FINRA Rule 3130: what technology evidence backs the CEO's signature?

What does the CEO actually certify under FINRA Rule 3130?

The CEO certifies that the firm has processes to build, review, test, and update its compliance policies and written supervisory procedures, and that those processes are documented in a report. Under FINRA Rule 3130, each member's chief executive officer (or equivalent) must certify annually, and must have met with the chief compliance officer in the preceding 12 months.

The certification text says the firm has processes to establish, maintain, and review policies and procedures reasonably designed to achieve compliance, to modify them as business, regulatory, and legislative changes and events dictate, and to test their effectiveness on a periodic basis. It also says those processes are evidenced in a report reviewed by the CEO, and that the final report has been or will be presented to the board of directors and audit committee at the earlier of their next scheduled meetings or within 45 days of the certification.

Supplementary Material .07 says the signatory certifies only to having those processes in place, and that signing does not by itself create business line responsibility. In plain terms, the CEO attests that the machinery for staying compliant exists, including periodic testing. That is a statement an examiner can check against the report.

Does the Rule 3130 certification cover technology?

Yes, wherever a compliance obligation depends on technology. The cybersecurity section of FINRA's 2026 Annual Regulatory Oversight Report lists the rules that apply to a member's cyber program: SEC Regulation S-P, Regulation S-ID, FINRA Rule 3110 on supervision, FINRA Rule 4370 on business continuity, and Exchange Act Rules 17a-3 and 17a-4 on books and records.

Each of those rules requires written policies and procedures, and each runs on systems: email archiving, access controls, backup and failover, vendor platforms, and incident response. If the processes for those systems are undocumented or untested, the certification rests on the CCO's memory and the IT provider's goodwill. Supervision is a good example: Rule 3110 remote inspections now depend on technology records that IT has to produce.

How is the Rule 3130 report different from the Rule 3120 report?

The Rule 3120 report summarizes testing results; the Rule 3130 report documents the processes that produce them. Under FINRA Rule 3120, designated principals must test and verify that supervisory procedures are reasonably designed, amend them where testing shows a need, and at least annually give senior management a report detailing the supervisory control system, summarizing test results and significant exceptions, and listing any procedures added or amended in response.

Rule 3130 Supplementary Material .10 says its report must document the processes for establishing, maintaining, reviewing, testing, and modifying compliance policies, including the manner and frequency of administration and the officers and supervisors responsible. It need not contain conclusions. It may be combined with other reports if it is clearly titled as responsive to Rule 3130, and it must be produced before the CEO signs. In practice, the 3120 testing results are some of the strongest evidence that the 3130 testing process exists.

What technology evidence should sit behind the signature?

Map each verb in the certification to artifacts that IT can produce on request. A workable structure:

• Establish and maintain: current written policies for safeguarding customer information under 17 CFR 248.30, the identity theft program under Regulation S-ID, electronic communications and archiving procedures, and device and remote access standards.
• Review: a calendar showing when each technology policy was last reviewed and by whom, including the annual business continuity plan review required by Rule 4370 (see our guide to the Rule 4370 annual review and failover test).
• Test: penetration test and vulnerability scan results, phishing simulation results, incident response tabletop reports, backup restore and failover test records, quarterly access reviews, and archive retrieval tests under Rule 17a-4.
• Modify: a change log showing that new systems, new vendors, and new tools, including generative AI, triggered a policy or procedure update before going live.

Vendor oversight belongs in all four. In the third-party risk section of its 2026 report, FINRA notes an increase in reported cyberattacks and outages at vendors and lists effective practices: initial and ongoing due diligence on vendors that support mission-critical systems, an inventory of firm data types each vendor accesses or stores, involving vendors in incident response plan testing, and procedures to destroy firm data and revoke access when a contract ends.

What should the CEO ask the CCO before signing?

The CEO should ask to see the evidence. Supplementary Material .04 says the CEO-CCO meetings should review the matters that are the subject of the certification and the firm's compliance efforts as of the meeting date, and identify and address significant compliance problems and plans for emerging business areas. For technology, five questions do most of the work:

• Which technology controls were tested this year, and where are the results?
• What did testing find, and which findings are still open?
• Which new systems, vendors, or AI tools did we adopt, and which procedures changed as a result?
• Did any security incident or vendor breach occur, and is the response documented?
• Could we produce this evidence within a day if FINRA asked for it?

What should you do this quarter?

Start with the date, then work backward. A practical sequence:

• Find last year's certification date. Each annual certification must be signed no later than its anniversary.
• Schedule the CEO-CCO meeting at least six weeks before that date, with the technology evidence package as an agenda item.
• Ask IT or your managed service provider for the test results, change log, vendor inventory, and incident records described above.
• Title the report so it clearly responds to Rule 3130, especially if it is combined with the Rule 3120 report.
• Calendar delivery of the final report to the board and audit committee at the earlier of their next scheduled meetings or 45 days after signing, or confirm Supplementary Material .09 applies if the firm has neither.

How can s90 help?

s90 supports broker-dealers and dual-registered firms with technology evidence that maps to the certification: test results, access reviews, vendor monitoring, and change records delivered in monthly reporting. Our agreements commit to 72-hour breach notification and 24-hour evidence production, so the material behind the CEO's signature is ready when the CCO asks for it. If your certification date is coming up, we are glad to help assemble the technology section.