Updating your Needs Analysis and Annual Compliance Questionnaires for 2025

2025 NAQ and ACQ Key Updates

• Early in 2024, FINRA released 3110.19 Residential Supervisory Location, effective June 1, 2024 and this was covered in its 2025 Annual Regulatory Oversight Report as well.  There are specific requirements that a location must meet in order to qualify as an RSL.  Prior to the release of the rule, RegEd updated its template to add a series of questions to its ACQ to determine and validate RSL eligibility.  RSL Requirements were also added as a potential training topic as part of the NAQ, though this topic should be part of each firm’s written training plan if it maintains RSLs as part of its structure. 

• Effective July 1, 2024, FINRA’s Remote Inspections Pilot Program requires members to qualify locations as eligible to be inspected remotely.  We have reviewed and adjusted our ACQ’s validation questions around the Location Level Conditions including that emails are made through the member’s system, that correspondence and communications are subject to supervision, and that no required books and records are maintained at the location. 

• FINRA Rule 3240 amendments will be effective April 28, 2025. We have adjusted the questions in our ACQ to account for the changes FINRA is making to the exceptions, the notice and approval requirements, and the definition of “immediate family.”  

• In its 2025 Annual Regulatory Oversight Report, FINRA highlighted that it has observed an increase in suspicious and fraudulent activity related to ACH fraud, and an emerging risk in the form of adversarial use of generative artificial intelligence.  Both of these topics have been added to our NAQ as potential training topics. 

• In the 2025 Report, FINRA observed in the area of Technology Management that firms have not established security controls that branch offices must follow when they maintain their own email systems or other application systems or servers.  Additionally, FINRA noted that effective practices would include Branch Office Procedures that limit the use of such servers or if permitted, ensure that adequate security controls are maintained.  While we did not add this to our ACQ template, we suggest that firms which utilize an annual branch-level questionnaire consider adding questions around the use of this technology. 

• FINRA also added observations in its Report of firms that are inadequately supervising the use of social media influencers, and thus RegEd has added a question to its ACQ as to whether the representative is using social media influencers in his or her marketing. 

• FINRA released RN 24-09, which reminds member firms of regulatory obligations when using generative AI and large language models (LLMs).  As noted above, we have updated our NAQ to expand upon our existing list of AI training topics and we have listed generative AI as a specific training option that can be selected by questionnaire respondents.  

• For our ACQ, in addition to our existing question regarding representatives’ use of AI in general, we have added a specific question regarding the use generative AI technology and if so, to provide a description of its use.  This will help firms understand across the rep base the level of risk regarding this technology, and can verify whether proper due diligence has been conducted on the solutions. 

• In its 2025 Examination Priorities, the SEC indicated it may focus examinations on dual registrants and firms’ process for identifying and mitigating conflicts of interest, account allocation practices, and account selection practices (brokerage vs. advisory).  We have added this as a potential training topic in our NAQ along with fully-paid lending programs, funding portals, pricing of illiquid securities, Regulation ID/Identity Theft, and trading algorithms, as all these topics were mentioned as priorities for the SEC in 2025. 

• While not related to the ACQ or NAQ, FINRA’s 2025 report contains specific guidance related to reviewing retail communications that concern crypto assets, and firms may wish to incorporate this information into their marketing checklists and lexicon detection in their advertising review systems. 

In addition to making updates due to regulatory activity, it is important to update your Needs Analysis and ACQ based on any changes to your firm’s written supervisory procedures. The ACQ can be used not only as a data collection and information-gathering tool, but also to train representatives on new (and old) policies and validate their understanding.  The ACQ can also be used as part of the risk assessment that must be performed as part of the Remote Inspections Pilot Program.  If there is any data or information that you need from representatives as part of that assessment, the ACQ represents an opportunity to gather that information.