Does your FINRA Rule 4370 annual BCP review include a real failover test?

What does FINRA Rule 4370 require each year?

FINRA Rule 4370 requires each member firm to review its written business continuity plan every year, with the review led by a designated member of senior management who is a registered principal. FINRA Rule 4370(b) says each member "must also conduct an annual review of its business continuity plan to determine whether any modifications are necessary in light of changes to the member's operations, structure, business, or location." Rule 4370(d) assigns that review to the senior manager who approves the plan.

The plan must also be updated whenever there is a material change, must be available "promptly upon request to FINRA staff," and must address ten minimum elements listed in Rule 4370(c). Those include data backup and recovery, all mission critical systems, alternate communications with customers and employees, alternate physical location of employees, regulatory reporting, and how customers will get prompt access to their funds and securities if the firm cannot continue its business.

Does Rule 4370 require you to test the plan?

The rule text does not. FINRA said so plainly in Regulatory Notice 21-44: "the rule does not specifically mandate BCP testing." The same notice says the required annual review "may encompass testing BCP functionality," and points to annual testing as an effective practice FINRA has observed at member firms.

FINRA's business continuity planning FAQ takes the same position: "The required annual review may include testing of specific functions or functionality." In practice, a review that only re-reads the document leaves the hardest question unanswered. Would the firm actually keep serving customers if its primary systems went down tomorrow?

Why does a tested failover matter more in 2026?

FINRA's recent guidance centers on technology and vendor outages, and a document review cannot show how the firm would recover from one. In its 2026 Annual Regulatory Oversight Report section on third-party risk, FINRA warns that "an attempted cyberattack or an outage at a third-party provider could potentially impact a large number of member firms" and lists Rule 4370 among the rules that apply. Its effective practices include "Regularly testing the recovery of data from backups to confirm information can be restored" and involving vendors in incident response plan testing.

The same report lists SEC Regulation S-P next to Rule 4370, so the incident response and vendor oversight work you do for Reg S-P can feed directly into the BCP test. If ownership of that program is still unsettled, see who should own and sign your Reg S-P program.

FINRA's Cybersecurity Effective Practices, published in August 2026, connects the same dots. It cites Rules 3110 and 4370, notes that "ransomware, system failures and natural disasters can render critical systems unavailable," and recommends that firms "test recovery capabilities through tabletop or simulation exercises, including offline scenarios," and define recovery point and recovery time objectives that "align with business criticality."

For a broker-dealer, the CEO's annual certification under Rule 3130 also states that the firm "has in place processes to establish, maintain, review, test and modify written compliance policies." A business continuity plan that has never been exercised is a hard fit with that language.

What should a BCP failover test cover?

Pick the scenarios most likely to stop your business, then prove each recovery path works end to end. For most small and mid-sized broker-dealers and dual-registered firms, that means four tests:

• Restore from backup. Restore a real file share, mailbox, or database to a clean location and time it. Compare the result to the recovery time objective in your plan.
• Lose the office. Have staff work a full morning from their alternate location, usually home, using only firm-managed devices. Confirm they can reach the order entry system, the clearing firm portal, email, archived communications, and the phone system.
• Lose a critical vendor. Walk through what happens if your clearing firm portal, CRM, or email provider is unavailable for a day. Check the clearing firm's own continuity disclosures against what your plan promises customers.
• Lose the network. Simulate an internet outage at the main office and confirm the backup connection, call forwarding, and customer communication plan.

Record who took part, what failed, how long each recovery took, and what you changed afterward. That record is the evidence your annual review happened and found something.

Are your emergency contacts and customer disclosures current?

Check them in the same sitting. Rule 4370(f) requires two emergency contact persons, at least one of whom is a member of senior management and a registered principal, reported to FINRA and updated promptly after any material change. Under FINRA Rule 4517, members must update required contact information "not later than 30 days following any change" and review it "within 17 business days after the end of each calendar year."

Rule 4370(e) also requires the firm to disclose to customers how the plan addresses a significant business disruption, in writing at account opening, posted on the firm's website if it has one, and mailed on request. If the test changed how you would operate during a disruption, update that disclosure too.

How should a broker-dealer run its annual BCP review this quarter?

A workable sequence for the annual review:

• Confirm the designated senior manager and registered principal who will approve the plan and own the review.
• Walk the ten elements of Rule 4370(c) against how the firm operates today, including any new office, custodian, clearing arrangement, or major software vendor since the last review.
• Run at least the backup restore and work-from-alternate-location tests, and schedule the vendor and network tests if time is short.
• Update the plan, the customer disclosure, and the emergency contacts based on what you found.
• File test results, the updated plan, and the approval together, dated, so the review is easy to show an examiner.

Is this legal advice for my firm?

No. This article summarizes what FINRA's rules and published guidance say. How they apply to your firm depends on your business model and clearing arrangements, and your compliance counsel or FINRA coordinator is the right source for firm-specific answers.

How s90 helps

s90 manages IT for broker-dealers and dual-registered firms in Los Angeles and Orange County. We design backups and failover around your recovery objectives, run the restore and remote work tests with your team, and document results in a form your registered principal can sign and file. If your annual BCP review is coming up, we can help you turn it into a test you can show an examiner.