FINRA remote inspection pilot: what evidence must your tech produce?

What is the FINRA remote inspection pilot?

The FINRA remote inspection pilot is a voluntary program under Rule 3110.18 that lets eligible broker-dealers inspect qualified offices, including OSJs and non-branch locations, remotely instead of on-site. It took effect July 1, 2024 and, according to FINRA, ends June 30, 2027.

At its June 2026 meeting, the FINRA Board of Governors approved a proposal that would make the pilot permanent, along with changes that would extend the presumptive inspection cycle for non-branch locations and modify parts of the residential supervisory location rule. FINRA said these proposals will be filed with the SEC, so none are in effect yet. For now, the opt-in and opt-out deadline for Pilot Year 4 is December 27, 2026.

Does a remote inspection lower the standard?

No. The SEC's approval order describes remote inspections as "held to the same standards for review applicable to on-site inspections."

Rule 3110(c)(2) still requires every inspection to be reduced to a written report kept for at least three years. Where applicable, the report must cover testing and verification of the firm's policies and procedures in areas that include safeguarding customer funds and securities, maintaining books and records, supervision of supervisory personnel, transmittals of funds or securities, and changes to customer account information.

On-site, an inspector can see the desk, the screens and the filing cabinet. Remotely, each of those observations has to come from a system. That makes the pilot as much a technology question as a supervision one.

What must the risk assessment and procedures cover?

A participating firm must conduct and document a risk assessment for each location it inspects remotely, and its written supervisory procedures must address the methodology, including technology, that may be used to conduct remote inspections.

Factors described in the approval order include the volume and nature of customer complaints, the nature of the customer base including vulnerable adult investors, failures to follow the firm's procedures, any recordkeeping violations, and any red flags. The firm must also keep a centralized record for each pilot year identifying every location inspected remotely and any additional supervisory procedures or more frequent monitoring applied to it.

Some firms and locations cannot use the pilot at all. At the firm level, that includes Restricted Firms under Rule 4111, Taping Firms under Rule 3170, firms suspended by FINRA, firms whose membership became effective within the prior 12 months, and firms found within the past three years to have violated Rule 3110(c). At the location level, it includes locations where a person is subject to a mandatory heightened supervisory plan, locations engaged in proprietary trading, and locations that handle customer funds or securities.

What evidence should your technology stack produce?

Your systems should produce enough dated records for the inspector to test each Rule 3110(c)(2) area, rather than only ask about it. A remote inspection built on a questionnaire and a video call is thin. A stronger file pulls records directly from firm systems for the period under review.

Evidence that maps to the Rule 3110(c)(2) areas often includes:

• Books and records: archive reports showing email, chat and text capture for each person at the location, with no gaps in the period. See which Teams, text and AI notetaker records your archive should hold.
• Correspondence review: records from the surveillance tool showing review by a registered principal, as Rule 3110(b)(4) requires.
• Devices and access: an inventory of devices used at the location with encryption, patch and endpoint protection status from management tools, multifactor enrollment, and sign-in logs that show where people actually work.
• Customer account changes: logs showing who changed addresses, bank instructions or beneficiaries, and how each change was verified.
• Transmittals of funds: records showing callback or second-person verification on disbursement requests.
• Physical safeguards: dated photos or a recorded walkthrough, with attestations, kept with the report.

Each item should be dated, traceable to a system or a named person, and retained with the inspection report.

Where do remote inspections usually fall short?

Remote inspections usually fall short in the gap between what a location reports and what the systems show. Common issues:

• Personal devices not enrolled in management, so no one can confirm encryption or patching.
• Home network equipment on default settings, documented only by attestation.
• Archive coverage never tested for the specific people at the location.
• Inspection files with undated screenshots and no source system.
• An inspector who reports to someone assigned to the location, which Rule 3110(c)(3) is designed to prevent.

Because recordkeeping violations are a risk factor, a capture gap found during an inspection can also affect whether that location remains a good candidate for remote review.

How do residential supervisory locations fit in?

Rule 3110.19, effective June 1, 2024, lets a private residence where specified supervisory activities take place be treated as a non-branch location, inspected on a periodic schedule presumed to be at least every three years rather than annually. The firm must document a risk assessment and give FINRA a current list of these locations by the 15th day of the month after each calendar quarter. The June 2026 Board proposal would change parts of this rule, subject to SEC approval.

What should you do before year-end?

Before year-end, a few steps put the 2027 inspection cycle on firmer ground:

• Decide by December 27, 2026 whether to opt in or out for Pilot Year 4, and record the rationale.
• Refresh the risk assessment for each location you plan to inspect remotely, including any recordkeeping findings from the past year.
• Map each Rule 3110(c)(2) area to a report your IT provider can produce on request.
• Run one test inspection using only system evidence, and fix what you could not produce.
• Confirm the centralized pilot record lists every remotely inspected location and any added monitoring.
• Calendar the Pilot Year 3 fourth-quarter data submission due January 15, 2027.

How does s90 help?

s90 supports broker-dealers and dual-registered firms with managed devices, Microsoft 365 controls and reporting built around supervision. We can produce the device, access and archive evidence your inspectors need for each location, and our agreements commit to producing evidence within 24 hours of a request. The same system-evidence approach applies to testing your FINRA Rule 4370 BCP failover. If remote inspections are part of your 2027 plan, start with a conversation.