Quick Answer
Credible signs of prohibited trading require a reasonable investigation and appropriate escalation under the firm's procedures. Protect customers and markets with controls suited to the risk, preserve records, and assess each external reporting trigger separately. Supervisory liability turns on reasonable design and implementation, not a guarantee that every trading violation will be prevented.
The trading-desk supervisor is the firm's first line of defense against prohibited activity. The duty is not just to monitor but to act on what monitoring reveals. The Series 24 exam tests the escalation pathway as a process: how the supervisor identifies a problem, who gets notified, what gets preserved, and how the firm protects itself against a supervisory-failure charge.
What Triggers Escalation
A supervisor must recognize indications of prohibited activity from multiple sources:
| Source | Examples |
|---|---|
| Alerts and exception reports | Trade-surveillance flags for spoofing patterns, marking-the-close, layering, near-breakpoint orders, just-under wash-trade thresholds |
| Customer complaints | Complaints about fills, missed price improvement, unauthorized trades |
| Employee tips | Whistleblower reports from other traders, operations staff, or compliance |
| Regulatory inquiries | FINRA blue-sheet requests, SEC subpoenas, exchange surveillance referrals |
| Self-discovery | A trader's own escalation of an error or a suspected colleague misconduct |
The supervisor cannot ignore a credible indication on the ground that the underlying activity has not been definitively proven. The duty is to investigate, not to wait until proof emerges on its own.
The Three-Step Supervisory Response
Under the FINRA supervisory-system requirement and the conduct rules covered in this unit, the supervisor's response has three steps:
Step 1: Recognize
- Read exception reports promptly and completely
- Take customer complaints seriously, even if they appear minor
- Assess employee tips promptly and investigate credible concerns
A supervisor who dismisses a credible indication has already failed Step 1.
Step 2: Investigate
- Interview employees involved (the trader, the operations team, any witnesses)
- Pull tickets and trade records for the time period in question
- Review communications: emails, chats, recorded phone lines (if applicable under the Taping Rule)
- Cross-reference with trade-surveillance alerts, trade-blotter exceptions, and best-execution review
Document the investigation, decisions, and disposition under applicable recordkeeping requirements and firm procedures. A disposition memo is useful for a completed matter; an open investigation will instead have records of work and follow-up still in progress.
Step 3: Escalate
Based on the investigation, the supervisor escalates as appropriate.
Internal Escalation Pathway
| Step | Recipient | Trigger |
|---|---|---|
| 1 | Trading desk supervisor (the principal) | Initial finding |
| 2 | CCO (Chief Compliance Officer) | Confirmed concern requiring compliance review |
| 3 | Legal | Potential rule violation requiring legal analysis |
| 4 | Senior management | Material findings affecting firm-level decisions or external reporting |
| 5 | Audit committee / board | Where required by firm governance or external reporting obligations |
This table illustrates a firm's possible escalation structure; FINRA does not prescribe this exact sequence for every matter. Follow the firm's procedures and promptly involve the people appropriate to the issue's seriousness. Urgent concerns may require simultaneous escalation.
Exam Tip: Gotchas
- An unreasonable failure to investigate or escalate can be a separate supervisory violation. Assess the supervisor's responsibilities, warning signs, and response.
- Documentation is evidence, not immunity. A contemporaneous record helps establish what happened, but cannot cure an inadequate response by itself.
External Escalation and Reporting
Some findings trigger external reporting obligations:
| Trigger | Filing | Rule |
|---|---|---|
| Regulatory or disciplinary event affecting an associated person (criminal charge, regulatory action, customer complaint) | Form U4 amendment | FINRA registration rules, filed via Web CRD |
| Member firm disclosure events (regulatory action against the firm, written customer complaint alleging theft or misappropriation of any amount, etc.) | Regulatory event reporting | Filed quarterly or within 30 days depending on subsection |
| AML or fraud concerns | Suspicious Activity Report (SAR) | FinCEN filing; referenced by the FINRA AML compliance program rule |
| Manipulation or insider-trading patterns | Referral to FINRA, SEC, or the listing exchange | Supervisory escalation, exchange referrals |
A written customer complaint alleging theft, misappropriation, or forgery triggers the firm's regulatory event reporting obligation regardless of amount. Form U4 has separate disclosure criteria; not every complaint or arrest is reportable on that form. Assess suspicious transactions, including aggregated patterns, against the SAR criteria and threshold rather than assuming every unexplained transaction requires a filing.
Special Procedures for Manipulation or Front-Running Discoveries
When a supervisor discovers manipulation or front-running, the response includes additional procedural steps:
Control the Immediate Risk
Apply protective measures appropriate to the evidence and risk. These may include suspending a trader's access, restricting affected accounts or securities, disabling an algorithm, or requiring preapproval. A credible manipulation concern cannot be ignored, but there is no universal requirement to freeze all trading whenever a concern arises.
Preserve Records
The supervisor must preserve:
- Electronic communications (email, chat, recorded calls)
- Order tickets (paper and electronic)
- Trade blotter entries
- Surveillance alerts and exception reports
- Risk system snapshots (positions, P&L) at the time of the activity
Preservation must be immediate. The firm's IT and compliance teams should be alerted to apply a litigation hold on relevant data.
Document the Investigation
Under the broker-dealer books-and-records rules, the firm must memorialize:
- The investigation steps taken
- The findings
- The disposition (e.g., trader terminated, trade canceled, regulatory referral made)
Order tickets, blue sheets (regulatory data requests), and communications must be retained under the applicable broker-dealer retention periods.
Exam Tip: Gotchas
- Address the immediate risk while investigating. Trading restrictions may be necessary; their scope should fit the facts and protect customers and markets.
- Records must be preserved IMMEDIATELY upon discovery, not at the conclusion of the investigation. A litigation hold protects against spoliation claims if the matter goes to enforcement.
How Escalation Connects to the Supervisory-System Requirement
The FINRA supervisory-system requirement is the umbrella supervisory rule. It requires every member firm to establish, maintain, and enforce a system for supervising the activities of associated persons that is reasonably designed to achieve compliance with applicable rules.
Potential supervisory failures include:
- Unreasonable detection design or implementation: assess whether surveillance was reasonably designed, maintained, and enforced for the firm's business and known risks
- Unreasonable response to warning signs: assess whether the responsible supervisor investigated and acted appropriately on credible alerts
A trading violation may support charges under the applicable conduct rules. It does not automatically establish a separate supervisory violation. A firm or individual supervisor can be sanctioned when the evidence establishes an unreasonable supervisory failure within their responsibilities.
Detection must lead to a reasonable response. A rare violation does not excuse inadequate controls, but even a reasonably designed and enforced system may fail to detect particular misconduct.
Exam Tip: Gotchas
- Separate the trading violation from the supervisory analysis. Examine reasonable design, implementation, responsibilities, and response to warning signs.
- Reasonably designed does not mean infallible. Evidence that reasonable controls could not have detected a particular violation may support a defense; it is not itself an admission of supervisory failure.
- Personal liability under the supervisory-system requirement attaches to the supervisor, not just the firm. A principal who failed to escalate can be sanctioned individually.
What Should You Check on Exam Day?
- Can you describe the three-step response, recognize, investigate, escalate, and explain why failure to escalate is itself a supervisory failure?
- Do you know a written customer complaint alleging theft or misappropriation triggers a regulatory event reporting obligation regardless of the dollar amount?
- Can you select protective controls appropriate to the risk and preserve relevant records promptly?
- Can you apply the firm's escalation procedures while distinguishing reasonable supervision from guaranteed detection?