FINRA Rule 2090

The know your customer obligation is not a one-time formality satisfied at account opening — it is a continuous obligation applicable throughout the life of every customer relationship, requiring ongoing attention to changes in the customer's circumstances, periodic updating of customer profile information, and continuous monitoring of account activity to ensure that the member firm's understanding of the customer remains current and accurate.

The Essential Facts — What Must Be Known

The supplementary material to Rule 2090 defines essential facts as those required to satisfy four specific purposes — effectively service the customer's account, act in accordance with any special handling instructions for the account, understand the authority of each person acting on behalf of the customer, and comply with applicable laws, regulations, and rules.

Effectively servicing the customer's account requires knowing the information necessary to manage the account in a manner consistent with the customer's investment objectives and financial situation — including the customer's financial profile, investment goals, risk tolerance, time horizon, and liquidity needs.

A member firm cannot effectively service an account whose owner's financial situation and objectives it does not understand — recommendations made without this knowledge may be unsuitable, portfolio management conducted without it may be inconsistent with the customer's actual needs, and account monitoring conducted without it cannot identify deviations from expected patterns.

Acting in accordance with special handling instructions requires knowing any specific directions the customer has provided about how their account should be managed — including restrictions on certain types of investments, directions about communication preferences, instructions about account authority granted to third parties, and any other specific requirements the customer has established for the management of their account.

Understanding account authority requires knowing who is authorised to give instructions for the account — whether the account is held by an individual, jointly, in trust, through a power of attorney, or through any other ownership or authority structure that determines who can legally direct account activity.

A member firm that accepts instructions from an unauthorised person — or that fails to follow instructions from an authorised person because it does not know their authority — has failed its essential facts obligation regardless of the outcome of any specific transaction.

Complying with applicable laws and regulations requires knowing the information necessary to satisfy the member firm's legal obligations in connection with the account — including the customer identification programme requirements of the USA PATRIOT Act, the anti-money laundering obligations of the Bank Secrecy Act enforced through FINRA Rule 3310, the beneficial ownership requirements applicable to legal entity customers, and any other regulatory requirements that depend on knowledge of the customer's identity, background, or account relationships.

Who Counts as a Customer

Rule 2090 applies to every customer without itself defining the word. The definition comes from FINRA's general definitions in FINRA Rule 0160, which provide that, when used in FINRA's rules and unless the context otherwise requires, the term customer shall not include a broker or dealer — so a broker-dealer with which the member firm deals in that capacity falls outside the term, and FINRA has described the term as including anyone who is not a broker or dealer.

FINRA has also stressed how broadly the term reaches. In its guidance on the suitability rule in Regulatory Notice 12-25, it stated that a customer clearly would include an individual or entity with whom a broker-dealer has even an informal business relationship related to brokerage services, as long as that individual or entity is not a broker or dealer, and that a broker-customer relationship would arise, and the suitability rule would apply, when a broker recommends a security to a potential investor even if that potential investor does not have an account at the firm. That statement concerns the suitability rule, whose trigger is a recommendation; Rule 2090's own obligation is framed, in its text, around the opening and maintenance of every account.

Who the customer is can also depend on how an account relationship is intermediated. FINRA's Regulatory Notice 17-40 explains that, under FinCEN's customer due diligence rule, where existing guidance under the customer identification programme rules provides that a firm shall treat an intermediary — and not the intermediary's own customers — as its customer, the firm should treat the intermediary as its customer for the customer due diligence rule as well.

Authority to Act — Names, Limits and Fiduciaries

FINRA's Regulatory Notice 11-25 addressed whether the obligation to understand the authority of each person acting on behalf of the customer requires a member firm to know more than the names of those persons. FINRA's answer was that Rule 2090 generally requires a member firm to know the names of any persons authorised to act on behalf of a customer and any limits on their authority that the customer establishes and communicates to the member firm.

The same answer acknowledged a business choice open to firms. FINRA stated that it understands that some member firms may decide, as a business practice, to accept only those customers that do not qualify the scope of authority of persons acting on the customers' behalf in their dealings with the member firms.

Where a third party manages the account, that person's own knowledge also matters when recommendations are made. In Regulatory Notice 12-25 FINRA stated that, in many circumstances, the investment experience of a guardian, custodian, trustee or similarly situated third party managing an account should be taken into consideration when making account recommendations — in the case of a trust held in a brokerage account, the firm should consider the trustee's investment experience with, and knowledge of, various investments and investment strategies — while the firm also must consider factors such as the trust's investment objectives, time horizon and risk tolerance to complete the suitability analysis.

Rule 2090 and the Account Opening Process

The know your customer obligation commences at the moment a customer decides to open an account with a member firm — before any recommendation has been made and before any transaction has been executed. Rule 2090's obligation is triggered by the decision to open an account, not by the first recommendation or transaction, reflecting the regulatory recognition that adequate customer knowledge must precede rather than follow the commencement of the customer relationship.

The account opening process — governed jointly by Rule 2090's essential facts requirement and the account information requirements of FINRA Rule 4512 — requires collection of a comprehensive customer profile including full name, date of birth, residential address, social security number, employment status, annual income, net worth, investment objectives, investment experience, time horizon, liquidity needs, risk tolerance, and tax status. This information collectively constitutes the investment profile that underpins the suitability analysis required by FINRA Rule 2111 for every subsequent recommendation made to the customer.

The customer identification programme requirements of the USA PATRIOT Act — implemented for broker-dealers through 31 CFR 1023.220 — operate alongside Rule 2090's essential facts requirement, adding the specific identity verification requirements applicable to anti-money laundering compliance.

Together these two frameworks ensure that member firms know both who their customers are — for regulatory and anti-money laundering purposes — and what their customers need — for suitability and account servicing purposes.

When Customer Information Is Withheld or Unreliable

Some customers are reluctant to provide certain types of information — FINRA's example in Regulatory Notice 12-25 is a customer who may not want to divulge information about other investments held away from the broker-dealer. Rule 2090 shares its reasonable diligence standard with the suitability rule, Regulatory Notice 11-02 explaining that FINRA chose the term for consistency with the language of Rule 2111, and FINRA's suitability guidance answers the question directly: the broker-dealer must use reasonable diligence to seek to obtain and analyse the customer-specific factors, but it cannot make assumptions about customer-specific factors for which the customer declines to provide information, the authorities FINRA cites requiring recommendations to rest only on the concrete information the customer did supply and not on guesswork.

A refusal does not by itself forbid a recommendation. When customer information is unavailable despite the broker-dealer's reasonable diligence, the firm must carefully consider whether it has a sufficient understanding of the customer to evaluate the suitability of a recommendation properly; but the rule does not prohibit a recommendation made in the absence of certain customer-specific factors, as long as the firm has enough information about the customer to have a reasonable basis to believe the recommendation is suitable, the significance of any particular type of information depending on the facts and circumstances of the case.

Information the customer does give is ordinarily usable as given. Asking the customer for the information will ordinarily suffice, and, absent red flags indicating that the information is inaccurate or that the customer is unclear about it, a broker generally may rely on the customer's responses — but a broker may not be able to rely exclusively on those responses where its own questions are confusing or misleading to a degree that taints the information-gathering process, where the customer exhibits clear signs of diminished capacity, or where other red flags indicate that the information may be inaccurate.

The Ongoing Maintenance Obligation

Rule 2090's obligation applies not only to the opening of accounts but to their ongoing maintenance — creating a continuous obligation throughout the life of every customer relationship to keep essential customer facts current and accurate.

Customer circumstances change over time — financial situations improve or deteriorate, investment objectives evolve as life circumstances change, risk tolerance shifts as customers age or experience market events, and account authority arrangements may be modified through new powers of attorney, trust amendments, or changes in family circumstances.

A member firm that collected adequate essential facts at account opening but failed to update that information when the customer's circumstances changed materially has failed its Rule 2090 obligation — the essential facts must reflect the customer's current situation, not merely their situation at the time the account was opened.

The ongoing maintenance obligation creates a practical compliance challenge for member firms — how frequently must customer information be updated, and what triggers a required update? FINRA's guidance in Regulatory Notice 11-02 does not prescribe a period within which firms must attempt to update customer information, because a broker-dealer's relationship with its customers is dynamic; it states instead that a firm should verify the essential facts about a customer at intervals reasonably calculated to prevent and detect any mishandling of the account that might result from a change in the customer's circumstances, the reasonableness of those efforts depending on the facts and circumstances of the particular case.

Many member firms implement annual or biennial customer profile reviews as a systematic compliance mechanism — supplemented by event-triggered reviews when specific circumstances suggest that customer information may have changed.

The SEC Account Record and the Customer's Verification

Alongside Rule 2090, SEC Rule 17a-3(a)(17) under the Securities Exchange Act requires, for each account with a natural person as a customer or owner, an account record that includes, among other things, the customer's name, tax identification number, address, telephone number, date of birth, employment status, annual income, net worth excluding the value of the primary residence, and the account's investment objectives. In the case of a joint account, the record must include personal information for each joint owner who is a natural person, although financial information for the individual joint owners may be combined.

The rule makes the customer a check on the record. The broker-dealer must furnish each customer a copy of the account record, or an alternate document carrying the required information, within thirty days of the opening of the account and thereafter at intervals no greater than thirty-six months, together with an explanation of any terms regarding investment objectives and prominent statements that the customer should mark any corrections and return the document and should notify the firm of any future changes to the information it contains. Regulatory Notice 11-02, while declining to prescribe an updating period under Rule 2090, reminds firms of this SEC requirement.

The account record requirements are narrower in reach than Rule 2090. They apply only to accounts for which the broker-dealer is, or has within the past thirty-six months been, required to make a suitability determination, whereas Rule 2090's obligation extends to the opening and maintenance of every account; and, for the purposes of the account record paragraph, the neglect, refusal or inability of a customer to provide or update the required information excuses the broker-dealer from obtaining it.

Rule 2090 and Rule 2111 — The Inseparable Pair

Rule 2090 and FINRA Rule 2111 — the suitability rule described in the FINRA Rule 2111 entry of this dictionary — are operationally inseparable because adequate customer knowledge is the prerequisite for a valid suitability analysis.

Rule 2111's customer-specific suitability obligation requires that a registered representative have a reasonable basis to believe that a recommendation is suitable for the specific customer based on information obtained through reasonable diligence to ascertain the customer's investment profile. That investment profile — age, other investments, financial situation and needs, tax status, investment objectives, investment experience, time horizon, liquidity needs, and risk tolerance — is precisely the essential facts that Rule 2090 requires the member firm to know and retain.

A suitability analysis conducted without adequate essential facts is not a valid suitability analysis — it is a guess about what might be appropriate for a customer whose actual circumstances are unknown.

This means that a Rule 2111 violation is often simultaneously a Rule 2090 violation — the registered representative who made an unsuitable recommendation may have done so partly because they failed to gather the essential facts that would have revealed the recommendation's unsuitability.

This operational interdependence explains why FINRA regulators and examination professionals consistently evaluate Rule 2090 compliance as the foundation of suitability programme effectiveness — a firm that does not know its customers cannot make suitable recommendations for them, and a firm that makes unsuitable recommendations has frequently failed first at the essential facts obligation that should have prevented the unsuitable recommendation.

Rule 2090 and Anti-Money Laundering

Rule 2090's essential facts obligation directly supports the anti-money laundering compliance programme required by FINRA Rule 3310 — connecting the customer knowledge obligation to the broader framework of financial crime prevention that applies to all FINRA member firms.

The Bank Secrecy Act and its implementing regulations require broker-dealers to establish anti-money laundering programmes that include procedures for identifying and reporting suspicious activity — and effective suspicious activity detection depends fundamentally on knowing what normal activity looks like for each specific customer.

A member firm that knows its customer's financial profile, investment objectives, typical transaction patterns, and sources of funds can identify deviations from expected behaviour that may indicate suspicious activity.

A member firm that does not know its customer cannot distinguish normal from suspicious behaviour in that customer's account.

The beneficial ownership requirements of FinCEN's customer due diligence rule, 31 CFR 1010.230 — requiring identification and verification of the natural persons who own or control legal entity customers — operate alongside the Rule 2090 essential facts obligation for legal entity accounts, where the direct account holder is a corporation, limited liability company, partnership or other entity rather than an individual.

Knowing who ultimately owns or controls the account is essential both to effective account servicing and to the anti-money laundering obligations that require knowledge of the true beneficial owners of customer accounts.

Customer Due Diligence and the Customer Risk Profile

FinCEN's customer due diligence rule added to the anti-money laundering programme requirement for broker-dealers in 31 CFR 1023.210 appropriate risk-based procedures for conducting ongoing customer due diligence — understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile, and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. FINRA's Regulatory Notice 17-40 records FinCEN's view that these provisions are not new: they codify existing expectations that firms adequately identify and report suspicious transactions and encapsulate practices generally undertaken by securities firms to know and understand their customers, so that a firm whose programme did not include them explicitly had to update the programme to incorporate them.

The rule does not prescribe a particular form for the customer risk profile. Depending on the firm and the nature of its business, the profile may consist of individualised risk scoring, the placement of customers into risk categories, or another means of assessing customer risk that allows the firm to understand the risk posed by the customer and to demonstrate that understanding.

Nor does the rule require the profile to be built into automated surveillance. FinCEN explained that firms are not necessarily required or expected to integrate customer information or the customer risk profile into existing transaction monitoring systems; instead, it expects firms to use that information and profile as appropriate, in the course of complying with their Bank Secrecy Act obligations, to determine whether a particular flagged transaction is suspicious.

Beneficial Owners — Certification, Reliance and Existing Accounts

Under 31 CFR 1010.230 a firm identifies the beneficial owners of a legal entity customer at the time a new account is opened, either by obtaining a certification in the form appended to the rule from the individual opening the account on the entity's behalf, or by obtaining the same information from that individual by another means, provided the individual certifies, to the best of the individual's knowledge, the accuracy of the information. The firm may rely on the information supplied by the legal entity customer regarding the identity of its beneficial owners, provided that it has no knowledge of facts that would reasonably call the reliability of that information into question.

Verification then has a limited object. FINRA's Regulatory Notice 17-40 explains that the firm must verify the identity of each beneficial owner — that the individuals are who they say they are, and not their status as beneficial owners — through risk-based procedures that include, at a minimum, the elements its customer identification programme requires for verifying individual customers, with verification completed within a reasonable time after account opening.

The requirement is prospective, applying to legal entity customers that open new accounts from the rule's implementation, but a firm should obtain beneficial ownership information for an existing legal entity customer if, during the course of normal monitoring, it receives information that is needed to assess or re-evaluate the risk of that customer. Not every account held for a business or a fiduciary is a legal entity customer: FinCEN has stated that the term does not include sole proprietorships, unincorporated associations, trusts other than statutory trusts, or natural persons opening accounts on their own behalf.

Examination Relevance and Key Takeaways

FINRA Rule 2090 appears in FINRA's content outline for the Series 7 examination, under the function of obtaining and updating customer information and documentation; the Series 65 — the NASAA Investment Advisers Law Examination — is a North American Securities Administrators Association examination that FINRA administers. Rule 2090 is the foundational know your customer rule — the prerequisite customer knowledge obligation that underlies every subsequent conduct standard applicable to broker-dealer registered representatives.

The key points to retain are these.

FINRA Rule 2090 — Know Your Customer — requires every member firm to use reasonable diligence in the opening and maintenance of every account to know and retain the essential facts concerning every customer and every person acting on their behalf.

Essential facts are defined as those required to effectively service the account, follow special handling instructions, understand account authority, and comply with applicable laws and regulations.

The know your customer obligation commences at account opening — before any recommendation or transaction — and continues throughout the life of the customer relationship as a continuous maintenance obligation requiring updates when customer circumstances change materially.

Rule 2090 is the prerequisite for the suitability analysis required by FINRA Rule 2111 — a valid customer-specific suitability determination requires adequate essential facts about the specific customer, making Rule 2090 compliance the foundation of the entire suitability framework. 

Rule 2090 also supports the anti-money laundering compliance programme required by FINRA Rule 3310 — effective suspicious activity detection requires knowing what normal activity looks like for each specific customer, making the essential facts obligation central to both investor protection and financial crime prevention.