; the volume and nature of outside business activities, particularly investment-related; the volume and complexity of products offered; the nature of the customer base, including vulnerable adult investors; whether associated persons are subject to heightened supervision; failures by associated persons to comply with the member's written supervisory procedures; and any recordkeeping violations. In addition, the proposed rule change would mandate that a participating member firm consider higher-risk activities, higher-risk persons, and red flags occurring at any location when determining whether a remote inspection is or continues to be appropriate. Furthermore, the proposed rule change emphasizes consideration of red flags as part of a participating member firm's ongoing determination of whether to remotely inspect a location. In this way, the proposed rule change helps to ensure that a participating member firm appropriately accounts for the full range of risks associated with each location throughout the term of the Pilot. For these reasons, the proposed rule change is reasonable.

The commenter requested that participating member firms submit documentation of risk assessments following the identification of red flags, but FINRA reasonably determined not to require such documentation, given that it would be required to be maintained by the participating member firms and be made available to FINRA and the Commission during an examination. In addition, the proposed rule change already contains provisions requiring quarterly submission of data and information to FINRA, including submission of “significant findings,” which should help FINRA to study trends and promptly identify any regulatory oversight concerns, as well as provide FINRA with periodic data to evaluate a participating member firm's continued participation in the Pilot. For these reasons, the proposed risk assessment provision is reasonable.

D. Written Supervisory Procedures

The proposed rule change would require that a participating member firm “establish, maintain, and enforce” certain written supervisory procedures for conducting remote inspections.^[190] Reasonably designed written supervisory procedures for conducting remote inspections would be required to address, among other things: (1) the methodology, including technology, that may be used to conduct remote inspections; (2) the factors considered in the risk assessment made for each applicable location pursuant to the risk assessment provision of the Pilot; (3) the procedures specified elsewhere in the Pilot regarding escalating significant findings, new hires, supervising brokers with a significant history of misconduct, OBA and DBA designations, and data and information collection and transmission; and (4) the use of other risk-based systems employed generally by the participating member firm to identify and prioritize for review those areas that pose the greatest risk of potential violations of applicable securities laws and regulations, and of applicable FINRA rules.^[191] FINRA stated that it “expects firms to take into account the factors affecting their systems and businesses in crafting reasonably designed policies and procedures” to comply with the Pilot.^[192]

One commenter recommended that the proposed rule change also require each participating member firm's written supervisory procedures to include four additional factors: (1) the specific technologies that the participating member firm would use for remote inspections and evidence that the participating member firm and its supervisory personnel have sufficient access to and proficiency with those technologies; (2) the circumstances in which the participating member firm will conduct physical inspections, both in the ordinary course and as a result of red flags; (3) whether and how the participating member firm intends to conduct unannounced inspections; and (4) how the participating member firm will use its remote inspection procedures to control for the possibility of active deception such as concealment, removal, or destruction of evidence of misconduct.^[193]

In response, FINRA stated that the proposed written supervisory procedures provision reflects a balanced approach between dictating the content of a participating member firm's written supervisory procedures for remote inspections and maintaining flexibility in alignment with FINRA Rule 3110's principle-based view of what constitutes reasonably designed written supervisory procedures.^[194] Nevertheless, FINRA also stated that many of this commenter's recommendations are already addressed by specific terms in its rules and in the proposed rule change. For example, proposed Rule 3110.18(c) would require a participating member firm's reasonably designed supervisory procedures to address the technology tools that may be used to conduct ( printed page 82478) remote inspections. FINRA stated that it believes that the failure to have adequate surveillance and technology tools, and the knowledge of and access to them, would raise questions about the reasonableness of remote inspection.^[195] Proposed Rule 3110.18(b)(2) also would require, among other things, participating member firms to conduct on-site inspections or more frequent unannounced, on-site inspections of a location where there are indicators of irregularities or misconduct; ^[196] and proposed Rule 3110.18(c) would require participating member firms to “establish, maintain, and enforce written supervisory procedures regarding remote inspections that are reasonably designed to detect and prevent violations of and achieve compliance with applicable securities and regulations, and with FINRA rules.” ^[197] In addition, FINRA stated that, overall, FINRA Rule 3110 established a framework that requires a firm to have a reasonably designed supervisory system, including written supervisory procedures, to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules. As such, FINRA declined to amend the proposed rule change to explicitly include the commenter's suggested prescriptive elements.^[198]

Requiring participating member firms to establish, maintain, and enforce written supervisory procedures for conducting remote instructions is reasonable and should help such member firms detect and prevent violations of and achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules. In particular, requiring those procedures to address technology, risk assessment factors, data and information collection and transmission, and other risk-based systems to identify and prioritize for review areas that pose the greatest risk should reasonably address aspects of remote inspections that may raise a threat of heightened risk of compliance failures. While the proposed rule change prescribes several items that would be required to be addressed, participating member firms are not limited to these items alone and have flexibility to tailor their procedures to their business activities and other relevant factors to meet the obligation under FINRA Rule 3110 that the procedures be “reasonably designed to detect and prevent violations of and achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules.” ^[199] In addition, the proposed rule change makes clear that the requirement to conduct inspections of locations is only one part of the member firms' overall obligation to have an effective supervisory system.^[200] For these reasons, the proposed written supervisory provisions are reasonable.

E. Effective Supervisory System

As stated above, the proposed rule change would hold a remote inspection of a location to the same standards applicable to on-site inspections.^[201] Specifically, the proposed rule change would reiterate that the requirement to conduct inspections of locations is one part of the member firm's overall obligation to have an effective supervisory system and therefore a participating member firm would be required to maintain its ongoing review of the activities and functions occurring at all locations, whether or not the member firm conducts inspections remotely.^[202] In addition, where a participating member firm's remote inspection of a location identifies any red flags, the proposed rule states that the participating member firm may need to impose additional supervisory procedures for that location or may need to provide for more frequent monitoring of that location, including potentially a subsequent on-site visit on an announced or unannounced basis.^[203] No commenter offered specific support for, or opposition to, this proposed provision.

The proposed rule change is reasonable and will serve as an appropriate reminder to participating member firms that any location subject to a remote inspection is still subject to the same standard for review as that of an on-site inspection. As such, there should be no diminution in on-going supervision, regardless of the method a participating member firm uses to inspect its locations. The proposed rule change should also help ensure that participating member firms are aware that even if a location is eligible for a remote inspection at one point in time, a participating member firm may need to take additional steps ( e.g., an on-site visit on an announced or unannounced basis) should it become aware of any red flags associated with that location.^[204] For these reasons, the proposed rule change is reasonable.

F. Documentation Requirement

As stated above, the proposed rule change would require that a participating member firm maintain and preserve a centralized record for each year of the Pilot that identifies: (1) all locations that were inspected remotely; and (2) any locations for which the participating member firm determined to impose additional supervisory procedures or more frequent monitoring.^[205] FINRA stated that requiring the retention of such written reports would act as an important safeguard for the Pilot.^[206] No commenter expressly supported or objected to these proposed changes.

Documenting locations that were inspected remotely, as well as locations where additional supervisory procedures or more frequent monitoring were imposed, is reasonable and should provide regulators with relevant information when conducting their examination and risk monitoring responsibilities. Specifically, this information should help regulators assess the reasonableness of a participating member firm's use of remote inspection as one component of a reasonably designed supervisory system. For these reasons, the proposed documentation requirement is reasonable.

G. Data Collection

1. Quarterly Data and Information

As stated above, the proposed rule change would require participating member firms to collect and submit ( printed page 82479) certain data and information to FINRA on a quarterly basis. Specifically, it would cover information about the number and nature of inspections completed during the quarter, and a list of the significant findings, among other things.^[207] The proposed rule change also would require that a participating member firm establish, maintain, and enforce written policies and procedures that are reasonably designed to comply with the data and information collection, and transmission requirements of the Pilot.^[208] FINRA stated that it believes that “formalized, uniform collection of data is critical” for it to meaningfully assess the effectiveness of remote inspections and shape potential permanent amendments to FINRA Rule 3110(c).^[209]

Several commenters agreed that the data and information requirements would benefit the Pilot by providing FINRA the information it needs to make informed decisions about potential future rule changes regarding remote inspections.^[210] Two commenters suggested modifications to the proposed rule change, stating that requiring quarterly reporting was too onerous.^[211] In particular, one of these commenters stated that quarterly reporting “creates an outsized burden on smaller, middle-market, and regional firms” due to the detailed data and information required.^[212] The other commenter described the expected burden on larger firms and requested FINRA change the reporting frequency to twice a year.^[213]

In response, FINRA declined to amend the required frequency of data and information reporting.^[214] FINRA stated that it “believes that the cadence and amount of comprehensive data are appropriate and necessary for FINRA to effectively study trends and firms' experiences with their remote inspection programs in a timely manner.” ^[215] However, FINRA also stated that it is exploring ways for participating member firms to provide the data and information to FINRA in a more efficient and timely manner.^[216]

One commenter recommended that FINRA amend the proposed rule change to require participating member firms provide “all findings” made during remote inspections or, at a minimum, “all significant findings” as opposed to “most significant findings.” ^[217] The commenter reasoned that allowing subjectivity and discretion in data reporting would undermine the uniformity of the data and hinder FINRA's ability to assess trends and developments.^[218] The commenter maintained that “all findings” would therefore be appropriate because any finding significant enough to be documented in an inspection report should be reported.^[219]

In response, FINRA amended the proposed rule change to require participating member firms to report “significant findings” rather than “most significant findings.” ^[220] FINRA, however, declined to require participating member firms to report “all findings” because it would yield overly broad data, making it “challenging to discern key trends in a meaningful way.” ^[221] FINRA stated that providing participating member firms “the agency to assess what constitutes their significant findings” would enhance FINRA's ability to review a discrete set of data that would focus on key areas of concern, which would help it assess the effectiveness of remote inspections.^[222]

The same commenter acknowledged FINRA's amendment and requested that FINRA define the term “significant findings” with more precision to avoid varying subjective judgments that might skew the data used to evaluate the effectiveness of the Pilot.^[223] In response, FINRA stated that it provided several clarifying examples of findings that may prompt escalation or further internal review, including the use of unapproved communication mediums, customer complaints, or undisclosed outside business activities or private securities transactions.” ^[224] FINRA further explained that it decided to include flexibility in the definition of “significant findings” because a finding that is significant for one participating member firm “may differ from another participant due to their respective attributes ( e.g., size, business model, organizational structure) and tailored supervisory system.” ^[225] Moreover, findings that may suggest a pattern could be deemed “significant” for purposes of the proposed Pilot.^[226] As a result, FINRA stated that it believes that participating member firms “should have the ability to exercise their reasonable judgment of what findings are significant based on the relevant facts and circumstances.” ^[227] FINRA stated it believes that this proposed approach is consistent with the principle-based framework of Rule 3110.^[228] In addition, while the commenter suggested that FINRA take a more prescriptive approach, FINRA reiterated its belief that the proposed rule change's definition of “significant findings” would provide a balanced approach to obtain meaningful data and information to appropriately assess the ( printed page 82480) effectiveness of a participating member firm's inspection program.^[229]

Quarterly reporting of Pilot data should allow FINRA to review and assess data about participating member firms' inspection programs in a timely manner. While a quarterly reporting obligation is more burdensome than a less frequent one, participation in the Pilot is voluntary, and a quarterly schedule should help FINRA to study trends in the data and information and more promptly identify any regulatory oversight concerns than with a less frequent reporting interval. A more frequent reporting cycle would also provide FINRA with more up-to-date data to evaluate a participating member firm's continued participation in the Pilot.

A commenter expressed concerns about the potential subjectivity of the data and information that would be collected during the Pilot if parties were required to report only “significant findings.” However, FINRA has made a reasonable distinction between the quantity and the quality of the data it would seek from participating member firms during the Pilot, and narrowing the focus to study significant areas of concern should help serve the Pilot's purpose to assess the effectiveness of remote inspections. Also, to help alleviate concerns around subjectivity, FINRA defined “significant finding” in the proposed rule change and provided examples to further clarify its meaning, which will help standardize reporting of data by participating member firms.^[230] The proposed principle-based approach to this aspect of data reporting should allow firms flexibility to determine what types of findings need to be reported based on their unique business models. Further, as FINRA stated, whether a finding is significant may change depending on the relevant facts and circumstances. Moreover, findings that may suggest a pattern could be deemed “significant” for purposes of the proposed Pilot even where they might not be considered significant individually. Thus, having reasonable flexibility is beneficial. Accordingly, FINRA's principle-based approach to interpreting the term “significant finding” is reasonable. For these reasons, the Commission finds the proposed data and information collection provision is reasonable.

2. Additional Data and Information if the First Year of the Pilot is Less Than a Full Year

As stated above, if Pilot Year 1 covers less than a full calendar year, the proposed rule change would require a participating member firm to provide additional data and information to cover the period of time between January 1 and the day prior to the effective date of the Pilot.^[231] FINRA stated that this would enable it to capture, in the aggregate, complete inspection counts (including remote and on-site) for the entire calendar year in addition to the quarterly data it would receive during the Pilot.^[232] Aside from general comments in support of the Pilot's data and information requirements discussed above, no commenter offered specific support for, or opposition to, this provision.

The proposed rule change should provide FINRA with a fuller picture of the nature, amount, and outcomes of the inspections conducted by participating member firms and allow FINRA to aggregate the data and information provided with the quarterly data received during the Pilot to obtain a full picture of inspections completed for the entire calendar year. More specifically, the requirement to provide this additional data and information to FINRA should help address the potential gap of time that would result in FINRA lacking complete data if the first year of the Pilot is less than a full calendar year. The data and information should also provide FINRA with useful information regarding those remote inspections conducted under the temporary relief of FINRA Rule 3110.17 if those inspections are completed between January 1 and the day before the effective date of the Pilot. Therefore, the proposed data and information collection should improve FINRA's ability to assess the effectiveness of the Pilot during its pendency. For these reasons, the proposed data and information collection provision is reasonable.

3. Additional Data and Information for Calendar Year 2019

As originally proposed, the proposed rule change would have required that a participating member firm collect and provide to FINRA data about inspections completed in 2019.^[233]

One commenter expressed support for the collection of 2019 data, stating that it would “significantly enhance” FINRA's ability to more broadly judge the efficacy of remote supervisions.^[234] Two other commenters similarly acknowledged the value in obtaining this data and information from participating member firms, but raised concerns that some member firms may no longer maintain inspection reports from 2019 since inspection reports are generally only required to be maintained for a period of three years.^[235] These two commenters stated that a member firm should not be excluded from participation in the Pilot if it is unable to provide the 2019 data to FINRA, despite having complied with the applicable record retention requirement. Instead, they recommended that FINRA amend the proposed rule change to require participating member firms to collect and provide to FINRA the 2019 data “if available in the firm's records” and to require member firms to make a “best efforts” attempt to collect it.^[236]

In response, FINRA amended the proposed rule change to require ( printed page 82481) participating member firms to “act in good faith using best efforts” to collect and provide the 2019 data to FINRA (“good faith exception”).^[237] As such, FINRA stated that if a participating member firm is unable to provide these data, the member firm would not necessarily be precluded from participating in the Pilot. FINRA acknowledged that not all member firms will have maintained the 2019 data, but strongly encouraged firms that plan to participate in the Pilot to retain their 2019 data, as it would enhance the value of the Pilot for any future rulemaking regarding remote inspections.^[238]

One commenter opposed this amendment to the proposed rule change, stating that it was insufficient. This commenter recommended that FINRA further amend the proposed rule change to require any member firm seeking to avail itself of this exception to “document the precise steps in support of [its] `best efforts in good faith' ” to recover its 2019 data.^[239]

In response, FINRA stated that because the concepts of “good faith” and “best efforts” are commonly understood legal standards, there is no need to require a participating member firm to document the steps it took to recover its 2019 data.^[240] Furthermore, FINRA stated that while some participating member firms may keep their inspection reports beyond the minimum rule-based retention period, they are not required to do so.^[241] Thus, FINRA declined to amend the proposed rule change.^[242]

The proposed rule change is reasonable and should help ensure that FINRA has the data and information it needs to best meet a key objective for the Pilot—to determine the effectiveness of the Pilot. Since 2019 is the last full calendar year that member firms were required to include an on-site visit in their inspections, the 2019 data should represent a baseline of data about on-site inspections against which FINRA could measure changes due to using remote inspections. Specifically, the proposed rule change would enable FINRA to compare the 2019 data with the quarterly data that would be collected during the Pilot to identify and assess any differences. Some participating member firms may not have maintained 2019 inspection reports beyond the time period required by FINRA Rule 3110(c)(2) and such member firms should not be excluded from participating in the Pilot for that reason. As such, FINRA reasonably determined that such member firms may continue to participate if they act in good faith using best efforts to provide the data and information in order to maintain a level of accountability and mitigate concerns that a participating member firm would purposely withhold this information.

H. Other Safeguards and Limitations Provisions

1. Length of Pilot

As stated above, under the proposed rule change the Pilot would expire three years after its effective date. FINRA stated that it believes the Pilot would provide FINRA the appropriate amount of time and population sample to better evaluate the use of remote inspections in the current hybrid work environment.^[243] No commenter expressly supported or objected to these proposed changes.

The proposed length of the Pilot should suffice to allow FINRA to evaluate the efficacy of the Pilot, and to consider any adjustments as necessary. For these reasons, the scope of the Pilot provision is reasonable.

2. Method of Pilot Participation

As stated above, the proposed rule change would set forth the process for opting in and out of the Pilot.^[244] FINRA stated that it believes the proposed process would lend continuity to the data and information collected during the Pilot.^[245] No commenter expressly supported or objected to these proposed changes.

The proposed process for opting in and out of the Pilot is reasonable and should help FINRA obtain consistent data and information from participating member firms, helping it assess the Pilot's effectiveness. Specifically, setting minimum commitments for participation and requiring a set time period for opting out should help ensure that FINRA will receive a full set of data from any participating member firm for any given Pilot Year. In addition, such commitments should help safeguard against a participating member firm trying to exit the Pilot in order to avoid submitting problematic data or complying with other conditions in the Pilot. For these reasons, the Pilot participation provision is reasonable.

3. Failure To Satisfy Conditions and Determination of Ineligibility

As stated above, the proposed rule change would deem a participating member firm that failed to satisfy the safeguards and limitations of the Pilot, including the requirement to timely collect and submit data, ineligible to participate in the Pilot, thus requiring it to conduct on-site inspections of each location.^[246] In addition, as stated above, the proposed rule change would give FINRA discretion to make a determination in the public interest and for the protection of investors that a member firm is no longer eligible to participate in the Pilot if the member firm fails to comply with the Pilot's requirements.^[247] FINRA stated that it proposed this second provision to address concerns regarding allowing FINRA to more effectively assess whether particular member firms pose a higher risk when monitoring for compliance with the Pilot.^[248] Specifically, FINRA stated that the proposed rule change would permit FINRA to exclude higher risk firms and locations that were not otherwise excluded from participation by the Pilot's other safeguards and limitations.^[249] No commenter expressly supported or objected to these proposed changes.

The Pilot's safeguards and limitations, discussed herein, are reasonable and should help reduce the potential risk of non-compliance among member firms participating in the Pilot. Member firms who fail to satisfy the conditions of the Pilot should not be eligible to participate in the Pilot or conduct remote inspections and should be required to conduct all inspections on-site. Additionally, FINRA would have the flexibility to address situations ( printed page 82482) where a participating member firm may pose a heightened risk of non-compliance but has not been otherwise excluded by the safeguards and limitations of the Pilot. For these reasons, proposed Rule 3110.18(j) and proposed Rule 3110.18(k) are reasonable.

III. Conclusion

For the reasons set forth above, the Commission finds that the proposed rule change, as modified by Amendment No. 1, is consistent with Section 15A(b)(6) of the Exchange Act, which requires, among other things, that FINRA rules be designed to prevent fraudulent and manipulative acts and practices, promote just and equitable principles of trade, and, in general, protect investors and the public interest.^[250]

It is therefore ordered pursuant to Section 19(b)(2) of the Exchange Act ^[251] that the proposed rule change (SR-FINRA-2023-007), as modified by Amendment No. 1, be, and hereby is, approved.