FINRA Rule 2090 is the broker-dealer obligation to use reasonable diligence in learning and retaining essential facts about each customer and anyone authorized to act for them. The rule is a continuing KYC requirement, covering account opening, authority verification, profile maintenance, and ongoing monitoring across the life of the relationship.
What FINRA Rule 2090 Requires in Practice
FINRA Rule 2090 is a continuing customer due diligence obligation, not a one-time onboarding check. It requires a broker-dealer to know who the customer is, who is authorised to act for them, and what facts remain essential as the relationship changes over time. That makes the rule central to account opening, authority verification, profile maintenance and ongoing supervision.
Because the obligation is ongoing, firms need a durable view of the customer relationship rather than a static form on file. Changes in ownership, trading authority, beneficial control, contact details or account purpose can all change the facts that matter to suitability, supervision and fraud prevention. The rule therefore sits at the intersection of onboarding, servicing and monitoring.
Why the Rule Matters for Broker-Dealer Risk
Rule 2090 matters because bad or stale customer facts can undermine every downstream control built on them. If a firm does not understand who can give instructions, who owns the account, or whether authority has changed, it can misroute trades, miss red flags, or rely on information that is no longer true.
It is also a control against impersonation and authority misuse, because the firm is expected to test whether the person acting for the account really has the right to do so. That makes the rule especially important where accounts are managed by agents, trusted contacts, caretakers, family members or other third parties, and where the firm’s records must support later review.
How Firms Evidence Compliance
Compliance is usually demonstrated through a mix of customer records, verification steps, supervisory review and lifecycle controls. Firms need a defensible process for capturing the “essential facts” at opening, refreshing them when relationships change, and keeping a record of authority evidence, account documentation and exceptions.
Practically, that means the firm should be able to show what it knew, when it knew it, and why it believed the information was sufficient for the relationship at that point in time. Clear recordkeeping and supervisory ownership matter because Rule 2090 is not satisfied by initial intake alone; the obligation continues as long as the account remains active.
Relationship to KYC, Supervision and Recordkeeping
Rule 2090 works alongside broader KYC, supervision and books-and-records obligations. It is about the quality and persistence of customer knowledge, while other rules may focus more specifically on transaction monitoring, trade supervision, suitability or document retention. Together, they create a control chain from onboarding through ongoing relationship management.
That is why firms should treat the rule as part of a living customer file, not a compliance checkbox. When the customer profile, authority structure or expected activity changes, the firm’s supervisory posture should change with it. Strong recordkeeping supports that continuity and helps the firm defend decisions after the fact.
Risk and Threat Considerations
Stale customer facts create a real exposure for fraud, unauthorised instruction and supervisory failure. If a broker-dealer relies on outdated authority or incomplete relationship data, an attacker, impersonator or abusive insider can exploit that gap to move funds, place trades or hide control changes.
Failure mechanism: The firm’s records no longer match the actual customer relationship, so the control that should validate authority becomes unreliable.
Impact: This can lead to account misuse, missed red flags, regulatory findings, customer harm and remediation costs after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Broker-dealer authority checks depend on verifying who is acting on the account. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Customer and third-party actor verification maps to external-user authentication and proofing. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Ongoing customer facts require review of records and exceptions over the life of the relationship. | |
| Recommendation — Verify the acting party’s identity before accepting account instructions or authority changes. Apply external-user authentication and proofing before granting account access or action authority. Review audit and supervision records for changed customer facts, exceptions and unauthorised activity. | ||
| CIS Controls v8 | CIS-5 — Account Management | The rule depends on knowing who may act for an account and keeping that authority current. |
| Recommendation — Maintain authoritative account records and remove or update stale access and authority relationships. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Authority verification and customer-access governance align with controlling who may act. |
| Recommendation — Define and enforce access approval rules for account authority and representative access. | ||
Practitioner Guidance
Governance implication: Treat Rule 2090 as an owned lifecycle control, not a front-office formality. The control should have clear accountability for refresh triggers, authority changes and exception handling so that essential facts are reviewed whenever the relationship changes materially.
Practitioner note: The hardest failures usually come from “mostly known” customers, where staff assume the file is still accurate because the account has been open for a long time. Build review points around change events, not just annual cycles, so the firm does not confuse familiarity with current knowledge.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org