FINRA Cyber Security and Reg S-ID for Broker-Dealers

A US broker-dealer has no single cyber security rule: its duties are spread across SEC Regulation S-ID, Regulation S-P, the Exchange Act recordkeeping rules and FINRA's supervision, continuity and reporting rules, and examiners test them together. This guide covers the parts that are specific to broker-dealers and are not about breach notification: the Regulation S-ID identity theft programme at 17 CFR 248.201 and 248.202, how its red flags apply to online account takeover and new account fraud, and the FINRA rules (3110, 4370, 4530) that examiners cite on cyber topics. It is for CCOs, CISOs, fraud and AML leads at FINRA member firms. The Regulation S-P incident response and 30 day notice regime is covered in the SEC Regulation S-P Amendments Guide, and the cross-sector Red Flags structure in the FTC Red Flags Rule.

Status checked 14 November 2026: Regulation S-ID text as shown on the eCFR (17 CFR Part 248, Subpart C); FINRA rule texts and the cybersecurity topic page on finra.org; FINRA's 2026 Annual Regulatory Oversight Report (published 9 December 2025). The SEC's 2023 proposed cybersecurity risk management rule for broker-dealers was withdrawn as of 17 June 2025 and imposes no obligation. This page is not legal advice.

Key takeaways

Reg S-ID is a programme rule: any broker-dealer that offers or maintains covered accounts needs a written Identity Theft Prevention Program, approved by the board or a board committee, that identifies, detects and responds to red flags and is updated as risks change.
Covered accounts are wider than retail: personal brokerage accounts that permit multiple payments or transactions are covered, and so is any other account with a reasonably foreseeable risk of identity theft, including operational, compliance, reputational or litigation risk.
Account takeover is a red flag problem: FINRA's oversight report links Reg S-ID directly to new account fraud, account takeover and third-party wire requests, and expects monitoring of unusual logins and new wire destinations.
FINRA rules carry the cyber load: examiners cite Rule 3110 (supervision), Rule 4370 (business continuity) and Exchange Act Rules 17a-3 and 17a-4 alongside Reg S-P and Reg S-ID; Rule 4530 adds 30 day reporting where a matter becomes a reportable event.
Help desks and contractors are the soft spot: the SEC's first Identity Theft Red Flags Rule action followed password resets obtained by impersonating contractors on a support line.

The broker-dealer cyber rule set

FINRA's cybersecurity topic page and the 2026 oversight report list the rules below. Only Reg S-ID and the FINRA rules are covered in depth here.

Rule	What it requires on cyber and identity	Where to read more
Regulation S-ID (17 CFR 248.201 to 248.202)	Written identity theft programme for covered accounts; card issuer change of address validation	This guide
Regulation S-P (17 CFR 248.30)	Written safeguards; incident response programme; customer notice within 30 days; service provider notice within 72 hours	SEC Regulation S-P Amendments Guide
FINRA Rule 3110 and 3120	Supervisory system and written supervisory procedures, including over technology, vendors and customer information	This guide
FINRA Rule 4370	Written business continuity plan with ten required elements, annual review, emergency contacts	This guide
FINRA Rule 4530	Reporting of specified events and internal conclusions of violations within 30 calendar days	This guide
Exchange Act Rules 17a-3 and 17a-4	Books and records, including electronic recordkeeping under 17a-4(f)	FINRA topic page
Regulation SCI	Systems compliance and integrity for SCI entities only	SEC Regulation SCI Guide
FINRA Rule 3310	AML programme, including suspicious activity reporting where cyber events involve suspicious transactions	FINRA topic page

For the wider picture across banking, insurance and state rules, see the Financial Services Cyber Regulation Map.

Regulation S-ID: scope and covered accounts

Section 248.201(a) applies to financial institutions and creditors, as defined in the Fair Credit Reporting Act, that are broker-dealers registered or required to register under the Exchange Act, registered investment companies, business development companies, employees' securities companies and registered investment advisers. A broker-dealer that holds customer accounts or makes payments on behalf of customers will normally meet the financial institution test, so the practical question is whether it offers or maintains covered accounts.

Covered account, first prong: an account offered or maintained primarily for personal, family or household purposes that involves or is designed to permit multiple payments or transactions. FINRA's oversight report gives brokerage accounts that allow wires to third parties as the example.
Covered account, second prong: any other account with a reasonably foreseeable risk of identity theft to customers or to the firm's safety and soundness, including financial, operational, compliance, reputation or litigation risks. Institutional and business accounts can fall here.
Identity theft: a fraud committed or attempted using the identifying information of another person without authority.
Red flag: a pattern, practice or specific activity that indicates the possible existence of identity theft.
Periodic determination (248.201(c)): firms must periodically decide whether they offer covered accounts, using a risk assessment that considers the methods provided to open accounts, the methods provided to access accounts, and previous experiences with identity theft. A new mobile app, an API for aggregators or a new digital onboarding flow changes the answer and should trigger a fresh assessment.

The four programme elements and administration

Section 248.201(d) requires a written programme, appropriate to the firm's size, complexity and activities, with reasonable policies and procedures to:

Identify relevant red flags for the firm's covered accounts and incorporate them into the programme.
Detect those red flags.
Respond appropriately to detected red flags to prevent and mitigate identity theft.
Update the programme periodically to reflect changes in risks to customers and to the firm.

Section 248.201(e) sets the administration duties. The board of directors or an appropriate board committee must approve the initial written programme; the board, a committee or a designated senior management employee must oversee development, implementation and administration; staff must be trained as necessary; and the firm must exercise appropriate and effective oversight of service provider arrangements. Appendix A, which firms must consider and adopt where appropriate (248.201(f)), says staff should report on compliance at least annually.

Card issuers: a broker-dealer that issues debit or credit cards must also follow 248.202. If a request for an additional or replacement card arrives within at least the first 30 days after a change of address notice, the card must not be issued until the address change is validated, by notifying the cardholder at the former address or through a previously agreed channel, or by another assessment under its programme. The notice must be clear and conspicuous and separate from regular correspondence.

Applying the red flags to digital account risk

Appendix A groups red flags into five categories: alerts from consumer reporting agencies or service providers; suspicious documents; suspicious personal identifying information; unusual use of, or suspicious activity on, a covered account; and notices from customers, victims, law enforcement or others. The table maps each to signals described in FINRA Regulatory Notice 21-18 and the 2026 oversight report. The notice states that it creates no new requirements; the practices are what firms told FINRA they use.

Appendix A category	Digital channel signal	Example response
Alerts and warnings	Fraud alert, credit freeze or address discrepancy from a consumer report; vendor identity verification failure	Step-up verification before opening or funding
Suspicious documents	Altered or forged ID; photo or video likeness check that does not match; GenAI-created identity documents	Decline or request further documents
Suspicious identifying information	SSN not issued or on the Death Master File; SSN, phone or email shared across applicants	Hold the application; link review across accounts
Unusual account activity	Login from a new device or location; spike in failed logins; email or bank details changed then a third-party wire requested; request for new credentials shortly after an address change	Adaptive authentication; confirmation call to the number on file; trading or fund restrictions
Notices from others	Customer reports an unknown account or transaction; another firm reports a profiting account	Freeze, investigate, use FINRA's compromised accounts checklist

Authentication: Notice 21-18 describes MFA, adaptive authentication triggered by risk thresholds, and a move away from email addresses as an authentication factor. The 2026 report lists MFA for firm systems, email and operational tools used by staff, contractors and customers as an effective practice.
Cross-account monitoring: credential stuffing shows up across many accounts at once, so firms in Notice 21-18 used web application firewalls, a "penalty box" for suspicious IP addresses, impossible travel checks and dark web scanning. See the Credential Stuffing Attack Response Playbook.
Linked trading fraud: Regulatory Notice 20-32 describes account takeover and new account fraud used to buy low-value, out-of-the-money options at inflated prices from a "profiting" account at another broker-dealer. Surveillance teams need to connect identity signals with trading signals.
Account recovery: recovery is an account opening in disguise. Notice 21-18 describes time-limited SMS codes and call centre verification using less commonly available information. See the Account Takeover Prevention Guide and Account Takeover vs New Account Fraud.

FINRA supervision, continuity and reporting duties

Rule 3110 supervision: the supervisory system and written supervisory procedures must reach the controls that protect customer accounts. Regulatory Notice 20-32 asked firms to review whether their procedures address compromised customer records, and Notice 21-29 covers supervising outsourced functions. In practice examiners look for named supervisors of identity verification, fraud alerts and vendor-run controls.

Rule 4370 continuity: the written business continuity plan must cover ten elements, including data backup and recovery, all mission critical systems, alternate communications with customers and employees, regulatory reporting, communications with regulators, and how the firm will assure customers' prompt access to their funds and securities. A senior manager who is a registered principal approves it and the plan is reviewed annually. Ransomware scenarios test these elements directly, and FINRA Notice 22-29 addressed ransomware risk.

Rule 4530 reporting: the rule has no cyber incident category, but cyber events can produce reportable events. Members report within 30 calendar days written customer complaints alleging theft or misappropriation of funds or securities, or forgery (4530(a)(1)(B)), and internal conclusions of violations with widespread impact or material system failures (4530(b)). Customer complaint statistics are filed by the 15th day of the month after each quarter (4530(d)).

Cyber event	Rules that may be engaged	Clock
Unauthorised access to sensitive customer information	Reg S-P notice	No later than 30 days after awareness
Vendor breach of a customer information system	Reg S-P service provider duty	Vendor notice within 72 hours
Account takeover with stolen funds and a written complaint	FINRA Rule 4530(a)(1)(B); Reg S-ID response; AML review under Rule 3310	30 calendar days for 4530
Firm concludes a control failure violated rules with widespread impact	FINRA Rule 4530(b)	30 calendar days after the conclusion
Outage from ransomware	Rule 4370 plan execution; customer access to funds and securities	As the plan sets

Where identity fits: contractors, help desks and machine access

Contractor and help desk resets: in September 2018 the SEC settled its first action under the Identity Theft Red Flags Rule with Voya Financial Advisors. Intruders posed as the firm's independent contractors, called the support line to have passwords reset, and reached personal information of 5,600 customers; the firm also had not applied its procedures to systems used by its contractors. The firm agreed to a censure and a USD 1 million penalty without admitting or denying the findings. The lesson is that reset and recovery flows for representatives are in scope as much as customer flows. See the Vishing and Help Desk Social Engineering Awareness Guide.

Machine access to covered accounts: identity verification vendors, aggregators reaching accounts through APIs, and internal service accounts that can change addresses or bank details all touch covered accounts. Reg S-ID requires oversight of service provider arrangements, and an API key or service account that can change a customer's bank details is a high-value target. Give each one an owner, scope it to the minimum, log every change it makes to account details, and apply the same red flags to API-driven changes as to web logins. See the Service Account Security Guide.

GenAI-enabled fraud: the 2026 report lists synthetic media, fake identity documents and deepfake audio and video as emerging threats, so likeness checks and call-back controls should assume voices and faces can be faked. See the Deepfake-Resistant Identity Verification Guide.

Framework mapping

Obligation	NIST CSF 2.0	NIST SP 800-53 Rev 5
Identity proofing at account opening (Reg S-ID identify and detect)	PR.AA-02	IA-12
Customer and staff authentication, MFA	PR.AA-03	IA-2, IA-8
Account and credential management, including service accounts	PR.AA-01	AC-2
Monitoring for unusual account activity	DE.CM-03	SI-4
Service provider oversight	GV.SC-07	SA-9
Staff training (248.201(e)(3))	PR.AT-01	AT-2
Rule 4370 continuity	RC.RP-01	CP-2
Rule 4530 and Reg S-P notifications	RS.CO-02	IR-6

Implementation steps

Re-run the covered account determination: list every account type and every opening and access method (branch, web, app, API, call centre), and record the 248.201(c) risk assessment.
Refresh the red flag register: for each Appendix A category, list the signals your systems can actually detect, the owner and the response. Add GenAI document fraud and API-driven changes.
Close detection gaps: wire new device, failed login, contact detail change and new wire destination events into one case queue shared by fraud, cyber and AML, as the 2026 report suggests.
Harden recovery and resets: apply step-up verification to customer and representative resets, use call-backs to numbers on file, and include contractor systems.
Bind vendors: contract and monitor identity verification, aggregator and call centre providers under the service provider oversight duty and Reg S-P's 72 hour clause.
Get approval and train: take material changes to the board or committee, train staff who open accounts or handle resets, and record the annual compliance report.
Test: run a tabletop that starts with an account takeover and walks through Reg S-ID response, Reg S-P notice assessment, Rule 4530 and SAR decisions and Rule 4370 if systems go down.

Measure it: account takeover attempts detected before funds move (percentage), median time from red flag to account restriction, share of customer and representative logins protected by MFA, share of resets with step-up verification, and service accounts able to change customer details that have a named owner and change logging (target 100%).

Common failure patterns

A shelf programme: the written programme was approved years ago and never updated after new digital channels launched, breaching the 248.201(d)(2)(iv) update duty.
Customers only: representative and contractor credentials and support line resets sit outside the programme, the gap in the Voya action.
Siloed teams: fraud sees the wire, cyber sees the login and AML sees neither, so the pattern is missed.
Email as a factor: email changes and email-based approvals are trusted, despite FINRA notices on verifying emailed instructions and impersonation.
Unowned machine access: integration accounts that can change bank details are not inventoried or monitored.

Practitioner checklist

Written covered account determination with the three 248.201(c) factors, dated and current.
Board or committee approval of the programme on file, with a named senior overseer.
Red flag register mapped to the five Appendix A categories, with detection source and response.
MFA and adaptive authentication for customers, staff and contractors.
Step-up verification on all password resets and contact or bank detail changes.
Service provider list for identity, aggregation and call centre functions, with oversight evidence.
Annual compliance report and training records.
Rule 4370 plan reviewed this year and tested against ransomware.
Incident playbook that decides Reg S-P, Rule 4530 and SAR questions in parallel.

Standards and references

Related NHI Mgmt Group resources: SEC Regulation S-P Amendments Guide, FTC Red Flags Rule, Financial Services Cyber Regulation Map, Identity Verification Requirements Map. This guide summarises Regulation S-ID and related FINRA rules and is not legal advice.

FINRA Cyber Security and Reg S-ID: broker-dealer identity theft programme and supervision duties