The Devil's in the Details. FINRA proposed new FINRA Rule 3190, Use of Third-Party Service Providers, is intended to clarify a firm’s obligations and supervisory responsibilities for outsourced arrangements.  The rule proposal was prompted by repeated questions from, and continued concerns expressed by, member firms about the risks related to outsourcing.  Accordingly, proposed new Rule 3190 will clarify obligations and supervisory responsibilities, while imposing additional restrictions and obligations that would apply solely to a clearing and carrying member firm and its third-party service provider arrangements . FINRA Contact. Patricia Albrecht, Office of General Counsel - (202) 728-8026. For further details, go to:   [FINRA RegNote 11-14, March 2011] For everyone else, here the full text - we've highlighted the salient references. I. Member Firms’ Responsibilities for Activities Outsourced to Third-Party Service Providers and Activities Requiring Registration and Qualification. Proposed FINRA Rule 3190(a)(1) clarifies that a member firm’s use of a third-party service provider (including any sub-vendor) to perform functions or activities related to the member firm’s business as a regulated broker-dealer does not relieve the firm of its obligation to comply with applicable securities laws and regulations and with applicable FINRA and MSRB rules. Proposed Supplementary Material .01 (Scope of Third-Party Service Provider) clarifies that the term “third-party service provider (including any sub-vendor)” shall include any person controlling, controlled by or under common control with a member firm, unless otherwise determined by FINRA.4 The proposed provision also prohibits a member firm from delegating its responsibilities for, or control over, any functions or activities performed by a third-party service provider. Proposed FINRA Rule 3190(a)(1) is consistent with FINRA’s current guidance that a member firm’s use of a third-party service provider for such activities does not relieve the firm of its ultimate  responsibility to achieve compliance with all applicable securities laws and regulations and FINRA and MSRB rules, and that the ultimate responsibility for supervision of outsourced activities lies with the firm.5 Additionally, FINRA Rule 3190(a)(3) clarifies that nothing in the proposed rule’s provisions shall be construed to permit any person to engage in activities that require registration and qualification under FINRA rules without obtaining the necessary registrations and qualifications. II. Member Firms’ Supervision and Due Diligence Analysis of Third-Party Service Providers. Proposed FINRA Rule 3190(a)(2) requires each member firm, pursuant to its obligations under FINRA rules, to establish and maintain a supervisory system and written procedures for any functions or activities performed by a third-party service provider that are reasonably designed to achieve compliance with applicable securities laws and regulations and applicable FINRA and MSRB rules. Additionally, proposed FINRA Rule 3190(b) requires that a member firm include in these supervisory procedures an ongoing due diligence analysis of each current or prospective third-party service provider to determine, at a minimum, whether: (1) the third-party service provider is capable of performing the activities being outsourced; and (2) with respect to any activities being outsourced, the member firm can achieve compliance with applicable securities laws and regulations and applicable FINRA and MSRB rules. These provisions are consistent with existing guidance noting that, if a member firm outsources activities, its supervisory system and written supervisory procedures required by NASD Rule 3010 (Supervision) must include supervisory procedures for its outsourcing practices to ensure such compliance and that those procedures should include, without limitation, conducting a due diligence analysis of all of its current or prospective third-party service providers to determine whether they are capable of performing the outsourced activities.6 III. Clearing or Carrying Member Firms’ Restrictions and Obligations Regarding Outsourced Activities. In addition to the requirements discussed above in proposed FINRA Rule 3190(a) and (b), the proposed rule imposes certain heightened requirements on a clearing or carrying member firm’s outsourcing arrangements. Given the additional responsibilities of a clearing or carrying member firm to protect customer funds and securities, these heightened requirements are designed to address concerns regarding the great potential harm that could result from its third-party service providers’ non-compliance (either accidental or intentional) with the federal securities laws and FINRA and MSRB rules. The involvement by improperly authorized or inadequately supervised persons may cause systemic risk and undermine investor confidence in the securities industry. As detailed further below, FINRA believes these concerns can be mitigated by requiring a clearing or carrying member firm to limit certain enumerated activities to persons directly subject to the control and supervision of the member firm, have additional supervisory procedures to oversee third-party service providers and notify FINRA of its outsourcing arrangements.

A. Restrictions Applicable to Certain Clearing or Carrying Member Firms’ Activities. Specifically, proposed FINRA Rule 3190(c) requires a clearing or carrying member firm to vest an associated person of the firm with the authority and responsibility for the following activities:

(1) the movement of customer or proprietary cash or securities; (2) the preparation of net capital or reserve formula computations; and (3) the adoption or execution of compliance or risk management systems.

However, pursuant to proposed FINRA Rule 3190(a)(3), the clearing or carrying member firm would have to vest authority and responsibility for any functions related to these activities that would require registration and qualification under FINRA rules with an associated person of the firm who has the necessary registrations and qualifications.

With respect to the movement of customer or proprietary cash or securities, FINRA has found this area to be subject to additional risk for errors, fraud or other violative conduct. The involvement of improperly authorized persons could, in certain circumstances, cause systemic risk and undermine investor confidence in the securities industry. FINRA believes these concerns would be mitigated by expressly limiting authority and responsibility for this activity to an associated person directly subject to the clearing or carrying member firm’s supervision and control. Accordingly, the proposed rule would require that persons responsible for the handling, transfer or disposition of cash or securities as they enter and flow from the firm be associated persons of the member firm.

Proposed Supplementary Material .02, Posting to Books and Records, clarifies that the restriction regarding the movement of funds or securities would not preclude a designated third-party service provider from posting items to a clearing or carrying member firm’s books or records, provided the firm reviews each posting prior to the close of the business day following the posting. In this regard, FINRA generally would permit the prompt supervisory review required by proposed Supplementary Material .02 to be performed by substantiation of financial balances and spot-check reviews of individual entries, rather than an actual sign off on each individual entry. FINRA believes that the proposed approach balances the need to protect the integrity of the clearing or carrying member firm’s books and records with the efficiencies of having the work performed by a third-party service provider.7

FINRA also has concerns about the use of third-party service providers in the preparation of net capital or reserve formula computations. The execution of the SEC’s financial responsibility rules8 enables firm management and regulators to ascertain the financial state of a firm and helps to ensure protection of customer assets. Accordingly, FINRA believes that a properly registered associated person of the clearing or carrying member firm should be directly responsible for this function. For purposes of proposed FINRA Rule 3190(c), FINRA would consider the performance of calculations in aid of the preparation of these computations to be ministerial functions that could be performed by a third-party service provider; however, the review and understanding of the  computations and the ability to explain the mechanics and rationale of the computations to FINRA staff would reside with the firm’s properly registered associated person vested with authority and responsibility for this function. With respect to the adoption or execution of compliance or risk management systems, the proposed rule does not prohibit a firm from using a third-party service provider or its systems as part of the member firm’s compliance and risk management solutions, provided the member firm adopts such services and systems in a manner consistent with the regulatory requirements as they apply in light of the firm’s size, businesses and business model, retains control over their implementation and use within the firm, and independently determines that they achieve compliance with the applicable securities laws and FINRA and MSRB rules. Further, basic calculations, logging or maintaining lists that are preparatory to creating related books and records and review of output from these systems could be performed by a third-party service provider; however, any analysis or conclusions based upon the data would have to be performed by an associated person of the firm.

B. Oversight of Third-Party Service Providers by Clearing or Carrying Member Firms. Proposed FINRA Rule 3190(d) requires that a clearing or carrying member firm include additional supervisory procedures that would: (1) enable the firm to take prompt corrective action where necessary to achieve compliance with applicable securities laws and regulations and with applicable FINRA and MSRB rules; and (2) require the firm to approve any transfer of duties by a third-party service provider to a sub-vendor. As with the restrictions in proposed FINRA Rule 3190(c), FINRA believes that these supplementary procedures will help prevent potential harm that could result from possible noncompliance by a clearing or carrying member firm’s third-party service provider with the federal securities laws and FINRA and MSRB rules

C. Notifications by Clearing or Carrying Member Firms. Proposed FINRA Rule 3190(e) requires a clearing or carrying member firm to notify FINRA within 30 calendar days after entering into any outsourcing agreement with a third-party service provider to perform any functions or activities related to the firm’s business as a regulated broker-dealer that is permitted to be outsourced pursuant to the proposed rule.9

Pursuant to proposed FINRA Rule 3190, a clearing or carrying member firm’s notification must include:

(1) the function(s) being performed by the third-party service provider; (2) the identity and location of the third-party service provider; (3) the identity of the third-party service provider’s regulator (if any); and (4) a description of any affiliation between the firm and the third-party service provider.

The clearing or carrying member firm also would be required to maintain a copy of each notification and any underlying written agreement(s) with the third-party service provider, in accordance with SEA Rule 17a-4(b).10

FINRA notes that proposed FINRA Rule 3190 and its heightened requirements for clearing or carrying member firms does not necessarily require a clearing or carrying member firm to alter any contracts with its third-party service providers. Nonetheless, a clearing or carrying member firm remains responsible for maintaining control over any outsourced activity and effecting any necessary changes to achieve compliance with the proposed rule’s requirements. Consequently, upon approval of proposed FINRA Rule 3190, FINRA would expect each clearing or carrying member firm to consider whether amendments or addendums to any such contracts would be necessary to comply with the rule’s requirements.11

IV. Exceptions to Proposed FINRA Rule 3190’s Requirements. Proposed FINRA Rule 3190 excepts from its requirements ministerial activities performed on behalf of a member firm, unless otherwise prohibited by applicable securities laws and regulations or applicable FINRA and MSRB rules, and clarifies that its provisions would not restrict activities performed pursuant to a carrying agreement  approved under FINRA Rule 4311 (Carrying Agreements).