FINRA Rule 3310

Under Rule 3310, what is the firm's obligation regarding testing of its Anti-Money Laundering compliance program?

1. A.Any documented internal review of the AML program satisfies the requirement, regardless of who performs itWrong. This omits the independence requirement central to Rule 3310's testing obligation.
2. B.Testing must be performed with independence from the personnel who operate the AML program day-to-dayCorrect. Rule 3310 calls for independent testing, not review performed by those responsible for the program's daily operation.
3. C.Testing is required only once at the program's initial adoption, with no ongoing obligationWrong. AML program testing is an ongoing obligation, not a one-time event at initial adoption.
4. D.Testing may be waived entirely if the firm has never had a confirmed money laundering incidentWrong. The testing requirement does not depend on whether the firm has had a confirmed incident.

Why: Rule 3310 requires firms to provide for independent testing of their AML program, generally by personnel who are not themselves involved in the day-to-day operation of the program being tested. The principal must ensure this independence in how testing is structured, not treat testing performed by the same people who run the program day-to-day as satisfying the requirement.

A firm's AML Compliance Officer also personally reviews and clears the daily alert queue as part of her regular duties. When designating who will conduct the firm's required independent test of the AML program this year, the principal proposes having her conduct the test herself since she knows the program best. What is the problem?

1. A.The person who performs the AML program's day-to-day functions cannot also be the one who independently tests it; testing must be performed by a qualified person not involved in the functions being tested.Correct. Independence from the tested function is the core requirement for who may conduct the test.
2. B.The AML Compliance Officer is barred from ever participating in the testing process in any capacity, even to provide documentation to the tester.Wrong. She may still support the test with information; she just cannot be the tester of a function she performs.
3. C.Independent testing must be performed by an entity entirely outside the firm, such as an outside consultant, and never by any firm employee.Wrong. Qualified internal personnel not involved in the tested function may perform the test; an outside party is not mandatory.
4. D.The concern is timing, not independence — testing conducted by any staff member is acceptable as long as it occurs annually.Wrong. This misidentifies the actual defect as a timing issue when it is an independence issue.

Why: Under Rule 3310, the independent test must be performed by a qualified person who is not involved in performing the functions being tested. Because the AML Compliance Officer personally performs the daily alert review, she cannot also be the one who independently tests that function.

A principal is reviewing whether the firm's AML Compliance Officer has the information needed to do the job effectively. Under the supplementary material to Rule 3310, what should the principal confirm regarding how that person's information is kept current?

1. A.Nothing, since the AML Compliance Officer's information only needs to be accurate at initial designationWrong. This treats the designation as a one-time task, missing the need for ongoing review to keep the information current.
2. B.That there is a functioning process for reviewing and updating the AML Compliance Officer's information as needed, on an ongoing basisCorrect. Keeping this information current on an ongoing basis, not just at initial designation, is part of maintaining an effective AML program.
3. C.That the AML Compliance Officer holds a Series 7 registrationWrong. This is not the specific concern raised; the issue is whether the person's information is kept current, not their particular registration category.
4. D.That the AML Compliance Officer reports directly to the sales departmentWrong. Reporting to sales would raise independence concerns rather than address the information-currency issue described.

Why: The firm should have a process for reviewing and updating the AML Compliance Officer's contact and related information as needed, so that the person designated to receive and act on AML-related matters can actually be reached and is current. The principal must confirm this review process is functioning, not assume it was handled correctly once at initial designation and never revisited.