What are the FINRA residential supervisory location requirements?

If your principals supervise from home, the FINRA residential supervisory location (RSL) designation can move those homes from an annual inspection cycle to one presumed to run every three years. The trade-off is that home office technology carries the supervisory weight between inspections, and examiners will ask how the firm knows it does.

What is a FINRA residential supervisory location?

A FINRA residential supervisory location (RSL) is a private residence where an associated person performs specified supervisory activities, which FINRA Rule 3110.19 allows a member firm to treat as a non-branch location. The SEC approved the rule in November 2023, FINRA announced it in Regulatory Notice 24-02, and it took effect June 1, 2024.

The practical effect is on inspections. An office of supervisory jurisdiction (OSJ) or supervisory branch office must be inspected at least annually. An RSL is inspected on a regular periodic schedule that Rule 3110 Supplementary Material .13 presumes to be at least every three years. That longer cycle is what makes the designation useful for supervisors who work from home. It also means up to three years can pass between inspections, so the controls that operate every day carry more of the supervisory weight.

Which firms and people cannot use the designation?

Some firms are ineligible outright, and some individuals make a location ineligible. FINRA's RSL Requirements and Conditions checklist lists firm-level exclusions that include:

• Restricted Firms under Rule 4111 and Taping Firms under Rule 3170.
• Firms whose FINRA membership is suspended or became effective less than 12 months ago.
• Firms found by the SEC or FINRA to have violated Rule 3110(c) within the past three years.
• Firms subject to Rule 9557 or to Rule 1017(a)(7).

A location is also ineligible if the associated person assigned to it is a designated supervisor with less than one year of direct supervisory experience with the member, is a limited principal under Rule 1012.04, is subject to a mandatory heightened supervisory plan, is statutorily disqualified (unless approved), has had certain Form U4 disclosure events within the prior three years, or has received written notice of an investigation or proceeding alleging a failure to reasonably supervise.

These conditions can change after designation. A new disclosure event or a regulatory inquiry can make a previously eligible location ineligible.

What conditions must the home office meet?

The checklist, drawing on Rule 3110.19 and the residence conditions in Rule 3110(f)(2)(A), lists the conditions a private residence must meet:

• Only one associated person, or multiple associated persons who live there and are members of the same immediate family, conducts business at the location.
• The location is not held out to the public as an office, and the associated person does not meet customers or prospective customers there.
• No customer funds or securities are handled there.
• The associated person is assigned to a designated branch office, which appears on business cards, stationery, retail communications and other communications to the public.
• Correspondence and communications with the public are subject to the firm's supervision, and electronic communications are made through the firm's electronic system.
• The firm maintains a compliant recordkeeping system, records are not kept at the location, and the firm has prompt access to them.
• The firm has determined that its surveillance and technology tools are appropriate to supervise the risks of the location.

The checklist also states that, effective November 26, 2024, firms report current RSL status by answering the RSL question on Form U4.

What does FINRA expect for home office technology?

FINRA does not prescribe products, but the conditions put technology at the center of the designation. Two of them are technical on their face: electronic communications must run through the firm's system, and records may not be kept at the residence. The checklist then describes the surveillance and technology tools a firm should weigh in three groups: firm-wide tools (an electronic recordkeeping system, electronic surveillance of email and correspondence, electronic trade blotters, regular activity-based sampling reviews and visual inspection tools), tools specific to the location based on the person's activities and products, and system tools described as secure network connections and effective cybersecurity protocols.

Customer information at a home office is also covered by SEC Regulation S-P, which requires written policies and procedures with administrative, technical and physical safeguards for customer information wherever it is accessed.

Firms commonly translate those expectations into a home office standard along these lines. These are practices, not rule text:

• A firm-managed computer, enrolled in device management, with full disk encryption, current patches and an endpoint detection agent.
• Firm business conducted only through firm email, chat and approved texting tools, with personal messaging apps kept off managed devices (see our note on off-channel communications).
• Access to firm systems through multifactor authentication and an encrypted connection, such as a VPN or a conditional access policy that checks device health.
• No local copies of records: files saved to the firm's document system, removable storage blocked, and downloads restricted.
• A home network kept separate from family devices where practical, with the router's default credentials changed and firmware current.
• Physical safeguards for printed material, screen locks, and a shredder or secure disposal method.

What should the risk assessment document?

Before designating a location, the firm must conduct and document a risk assessment for the associated person assigned to it under Rule 3110.19(e). The checklist lists factors to document, including customer complaints (considering volume and nature), heightened supervision short of the ineligibility threshold, failures to follow the firm's written supervisory procedures, recordkeeping violations, and regulatory communications that suggest a failure to reasonably supervise, such as subpoenas, inquiries, deficiency letters and trading questionnaires. The firm should also consider higher-risk activities at the location and red flags, both when designating the location and when deciding whether to keep the designation.

Technology evidence fits naturally into the same file. A device compliance report, confirmation that no records are stored locally, and a summary of communications surveillance coverage show that the conditions are being met between inspections.

Is the RSL rule changing?

Possibly, but the current rule still applies. At its June 2026 meeting, the FINRA Board of Governors approved a proposal that would extend the presumptive inspection cycle for non-branch locations, simplify the approach to different types of residences, and modify the supervisory ineligibility requirement for RSLs. FINRA said the proposal would be filed with the SEC. Until the SEC approves a change and FINRA sets an effective date, firms designating RSLs work from the existing conditions above.

What should firms do this quarter?

A short review cycle keeps designations defensible:

• Re-run firm and individual eligibility for every RSL, including any new disclosure events, heightened supervision or regulatory inquiries.
• Pull current device compliance evidence for each RSL: encryption, patch status, endpoint protection and multifactor enrollment.
• Confirm that no books and records are stored on home devices or in personal cloud accounts.
• Check that communications surveillance covers every channel the supervisor actually uses.
• Update written supervisory procedures to state the inspection schedule for RSLs and how its frequency was set, as Rule 3110(c)(1)(C) requires for non-branch locations.
• If the firm also uses remote inspections under the Rule 3110.18 pilot, keep that program's records separate, since it is a distinct program with its own conditions.

How does s90 help?

s90 supports broker-dealers and dual-registered firms in Los Angeles and Orange County with managed IT and security built around supervisory and recordkeeping requirements. Our client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, which helps when a principal needs device or access evidence for an RSL file. If you would like a second look at your home office standard, we are happy to compare it against the RSL conditions with you.