Supervisory Review of Representative Correspondence and Activity

Correspondence review is not a one-time gate like account approval. It is an ongoing duty that has to reach the communications that carry the most risk.

What Correspondence and Communications Must the Firm Review?

• These review procedures must be appropriate for the firm's business, its size, its structure, and its customers. That standard belongs to the correspondence-review procedures, not to the written supervisory procedures in general.
• Written supervisory procedures must provide for the review of incoming and outgoing correspondence, including electronic correspondence, and internal communications relating to the firm's investment banking or securities business.
• The review must be conducted by a registered principal and evidenced in writing, either electronically or on paper.
• The principal may delegate certain functions of that review to people who are not registered. Delegating a task does not delegate the duty: the principal stays ultimately responsible for every necessary supervisory review, and must take reasonable and appropriate action to see that a delegated function is properly carried out.
• Required review specifically extends to correspondence and communications that reflect customer complaints, customer instructions, and customer funds and securities.
• It also extends to any communication whose subject matter requires review under FINRA rules or the federal securities laws. That fourth category is open-ended, not a fixed list.

What Standard Makes a Review Sufficient?

• For transactions, a firm may use a reasonably designed, risk-based review system instead of a detailed review of each one, provided it focuses on the areas posing the greatest numbers and risks of violation.
• For correspondence, risk-based principles decide how far the firm's extra procedures reach beyond the four subject matters above. A firm whose procedures do not require every piece to be reviewed before use must instead provide education and training, document that training, and run surveillance and follow-up.
• Merely opening a communication does not satisfy the review requirement. The record must identify the reviewer, the item reviewed, and the date of review. It must also show the actions the firm took as a result of any significant regulatory issues the review identified. Those first three items always apply; the fourth one is conditional, so a clean review has no action to record.

Exam Tip: Gotchas

• A risk-based review system is permitted. Do not assume the review requirement means a principal must individually review every piece of correspondence or every transaction.
• "Conducted by a registered principal" does not mean only a registered person may touch the work. The principal may delegate functions to an unregistered person and remains responsible for the result.
• Opening or accessing a communication, without more, is not "review." The documentation must show who reviewed it, what was reviewed, and when.
• The action-taken entry is not unconditional. The rule ties it to the actions the firm took because the review found a significant regulatory issue. An answer saying every review record must show an action taken is wrong.

What Should You Check on Exam Day?

• Confirm the reviewer is a registered principal and the review is evidenced in writing, on paper or electronically. A delegated function performed by an unregistered person is allowed, as long as the principal stays responsible.
• Watch for a fact pattern where a principal only opened a message; that fails the review standard on its own.
• Confirm a described review system is risk-based and targets high-risk areas, not that it reviews every single item.
• Check whether the correspondence involves a complaint, an instruction, or customer funds and securities; those categories draw required review.