FINRA published Regulatory Notice 26-14 in July proposing the biggest Rule 2210 change in years. The comment period closed September 11, and now FINRA decides whether to file with the SEC. The SEC still has to approve it, but the direction is clear enough that firms should start thinking about what it would mean operationally.
Short answer on what changes
Today, a registered principal signs off on most retail communications before they go out. If the proposal goes into effect, that blanket requirement is replaced with sign-off based on risk.
FINRA lists eight factors to weigh: how complex the product is, who wrote the content, whether it makes a recommendation, whether it promotes a third party, whether it’s aimed at a specific audience, whether it carries performance data, what platform it ran on, and whether you’ve had problems with that kind of content before.
Other proposed changes
- The static-versus-interactive social media split goes away. What matters instead is who wrote the post, where it ran, how it spread, and who saw it. Paid influencer content would therefore be evaluated under the same risk factors.
- The checklist for ads naming a specific investment gets deleted: whether you make a market in it, whether the writer owns it, the offer to send backup research. In its place, you may cite a past recommendation only if you present it fairly, which means you cannot show your winners and leave out the rest. Investment advisers already work under that standard.
- A new firm’s first-year filing clock would start at its first actual filing, not its registration date. FINRA’s own numbers: new firms wait an average of 111 business days before filing anything.
- Fund ads with self-published performance rankings could ship immediately and get filed within 10 business days, instead of sitting while FINRA reviews.
Why AI is driving this
About a third of the notice is about artificial intelligence. FINRA’s position on AI-generated content is unchanged: you own what your firm publishes, whether a person wrote it or a model did. A pre-approval requirement designed for reviewed brochures becomes difficult to operate when a tool can draft a hundred posts in an hour. Commenters went further and told FINRA the pre-approval rule is incompatible with using AI to review communications at all.
The notice also sets out what FINRA expects if you put generative AI inside your supervisory system. The tools have to be vetted, tested and monitored. Firms should have governance covering accuracy, hallucinations included, and data protection. And under the new risk factors, the qualifications of whoever supervises and validates the AI tool count the same way the qualifications of a human preparer would.
The notice also asks how firms would supervise and retain automatically generated messages: account balances, margin notifications, order status updates, price alerts, transaction confirmations. Those are communications too, and most firms have never treated them that way.
Post publication supervision
Removing pre-approval does not remove work, but instead moves it from before publication to after.
You still have to train your people on the procedures, keep records showing the training happened, review a sample of what went out after it ran, and produce evidence for FINRA that the program worked the way your procedures say it does.
When an examiner asks how a piece of content was approved today, you show the approval record. A name and a date. Under the proposal there is no signature to show, so you have to demonstrate that the training happened, that someone reviewed a sample after publication, and that someone acted when a problem turned up. Most firms are not building that file today.
Firms already running risk-based review for institutional communications have most of that machinery. The firms that pre-approve everything because it is simpler are the ones with the most to build, and FINRA is explicit that they do not have to. Members may keep pre-approving every retail communication if that is cheaper than building the program.
What to do now
There’s nothing urgent you need to act on. If your written supervisory procedures are based on the static versus interactive distinction, they may need to be revised if this proposal goes through.
