FINRA Rule 4380

Regulation SCI and the BC/DR Testing Mandate

Regulation SCI — formally titled Regulation Systems Compliance and Integrity — was adopted by the SEC under Exchange Act authority in November 2014 to strengthen the operational resilience of the U.S. securities market infrastructure. SCI entities — a defined category that includes national securities exchanges, registered clearing agencies, alternative trading systems with significant volume, plan processors, and FINRA itself — are required to establish, maintain, and enforce written policies and procedures addressing systems capacity, integrity, resilience, availability, and security. A core element of Regulation SCI is the requirement that each SCI entity establish and maintain business continuity and disaster recovery plans that include backup and recovery capabilities that are sufficiently resilient and geographically diverse to maintain operations in the event of a wide-scale disruption.

Rule 1004 of Regulation SCI specifically requires each SCI entity to designate members and participants whose participation in BC/DR testing is the minimum necessary for the maintenance of fair and orderly markets in the event of the activation of the SCI entity's BC/DR plan. The SEC's rationale is that a BC/DR test conducted only by FINRA's own systems in isolation — without the participation of the member firms that actually route orders through and report transactions to those systems — would not constitute a meaningful test of whether the markets could actually function. FINRA's BC/DR systems must be tested in conjunction with the member firms whose activity would constitute the market during a BC/DR activation. Rule 4380 is FINRA's implementation of this Rule 1004 requirement.

The Designation Framework and Criteria

Rule 4380(a) establishes the key structural features of FINRA's designation authority. FINRA will designate members for mandatory BC/DR testing participation according to established criteria that are designed to ensure participation by those members that FINRA reasonably determines are, taken as a whole, the minimum necessary for the maintenance of fair and orderly markets in the event of activation. The criteria must consider volume of activity on a FINRA market system over a specified period of time. FINRA must communicate its criteria for designation — and any changes to those criteria — to members on a prospective basis by Regulatory Notice.

The volume-based approach to designation reflects the regulatory logic underlying the minimum necessary standard. The member firms whose absence from the markets would most disrupt fair and orderly trading in a BC/DR scenario are those that conduct the largest share of activity on FINRA's systems. By focusing on high-volume participants, FINRA ensures that its BC/DR test simulates conditions under which the systems would actually be heavily used during a real activation, while avoiding the burden of requiring participation from small-volume members whose absence from the BC/DR market would have minimal systemic impact.

Regulatory Notice 15-43 established the initial criteria across five FINRA market systems: the Trade Reporting Facilities — the TRF operated jointly with NYSE and the TRF operated jointly with Nasdaq — the OTC Bulletin Board and OTC Markets systems, the Alternative Display Facility, and TRACE for corporate bonds and securitized products. For each system, the notice specified a volume threshold expressed as a percentage of reportable transactions, at or above which a member would be designated. Regulatory Notice 18-09 added a sixth system — TRACE for U.S. Treasury securities — with its own threshold reflecting the systemic importance of Treasury market reporting to FINRA's market surveillance and transparency functions. Regulatory Notice 19-15 published the consolidated criteria table incorporating all systems.

FINRA calculates participant activity at the Member Participant Identifier level — the MPID — and designates the parent firm of any MPID that meets or exceeds a stated threshold. Where a parent firm represents significant aggregate volume through multiple MPIDs — none of which individually meets the threshold but whose combined activity does — FINRA may in its discretion designate the parent firm based on overall activity. This aggregation approach prevents large broker-dealers from structuring their market system participation across multiple MPIDs to avoid individual threshold triggers while retaining an aggregate market presence that would be critical in a BC/DR activation.

Testing Frequency, Scope, and the Ninety-Day Notice Requirement

Rule 4380(b) establishes three key parameters for the testing itself. Testing must occur at least once every twelve months — creating an annual minimum frequency that parallels the annual BC/DR testing frequency applicable to members' own plans under FINRA Rule 4370. Each test must include both functional and performance testing of FINRA's BC/DR plan operation. And FINRA must notify designated members of their required participation at least ninety days before the scheduled test date.

The functional and performance testing requirement is substantively demanding. As the SEC explained in the Regulation SCI adopting release, functional and performance testing goes beyond simple connectivity testing or validation that a connection to FINRA's backup systems can be established. It requires testing of actual system functions — order entry, execution, trade reporting, order routing, and the transmission and receipt of market data, as applicable — to determine whether those functions can operate as contemplated by the BC/DR plans. A designated member must test not only that it can connect to FINRA's backup trading and reporting infrastructure but that it can actually route orders, execute reports, and process market data through those systems under realistic operating conditions.

The ninety-day advance notification period gives designated members meaningful lead time to prepare for the test — coordinating their own technology teams, operations staff, and business continuity personnel, scheduling the necessary system connectivity arrangements, briefing relevant management, and ensuring that any internal testing required to prepare for the FINRA BC/DR test has been completed. Ninety days is substantially longer than the notice period for many regulatory obligations, reflecting the operational complexity of mobilizing a firm's technology infrastructure for a coordinated industry-wide systems test.

Member Obligations Upon Designation

Rule 4380(c) establishes the operative obligations for designated members. Members designated under the rule must fulfill, within the timeframes FINRA establishes, all testing requirements that FINRA determines are necessary and appropriate. Members may also be required to satisfy related reporting requirements — for example, reporting the results of their participation in the test — as determined by FINRA. The rule's language is deliberately flexible in delegating the specific testing and reporting requirements to FINRA's operational determinations rather than specifying them in the rule text, allowing FINRA to calibrate what is required of designated members for each annual test based on the systems being tested and the scenarios being validated.

The connection between Rule 4380 and FINRA Rule 6121 — Trading Halts Due to Extraordinary Market Volatility — creates an additional testing obligation for a specific subset of designated members. Members designated pursuant to Rule 4380 with respect to a FINRA Trade Reporting Facility or the Alternative Display Facility are required to participate in at least one industry-wide market-wide circuit breaker test each year and to verify their participation by attesting that they are able to receive and process MWCB halt messages from the securities information processors, receive and process resume messages following a MWCB halt, receive and process relevant market data, and send quotes, trades, or both to the applicable FINRA facility following a Level 1 or Level 2 MWCB halt in a manner consistent with their usual trading behavior. This MWCB testing component integrates the BC/DR testing framework with the operational testing of the market infrastructure designed to manage systemic market stress events.

Relationship to FINRA Rule 4370 and the Broader BC/DR Framework

Rule 4380 and FINRA Rule 4370 address complementary dimensions of business continuity planning from different regulatory angles. Rule 4370 imposes obligations on member firms regarding their own business continuity plans — requiring each member to maintain a written BCP addressing how it will continue operations in the event of a significant business disruption, and requiring annual review of that plan. Rule 4380 addresses a different obligation — the member's participation in testing FINRA's own BC/DR infrastructure — which is a collective industry resilience obligation rather than a firm-specific continuity planning obligation.

A firm's compliance with Rule 4370's own BCP requirements does not satisfy Rule 4380's BC/DR testing participation obligation, and vice versa. They are independent obligations addressing different aspects of market resilience. A member designated under Rule 4380 must both maintain its own compliant BCP under Rule 4370 and fulfill its annual BC/DR testing participation obligations under Rule 4380. The two rules together reflect the SEC's and FINRA's recognition that effective market resilience requires both individual firm preparedness and coordinated systemic testing of the market infrastructure itself.

Supervision and Written Supervisory Procedures

Members that are or may be designated under Rule 4380 should address the BC/DR testing participation obligation in their written supervisory procedures under FINRA Rule 3110. WSPs should specify the internal process for receiving and responding to FINRA designation notifications, the coordination procedures for preparing for and participating in scheduled BC/DR tests, the assignment of responsibility for testing coordination across technology, operations, and compliance functions, and the procedures for fulfilling any FINRA-required reporting of test participation results. Members should also maintain records of their participation in BC/DR tests — both to demonstrate compliance in FINRA examinations and to support their own internal assessments of BC/DR readiness.

Examination Relevance and Key Takeaways

FINRA Rule 4380 is tested on the Series 24 General Securities Principal examination in the context of regulatory infrastructure, business continuity obligations, and the relationship between FINRA's own operational requirements and member firm obligations. The rule is a secondary examination topic that appears most commonly in questions about Regulation SCI's requirements for SCI entities and the obligations that flow from FINRA's status as an SCI entity to its member firms.

The key points to retain are these: FINRA Rule 4380 implements the requirements of Regulation SCI Rule 1004 by authorizing FINRA to designate member firms that must participate in FINRA's annual BC/DR testing; designation is based on established criteria published by Regulatory Notice that consider a member's volume of activity on specified FINRA market systems over a specified period — currently encompassing the Trade Reporting Facilities, OTC systems, the Alternative Display Facility, and TRACE for both corporate and Treasury securities; FINRA must communicate its designation criteria and any changes to those criteria to members on a prospective basis by Regulatory Notice before applying updated criteria; BC/DR testing must occur at least once every twelve months and must include both functional and performance testing — not merely connectivity testing — of FINRA's BC/DR plan operation across relevant trading, reporting, and data systems; designated members must receive at least ninety days advance notice before a scheduled test; designated members must fulfill all testing requirements within the timeframes FINRA establishes and may be required to report test participation results; members designated with respect to a FINRA TRF or the ADF must additionally participate in at least one annual industry-wide MWCB circuit breaker test and provide the specified attestation of their ability to process halt and resume messages; and Rule 4380 operates alongside but independently of FINRA Rule 4370's requirements for members' own business continuity plans — the two rules address different dimensions of market resilience and compliance with one does not satisfy obligations under the other.