CEO Annual Certification

The CEO certification requirement is the top-of-firm sign-off. The internal supervisory controls requirement hands senior management the testing results; the CEO certification requirement puts the CEO's signature on a statement that the entire supervisory and compliance machine is in place. The exam tests two things constantly: that the CEO (not the CCO) signs the certification, and that the CEO must meet with the CCO before signing.

The CEO Annual Certification

Each member must have its chief executive officer (CEO) (or equivalent officer) certify annually that the firm has in place processes to:

• Establish written compliance policies and WSPs
• Maintain those policies and procedures
• Review them periodically
• Test them (the link to the internal supervisory controls requirement)
• Modify them in response to test results, regulatory changes, or business changes

The certification must be:

• In writing
• Dated
• Reasonably designed to achieve compliance with FINRA rules, MSRB rules, and federal securities laws

The prior year's certification sets the anniversary deadline for the next certification. A firm that certified on March 15 last year owes its next certification by March 15 this year.

Exam Tip: Gotchas

• The CEO personally signs the annual certification. They cannot delegate the certification itself to the CCO or in-house counsel. The CCO is who the CEO has the meeting with; the CEO is who certifies that the meeting occurred and that processes are in place.
• The certification is annual on a rolling anniversary, not on a calendar-year basis. Last year's certification date sets this year's deadline.

Designating the Chief Compliance Officer

Each member must designate one or more principals as chief compliance officer (CCO) and identify them to FINRA on Schedule A of Form BD. A firm may designate more than one CCO if each is a principal and the firm documents each CCO's area of primary compliance responsibility.

• The CCO must be a principal
• The designation is identified to FINRA; it is not a purely internal title
• The designation must stay in place, so a departing CCO must be replaced by another principal

The Required CEO-CCO Meeting

The CEO certification is not a paper-only exercise. The CEO certification requirement requires the CEO to certify that they met with the CCO within the preceding 12 months to discuss:

• The firm's processes for establishing, maintaining, reviewing, testing, and modifying policies and procedures
• The firm's compliance efforts during the preceding year
• Significant compliance problems, plans for emerging business areas, and the firm's response

The certification reflects the discussions and conclusions of this meeting. A CEO who never met with the CCO cannot honestly sign the certification.

Think of it this way: The CEO certification requirement forces the CEO and CCO into the same room at least once a year. The rule's drafters understood that compliance failures often start when senior management treats the CCO as a back-office function rather than a peer. Forcing an annual sit-down with documented topics is the structural fix.

Exam Tip: Gotchas

• The CEO must meet with the CCO; the CEO does not delegate the meeting. A meeting between the CCO and the chief operating officer does not satisfy the CEO certification requirement. The rule names the CEO specifically.
• The 12-month window is preceding, not concurrent. The meeting must have occurred sometime in the 12 months before the certification date.

The Report to the Board and Audit Committee

The certification process is documented in a report that the CEO, CCO, and other necessary officers review. The final report must be submitted to the firm's board of directors and audit committee (or equivalent bodies) at the earlier of their next scheduled meetings or within 45 days of the date the certification is executed.

A member that does not use those governing bodies is not subject to the board and audit committee report requirement.

The report typically includes:

• The substance of the CEO-CCO discussions
• The firm's compliance and supervisory program structure
• Significant issues raised during the meeting and the firm's response

Exam Tip: Gotchas

• 45 days is the outer limit for the board report, not the certification deadline. The certification is signed first; the report follows at the next scheduled board and audit committee meetings or within 45 days, whichever is earlier. The exam will sometimes pose a fact pattern where the firm certified on time but submitted the board report late, asking whether the firm violated the rule. It did.
• The CEO certification report goes to the board and audit committee; the supervisory control report goes to senior management. Senior management oversees daily operations; the board oversees the CEO. Each rule sends its report to the layer above the activity being reported on.

Why the Certification Matters

The personal signature of the CEO converts compliance from a back-office concern into a top-of-firm responsibility. A CEO who has signed an annual certification has personally attested that:

• WSPs and compliance policies exist
• A program is in place to test and modify them
• The CCO has communicated significant compliance issues
• The firm is taking action on those issues

Enforcement actions arising from supervisory failures often cite both the underlying supervisory-system defect and a related CEO certification problem (CEO signed despite knowing of unaddressed compliance issues, or CEO signed without holding the required CCO meeting).

What Should You Check on Exam Day?

• Do you know that only the CEO, not the CCO or in-house counsel, can sign the annual certification, even though the CEO meets with the CCO?
• Can you state the deadline for submitting the certification's supporting report to the board of directors and audit committee, at their next scheduled meetings or within 45 days, whichever is earlier?
• Do you know that each member must designate one or more principals as chief compliance officer and identify them to FINRA on Schedule A of Form BD?
• Do you know that the CEO-CCO meeting must occur within the preceding 12 months, and that the CEO cannot delegate the meeting itself?
• Can you explain why the certification deadline follows a rolling anniversary date rather than a fixed calendar-year schedule?