FINRA Rule 4380 has not been formally amended since its adoption, yet its designation criteria have changed more than once. How?

The criteria are set by the Commission under Regulation SCI rather than by FINRA at all

The rule delegates the criteria to Regulatory Notices, which can be updated without rulemaking

The criteria are fixed in the rule and the changes were to the systems rather than the thresholds

Each change was made by an exempting order that operates alongside the unamended rule text

Which bodies does Regulation SCI reach as SCI entities?

Exchanges, clearing agencies, significant alternative trading systems, plan processors and FINRA

Exchanges and clearing agencies only, other market participants being outside the regulation

Every broker-dealer registered with the Commission under the Exchange Act

Any entity operating a system through which customer orders are routed for execution

What does Rule 1004 of Regulation SCI require of an SCI entity, and what is FINRA Rule 4380's relation to it?

That it test its plan annually; Rule 4380 sets FINRA's own testing calendar

That it designate members whose participation is the minimum necessary, which this rule implements

That it obtain Commission approval for its plan; Rule 4380 is FINRA's approved plan

That it maintain geographically diverse backup systems; Rule 4380 specifies the locations

Why must member firms participate in testing FINRA's business continuity systems rather than FINRA testing them alone?

Because members bear the cost of the systems through their fees and are entitled to verify them

Because members' own plans cannot be validated without a simultaneous test of FINRA's

Because a test without the firms whose activity constitutes the market would not be meaningful

Because the Commission requires a stated proportion of members to attend each test conducted

What must FINRA's criteria for designating members take into account?

The member's net capital and the scale of the customer assets it holds in custody

Whether the member has previously experienced a significant business disruption of its own

The geographic diversity of the member's own backup and recovery facilities and staffing

The volume of the member's activity on a FINRA market system over a specified period

What does the volume-based approach to designation achieve?

It ensures the test simulates heavy use while sparing members of minimal systemic impact

It allows FINRA to rotate designation so that no member is designated twice running

It matches each designated member to the system on which it is most active

It spreads the testing burden evenly across the membership over successive years

A firm's activity is spread across several Member Participant Identifiers, none of which individually reaches the designation threshold, though together they represent substantial volume. May FINRA designate it?

No, unless the firm chooses to consolidate its activity under one identifier voluntarily

Yes — FINRA may designate the parent firm on its overall activity across the identifiers

No — designation operates at identifier level and no single identifier of the firm meets the threshold

Yes, but only where the firm's combined activity exceeds twice the stated threshold figure

How often must the testing FINRA Rule 4380 governs take place?

At least once every calendar quarter

At least once every twenty-four months

Whenever FINRA materially changes its systems architecture

What does the requirement for functional and performance testing demand beyond establishing that a member can connect to FINRA's backup systems?

That the member complete the test within a window FINRA sets on the day

That the member's own backup site be used rather than its primary facility

That the member's results be independently verified by an outside auditor

That the member exercise actual functions — order entry, execution, reporting, routing, market data

How much advance notice must FINRA give a designated member of a scheduled test?

Sixty days before the scheduled test date

One year before the scheduled test date

Thirty days before the scheduled test date

What does FINRA Rule 4380(c) specify about the testing a designated member must perform?

The precise systems, scenarios and durations that each annual test must cover

That the member must fulfil the requirements FINRA determines, within the timeframes it sets

That the member may elect which of FINRA's systems it will test in a given year

That the member must test every system on which it has reported in the preceding year

What distinguishes the concern of FINRA Rule 4370 from that of FINRA Rule 4380?

One sets requirements for a firm's trading systems, the other for its books and records

One is reviewed annually and the other tested annually, the cadence being what separates them

One governs a firm's own continuity, the other its part in the market's collective resilience

One governs a firm's customer-facing systems, the other its back-office and clearing systems

Beyond the general written supervisory procedure requirements, what should a designated member's procedures address about testing coordination?

That a single named principal is responsible for the whole of the member's participation

That an outside vendor is retained to manage the member's participation in each test

That the compliance department alone conducts and records the member's participation

That responsibility is assigned across the technology, operations and compliance functions

When did FINRA Rule 4380 take effect, and how does that timing relate to Regulation SCI?

The rule took effect in November 2015, a year after Regulation SCI's adoption in November 2014

The rule took effect in November 2014, the same month the Commission adopted Regulation SCI

The rule took effect in November 2014, a year before Regulation SCI's adoption in November 2015

The rule took effect in November 2015, the same month the Commission adopted Regulation SCI

What is the regulatory position of a broker-dealer that FINRA designates for business continuity testing under FINRA Rule 4380?

It becomes an SCI entity itself, subject to Regulation SCI for as long as its designation lasts

It is bound through FINRA's rule, FINRA being the SCI entity whose testing it joins

It is bound directly by Regulation SCI, as a participant that the Commission's rule names

It takes part by agreement with FINRA, the rule itself creating no enforceable obligation

What must the written policies and procedures that Regulation SCI requires of an SCI entity address?

The suitability, disclosure and best-execution duties that its members owe their customers

The capital, liquidity and credit exposure of the entity and of its largest participants

The fees, access terms and listing standards it applies to its members and issuers

Regulation SCI requires an SCI entity's business continuity and disaster recovery plans to include backup and recovery capabilities. What standard must those capabilities meet?

Maintained by FINRA on behalf of every SCI entity, so that one backup site serves the whole market

Located near enough to the primary site that staff can relocate there within the same trading day

Operated by an independent vendor that the Commission has certified to run backup facilities

Geographically diverse and robust enough to maintain operations through a wide-scale disruption

FINRA decides to revise the volume thresholds it uses to designate members for business continuity testing. How must the revision reach the membership?

It is announced to members in advance and applies to designations made after the announcement

It applies at once to the period just measured, affected members learning of it on designation

It takes effect on the date of FINRA's next scheduled test, members being told at that point

It is sent privately to each member whose status changes, without any general publication

For each FINRA market system its criteria cover, how is the threshold for designation expressed?

As a count of transactions per day averaged over the year, designation applying above it

As a percentage of the system's reportable transactions, designation applying at or above it

As a ranking of members by activity, the few largest on each system being designated

As a dollar value of reported trades, measured over the member's most recent calendar quarter

During FINRA's scheduled test, a designated member confirms that it can establish a connection to FINRA's backup trading and reporting systems and then ends its participation. Has it done what the test requires?

Yes, provided the connection was made from its own backup site rather than its primary facility

Yes — establishing a connection to the backup systems is what the test is designed to verify

No — it must also route orders, submit reports and process market data through the backup systems

No — it must repeat the connection from each of its offices that report transactions to FINRA

What is the purpose of the advance notice FINRA must give a designated member before a scheduled test?

To let the member warn its customers of the test, since the test may interrupt their trading

To let the member contest its designation before FINRA's decision becomes final for that year

To let FINRA collect and approve the member's test scripts before the test is conducted

To give the member time to organise its staff and connectivity and finish its own preparatory testing

Besides taking part in the test itself, what further requirement may FINRA impose on a member designated under FINRA Rule 4380?

Related reporting, such as reporting the results of its participation in the test

A contribution toward the cost of running FINRA's backup systems, assessed on its volume

An independent review of FINRA's continuity plan, commissioned and paid for by the member

A permanent connection to FINRA's backup site, maintained between tests as well as during them

In the industry-wide market-wide circuit breaker test linked to FINRA Rule 4380, a participating member attests that it can receive and process halt messages. From which source?

From FINRA's Market Operations staff

From its clearing firm, which relays FINRA's halt instructions

From the Commission, which declares each market-wide halt

Which members designated under FINRA Rule 4380 must also take part in at least one industry-wide market-wide circuit breaker test each year?

Every designated member, whichever FINRA market system its designation rests on

Those designated in respect of TRACE for corporate bonds, securitized products or Treasuries

Those designated in respect of a Trade Reporting Facility or the Alternative Display Facility

Those designated in respect of the OTC Bulletin Board or the OTC Markets systems

A member designated under FINRA Rule 4380 is in full compliance with FINRA Rule 4370. What follows for its obligation to take part in FINRA's business continuity testing?

It joins FINRA's test in alternate years, its FINRA Rule 4370 compliance counting for the years between

It is excused from FINRA's testing, having already met FINRA's continuity requirements for the year

Its designation lapses, FINRA's criteria excluding members already compliant with FINRA Rule 4370

It must still take part in FINRA's testing, compliance with FINRA Rule 4370 not satisfying it

What does FINRA Rule 4370 require of each member firm?

A written plan setting out how it will continue operating through a significant business disruption

A backup office at least a set distance from its main office, approved in advance by FINRA

A continuity plan filed with FINRA for approval before the member may begin to do business

Notice to its customers of every business disruption within one business day of it occurring

Why should a member designated under FINRA Rule 4380 keep records of its participation in FINRA's business continuity tests?

Because FINRA scores each test from members' records rather than from its own system logs

To show compliance in FINRA examinations and to support its own assessment of its readiness

Because the records are filed with the Commission as part of FINRA's own compliance with Regulation SCI

So that it can show customers on request that its trading would survive a disruption

A member's activity on a FINRA market system sits just below the designation threshold, and it has not been designated. Should its written supervisory procedures address participation in FINRA's business continuity testing?

No — a member whose volume is below the threshold falls outside FINRA Rule 4380 until that changes

No — procedures are needed from the date FINRA designates the member, and not before

Yes — the procedures should cover a member that may be designated, not just one that is

Yes, but only once FINRA has warned it that its activity is nearing the threshold

What should the written supervisory procedures of a member designated under FINRA Rule 4380 specify about the designation notifications FINRA sends it?

The criteria the member applies in deciding whether to accept a designation for that year

The grounds on which the member will ask FINRA to withdraw a designation it disputes

That each notification be passed on to the member's customers within a set number of days

The internal process for receiving them and for responding to them

After its initial criteria, FINRA added reporting of U.S. Treasury securities through TRACE as a further basis for designating members, with a threshold of its own. What justified giving Treasury reporting a separate threshold?

The Commission's direction, under Regulation SCI, that members active in Treasury securities be designated separately from other members

The fact that Treasury securities are reported through the Trade Reporting Facilities, whose thresholds did not reach the firms most active in them

The need to offset the lower thresholds that apply to corporate bond and securitized product reporting through TRACE

FINRA Rule 4380 | BC/DR Testing Designation Authority

FINRA Rule 4380: FINRA's Authority to Designate Members for BC/DR Testing

FINRA Rule 4380 authorizes FINRA to designate member firms that must participate in FINRA's periodic, scheduled testing of its business continuity and disaster recovery plan, and establishes the framework governing that designation process, the testing frequency, the advance notification period, and the obligations of designated members to fulfill testing requirements and related reporting.

The rule was adopted specifically to comply with the requirements of Regulation Systems Compliance and Integrity — Regulation SCI — promulgated by the SEC in November 2014, which requires SCI entities including FINRA to designate the broker-dealers whose participation is the minimum necessary to ensure fair and orderly markets in the event that FINRA's BC/DR plan is activated.

Rule 4380 sits within the 4300 Operations section of the 4000 Financial and Operational Rules series, immediately following FINRA Rule 4370 which governs members' own business continuity plans. It was adopted by SR-FINRA-2015-046, effective November 3, 2015. Regulatory Notice 15-43 announced the rule's adoption and published FINRA's initial designation criteria.

Regulatory Notice 18-09 updated those criteria to add TRACE reporting of U.S. Treasury securities as a designation basis, and Regulatory Notice 19-15 published a consolidated updated set of criteria incorporating all systems and thresholds then operative. The rule has not been formally amended since adoption — its limited operative text delegates the substantive designation and testing parameters to the Regulatory Notice framework, allowing FINRA to update criteria as market structure and system architecture evolve without formal rulemaking.

Regulation SCI and the BC/DR Testing Mandate

Regulation SCI — formally titled Regulation Systems Compliance and Integrity — was adopted by the SEC under Exchange Act authority in November 2014 to strengthen the operational resilience of the U.S. securities market infrastructure. SCI entities — a defined category that includes national securities exchanges, registered clearing agencies, alternative trading systems with significant volume, plan processors, and FINRA itself — are required to establish, maintain, and enforce written policies and procedures addressing systems capacity, integrity, resilience, availability, and security.

A core element of Regulation SCI is the requirement that each SCI entity establish and maintain business continuity and disaster recovery plans that include backup and recovery capabilities that are sufficiently resilient and geographically diverse to maintain operations in the event of a wide-scale disruption.

Rule 1004 of Regulation SCI specifically requires each SCI entity to designate members and participants whose participation in BC/DR testing is the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of the SCI entity's BC/DR plan. The SEC's rationale is that a BC/DR test conducted only by FINRA's own systems in isolation — without the participation of the member firms that actually route orders through and report transactions to those systems — would not constitute a meaningful test of whether the markets could actually function. FINRA's BC/DR systems must be tested in conjunction with the member firms whose activity would constitute the market during a BC/DR activation. Rule 4380 is FINRA's implementation of this Rule 1004 requirement.

The Designation Framework and Criteria

Rule 4380(a) establishes the key structural features of FINRA's designation authority. FINRA will designate members for mandatory BC/DR testing participation according to established criteria that are designed to ensure participation by those members that FINRA reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of activation. The criteria must consider volume of activity on a FINRA market system over a specified period of time. FINRA must communicate its criteria for designation — and any changes to those criteria — to members on a prospective basis by Regulatory Notice.

The volume-based approach to designation reflects the regulatory logic underlying the minimum necessary standard. The member firms whose absence from the markets would most disrupt fair and orderly trading in a BC/DR scenario are those that conduct the largest share of activity on FINRA's systems. By focusing on high-volume participants, FINRA ensures that its BC/DR test simulates conditions under which the systems would actually be heavily used during a real activation, while avoiding the burden of requiring participation from small-volume members whose absence from the BC/DR market would have minimal systemic impact.

Regulatory Notice 15-43 established the initial criteria across five FINRA market systems: the Trade Reporting Facilities — the TRF operated jointly with NYSE and the TRF operated jointly with Nasdaq — the OTC Bulletin Board and OTC Markets systems, the Alternative Display Facility, and TRACE for corporate bonds and securitized products. For each system, the notice specified a volume threshold expressed as a percentage of reportable transactions, at or above which a member would be designated. Regulatory Notice 18-09 added a sixth system — TRACE for U.S. Treasury securities — with its own threshold reflecting the systemic importance of Treasury market reporting to FINRA's market surveillance and transparency functions. Regulatory Notice 19-15 published the consolidated criteria table incorporating all systems.

FINRA calculates participant activity at the Member Participant Identifier level — the MPID — and designates the parent firm of any MPID that meets or exceeds a stated threshold. Where a parent firm represents significant aggregate volume through multiple MPIDs — none of which individually meets the threshold but whose combined activity does — FINRA may in its discretion designate the parent firm based on overall activity. This aggregation approach prevents large broker-dealers from structuring their market system participation across multiple MPIDs to avoid individual threshold triggers while retaining an aggregate market presence that would be critical in a BC/DR activation.

Testing Frequency, Scope, and the Ninety-Day Notice Requirement

Rule 4380(b) establishes three key parameters for the testing itself. Testing must occur at least once every twelve months — creating an annual minimum frequency that parallels the annual review FINRA Rule 4370 requires of members' own business continuity plans. Each test must include both functional and performance testing of FINRA's BC/DR plan operation. And FINRA must notify designated members of their required participation at least ninety days before the scheduled test date.

The functional and performance testing requirement is substantively demanding. As the SEC explained in the Regulation SCI adopting release, functional and performance testing goes beyond simple connectivity testing or validation that a connection to FINRA's backup systems can be established.

It requires testing of actual system functions — order entry, execution, trade reporting, order routing, and the transmission and receipt of market data, as applicable — to determine whether those functions can operate as contemplated by the BC/DR plans. A designated member must test not only that it can connect to FINRA's backup trading and reporting infrastructure but that it can actually route orders, execute reports, and process market data through those systems under realistic operating conditions.

The ninety-day advance notification period gives designated members meaningful lead time to prepare for the test — coordinating their own technology teams, operations staff, and business continuity personnel, scheduling the necessary system connectivity arrangements, briefing relevant management, and ensuring that any internal testing required to prepare for the FINRA BC/DR test has been completed. Ninety days is substantially longer than the notice period for many regulatory obligations, reflecting the operational complexity of mobilizing a firm's technology infrastructure for a coordinated industry-wide systems test.

Member Obligations Upon Designation

Rule 4380(c) establishes the operative obligations for designated members. Members designated under the rule must fulfill, within the timeframes FINRA establishes, all testing requirements that FINRA determines are necessary and appropriate. Members may also be required to satisfy related reporting requirements — for example, reporting the results of their participation in the test — as determined by FINRA. The rule's language is deliberately flexible in delegating the specific testing and reporting requirements to FINRA's operational determinations rather than specifying them in the rule text, allowing FINRA to calibrate what is required of designated members for each annual test based on the systems being tested and the scenarios being validated.

The connection between Rule 4380 and FINRA Rule 6121 — Trading Halts Due to Extraordinary Market Volatility — creates an additional testing obligation for a specific subset of designated members. Members designated pursuant to Rule 4380 with respect to a FINRA Trade Reporting Facility or the Alternative Display Facility are required to participate in at least one industry-wide market-wide circuit breaker test each year and to verify their participation by attesting that they are able to receive and process MWCB halt messages from the securities information processors, receive and process resume messages following a MWCB halt, receive and process relevant market data, and send quotes, trades, or both to the applicable FINRA facility following a Level 1 or Level 2 MWCB halt in a manner consistent with their usual trading behavior. This MWCB testing component integrates the BC/DR testing framework with the operational testing of the market infrastructure designed to manage systemic market stress events.

Relationship to FINRA Rule 4370 and the Broader BC/DR Framework

Rule 4380 and FINRA Rule 4370 address complementary dimensions of business continuity planning from different regulatory angles. Rule 4370 imposes obligations on member firms regarding their own business continuity plans — requiring each member to maintain a written BCP addressing how it will continue operations in the event of a significant business disruption, and requiring annual review of that plan. Rule 4380 addresses a different obligation — the member's participation in testing FINRA's own BC/DR infrastructure — which is a collective industry resilience obligation rather than a firm-specific continuity planning obligation.

A firm's compliance with Rule 4370's own BCP requirements does not satisfy Rule 4380's BC/DR testing participation obligation, and vice versa. They are independent obligations addressing different aspects of market resilience. A member designated under Rule 4380 must both maintain its own compliant BCP under Rule 4370 and fulfill its annual BC/DR testing participation obligations under Rule 4380. The two rules together reflect the SEC's and FINRA's recognition that effective market resilience requires both individual firm preparedness and coordinated systemic testing of the market infrastructure itself.

Supervision and Written Supervisory Procedures

Members that are or may be designated under Rule 4380 should address the BC/DR testing participation obligation in their written supervisory procedures under FINRA Rule 3110. WSPs should specify the internal process for receiving and responding to FINRA designation notifications, the coordination procedures for preparing for and participating in scheduled BC/DR tests, the assignment of responsibility for testing coordination across technology, operations, and compliance functions, and the procedures for fulfilling any FINRA-required reporting of test participation results. Members should also maintain records of their participation in BC/DR tests — both to demonstrate compliance in FINRA examinations and to support their own internal assessments of BC/DR readiness.

Examination Relevance and Key Takeaways

FINRA Rule 4380 is tested on the Series 24 General Securities Principal examination in the context of regulatory infrastructure, business continuity obligations, and the relationship between FINRA's own operational requirements and member firm obligations. The rule is a secondary examination topic that appears most commonly in questions about Regulation SCI's requirements for SCI entities and the obligations that flow from FINRA's status as an SCI entity to its member firms.

The key points to retain are these: FINRA Rule 4380 implements the requirements of Regulation SCI Rule 1004 by authorizing FINRA to designate member firms that must participate in FINRA's annual BC/DR testing; designation is based on established criteria published by Regulatory Notice that consider a member's volume of activity on specified FINRA market systems over a specified period — currently encompassing the Trade Reporting Facilities, OTC systems, the Alternative Display Facility, and TRACE for both corporate and Treasury securities.

FINRA must communicate its designation criteria and any changes to those criteria to members on a prospective basis by Regulatory Notice before applying updated criteria; BC/DR testing must occur at least once every twelve months and must include both functional and performance testing — not merely connectivity testing — of FINRA's BC/DR plan operation across relevant trading, reporting, and data systems; designated members must receive at least ninety days advance notice before a scheduled test; designated members must fulfill all testing requirements within the timeframes FINRA establishes and may be required to report test participation results; members designated with respect to a FINRA TRF or the ADF must additionally participate in at least one annual industry-wide MWCB circuit breaker test and provide the specified attestation of their ability to process halt and resume messages; and Rule 4380 operates alongside but independently of FINRA Rule 4370's requirements for members' own business continuity plans — the two rules address different dimensions of market resilience and compliance with one does not satisfy obligations under the other.