Personal Trading, Attestations & Broker-Dealer Rules 2026

Running broker-dealer employee compliance means keeping track of what your people are trading, what they're attesting to, and what they're saying in their messages. Those three things are more connected than most programs treat them. If you're building out your program or stress-testing what you already have, here's what each area requires and where the common weak spots tend to show up.

TLDR:

• Broker-dealer employee compliance covers three connected areas: personal trading, attestations, and communications supervision.
• Under FINRA Rule 3210, employees must get prior written consent before opening outside brokerage accounts; existing accounts have a 30-day window.
• The SEC and FINRA have collected more than $3.5 billion in fines tied to recordkeeping and off-channel communications since 2021.
• New FINRA Rule 3290, approved Sept. 15, 2026, will replace Rules 3270 and 3280. FINRA has not yet announced an effective date; firms must comply with current rules while preparing for the change.
• Greenboard manages personal trading, attestations, and communications supervision in one place, with a WORM-compliant audit trail throughout.

What broker-dealer employee compliance actually covers

Employee compliance at a broker-dealer is a distinct discipline from firm-level regulatory compliance. Firm compliance covers things like net capital requirements, AML programs, and regulatory filings. Employee compliance is narrower: it governs what individual associated persons can do, disclose, and attest to, given their access to sensitive information and their position inside a licensed firm.

Three areas form the core of it:

• Personal trading oversight: monitoring and pre-clearing employee securities transactions to prevent insider trading and conflicts of interest
• Attestations: collecting periodic certifications that employees understand and are following firm policies
• Communications supervision: reviewing employee correspondence to catch misconduct before it becomes an exam finding

These aren't independent checkboxes. An employee who trades ahead of a client order, fails to disclose an outside account, and conducts that discussion over a personal text thread has touched all three at once. That's why broker-dealer compliance programs treat them as a connected program, not separate tasks.

The regulatory framework governing associated persons

Several FINRA rules create obligations at the individual employee level, beyond the firm level. Understanding which is which matters for building a compliance program that actually holds.

Key FINRA rules governing broker-dealer employee compliance

The pattern is consistent: the firm owns the supervisory infrastructure, but individual employees carry disclosure and consent obligations of their own.

Personal trading compliance for broker-dealer employees

Personal trading compliance software sits at the intersection of what employees are required to do and what firms are required to verify. The obligations run in both directions.

For employees, the starting point is account disclosure. Under FINRA Rule 3210, an associated person must get prior written consent from their employer before opening an account at another broker-dealer or financial institution where securities transactions can occur. If the account existed before the person joined the firm, they have 30 calendar days to get that consent retroactively. From there, they must notify the executing firm of their association with their employer member.

Once accounts are disclosed, most firms layer on additional controls:

• Pre-clearance: employees submit a request before executing a trade, which compliance reviews against restricted lists, watch lists, and existing client positions.
• Restricted and watch lists: securities tied to material nonpublic information are blocked or flagged, often automatically.
• Holding periods: some firms require employees to hold securities for a minimum period before selling, reducing short-term opportunistic trading.
• Duplicate confirmations and statements: under Rule 3210, the executing firm must send copies of confirms and account statements to the employer firm upon request.

Receiving duplicate confirms without reviewing them is not compliance. Regulators expect firms to show that personal trading data feeds into active surveillance, not a filing cabinet.

Outside business activities and private securities transactions

Under current rules, registered persons must notify their firms in writing before taking on any outside business activity, and all associated persons must do the same before engaging in private securities transactions. If a firm approves a private securities transaction where the associated person receives selling compensation, the firm must record and supervise it as if it were executed on behalf of the firm itself.

That framework is changing, much like the shifting expectations around cybersecurity as a compliance risk. On Sept. 15, 2026, the SEC approved new FINRA Rule 3290, which will replace Rules 3270 and 3280 with a single outside activities framework. The new rule narrows reporting obligations for registered persons to investment-related activities, and treats affiliated and unaffiliated roles differently. FINRA has not announced an effective date, so firms must continue complying with 3270 and 3280 while also beginning to map affected activities and personnel under the new structure.

How attestations function in a broker-dealer compliance program

Attestations are how firms create a paper trail proving that employees know the rules and have confirmed compliance with them at a specific point in time. They don't prevent misconduct on their own, but they build accountability and give regulators something concrete to review.

Common broker-dealer attestations include:

• Code of ethics acknowledgment: employees confirm they've read and understood the firm's ethics policies, usually at onboarding and annually thereafter.
• Annual compliance certification: a broader acknowledgment that the employee has complied with firm policies over the past year, covering trading, conflicts, and conduct.
• Outside business activity disclosure: employees attest that any outside activities have been reported to the firm and approved.
• Gifts and entertainment: employees confirm that anything given or received falls within firm policy limits.
• Political contribution disclosure: employees certify any political contributions to avoid pay-to-play violations.

At the firm level, FINRA Rule 3130 requires the CEO to certify annually that the firm has processes to build, maintain, review, test, and modify its written compliance policies and supervisory procedures. That certification sits above the employee layer, but depends on it. If employees aren't attesting accurately, the CEO's certification rests on shaky ground.

Written supervisory procedures and the attestation lifecycle

WSPs are where attestation obligations take concrete shape. The WSP defines who is responsible for collecting attestations, how frequently, what triggers an exception review, and how the firm documents completion. Without that structure in writing, a firm can't show an examiner that its attestation program is reasonably designed.

A typical attestation lifecycle inside a broker-dealer's WSP looks something like this:

• Issuance: compliance sends the attestation request through a configured workflow with a defined deadline.
• Tracking: completion rates are monitored in real time, flagging employees who haven't responded as the deadline approaches.
• Escalation: non-responses are routed to a supervisor or the CCO, with documentation of the escalation itself.
• Exception handling: disclosures outside policy limits are logged and routed for review before the attestation is marked complete.
• Recordkeeping: completed attestations are retained in a WORM-compliant archive, accessible for regulatory exams.

Regulators want more than proof that attestations were collected. They want the full audit trail: who attested, when, whether anyone was late, and how exceptions were resolved.

Communications supervision under FINRA Rule 3110

FINRA Rule 3110(b)(4) requires a registered principal to review incoming, outgoing, and internal communications and document that review in writing. The rule covers email, instant messages, and any other channel employees use to conduct business, which means compliance teams need to capture far more than a firm's official email system.

In practice, a principal reviews a sample of communications on a defined cadence, flags anything that warrants follow-up, and documents both the review and its outcome. The documentation piece matters as much as the review itself, which is why firms rely on dedicated communications archiving and supervision systems.

The enforcement record speaks for itself. Most of those cases share a common thread: employees used personal devices or apps the firm never captured, so the review never happened.

The challenge of off-channel and mobile communications

Personal devices are where compliance programs most often break down. An employee who uses WhatsApp to discuss a trade, sends a deal-related iMessage, or coordinates with a client over Signal has created a business record. Whether the firm captures it is a separate question.

SEC Rule 17a-4 and FINRA Rule 4511 both require broker-dealers to retain business-related electronic communications in a tamper-proof, retrievable format. The obligation applies to any communication that relates to the firm's business, regardless of which device or app it traveled through. Firms are expected to have policies restricting unapproved channels and controls that actually enforce those policies.

The enforcement record shows how seriously regulators treat gaps here. Since 2021, the SEC and FINRA have collected more than $3.5 billion in fines tied to off-channel communications failures, largely because firms had written policies against personal device use while supervisors were actively using those same channels and nothing was being captured, a gap that often explains compliance bottlenecks in financial firms.

Closing the gap requires two things working together: approved channels with archiving built in, and a supervision workflow that actually processes what gets captured.

How AI is being used compliantly in broker-dealer supervision

Firms are using AI for communications surveillance, personal trade monitoring, pattern detection in attestation completion, and risk scoring of employee activity. The question is how to deploy these tools in a way that holds up to regulatory scrutiny, which is really a question of AI compliance architecture.

FINRA's position is straightforward: its rules are tech-neutral. As the 2026 FINRA Annual Regulatory Oversight Report states, "if a firm is relying on GenAI tools as part of its supervisory system, its policies and procedures may consider the integrity, reliability and accuracy of the AI model." FINRA Regulatory Notice 24-09 reinforced this, confirming no new requirements were created.

In practice, compliant AI deployment keeps human accountability in the picture. AI can flag a communication for review, but a registered principal still documents the outcome. AI can surface a personal trade outside firm parameters within a broader trade compliance software setup, but a compliance officer still adjudicates the exception. The firm's WSPs need to explain how AI fits into that workflow and what happens when the model produces a false positive.

"FINRA's rules, which are intended to be technologically neutral, and the securities laws more generally, continue to apply when firms use GenAI or similar technologies in the course of their businesses, just as they apply when firms use any other technology or tool." FINRA, 2026 Annual Regulatory Oversight Report

Common gaps in broker-dealer employee compliance programs

Examination findings tend to cluster around the same weak points, year after year. If you're auditing your own program, these are the areas worth stress-testing first.

• Communications supervision that relies entirely on random sampling. Picking 5% of emails each month satisfies the letter of the requirement but misses concentrated risk. Regulators increasingly expect firms to show how their sampling methodology targets higher-risk employees, channels, and activity patterns.
• Stale or missing attestations. A code of ethics acknowledgment from three years ago tells an examiner that your program ran once, not that it runs continuously. Completion tracking and escalation for non-responses need to be documented in the WSP, not improvised.
• Incomplete personal trading coverage. Firms often monitor accounts they know about. The problem is accounts they don't. Employees who fail to disclose a brokerage account at another institution aren't in the system, so no surveillance runs on them. The gap isn't in the monitoring tool; it's in the disclosure process upstream.
• Outside business activity approvals with no follow-through. Firms collect OBA notifications but don't always document the review, record the decision, or reassess when circumstances change, a symptom of operating without a true system of action.
• Supervisory documentation that proves review happened but not what was done about it. A principal signing off on a communication review log without any notation of findings is difficult to defend on exam.

How Greenboard supports broker-dealer employee compliance

Greenboard is built around exactly this structure: personal trading, attestations, and communications supervision managed together in one place, alongside firm compliance software, instead of spread across disconnected tools.

On the personal trading side, brokerage feeds come in through direct integrations, the CFPB 1033 API, and AI-powered statement extraction, covering both brokerage and crypto accounts. Pre-clearance requests route automatically against restricted lists and existing positions. Accounts that fall outside firm policy are flagged before trading happens, and the full audit trail is retained in a WORM-compliant archive.

Attestation workflows cover code of ethics, outside business activities, gifts and entertainment, political contributions, and private investments. Completion is tracked in real time, non-responses escalate automatically, and every exception is logged and routed for review before the attestation closes. Regulators get a full record, far more than a count of who signed.

For communications supervision, AI replaces random sampling by analyzing the full corpus and surfacing higher-risk content for principal review. The principal still documents the outcome. The system handles signal detection; the accountability stays with the human.

More than 600 financial firms run their compliance programs on Greenboard, with over 99% customer retention. If your broker-dealer compliance program feels like three separate problems, book a 15-minute demo to see what they look like managed as one.

Final thoughts on personal trading and attestation compliance for broker-dealers

Broker-dealer employee compliance is one of the more documentation-heavy disciplines in financial services, and the enforcement data backs up why that matters. Your off-channel communications policy, your attestation completion rates, and your personal trading surveillance all get stress-tested the same way during an exam. The firms that hold up well are the ones that treat these as a single program with a single paper trail.

FAQ

What does broker-dealer employee compliance actually require at the individual level?

Broker-dealer employee compliance requires each associated person to disclose accounts, obtain prior written consent before opening accounts at other broker-dealers or financial institutions under FINRA Rule 3210, submit pre-clearance requests before trading, and complete periodic attestations covering the code of ethics, outside business activities, gifts and entertainment, and political contributions. The obligations run both ways: the firm owns the supervisory infrastructure, and individual employees carry their own disclosure and consent obligations.

Can broker-dealers use AI for communications supervision and personal trade monitoring under FINRA rules?

Yes. FINRA's rules are tech-neutral, so AI can be deployed for communications surveillance, personal trade monitoring, and risk scoring without triggering new regulatory requirements, as confirmed in FINRA Regulatory Notice 24-09 and the 2026 FINRA Annual Regulatory Oversight Report. The firm's written supervisory procedures need to explain how AI fits into the workflow, and a registered principal still reviews flagged content and documents the outcome. AI handles signal detection; accountability stays with the human.

How do I build a broker-dealer attestation program that holds up on exam?

Start with your written supervisory procedures: define who collects each attestation, how frequently, what triggers an exception review, and how the firm documents completion. Regulators want the full audit trail, including who attested, when, whether anyone was late, and how exceptions were resolved, so tracking completion in real time and escalating non-responses with documented follow-through matters as much as collecting the attestations themselves.

What are the most common gaps in personal trading compliance at broker-dealers?

The most common gap is incomplete account coverage: firms monitor accounts they know about, but employees who never disclosed a brokerage account at another institution are invisible to surveillance entirely. The problem sits upstream in the disclosure process, not in the monitoring tool. Receiving duplicate confirmations and statements without running active surveillance against them carries the same risk, since regulators expect personal trading data to feed a live review process.

When should a broker-dealer update its WSPs to reflect FINRA Rule 3290?

Firms should begin mapping affected activities and personnel under Rule 3290 now, even though FINRA has not announced an effective date. Rule 3290 will replace Rules 3270 and 3280 with a single outside activities framework that narrows reporting obligations for registered persons to investment-related activities and treats affiliated and unaffiliated roles differently. Updating your WSPs before the effective date, and not scrambling after it, is how you stay exam-ready through the transition.