Written supervisory procedures manual: from WSPs to settings

A written supervisory procedures manual (WSP manual) is the document in which a broker-dealer sets out how it supervises its business: who reviews what, how, how often and with what record, as FINRA Rule 3110 requires every member to "establish, maintain, and enforce." For Reg BI, the manual has to say how representatives meet the care, disclosure and conflict obligations and how principals check that they did. The common failure is a manual that describes the rule well and enforces nothing: the SEC's examiners and FINRA found exactly that at firm after firm between 2023 and 2026. The cure is specific: every Reg BI sentence in the WSPs should name a test, a threshold, a reviewer and a clock, and the firm should be able to show each one being applied. Botminds' Reg BI Compliance Review is built around that idea: the firm's WSPs become settings the chief compliance officer approves, applied to every retail recommendation overnight, changed only by proposal and second approval, with every change on the record.

The settings shown here are those of the solution's fictional sample broker-dealer, Quillfield Securities. The go-live plan is our suggestion, not a regulatory timetable; how long each step takes depends on a firm's systems and data.

What are written supervisory procedures?

Written supervisory procedures are the firm's own rulebook for supervision, required by FINRA Rule 3110(b)(1): "Each member shall establish, maintain, and enforce written procedures to supervise the types of business" it engages in. They sit between the regulations, which say what must be achieved, and the daily work, which is what supervisors actually do. A WSP manual names the principals, assigns representatives to them, describes the reviews of transactions and correspondence, sets out inspections, and says how exceptions are escalated.

Reg BI adds its own written-procedures requirements on top. The compliance obligation requires written policies and procedures "reasonably designed to achieve compliance with Regulation Best Interest," and the conflict obligation requires written procedures to identify, disclose, mitigate or eliminate conflicts. Most firms meet both inside the WSP manual. That is where the trouble starts, because a manual written to describe supervision is easily written to describe the rule.

What makes a WSP reasonably designed?

A WSP is reasonably designed when it can prevent, detect and correct a violation in the firm's actual business, and when the firm can show it doing so. The SEC's 2023 risk alert used that three-part test when it criticised firms that relied on old surveillance without asking whether it was "reasonably designed to prevent violations from occurring, to detect violations that have occurred, and to correct promptly any violations that have occurred." Rule 3110 adds a fourth requirement that is easy to miss: the procedures must be enforced, not just written.

The same alert described the opposite: "Staff observed multiple instances of generic written policies and procedures that were not tailored to the firm's business model or otherwise were limited to restating the rule's requirements." Restating the rule fails the test because a sentence like "representatives must consider reasonably available alternatives" prevents nothing, detects nothing and corrects nothing until someone decides what it means for a particular recommendation.

Why a WSP that restates the rule is a finding

Because regulators keep making it one. FINRA's 2026 oversight report lists among Reg BI findings procedures "failing to detail any steps a supervisor should take" and "not providing any procedures or guidance regarding the factors to consider when recommending a particular account type" (FINRA, Reg BI and Form CRS). In January 2026 FINRA fined The GMS Group $35,000 because its procedures "did not describe the steps representatives should take to make recommendations in customers' best interests, nor did they describe any methods for supervisors to review recommendations for Care Obligation compliance, such as procedures for evaluating whether representatives had considered costs and reasonably available alternatives" (FINRA, March 2026).

Updating the manual is not enough if the update is another description. In April 2026 FINRA fined Andes Capital Group $25,000: until June 2024 its procedures only described Reg BI in broad strokes (the enforcement guide has the full run of cases), and after an update that referenced the four component obligations they "still did not reasonably describe how associated persons would meet their obligations or how the firm would supervise for compliance" (FINRA, June 2026). A manual can grow longer and stay generic.

"In practice, these limitations were treated as guidelines."

SEC order, In the Matter of Lion Street Financial, LLC, 15 November 2024, on the firm's concentration limits for alternative investments

Written limits that are not applied are the other half of the finding. Lion Street's procedures capped any one alternative investment at 10% of a customer's liquid net worth and set lower caps for older customers, but its sales supervisors "had full discretion to grant exceptions to these limits" with no guidance on when. In the SEC's July 2024 order against Western International Securities, "Based upon Western's written supervisory procedures, all trading activity should have been restricted from any further trading when the customers failed to return the Activity Letters within 30 days of transmittal." The accounts were not restricted. In both cases the WSP said the right thing and nothing made it happen.

From WSP sentence to setting: a threshold, a reviewer, a clock

The conversion is mechanical once the firm decides what each sentence means. Take each Reg BI sentence in the manual and ask four questions: what test would show it was followed on a given recommendation; what threshold turns that test into a flag; who reviews a flag, and who may not; and by when. The answers are settings. A system can apply settings to every recommendation the same way; a principal can explain them to an examiner; and a change to one is a change to the WSPs, approved and recorded like one.

Two settings in the table deserve a second look because they come straight from Rule 3110. Requiring that no one supervise their own business follows the rule's demand for procedures to prevent the supervisory system "from being compromised due to the conflicts of interest that may be present" (Rule 3110(b)(6)(D)). And a second approver on every change follows from the rule's insistence that procedures be enforced: a threshold one person can quietly loosen is a guideline, which is the Lion Street finding in a new form.

The WSPs as settings: each test, its threshold, and who may change it

How often should WSPs be updated?

At least annually, and whenever the business changes. In its 2019 burden estimates the SEC assumed broker-dealers "would review and update their policies and procedures for compliance with Regulation Best Interest on an annual basis," and on a periodic basis to accommodate "new products or services, new business lines, and/or new personnel" (Release No. 34-86031). FINRA's own compliance tools remind firms to update their WSPs "on an ongoing basis." Rule 3110(c)(1) separately requires every office of supervisory jurisdiction to be inspected at least annually, which is the natural moment to test whether the branch's practice matches the manual.

Settings make the update cycle visible. When a threshold lives in a paragraph, nobody can say when it last changed or whether supervisors apply the current version. When it lives in a setting with a version and an approver, the annual review can start from a list of every change, who proposed it, what the back-test showed, and who approved it. FINRA's 2026 effective practices include "Incorporating Reg BI-specific reviews into the branch exam program" (FINRA); a branch inspection can then check the branch's items against the same settings the system applied.

A go-live plan in weeks

The plan in the timeline above has five steps, and the order matters more than the durations. First, read the WSPs and map every Reg BI sentence to a test, a threshold, a reviewer and a clock; sentences that cannot be mapped are the ones a regulator would call generic, and rewriting them is the most valuable output of the whole project. Second, connect the systems a recommendation lives in, the order management system, the CRM, product cost data, the compensation system and document management, and write the settings.

The last three steps decide whether the settings can be trusted, and they are covered next. In the solution's sample firm, the overnight review went live on October 5, and its first look-back found 186 copies of one branch's rationale from the preceding three months that sampling had never read.

What to back-test before the WSP settings go live

Back-test on a month of closed recommendations, then run beside the current reviews, and measure four things before anyone switches anything off. If the settings flag nothing, they test nothing; if they flag everything, the thresholds or the data are wrong. The numbers below are what the chief compliance officer should see before approving the switch.

First, the flag rate by test, on the firm's own month: how many recommendations each setting would have sent to a principal, by branch and product. In the sample firm's first live night, 293 of 4,812 recommendations, about 6.1%, needed a principal, and 12 waited for missing data rather than clearing. Second, what the old exception reports caught that the new settings did not: every such item needs an explanation, or a setting changes. Third, during the parallel run, how often principals agree with the agents' proposed disposition and why they overrule them; a test overruled most of the time is a threshold to revisit. Fourth, the data gaps: recommendations that could not be joined to a profile, a fee table or a payout grid. Each is a recommendation the firm cannot currently supervise on the evidence, whatever its WSPs say.

Only then does the chief compliance officer approve the switch, and the old reports are retired only for what the new review demonstrably covers. The approval, the back-test results and the parallel-run comparison belong in the file: they are the evidence that the new procedures are reasonably designed, which is the question an examiner will ask first.

Where Reg BI Compliance Review fits in this plan is the middle three steps: it applies the settings to every retail recommendation, back-tests a change on last week's recommendations before anyone approves it, and keeps the record of every decision. It does not write the firm's WSPs, decide the thresholds or replace the principals who answer for them; those stay with the firm. When an examiner asks, the audit trail shows each setting's version beside each decision, and one export holds the recommendations, evidence, decisions and both names.

The record that shows the WSPs were enforced

The care test the settings encode is set out in the Reg BI care obligation, and the cases that show what unenforced procedures cost in Reg BI enforcement actions. To map your own WSPs to settings, start from Reg BI Compliance Review.

Questions people ask

Is there a FINRA written supervisory procedures template?

FINRA publishes compliance tools, including a Reg BI and Form CRS Firm Checklist, and describes them as a starting point that each firm must tailor to its size and needs. A template copied without tailoring is the pattern regulators criticise: FINRA fined Taglich Brothers $60,000 in February 2026 partly because its Reg BI procedures only recited the rule's language.

What should Reg BI written supervisory procedures cover?

How representatives meet each component obligation and how supervisors check it: the profile information to gather and refresh, how costs and reasonably available alternatives are compared, account-type recommendations, complex products and older customers, conflict identification and mitigation, disclosure delivery, the records under Rules 17a-3(a)(35) and 17a-4(e)(5), escalation, and how the procedures themselves are tested and changed.

Who approves changes to WSPs?

The firm decides, and should write it down; in the sample firm, the chief compliance officer approves every test and threshold. A useful rule is that the person who proposes a change to a threshold is never the one who approves it, and that the change is tested on past recommendations first.

Are WSPs and Reg BI policies the same document?

They can be. Reg BI requires written policies and procedures for the compliance and conflict obligations; FINRA Rule 3110 requires written supervisory procedures. Many firms keep both in one manual, as Lion Street did in its WSPs and representative manual; what matters is that the Reg BI parts say how compliance is achieved and checked.

How do you prove WSPs are enforced?

With records of the procedure being applied: flags raised under each setting, decisions with reasons and names, exceptions granted and by whom, and periodic tests on closed files. FINRA and the SEC have fined firms whose procedures were sound on paper but were not applied, including concentration limits treated as guidelines and account restrictions that were never imposed.