8.1 AML Program, Independent Testing, Training, and Governance

Investment Company and Variable Contracts Products Principal Series 26

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Registration of the Broker-Dealer and Its Associated Persons

1.1 Broker-Dealer Registration, FINRA Membership, and Firm Filings 1.2 Individual Registration: Forms U4 and U5, Registration Categories, and Exempt Persons 1.3 Pre-Hire Screening, Fingerprinting, and Statutory Disqualification 1.4 Heightened Supervision, Interim Plans, and the Taping Rule 1.5 Broker-Dealers, Investment Advisers, Dual Registrants, and Unregistered Entities

2 Chapter 2: Training, Continuing Education, and Product Knowledge

2.1 Continuing Education (Rule 1240), the Maintaining Qualifications Program, and the Annual Compliance Meeting 2.2 The Investment Company Act of 1940: Classifications, Registration, and Fund Governance 2.3 Mutual Fund Pricing, Redemption, Exchanges, Sales Charges, and Share Classes 2.4 Variable Annuities and Variable Life Insurance: Structure, Charges, and Rule 2320 2.5 Closed-End and Interval Funds, UITs, Money Market Funds, 529 Plans, and Investment Risks

3 Chapter 3: Supervisory System, Conduct Standards, Insider Trading, and Discipline

3.1 The Supervisory System, Written Supervisory Procedures, and Standards of Conduct 3.2 Insider Trading, Information Barriers, and Personal Trading Supervision 3.3 FINRA Investigations, Disciplinary Proceedings, Sanctions, and Exemptions

4 Chapter 4: Communications with the Public

4.1 Communications Categories, Principal Approval, Filing, and Recordkeeping (Rule 2210) 4.2 Content Standards, Investment Company Advertising, and Professional Designations 4.3 Variable Contract Communications, Fund Rankings, Bond Fund Volatility Ratings, and Investment Analysis Tools 4.4 Correspondence and Internal Communications, Social Media, Public Appearances, and Telemarketing

5 Chapter 5: Recommendations, Customer Accounts, and Product Sales Supervision

5.1 Regulation Best Interest, Conflicts, and Form CRS 5.2 Know Your Customer, FINRA Suitability, and Institutional Accounts 5.3 New Accounts, Customer Authority, Discretion, and Order Handling 5.4 Mutual Fund Breakpoints, Share Classes, and Switching Supervision 5.5 Deferred Variable Annuities and the Seven-Business-Day Principal Review 5.6 Prospectuses, Summary Prospectuses, SAIs, and Ongoing Disclosures

6 Chapter 6: Compensation, Outside Activities, and Personal Conduct

6.1 Cash Compensation, Distribution Arrangements, and Conflicts 6.2 Gifts, Gratuities, and Business Entertainment (Rule 3220) 6.3 Training Meetings, Sales Contests, and Non-Cash Compensation 6.4 Referral Payments, Bank Networking, and Unregistered Persons 6.5 Outside Business Activities, Private Securities Transactions, and Rule 3290 Transition 6.6 Outside Accounts, Borrowing and Lending, Account Sharing, and Guarantees

7 Chapter 7: Customer Account Operations, Transfers, and Privacy

7.1 Account Records, Trusted Contacts, Confirmations, and Statements 7.2 Cash Accounts, T+1 Settlement, Regulation T, Extensions, and Freeriding 7.3 ACATS Transfers, Transfer-on-Death Accounts, and Account Changes 7.4 Regulation S-P, Incident Response, Service Providers, and Identity Theft

8 Chapter 8: Anti-Money Laundering, Customer Identification, and Sanctions

8.1 AML Program, Independent Testing, Training, and Governance 8.2 Customer Identification, Due Diligence, and Beneficial Ownership 8.3 SARs, CTRs, OFAC, Information Sharing, and AML Red Flags

9 Chapter 9: Supervisory Controls, Business Continuity, and Regulatory Reporting

9.1 Supervisory Controls, Annual Testing, and CEO Certification 9.2 Business Continuity, Systems Resilience, Cybersecurity, and Vendors 9.3 Rule 4530, FOCUS and Annual Reports, and Customer-Asset Events

10 Chapter 10: Office Classifications, Inspections, and Records

10.1 OSJs, Branches, RSLs, and Inspection Cycles 10.2 Inspection Reports, Independent Review, Signage, and Office Files 10.3 Broker-Dealer Books and Records, Electronic Storage, and Correspondence

11 Chapter 11: Complaints, Arbitration, Mediation, and Expungement

11.1 Customer Complaints, Investigation, Retention, and Reporting 11.2 Predispute Agreements, Arbitration Codes, Eligibility, Panels, and Awards 11.3 Mediation and Customer-Dispute Expungement

12 Chapter 12: Financial Responsibility, Membership Changes, and Investor Protection

12.1 Net Capital, Minimum Tiers, Haircuts, and Early Warning 12.2 Customer Protection, Possession or Control, Reserve Formula, and Exemptions 12.3 New-Product Review and Continuing Membership Applications 12.4 SIPC, Fidelity Bonds, Proxy Materials, and Financial Reports

8.1 AML Program, Independent Testing, Training, and Governance

Key Takeaways Explain This Topic AI

Rule 3310 requires a written AML program approved in writing by senior management and reasonably designed for the firm's business and BSA risks.

The program includes internal policies and controls, independent testing, a designated AML compliance person, ongoing training, and risk-based customer due diligence.

Independent testing is generally annual (every two years for firms that do not execute customer transactions, hold customer accounts, or act as introducing brokers) and may not be performed by the AML compliance person or anyone who performs or reports to the tested functions.

The AML compliance contact information must be current in FINRA's contact system, and findings require documented correction and follow-up.

Last updated: September 2026

The Written Program

FINRA Rule 3310 requires each member to develop and implement a written anti-money laundering program reasonably designed to achieve and monitor compliance with the Bank Secrecy Act and its implementing regulations. Senior management must approve the program in writing. The program must reflect the firm's customers, products, account types, funding methods, distribution channels, geography, intermediaries and clearing or direct-business model.

The familiar laundering stages help organize risk: placement introduces illicit value, layering obscures ownership or origin through transactions, and integration returns apparently legitimate funds to the economy. Packaged-product red flags include indifference to surrender charges, rapid purchase and redemption, third-party funding, refunds to a different destination, repeated free-look cancellations, unexplained offshore wires and complex entity ownership with no business rationale.

Program Elements

Element Principal's evidence

Written policies and internal controls Risk assessment, monitoring scenarios, escalation, reporting and records tailored to the business

Independent testing Qualified independent tester, appropriate scope, findings, remediation and retest

AML compliance person Clear authority, resources and current contact information reported through FINRA's required system

Ongoing training Role-based instruction, current red flags, attendance and comprehension evidence

Customer due diligence Understanding customer relationships, beneficial owners where required, and ongoing monitoring and updating

Rule 3310(d) requires the member to designate the AML compliance person or persons, who must be associated persons of the member, to identify them to FINRA by name, title, mailing address, email address, telephone and fax number, and to notify FINRA promptly of any change; Rule 3310.02 applies the Rule 4517 annual review of that contact information. The designated person administers the program but does not absorb every supervisor's responsibility. Representatives and operations personnel must recognize and escalate activity; principals must review exceptions and ensure corrective action; senior management must fund and support the program.

Independent Testing Frequency and Independence

Testing is generally required each calendar year . A member that does not execute transactions for customers, hold customer accounts, or act as an introducing broker with respect to customer accounts may conduct testing every two calendar years . The firm should confirm that it actually satisfies the rule's conditions before using the longer cycle.

Testing may be conducted by member personnel or by a qualified outside party, and the tester must have a working knowledge of the Bank Secrecy Act requirements. Under Rule 3310.01 , testing may not be conducted by a person who performs the functions being tested, by the designated AML compliance person , or by anyone who reports to either of them. Firms should test more often than the minimum when circumstances warrant. Scope should follow risk and include governance, CIP, CDD, monitoring, SAR decision processes, CTR controls if currency is accepted, OFAC escalation, information sharing, training, record retention and prior remediation.

Training and Issue Closure

Training must be ongoing and appropriate to duties. A representative needs product-specific red flags and a confidential escalation channel. Operations personnel need controls for wires, checks, ownership changes and returned funds. Analysts need alert investigation and SAR confidentiality. Principals need case escalation, documentation, reporting timelines and anti-retaliation expectations.

An audit report is not closure. Management should assign an owner, risk rating and deadline; preserve evidence of correction; validate that data and systems changed as intended; and retest high-risk findings. Repeated overrides, a backlog of unresolved alerts, incomplete customer risk ratings, or a tester lacking access to data can make an apparently complete program unreasonable.

Supervisory Perspective

AML decisions should be based on the total pattern, not a single threshold. A transaction below a reporting amount can be suspicious; a transaction above a threshold is not necessarily illegal. The principal should prevent frontline personnel from telling a customer that a SAR is being considered and should route government and law-enforcement contacts through authorized staff.

Risk Assessment and Data Quality

The AML risk assessment should link inherent risk to specific controls and residual risk. Customer type, product liquidity, funding method, geography, intermediaries, transaction volume and remote onboarding all matter. A low-cash business can still face fraud, cyber-enabled account takeover, sanctions and rapid movement of redemption proceeds.

Monitoring is only as reliable as its data. Testing should reconcile alerts to orders, wires, ACH, checks, customer ownership and transfer-agent activity; confirm that excluded accounts were legitimately excluded; and challenge thresholds through below-threshold scenarios. A monitoring rule that never generates an alert can be a sign of bad data rather than low risk.

Governance includes timely escalation of backlogs. Management should know alert age, investigator capacity, high-risk customer reviews, overdue SAR decisions and repeat findings. Temporary staffing or system problems need documented compensating controls and a plan to clear risk in priority order.

Board or senior-management reporting should describe significant risk and remediation without exposing SAR information to unauthorized recipients. Metrics need context: fewer alerts may reflect lower risk, a broken data feed or an overly restrictive scenario.