FINRA Updates: What Broker-Dealers Should Track

Monitoring FINRA updates is essential for fintech broker-dealers operating in fast-moving and highly digital environments. From AI governance and social media supervision to crypto communications and cybersecurity oversight, FINRA’s recent priorities show that regulators are paying closer attention to how firms market products, supervise technology, manage vendors, and monitor customer activity across modern platforms.

A logical assumption is that most of the regulatory pressure fintech broker-dealers face today stems from entirely new rules. In reality, that pressure comes from how FINRA is applying existing rules to newer business models, newer technologies, and faster-moving customer interactions. That includes everything from AI tools and influencer campaigns to remote supervision and crypto-related communications.

This article focuses on the FINRA updates firms should pay attention to. It covers the areas regulators continue to raise during exams and enforcement actions, along with the operational issues compliance teams are dealing with as platforms, products, and internal systems keep changing.

Why FINRA Updates Matter for Fintech Broker-Dealers

Traditional broker-dealers and fintech broker-dealers often face very different operational realities. Fintech firms usually move faster, rely more heavily on technology vendors, and interact with customers across a wider range of digital channels. That combination has created new supervision and compliance concerns that regulators continue to focus on. 

FINRA updates often affect fintech firms faster and more directly than firms operating with older infrastructure and slower-moving business models. A change in exam focus around influencer marketing, AI-generated communications, or vendor oversight can immediately impact how a fintech firm reviews content, supervises employees, documents approvals, or monitors customer activity.

Several areas are drawing particularly close attention from regulators today: 

Another challenge is that many fintech products do not fit neatly into older regulatory categories. Existing FINRA rules were written long before app-based investing, embedded finance models, retail crypto access, or AI-assisted customer interactions became common. As a result, regulators are increasingly applying long-standing supervision, communications, and recordkeeping rules to newer technologies and distribution methods.

For compliance teams, the challenge is rarely static. A fintech broker-dealer may update its platform several times a year, expand into new communication channels, or integrate additional third-party tools as the business grows. Regulatory expectations and existing rules, however, continue to apply across each of those changes.

That’s why many FINRA examinations now focus heavily on operational controls. Regulators continue identifying issues tied to supervision gaps, weak documentation practices, fragmented oversight structures, and failures to escalate compliance concerns early enough.

The FINRA Updates Fintech Broker-Dealers Should Monitor Most Closely

Many of the FINRA updates receiving the most attention right now are connected to technology and day-to-day operational oversight. Regulators are spending more time reviewing how fintech broker-dealers supervise digital platforms, monitor communications, manage outside vendors, and oversee customer activity across online environments. 

AI and Generative AI Supervision

Broker-dealers are using AI tools in more places than they were even a year ago. Firms are experimenting with AI-generated content, automated onboarding flows, internal productivity tools, surveillance systems, and customer support functions. Regulators are paying closer attention to how those systems are supervised. 

FINRA’s Position on AI Governance

One of the biggest regulatory focus areas is governance. FINRA increasingly expects firms to understand where AI tools are used, what functions they perform, what data they access, and who is responsible for monitoring their outputs. The use of AI does not shift responsibility away from the broker-dealer itself.

This has become critical for fintech firms adopting AI tools quickly across multiple departments. In many cases, compliance teams are being asked to oversee technologies that were implemented initially by product, marketing, operations, or engineering teams. Regulators are paying closer attention to how firms coordinate oversight internally once AI becomes part of day-to-day business activity.

Recordkeeping and Supervision Concerns

Many firms started using AI tools before they fully understood the supervision implications. What begins as a simple productivity tool can quickly become part of customer communications, onboarding reviews, marketing approvals, or internal decision-making processes. Once that happens, recordkeeping obligations usually follow.

FINRA and the SEC are increasingly looking at how firms handle those workflows in practice. Regulators want to know whether the firm is reviewing AI-generated material, properly retaining records, and knows how employees are using these tools during normal business activity.

This has become a practical challenge for fintech firms moving quickly across different platforms and vendors. In many cases, compliance procedures struggle to keep pace with how AI tools are used across the organization.

Risks Tied to AI-Generated Communications

The risks tied to AI-generated communications often come down to speed and oversight. A tool can produce large amounts of customer-facing content quickly, but compliance review processes may not scale at the same pace.

FINRA is increasingly focused on whether firms can properly supervise that activity and whether customer communications involving AI still meet existing standards around fairness and accuracy.

Vendor AI Tools vs. Internally Developed Tools

Many fintech broker-dealers are not building AI systems from scratch. Instead, they are relying on third-party vendors for chat tools, onboarding automation, surveillance systems, analytics, and customer support functions. That creates additional oversight questions around vendor management and supervision.

Regulators are increasingly focused on whether firms actually understand how those tools operate in practice. Using a third-party AI vendor does not remove the broker-dealer’s responsibility to supervise the activity tied to that system.

Internally developed tools can create different challenges. Firms may have more visibility into the underlying system, but they also take on more responsibility for testing, monitoring, documentation, and governance. For many fintech firms, the operational risk comes from adopting AI systems faster than internal oversight processes can adapt.

See how Regly’s vendor management tool helps fintechs track and evaluate third-party relationships →

Social Media, Influencers, and Digital Communications

Social media and digital communications remain a major focus area in recent FINRA updates. Regulators continue paying closer attention to how fintech broker-dealers supervise influencer activity, short-form content, affiliate marketing, and customer communications across fast-moving digital platforms. 

FINRA Scrutiny of Influencer Campaigns

Influencer campaigns move much faster than traditional financial marketing channels. A single creator partnership can generate large amounts of customer-facing content across TikTok, YouTube, X, Instagram, and podcasts within days.

That speed has become a growing concern for regulators. FINRA is increasing its focus on whether broker-dealers have supervision processes capable of keeping up with digital promotional activity and third-party marketing relationships.

Retail Communications Under Rule 2210

Rule 2210 continues to play a major role in fintech compliance. Customer-facing communications across social media, digital advertising, onboarding flows, and app-based messaging are all receiving closer regulatory attention.

FINRA now pays close attention to whether firms can review and supervise these communications consistently before they are distributed publicly.

Learn more about FINRA Rule 2210 →

Supervision of Short-Form Content

Short-form content creates a very different review environment for broker-dealers. A 20-second TikTok clip or Instagram Reel can spread quickly, reach large audiences, and still contain statements that fall under FINRA communications rules.

That has become a growing issue for regulators. Firms are expected to monitor high-volume content across fast-moving platforms where videos, captions, and creator edits can change constantly after publication.

Mobile App Disclosures and “Nudges”

Mobile investing apps have changed how broker-dealers communicate with customers. Push notifications, prompts, rewards, gamified features, and in-app messaging are now part of the customer experience across many fintech platforms.

One area that regulators are examining more closely is how mobile apps shape customer behavior through notifications, prompts, rewards, and other engagement features. In many cases, the concern is not only what firms say directly, but how app design may influence investor decisions over time.

For fintech broker-dealers, those questions often involve multiple teams at once. Product, marketing, engineering, and compliance functions can all become part of the review process when customer-facing app features are involved.

Cybersecurity and Vendor Risk

Many fintech broker-dealers are now more dependent on outside vendors, cloud systems, and integrated technology platforms. That has made cybersecurity and vendor oversight much larger focus areas in recent FINRA examinations and regulatory reviews.

Third-Party Vendor Oversight Expectations

Vendor risk has become much more complicated for broker-dealers over the last few years. Firms are connecting multiple outside systems together across onboarding, communications, surveillance, and customer data workflows, which can create supervision gaps when oversight processes do not evolve at the same pace. 

For fintech firms, vendor relationships often expand quickly as the business scales. FINRA expects firms to understand what vendors do, what risks they create, and how those risks are monitored internally over time.

That has become more complicated as firms rely on multiple vendors across interconnected systems and customer-facing workflows. In many cases, operational dependencies become difficult to map clearly once third-party tools are embedded throughout the business.

See how Regly helps fintechs track, organize, and evaluate vendor relationships →

Cyber Incident Reporting and Operational Resilience

Cyber incidents can create operational problems very quickly for fintech broker-dealers, especially when core systems depend on multiple vendors and cloud platforms at once. 

A single outage can affect onboarding, trading, communications, and customer access simultaneously.

Regulators are spending more time reviewing how firms respond to those events, particularly around escalation procedures, operational recovery, and incident response planning.

Vendor Concentration Risks

A fintech broker-dealer can become operationally tied to a small group of vendors very quickly. What starts as a simple onboarding or cloud relationship often expands into multiple parts of the business over time. 

Regulators are taking a harder look at whether firms understand how operational dependencies could affect multiple systems at the same time.

Regulation S-P Developments Fintechs Should Track

Regulation S-P is receiving more attention as regulators focus on customer data protection, cybersecurity incidents, and third-party access to sensitive information. 

Fintech firms operating across cloud systems, APIs, and vendor platforms are facing closer review around how data is monitored and protected internally.

Learn more about Regulation S-P → 

Crypto and Digital Asset Activity

Crypto-related activity remains one of the more closely watched areas in recent FINRA updates. Broker-dealers involved in digital assets, crypto-adjacent products, tokenized offerings, or retail crypto communications continue facing elevated scrutiny around disclosures, supervision, custody, and customer communications. 

Communications Involving Crypto Products

Crypto communications remain a difficult area for many fintech broker-dealers because content spreads across so many channels simultaneously. A firm may be using app notifications, social media campaigns, influencers, and educational content to discuss the same product at the same time.

Regulators are increasingly reviewing whether those communications stay balanced and whether important risk information remains visible throughout the customer experience.

Affiliate Marketing and Disclosure Risks

Affiliate programs have become a major customer acquisition channel across fintech and crypto platforms. Firms are working with creators, referral partners, online communities, and influencers to promote products across social media, podcasts, newsletters, and other digital channels.

Regulators are paying closer attention to whether those relationships are disclosed clearly enough to customers. Much of the concern centers on paid promotions that appear independent or unbiased when compensation is actually involved behind the scenes.

For broker-dealers, the challenge often comes from supervising large amounts of third-party content that may change quickly across social platforms, referral networks, and affiliate campaigns.

Custody and SIPC-Related Concerns

Regulators continue paying close attention to custody-related disclosures involving crypto products. Broker-dealers are facing more scrutiny around how they describe customer asset protection, insurance coverage, and SIPC eligibility in customer-facing materials.

For fintech firms, these disclosures can become difficult to present consistently across different platforms and communications channels.

FINRA Expectations for Crypto-Adjacent Firms

Even firms that don’t directly offer crypto trading can still face regulatory scrutiny if digital asset activity touches their business model. During examinations, FINRA is placing more weight on broker-dealers involved in tokenized products, crypto partnerships, blockchain infrastructure, or retail crypto communications.

FINRA is turning more attention to how firms supervise crypto-adjacent activity once digital assets become part of customer communications, operational workflows, or product offerings.

For many fintech firms, the challenge is that crypto exposure may exist across multiple areas of the business at once, including marketing, partnerships, onboarding, custody arrangements, and customer support.

Remote Supervision and Distributed Teams

Remote work changed more than employee location. It changed how firms review communications, monitor activity, document approvals, and manage oversight across the business on a day-to-day basis. 

Several areas continue drawing closer regulatory attention:

• Remote Inspection Rules: Regulators are reviewing how firms perform branch inspections and supervisory reviews when activity takes place remotely rather than inside traditional office settings.
  
  

• Residential Supervisory Locations (RSLs): Firms using home offices for supervisory functions are facing more questions around documentation, eligibility standards, and oversight controls tied to RSL arrangements.
  
  

• Supervising Remote Registered Representatives: FINRA continues focusing on how firms oversee customer communications, outside business activity, and supervision practices when representatives work remotely.
  
  

• Common Fintech Supervision Gaps: Fast-moving fintech environments can create oversight gaps when onboarding, communications, approvals, and customer support activities are spread across different systems and teams simultaneously.

Best Interest Obligations in App-Based Environments

App-based investing experiences can shape investor behavior in subtle ways. Prompts, alerts, rankings, and suggested actions may all affect how customers respond to products and investment opportunities.

Regulators are increasingly reviewing whether those experiences create conflicts, bias customer behavior, or make disclosures less visible during the investment process.

Product Recommendation Scrutiny

FINRA continues reviewing how broker-dealers present higher-risk and more complex products through apps and digital platforms. Product suggestions delivered through automated systems, prompts, or customer workflows can still trigger existing Reg BI and suitability obligations. 

For fintech firms, the challenge is that recommendation activity may appear across onboarding flows, product displays, notifications, educational content, and user interface design.

Complex Products and Retail Targeting

Digital investing platforms can make complex products easier to access than ever before. That has placed more regulatory focus on how firms market higher-risk investments and present those products online to retail investors.

Regulators continue asking whether firms are exposing certain customers to products they may not fully understand.

Fee and Cost Disclosure Concerns

Fee transparency continues to be a major examination issue for fintech broker-dealers. Regulators are stepping up their review of whether costs, spreads, conflicts, and compensation details are visible enough throughout digital investing workflows.

For firms operating across apps and automated systems, disclosure practices can become fragmented very quickly.

AML, Fraud, and Account Monitoring

Regulators continue focusing heavily on fraud detection and AML controls across fintech broker-dealers. Automated onboarding systems, app-based account activity, and digital customer interactions are all creating new monitoring challenges for firms.

Several areas continue to receive closer regulatory attention:

Fraud Trends FINRA Is Focused On

FINRA continues reviewing how firms detect and respond to evolving fraud patterns involving account takeovers, synthetic identities, social engineering, payment fraud, and suspicious trading activity.

For fintech firms, fraud risks can escalate quickly once onboarding, communications, and account access all operate through digital channels simultaneously.

New Account Fraud and Account Takeovers

Digital onboarding has made account creation faster, but it has also increased exposure to identity-related fraud and unauthorized access attempts. Regulators are increasingly reviewing how firms monitor unusual account activity, login behavior, and suspicious onboarding patterns.

A major concern is whether firms can identify fraudulent activity early enough before customer harm expands.

AML Expectations for Digital Onboarding

As onboarding becomes more automated, regulators are reviewing how firms handle core AML requirements like identity verification, sanctions screening, CIP processes, and ongoing monitoring activity.

Regulators are increasingly focused on whether fintech firms maintain effective AML controls once onboarding becomes highly automated and digitally driven.

Coordination Between AML, Cyber, and Operations Teams

Many operational incidents no longer stay isolated within one department. A single fraud event or cybersecurity issue can quickly involve compliance teams, fraud analysts, engineers, customer support staff, and cybersecurity personnel at the same time. 

For fintech firms, regulators are ramping up their review of whether escalation and coordination procedures function effectively across those operational areas.

Recent FINRA Enforcement Trends Fintechs Should Understand

Recent FINRA enforcement actions continue to focus heavily on supervision, digital communications, crypto marketing, recordkeeping, and operational oversight across fintech firms. 

Influencer Marketing Enforcement

Influencer marketing continues to appear in FINRA and SEC enforcement activity, especially when firms fail to supervise third-party promotions or disclose compensation arrangements clearly enough. Regulators are paying closer attention to social media campaigns involving creators, affiliates, referral programs, and retail-facing promotional content.

A recurring issue is promotional activity that appears independent, even though compensation or financial incentives exist behind the scenes.

For fintech firms, these risks become harder to manage once content spreads quickly across multiple platforms and outside marketing partners simultaneously.

Off-Channel Communications Cases

A growing number of enforcement cases involve communications outside firm-approved channels. Messaging apps, personal phones, collaboration tools, and informal communication platforms have all become larger supervision concerns for regulators.

In many cases, regulators are focusing less on the underlying customer interaction itself and more on whether firms failed to capture and retain the related records properly.

Fast-moving fintech environments can make this especially difficult once teams communicate across multiple systems throughout the day.

Learn more about off-channel communications →

Supervisory Failures in Digital Platforms

Many recent enforcement actions focus on operational gaps inside digital platforms rather than traditional misconduct issues. Regulators are reviewing whether firms maintained effective supervision as onboarding systems, customer experiences, and automated workflows became more complex.

In several cases, business operations changed faster than internal controls, documentation processes, and escalation procedures.

For fintech firms, these risks often increase once onboarding, recommendations, communications, and customer interactions become heavily integrated into digital platforms and automated systems.

Crypto Communications and Disclosure Cases

Crypto-related communications continue appearing in enforcement activity involving broker-dealers and fintech firms. Regulators are reviewing whether firms presented digital asset products, risks, custody arrangements, and customer protections clearly enough across marketing materials and retail-facing communications.

A recurring issue involves disclosures that regulators viewed as incomplete, overly promotional, or potentially misleading once crypto-related risks were considered fully.

For fintech firms, these risks often become harder to manage when crypto communications spread across apps, influencers, affiliate campaigns, onboarding flows, and social media simultaneously.

AML and Fraud Monitoring Deficiencies

Fraud monitoring and AML controls remain major enforcement themes for fintech broker-dealers, particularly when suspicious activity moves through automated onboarding and digital account systems without proper escalation.

Many cases also involve operational breakdowns between fraud, compliance, cybersecurity, and customer support teams after suspicious activity has already been identified.

For fintech firms, these risks often increase when monitoring activity becomes fragmented across vendors, platforms, and internal systems.

How Fintech Broker-Dealers Should Track FINRA Updates

Tracking FINRA updates is more essential for fintechs than it was a few years ago, as regulatory developments affect marketing workflows, onboarding systems, vendor oversight, app design, communications supervision, and fraud monitoring across the business. The challenge is in understanding how those changes affect day-to-day operations across multiple teams and systems. 

The Most Important FINRA Resources to Monitor

Keeping up with FINRA developments usually requires monitoring several sources at once. Different publications and enforcement trends often reveal different parts of the regulatory picture, especially for fintech firms operating across digital platforms and fast-changing business models.

• Annual Regulatory Oversight Report: Highlights FINRA examination priorities, common compliance weaknesses, and areas receiving increased scrutiny.
  
  

• Regulatory Notices: Covers rule proposals, amendments, interpretive guidance, and operational expectations firms may need to address internally.
  
  

• Enforcement Actions: Show where regulators are identifying supervision, communications, AML, recordkeeping, and operational control problems in practice.
  
  

• SEC Examination Priorities: Provide additional insight into broader regulatory focus areas that frequently overlap with FINRA examinations and reviews.

Internal Monitoring Processes Firms Should Build

Tracking FINRA updates is only part of the challenge for fintech broker-dealers. Firms also need internal processes capable of identifying how regulatory developments affect onboarding, communications, product features, vendors, customer interactions, and operational workflows across the business.

• Regulatory Change Management Workflows: Processes for reviewing regulatory developments, assigning responsibilities internally, and tracking implementation across different teams.
  
  

• Cross-Functional Escalation Procedures: Clear escalation channels between compliance, legal, product, engineering, operations, cybersecurity, and customer support functions once regulatory or operational issues are identified.
  
  

• Marketing and Communications Reviews: Review procedures tied to social media, digital advertising, influencer activity, customer messaging, and app-based communications.
  
  

• Vendor Review and Risk Tracking: Ongoing review processes for monitoring vendor relationships, operational dependencies, cybersecurity exposure, and third-party risks tied to critical business functions.

See how Regly helps fintechs review vendor relationships and track risks →

How Technology Helps With Regulatory Monitoring

Manually tracking regulatory developments has become difficult for many fintech firms. FINRA notices, SEC priorities, enforcement actions, cybersecurity guidance, and operational updates are now released constantly, often affecting several business areas at the same time.

Because of that, more firms are using regulatory monitoring software to organize updates in one place instead of relying on spreadsheets, inbox searches, PDFs, and disconnected review processes. These systems can help teams sort developments by topic, assign reviews internally, and flag updates that may affect specific products or workflows.

Regly Monitor helps fintech firms keep up with important regulatory developments across FINRA, the SEC, and other regulatory sources. The platform alerts teams to relevant changes, summarizes the development, and helps firms evaluate where the update may affect operations, communications, onboarding, vendor oversight, or compliance procedures.

For fintech firms moving quickly across multiple systems and teams, centralized monitoring can make regulatory tracking more manageable operationally.

See how Regly Monitor helps fintechs track regulatory updates →

Questions Fintech Compliance Teams Should Ask Quarterly

As fintech operations become more digital and interconnected, compliance risks can spread across multiple systems and teams at once. Quarterly reviews help firms reassess where supervision and operational controls may be weakening. 

 Have New Tools Introduced Supervision Gaps?

New onboarding systems, AI features, automation tools, collaboration platforms, and customer-facing technologies can create oversight gaps when firms adopt them faster than supervisory procedures evolve internally.

For many fintech firms, the challenge is not the technology itself. It is whether compliance controls, escalation procedures, and documentation practices changed alongside the new workflow.

Are Vendors Creating Recordkeeping Risk?

Third-party vendors often become deeply integrated into onboarding, communications, customer support, marketing, surveillance, and operational systems over time. That can create recordkeeping and supervision risks when firms lose visibility into how information is retained or monitored across those platforms.

Regulators continue paying closer attention to vendor-related operational dependencies across fintech environments.

Are Marketing Practices Aligned With Rule 2210?

Social media campaigns, influencer relationships, app messaging, onboarding content, videos, and digital advertising can all fall within FINRA communications rules once they become customer-facing activity.

Quarterly reviews can help firms evaluate whether disclosures, approvals, and supervision practices still align with Rule 2210 expectations as marketing activity evolves.

Are AI Tools Creating New Compliance Exposure?

As more and more firms use AI systems across onboarding, customer support, surveillance, marketing, internal operations, and employee productivity workflows, they may be creating more risks. Supervision, disclosure, recordkeeping, or operational risks may occur when firms do not fully understand how they are used internally.

A recurring issue is that AI adoption often expands gradually across teams before compliance procedures catch up.

Are Digital Marketing Partners Being Supervised Consistently?

Affiliate marketers, influencers, referral partners, creators, and third-party promotional relationships can create supervision challenges when content spreads quickly across several platforms simultaneously.

Regulators continue reviewing whether firms maintain oversight over third-party marketing activity and whether compensation relationships are disclosed appropriately.

Have Communication Channels Expanded Beyond Approved Systems?

Business communications do not always stay inside firm-approved platforms, especially in remote or fast-moving fintech environments. Employees may begin using texting apps, collaboration tools, personal devices, or informal messaging channels during day-to-day activity.

Quarterly reviews can help firms identify where communication activity may no longer align with existing supervision and recordkeeping procedures. 

—

FINRA updates affect how firms supervise technology, review communications, manage vendors, monitor fraud, and document day-to-day compliance activity.

For firms operating across digital platforms, the practical challenge is connecting regulatory developments to actual business workflows. That means reviewing new tools, vendor relationships, marketing activity, AI usage, and communications practices on a regular basis.

The firms best positioned to manage these expectations are usually the ones that treat regulatory monitoring as an ongoing operational process, not a once-a-year review.