Structuring SEC Supervision and Recordkeeping Programs

Getting cited for supervision deficiencies rarely comes from not having policies. It comes from policies that weren't updated, reviews that weren't documented, or records that can't be produced on request. Here's how to build a program that holds up when it counts.

TLDR:

• Your WSP must name specific roles, review cadences, and escalation paths. A generic template won't hold up in an exam.
• Every channel where business is discussed creates a recordkeeping obligation, including WhatsApp, iMessage, and social media.
• The SEC endorses a risk-based supervision model where review intensity scales with personnel history, product complexity, and conflict exposure.
• Rule 204-2 and Rule 17a-4 set retention periods ranging from three years to the life of the firm, and records must be stored in WORM-compliant format.
• Greenboard runs archiving, supervision, marketing review, and employee compliance controls in one unified system with WORM-based, 17a-4-compliant storage.

Why an SEC supervision program matters for your firm

Supervision is one of the first things the SEC looks for in an examination. Under Exchange Act Section 15(b) and Advisers Act Section 203(e), firms are required to supervise their personnel, and that obligation is treated as a bedrock compliance requirement. FINRA Rule 3110 spells out similar requirements for broker-dealers, mandating written procedures, assigned principals, and documented reviews.

When the Division of Examinations flags supervision deficiencies, the issues are usually structural: no written supervisory procedures, poorly defined responsibility chains, or reviews that happen on paper but not in practice. The SEC has been explicit that a supervision program only counts if it's actually working. A policy document sitting in a folder satisfies nothing if nobody follows it, and this is often where compliance becomes a bottleneck in financial firms.

A well-built supervision program gives your chief compliance officer a defensible record showing that the firm identified risks, assigned oversight, and acted on what it found. The cost of the alternative is concrete: the SEC has brought enforcement actions where firms faced censure, fines, and required undertakings precisely because supervisory procedures existed on paper but couldn't be proven in practice. In several of those cases, the underlying conduct was relatively minor. What drove the penalty higher was the firm's inability to show that any real oversight had occurred. A defensible record is more than a regulatory courtesy. It's the difference between a comment letter and a formal order.

The regulatory framework: SEC and FINRA rules that govern supervision

The rules governing supervision aren't uniform across firm types, so the starting point is knowing which ones apply to you.

Investment advisers

Rule 206(4)-7 under the Investment Advisers Act requires registered investment advisers to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act. The SEC treats this as the foundation of any adviser's compliance program.

Broker-dealers

Exchange Act Section 15(b)(4) holds broker-dealers accountable for supervising associated persons. Rule 17a-11 sets notification requirements when a firm falls out of compliance with financial or procedural standards.

FINRA member firms

FINRA Rule 3110 requires member firms to maintain written supervisory procedures, designate qualified principals, and conduct documented reviews. Rule 3120 goes further, requiring a supervisory control system with annual testing and a written report to senior management.

Firms registered with both the SEC and FINRA carry obligations under all of these, and the overlap is real. A broker-dealer that also manages advisory accounts needs procedures that satisfy both Rule 206(4)-7 and Rule 3110, with no gaps between them.

What a written supervisory procedures document must cover

A Written Supervisory Procedures (WSP) document is the practical core of any supervision program. Regulators expect it to reflect what your firm actually does, not a generic template downloaded from the internet.

At minimum, a WSP should cover:

• Each business activity the firm conducts and the supervisory procedures assigned to it
• The name or role of the person responsible for each supervisory function
• How reviews are conducted, how often, and how findings are documented
• Procedures for escalating issues and taking corrective action

Two things consistently get firms in trouble. WSPs that haven't been updated after a regulatory change or a shift in business activities, and procedures that exist but aren't accessible to the people doing the supervision. If a principal can't find the relevant section when they need it, the document isn't functioning as intended, which is why many firms turn to dedicated firm compliance tooling to keep procedures current and accessible.

How to assign supervisory responsibilities across your firm

Assigning supervisory responsibility sounds straightforward until you actually try to document it. Regulators aren't looking for an org chart. They want evidence that named individuals have the authority, time, and access to supervise the people and activities they're responsible for.

The key distinction is between direct supervision and overall supervisory responsibility. A branch manager exercising daily oversight of registered representatives is a direct supervisor. A chief compliance officer owning the supervisory control system as a whole carries overall responsibility. Both roles need to be documented, but they carry different obligations and different exposure when something goes wrong.

A few things regulators consistently check when reviewing responsibility assignments:

• Whether each assigned supervisor actually has the authority to act, beyond holding a title
• Whether supervisory capacity is realistic given the person's other responsibilities
• Whether the assignment is current, since people change roles and the WSP often doesn't catch up
• Whether there's a documented backup when a designated supervisor is unavailable

One place firms get caught is dual-hatting. When someone is both producing revenue and supervising the people generating it, that creates a structural conflict. The SEC has called this out repeatedly in examination findings. If that structure exists at your firm, the WSP needs to explain how the conflict is managed, and your reviews need to show that oversight is genuine, a shift captured in what some firms now call a system of action for compliance.

Building your books and records compliance foundation

Books and records sit underneath every other part of your supervision program. If you can't produce a record, the activity it documents effectively didn't happen in a regulator's eyes.

The two primary rules are Rule 204-2 for investment advisers and Rule 17a-4 for broker-dealers. Rule 204-2 requires advisers to retain records including trade orders, account statements, written agreements, and communications related to recommendations. Rule 17a-4 covers broker-dealers and sets specific storage requirements: records must be kept in a non-rewriteable, non-erasable format, which is what WORM (write once, read many) means in practice. Certain records must be kept for six years, others for three, and some for the life of the firm.

WORM-compliant storage means records can be written once and read repeatedly, but never altered or deleted before the retention period expires. Regulators can and do request records in original, unaltered form during exams. A system that allows edits, even accidental ones, doesn't meet the standard.

Electronic communications: capture, retention, and supervision requirements

Electronic communications have become one of the most closely reviewed areas in SEC and FINRA exams, and the gap between what firms think they're capturing and what regulators expect is often wide.

Any channel personnel use to conduct business creates a recordkeeping obligation. That includes email, but also instant messaging apps, text messages, social media, and third-party apps like WhatsApp or iMessage. The rule doesn't care which app your advisors prefer. If business is discussed there, it needs to be captured and retained in a proper communications archive.

The 2022 SEC amendments to Rule 17a-4 updated the electronic recordkeeping framework in a few meaningful ways. Firms can now use third-party audit trail systems as an alternative to traditional WORM storage, provided the system meets specific requirements, including the ability to download records promptly and produce them to regulators on request. That flexibility doesn't loosen the underlying obligation. It just expands how firms can satisfy it.

Retention alone isn't enough. Once records are captured, supervision review obligations attach. Firms need documented procedures for how electronic communications are reviewed, by whom, and how frequently. Random sampling has been the default approach for years, but regulators have grown skeptical of programs where sampling rates are low and review documentation is thin. If your supervision log shows the same number of reviewed messages every quarter regardless of volume, that's a pattern examiners notice.

How to design a risk-based supervision framework

The SEC has been clear that applying identical scrutiny to every employee, account, and business line isn't what regulators are looking for. The Division of Examinations has endorsed a risk-based approach where supervisory intensity scales with actual risk exposure.

In practice, that means categorizing personnel and activities by risk level and directing your review resources accordingly. A new registered rep with a complaint history warrants closer review than a tenured analyst in a back-office role. Your WSP needs to document how those risk tiers were determined, and the reasoning behind them. Regulators want to see the rationale behind your allocation of supervisory resources, because that reasoning is what makes the program defensible when outcomes are questioned.

A few factors that typically drive risk tiering:

• Personnel history, including complaints, disclosures, and prior disciplinary action
• Product complexity and potential for customer harm
• Compensation structures that could create conflicts
• Business line growth rate or recent material changes
• Geographic or structural distance from direct oversight

Random sampling doesn't disappear entirely in a risk-based model, but it becomes one tool among several, especially as firms adopt AI in securities compliance to scale review coverage. Higher-risk categories get targeted review; lower-risk categories may still receive periodic sampling to catch issues that risk scoring missed.

Marketing compliance as part of supervision: the SEC marketing rule

Marketing compliance review is a supervisory function, not a separate process. Under Rule 206(4)-1, investment advisers must have written policies and procedures governing how advertisements are reviewed and approved before they go out. That review process, and its documentation, is part of your supervision program.

The Marketing Rule covers a wide range of content: performance presentations, testimonials, endorsements, social media posts, and third-party ratings. For broker-dealers, FINRA Rule 2210 adds its own layer, requiring principal pre-approval for most retail communications before use.

What often gets overlooked is the recordkeeping side. Firms need to retain copies of advertisements and the records of who reviewed them, when, and what changes were made. A marketing piece that was approved but has no documented review trail creates an exam problem even if the content itself was fine.

Your review workflow needs to generate a full record, beyond the approval itself. Who flagged an issue, who resolved it, and on what basis are exactly the questions examiners ask. If that information lives in email threads or informal conversations, it's hard to produce on request.

Employee compliance controls: trading, attestations, and outside activities

Employee compliance controls sit at the intersection of your supervision program and your books and records. When regulators review personal trading, outside activities, or conflicts of interest, they're looking for two things: a documented policy and evidence that people actually followed it, which is the core function of personal trading compliance software.

Personal trading and pre-clearance

Rule 17j-1 for investment company personnel and Rule 204A-1 for advisers require firms to maintain a code of ethics covering personal securities trading. Pre-clearance is the mechanism that makes the policy real. Employees request approval before trading in covered securities, and the firm documents whether approval was granted, denied, or conditionally approved. Common gaps regulators find here include pre-clearance logs that weren't kept consistently, or approval records that don't document the basis for the decision.

Attestations, OBAs, and other disclosures

Code of ethics attestations need to happen on a documented schedule, with a record of who attested, when, and for what period. Outside business activity disclosures require the same treatment. An employee submitting an OBA form doesn't close the loop. The firm needs a record showing the disclosure was reviewed, assessed for conflicts, and either approved or escalated.

Gifts and entertainment logs and political contribution filings carry similar documentation requirements. Each of these connects back to your WSP, where the review and recordkeeping procedures for each control should be written out explicitly.

Annual review and testing requirements for your supervision program

Rule 206(4)-7 requires investment advisers to review their written policies and procedures at least annually. FINRA Rule 3120 goes further for broker-dealers, requiring a supervisory control system with annual testing and a written report delivered to senior management.

What regulators want to see from that review is specific. A compliant annual review should document:

• Which policies and procedures were tested and how
• Who conducted the testing and what their scope was
• What deficiencies or gaps were identified
• What corrective action was taken and when

The written report to senior management under Rule 3120 must include actual testing results. A short memo saying everything looked fine won't satisfy the rule unless the underlying testing records back it up, a lesson that also applies as cybersecurity becomes a core compliance risk for examiners.

One area examiners look at closely is whether the review is genuinely independent. If the same person responsible for a procedure is also signing off on whether it works, that's a red flag. Firms don't always need outside help, but the review process should give the tester enough distance to catch real problems.

Remediation documentation matters as much as the findings themselves. Identifying a gap is only half the work. Examiners expect to see that issues were tracked to resolution, with dates, responsible parties, and follow-up confirmation that the fix held.

Common supervision program deficiencies the SEC flags in examinations

The SEC's Division of Examinations has published risk alerts on supervision practices, and the deficiency patterns are consistent across firm types. Knowing what examiners find most often is the fastest way to audit your own program.

The most frequently cited issues include:

• WSPs that haven't been updated after regulatory changes or changes in business activities
• Failure to capture electronic communications across all channels where business is conducted
• Inadequate supervision of branch offices or remote personnel, where review documentation is thin or missing
• Supervisory review logs that exist but lack specifics, showing that reviews occurred without documenting what was found or how issues were resolved
• Dual-hatting arrangements with no documented conflict management

The SEC's supervision risk alert and published examination findings on adviser supervision practices both point to one underlying theme: the gap between written policy and actual practice. Firms tend to build procedures that look right on paper, then fail to generate the records showing those procedures ran in real time.

How Greenboard unifies supervision and books and records in one system

Fragmented tools are the most common root cause behind the deficiencies covered in this article. When archiving lives in one system, trade monitoring in a spreadsheet, and WSP tracking in a shared drive, the gaps between them are exactly where examination findings happen.

Greenboard brings communications archiving, AI-powered supervision, employee compliance controls, marketing review, and firm compliance operations onto one integrated system. The archive is WORM-based and 17a-4 compliant. Supervision replaces random sampling with AI review that catches more issues with fewer false positives. Marketing review runs AI pre-checks in seven seconds, with documented approval logs that satisfy the recordkeeping requirements under both Rule 206(4)-1 and FINRA Rule 2210. Employee compliance handles pre-clearance, attestations, OBA disclosures, and gifts and entertainment logs in the same place, with audit trails that connect back to your WSP.

More than 600 financial firms run their compliance programs on Greenboard, with over 99% customer retention. Customers have reported roughly 24 hours saved per week on marketing review alone. The goal is giving your compliance team a defensible, unified record that holds up when examiners ask to see it.

Final thoughts on SEC supervision programs and recordkeeping requirements

Most supervision deficiencies the SEC flags aren't about bad intentions. They're about records that didn't get made, procedures that weren't updated, or review logs that documented activity without capturing what was actually found. Your program is only as strong as what you can show an examiner, so building the record in real time is the whole game.

FAQ

What does a modern SEC supervision program actually need to include?

A defensible SEC supervision program requires four things working together: written supervisory procedures that reflect your actual business activities, named individuals with genuine authority to act, documented evidence that reviews ran in practice, and books and records that can be produced on request in original, unaltered form. The gap regulators find most often is between written policy and what the firm can prove happened.

How do I automate SEC communication archiving and supervision for a growing wealth management firm?

Start by auditing every channel where your personnel conduct business, including email, Slack, Teams, SMS, WhatsApp, and LinkedIn, because Rule 204-2 and Rule 17a-4 attach recordkeeping obligations to any channel used for business discussions. From there, you need a capture layer that pulls all those channels into a WORM-compliant archive, paired with a review layer that scales with message volume instead of relying on fixed random sampling. Firms running this on Greenboard have moved from manual, sampling-based review to AI-driven supervision that flags more real issues with fewer false positives across the full communications set.

Can a broker-dealer satisfy both Rule 3110 and Rule 206(4)-7 from one supervision program?

Yes, but the WSP needs to be written to cover both sets of obligations without gaps between them. Rule 3110 requires written supervisory procedures, designated principals, and documented reviews; Rule 206(4)-7 requires written policies and procedures reasonably designed to prevent Advisers Act violations. Firms registered with both the SEC and FINRA need procedures that map to each rule explicitly, with no reliance on one framework to cover the other.

How do small financial firms keep up with changing SEC recordkeeping requirements without a large compliance team?

The most practical approach is a single system that handles archiving, supervision, and books and records compliance in one place, so your team isn't manually piecing together outputs from separate tools every time a rule changes. Firms with small compliance teams are disproportionately exposed to the common deficiency patterns the SEC flags, like WSPs that go stale after regulatory changes, because there's no dedicated person tracking every amendment. A unified records foundation makes annual review and remediation considerably more manageable with limited headcount.

What RegTech platforms should a FINRA broker-dealer consider for full compliance coverage in 2026?

Any platform worth considering for full coverage needs to handle Rule 17a-4 WORM-compliant archiving, Rule 3110 supervisory controls, Rule 2210 marketing review, and employee compliance controls like pre-clearance and attestations, either natively or through documented integrations. Greenboard is built to cover all of those on one system, with a 17a-4 compliant archive, AI-powered supervision replacing random sampling, marketing review with documented approval logs, and employee compliance workflows that generate the audit trails examiners ask for. Point solutions that handle archiving or marketing review in isolation tend to leave the gaps between systems exactly where examination findings happen.