Applying FINRA Regulatory Notice 21-29 to your vendors in 2027

If your firm's next FINRA exam includes a look at vendor management, examiners will start with FINRA Regulatory Notice 21-29 and then ask what your program has added since 2021. This checklist covers what the Notice expects, what has changed, and what to fix before the exam request arrives.

What does FINRA Regulatory Notice 21-29 require?

It creates no new requirements. Regulatory Notice 21-29, issued August 13, 2021, reminds broker-dealers that outsourcing a function to a vendor does not relieve the firm of its "ultimate responsibility for compliance with all applicable federal securities laws," a principle FINRA first set out in Notice 05-48. The supervisory duty stays with the firm.

The obligations the Notice points to are already in the rulebook. FINRA Rule 3110 requires a supervisory system and written supervisory procedures (WSPs) reasonably designed to achieve compliance, and that covers activities a vendor performs on the firm's behalf. Rule 4370 requires a business continuity plan that accounts for how the firm operates, including the vendors it depends on. Rule 4511 and Exchange Act Rules 17a-3 and 17a-4 govern records a vendor may hold. Regulation S-P governs customer information a vendor can reach. The Notice then lists questions firms may consider across the vendor lifecycle: the decision to outsource, due diligence, contracts, ongoing supervision, and termination.

What has changed since 2021?

The Notice text is the same. The rules and expectations around it have moved, and four developments matter for a vendor program reviewed in 2027.

• Regulation S-P now requires written service provider oversight. Under the amended 17 CFR 248.30(a)(5), a broker-dealer's incident response program must include policies and procedures requiring oversight of service providers, including due diligence and monitoring, so that providers protect customer information and notify the firm no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. Larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. Our guide to updating vendor contracts for the Reg S-P service provider notice covers the contract side.
• Broker-dealers must keep the paper trail. 17 CFR 240.17a-4(e)(14) requires keeping the Reg S-P written policies and procedures until three years after they stop being used, and service provider contracts until three years after the contract ends.
• FINRA's 2026 Annual Regulatory Oversight Report expanded the list of effective practices. It notes "an increase in the reporting of cyberattacks and outages at firms' third-party vendors" and adds practices that Notice 21-29 did not spell out: assessing a vendor's use of generative AI in its products, keeping an inventory of the firm data types vendors access or store, assessing fourth-party vendors that handle firm data, and involving vendors in incident response plan testing.
• FINRA now collects vendor data directly. Through the Third-Party Vendor Request in FINRA Gateway, FINRA asks all firms to report the vendors and banks essential to their operations, so it can alert affected firms when a vendor has a cyber or operational event. FINRA says 2025 submissions led to impact assessments sent to more than 2,350 firms. Responses can be amended during the year.

For dual-registered firms, the SEC side points the same way. The SEC Division of Examinations' Fiscal Year 2027 Examination Priorities say staff will assess risks from registrants' increased use of third-party service providers and review Reg S-P service provider oversight.

Which vendors need full due diligence under Notice 21-29?

The ones whose failure would hurt customers or break a regulatory obligation. Notice 21-29 takes a risk-based approach and lets firms scale due diligence and oversight to the risk each vendor presents.

The Notice names the factors: whether the vendor handles sensitive firm or customer non-public information, how much damage a breach could cause (including how many customers it could affect), whether the vendor performs a business-critical role or a regulatory function, and the vendor's reputation and history. A practical way to apply this is three tiers:

• Tier 1: vendors that hold customer information or perform a regulatory function. Think email and communications archiving, CRM, cloud email and file storage, trade surveillance, and the managed IT provider with administrator access to your systems.
• Tier 2: vendors that are business-critical but do not hold customer information, such as phone systems or internet providers.
• Tier 3: low-risk tools with no customer data and no regulatory role.

Whatever tiers you choose, write the criteria into your WSPs so an examiner can see why each vendor received the review it did.

What should due diligence cover in 2027?

Start with the Notice 21-29 list, then add the items from FINRA's 2026 report. Documenting the findings matters as much as gathering them, because the Notice asks whether firms record their due diligence.

• Financial condition, experience, reputation, and the background of the vendor's principals.
• Information security controls and resilience, including SOC 2 Type II or SSAE 18 reports where available.
• The vendor's business continuity plan and whether it can support yours.
• Whether firm staff who oversee a vendor performing covered functions need Operations Professional registration under FINRA Rule 1220(b)(3).
• Controls over the vendor's own subcontractors, which the 2026 report frames as fourth-party risk.
• Whether and how the vendor uses generative AI in the product, and what happens to your data when it does.
• Which firm and customer data types the vendor will access or store, recorded in your vendor inventory.

What belongs in the vendor contract?

Terms that let the firm meet its own obligations when the vendor is doing the work. Notice 21-29 suggests contracts address compliance with securities laws and FINRA rules, confidentiality and protection of non-public information, notice of cybersecurity events and service failures, participation in business continuity testing, subcontractor relationships, firm and regulator access to books and records, and ownership and disposition of data when the relationship ends.

Two newer items belong on the checklist. For vendors that are Reg S-P service providers, the firm's procedures must require the 72-hour breach notice, and a contract term is the usual way to secure it. FINRA's 2026 report also describes contract language that "prohibits firm or customer sensitive information from being ingested" into an open-source generative AI tool.

How do you supervise a vendor after onboarding?

By collecting evidence on a schedule and acting on what it shows. Notice 21-29 describes obtaining vendor attestations, monitoring the accuracy and quality of vendor work, investigating deficiencies and customer complaints, and training staff to escalate red flags.

On the technology side, the Notice describes a "policy of least privilege" for vendor access, asks whether firms have considered multi-factor authentication for vendors and, where warranted, their subcontractors, and suggests tracking vendor access to sensitive information and critical systems. It also lists vendors failing to encrypt confidential firm and customer data as a past exam finding, so confirm encryption for data vendors store or transmit. Review each Tier 1 vendor's SOC 2 report annually and record what you concluded, including how you handled any exceptions the auditor noted.

Rule 4370 does not by itself mandate business continuity testing, but Notice 21-29 asks whether your BCP planning and testing include vendors, and FINRA's 2026 report lists vendor participation in incident response testing as an effective practice. A tabletop exercise that assumes your archiving vendor or managed IT provider is down is a practical place to start, and it fits naturally into your Rule 4370 annual BCP review.

What happens when a vendor relationship ends?

The firm still owns the data and the records obligation. FINRA's 2026 report lists two offboarding practices: procedures to return or destroy firm data when a contract ends, and revoking vendor access to systems, data and infrastructure when the relationship ends.

Records need special care. Notice 21-29 notes that vendor data purges after termination have caused books and records violations. Before a communications archive or CRM contract ends, confirm the records have moved to a system that meets Rule 17a-4 and that the retention periods carry over. Keep the terminated contract itself for three years under Rule 17a-4(e)(14) if the vendor was a Reg S-P service provider.

What should you do this quarter?

Pick the steps that close the largest gaps first. A reasonable sequence for the next 90 days:

• Reconcile your vendor list against what your firm reported in the FINRA Gateway Third-Party Vendor Request, and amend the submission if they differ.
• Tier every vendor using the Notice 21-29 risk factors and record the reasoning.
• Pull Tier 1 contracts and check for the 72-hour breach notice, generative AI data terms, records access, and data return or destruction at termination.
• Collect current SOC 2 reports for Tier 1 vendors and document your review.
• Add the data types each vendor accesses and its known fourth parties to the inventory.
• Confirm your WSPs name an owner for each Tier 1 vendor relationship and describe how oversight is performed.
• Schedule one critical vendor into your next incident response or BCP exercise.

None of this replaces your firm's own reading of the rules with counsel. It gives examiners a documented program to review.

How does s90 help?

s90 is a managed IT provider, so we sit in your vendor inventory too. We support broker-dealers and dual-registered firms with the technology side of vendor oversight: maintaining the inventory of systems and data flows, reviewing and removing vendor access, enforcing multi-factor authentication, and offboarding vendor accounts when a contract ends. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production, so the evidence an examiner asks for is ready when you need it. If you want a second look at your vendor program before your next exam, we are happy to talk.