FINRA Rule 4370: What Small Financial Firms Must Do by Year-End

FINRA's 2026 examination priorities make cybersecurity and business continuity testing non-negotiable. Firms without documented, tested BCPs face citations and fines.

If you run a small broker-dealer, introducing firm, or any FINRA-regulated financial institution, the clock is ticking. FINRA's 2026 Annual Regulatory Oversight Report prioritizes cybersecurity and operational resilience across all member firms. In plain terms: examiners are coming, and they will ask to see your business continuity plan. Not just that it exists on paper, but that it has been tested, documented, and updated.

Rule 4370 isn't new. But enforcement intensity is. Examiners in 2026 are looking for evidence that you can actually continue your business when things go wrong. If you don't have that evidence, plan to defend a citation.

What FINRA Rule 4370 Actually Requires

FINRA Rule 4370 mandates that every FINRA member firm maintain a written Business Continuity Plan (BCP). Here's what the rule covers in four core areas.

Backup and Recovery Procedures

Your BCP must document exactly how you will continue or resume critical business functions after an emergency. This includes your identified critical functions, backup facilities and systems, Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO). The key point: FINRA expects these targets to be realistic and justified. If you claim a 2-hour RTO but have never tested it and your backup provider has only committed to 4 hours, that discrepancy will be flagged.

Emergency Contact Information

You must maintain and periodically update key employee contact information, succession plans, alternate contact methods, and vendor contacts. Documentation aging is a common failure point. If your emergency contact list was last updated three years ago and key staff have turned over, examiners will cite this as a material deficiency.

Data Protection and Business Records

The rule requires documented procedures for backing up books and records, off-site data storage, access controls for backup data, and retention schedules aligned with SEC rules 17a-3 and 17a-4. Your backup strategy must ensure compliance with these regulations.

Branch Office and Remote Work Standards

Your BCP must address security standards for all locations, controls for remote workers, and vendor and third-party risk management. Post-pandemic dispersed workforces are now standard, and FINRA expects you to account for staff working from multiple locations.

The Third-Party Risk Management Shift

Here is what changed most significantly in 2026: third-party risk management is now a standalone examination focus. FINRA's language is clear: firms must maintain a reasonably designed supervisory system covering all outsourced activities to comply with FINRA Rules 1220, 3110, and 4370.

Translation: if you depend on a vendor—cloud, compliance, payroll, communications, anything—FINRA expects you to have documented evidence of their RTO/RPO capabilities, your contingency if they fail, participation in incident response testing, and procedures for data handling at contract termination. For small firms, the most common gap is the lack of a documented contingency if a critical vendor fails.

Why Firms Fail FINRA Examinations

Recent examination trends reveal consistent patterns. Sixty-two percent of small firms had a written BCP but had never tested it in the past 24 months. Eighty-one percent could not produce documentation of their last BCP test. Fifty-four percent claimed RTOs that were not backed by vendor commitments or historical testing. Seventy-six percent had no documented third-party risk assessment for their critical vendors. Forty-three percent had emergency contact lists over 2 years old, with multiple staffing changes since the last update.

These firms did not face criminal charges. But they did receive examination findings, draft citations, and letters to management. Several received formal enforcement actions with fines ranging from $250,000 to $1.2 million.

What Examiners Want to See

FINRA examiners will ask your Chief Compliance Officer specific questions about your BCP, RTOs, third-party dependencies, and emergency response procedures. They will expect documented answers backed by evidence: testing reports, vendor commitments, succession plans, and updated contact lists. A plan that has been tested and documented is defensible. A plan that hasn't been tested is indefensible.

Examiners are no longer satisfied with a plan in a filing cabinet. They want proof that you have actually thought through what happens when your critical systems fail and that you have a way to recover.

The Real Cost of Non-Compliance

Recent FINRA enforcement actions for inadequate business continuity planning resulted in significant fines. In 2026, a major firm was fined $1.2M for failure to maintain adequate incident response and BCP testing procedures. An introducing firm received an $800K fine for inadequate third-party oversight of cloud provider continuity. A small broker-dealer was fined $550K for failure to document BCP testing and unrealistic RTOs. Another firm faced a $375K fine for failure to maintain current emergency contact lists and no staff succession plan.

For a small firm with $5–$50M in revenue, a $500K fine is material. But the fine is often the smaller problem. A published examination finding or enforcement action signals to the market that your firm failed a compliance test, your operations may be fragile, and your continuity planning may be inadequate. Customers, especially institutional clients and hedge funds, are increasingly asking firms for evidence of business continuity before opening accounts. A regulatory finding becomes a dealbreaker.

A Realistic Compliance Roadmap

You don't need a consultancy budget. You need a clear plan, documented procedures, and discipline. Start by inventorying your critical systems. Identify every system required to serve customers and manage regulatory risk. For each system, define how long it can be down, how much data you can afford to lose, and what backup exists.

Next, map your third-party dependencies. Create a vendor risk inventory documenting each critical vendor, their function, dependency level, and your contingency if they fail. For critical vendors, get their RTO/RPO in writing.

Then, document and test. Write a one-page RTO/RPO summary. Run a tabletop exercise with your leadership team. Choose a realistic scenario—like "Our primary cloud provider goes down for 6 hours tomorrow"—and walk through the response. This 90-minute exercise generates real insights and produces documentation that satisfies FINRA's testing requirement.

Finally, commit to annual review. Once a year, update emergency contacts, review new systems or vendors, verify changes in RTO/RPO, update succession plans, and document lessons learned. Get sign-off from management.

Action Items for Your Firm

This week, assign BCP ownership to a named individual, usually your Chief Compliance Officer. Schedule a 90-minute tabletop exercise with your leadership team and pull your current BCP to review it for accuracy.

This month, update your emergency contact list, inventory your critical systems and define RTOs/RPOs, request RTO/RPO documentation from critical vendors, run your tabletop exercise and document results, and identify gaps with assigned owners.

By year-end, update your written BCP to reflect current systems, staff, and vendors. Get sign-off from your Chief Compliance Officer and board. File your updated BCP and testing documentation where examiners can find it. Schedule your follow-up BCP review for next fall.

The Bottom Line

FINRA Rule 4370 is not optional. Examiners in 2026 are looking for evidence that you can actually continue your business when things go wrong. If you don't have that evidence, plan to defend a citation. The good news: small firms can pass this test without thousands of dollars in consultants. You need a clear plan, documented procedures, and the discipline to test them.

Plan & Recover delivers audit-ready business continuity plans in one hour, not months. We help small financial firms, insurance companies, and regulated businesses build BCPs that satisfy FINRA, FFIEC, SEC, ISO 22301, and insurance audit requirements. Our AI-driven platform captures your critical processes, dependencies, and recovery strategy, then generates a documented plan with realistic RTOs and RPOs, third-party risk assessments, and regulatory-ready formatting.

Schedule a 20-minute demo to see how Plan & Recover builds your BCP faster and smarter than traditional consulting.