Series 24 Study Guide — 2026 Edition

Function 2 is where the Series 24 stops being a registration exam and becomes a supervision exam. Its first three tasks ask three questions a principal answers every week: Do our written procedures actually cover what we do, and do we test them? Are our people doing anything — outside jobs, private deals, personal trading, borrowing from clients — that the firm does not know about? And is anyone being paid, or paying, in a way the rules forbid^[1]?

2.1 Supervisory procedures, controls and inspections

The supervisory system (Rule 3110(a))

Every member must "establish and maintain a system to supervise the activities of each associated person that is reasonably designed to achieve compliance" with the securities laws and FINRA rules, and "Final responsibility for proper supervision shall rest with the member"^[2]. "Reasonably designed" is the standard throughout: the rule does not require a system that prevents every violation, and an exam option promising that no violation can occur is always wrong. At a minimum the system provides for:

• written supervisory procedures (WSPs);
• appropriately registered principals for each type of business;
• registration of each branch office and office of supervisory jurisdiction (OSJ);
• a designated principal in each OSJ and a designated representative or principal in each non-OSJ branch;
• assignment of every registered person to a supervisor;
• reasonable efforts to ensure supervisors are qualified by experience or training; and
• an annual compliance meeting or interview with every registered representative and principal^[2].

The annual compliance meeting need not be in person. A firm may use a webcast or other electronic means, but it must ensure each person attends the entire meeting and can ask questions and receive answers^[2].

Written supervisory procedures (Rule 3110(b))

WSPs must be "reasonably designed" for "the types of business in which it engages"^[2]. Several specific procedures are required:

• Transaction review. A registered principal must review, "evidenced in writing," all transactions relating to the member's investment banking or securities business^[2]. A risk-based review system may be used; the firm need not look at each trade in detail if the system lets it focus on the greatest risks^[2].
• Correspondence and internal communications. Reviews must be conducted by a registered principal and evidenced in writing^[2]. Merely opening a message "is not sufficient review"^[2]. A principal may delegate review functions to unregistered staff but "remains ultimately responsible"^[2].
• Customer complaints. Procedures must "capture, acknowledge, and respond to all written (including electronic) customer complaints"^[2].
• Supervising supervisors. Supervisory personnel may not supervise their own activities or report to someone they supervise; a firm too small to avoid this must document why and how it otherwise complies^[2]. FINRA expects that exception mainly for sole proprietors and the most senior executive officers^[2].
• Keeping WSPs current. A copy must be kept at each OSJ and each location where supervision is conducted, and the firm must "promptly amend" its WSPs to reflect changes in rules and in its own supervisory system^[2].

The record of who is designated as a supervisor, and when, is kept for at least three years, the first two in an easily accessible place^[2].

Offices: OSJ, branch and non-branch locations (Rule 3110(f))

An OSJ is any office where one or more of these functions occur: order execution or market making; structuring public offerings or private placements; custody of customer funds or securities; final approval of new accounts; review and endorsement of customer orders; final approval of retail communications (other than an office that only approves research reports); or supervision of other branch offices^[2].

A branch office is any location where associated persons regularly conduct securities business, or that is held out as such, unless it fits an exclusion^[2]. The exclusions most tested are:

• a back-office or customer-service location with no sales activity that is not held out as a branch;
• an associated person's primary residence, if (among other conditions) only one person or members of one immediate family work there, it is not held out to the public, customers are not met there, no customer funds or securities are handled there, and the person's communications and orders run through the firm's systems^[2];
• a location used for securities business fewer than 30 business days in a calendar year^[2];
• an office of convenience used occasionally and only by appointment;
• a location used primarily for non-securities business from which no more than 25 securities transactions a year are effected^[2];
• a temporary location established under a business continuity plan^[2].

Any location that supervises non-branch locations is itself a branch office^[2].

Residential Supervisory Location (RSL). Since 2024, Rule 3110.19 lets a private residence where supervisory activities take place be treated as a non-branch location if a long list of conditions is met — only one person (or one immediate family) works there, it is not held out to the public, no customers are met there, no customer funds or securities are handled there, communications run through the firm's systems, and no required records are kept there^[2]. A firm designated a Restricted Firm under Rule 4111 or a Taping Firm under Rule 3170 is ineligible^[2].

Inspections (Rule 3110(c))

The inspection cycle is one of the most tested facts on the exam:

The annual and three-year cycles come from Rule 3110(c)(1)(A) and (B)^[2], and the three-year presumption for non-branch locations from Rule 3110.13^[2]. Each inspection is "reduced to a written report and kept on file by the member for a minimum of three years"^[2]. The report must test and verify the firm's procedures on safeguarding customer funds and securities, books and records, supervision of supervisors, transmittals of funds or securities (to third parties, to outside entities, to addresses other than the customer's primary residence, and between customers and representatives), and changes of customer account information^[2].

Who may inspect. The inspector may not be an associated person assigned to the location, or someone who reports to a person assigned there^[2]. The exceptions — a one-office firm, or small offices that report directly to an OSJ manager — must be documented^[2].

Remote inspections. Rule 3110.18 created a Remote Inspections Pilot Program running from July 1, 2024, to June 30, 2027^[2]. A firm that opts in may inspect remotely after a documented risk assessment, but a location is ineligible if, for example, a person there is under a mandatory heightened supervisory plan, the office handles customer funds or securities, or a person there engages in proprietary trading^[2].

Supervisory controls and the CEO certification (Rules 3120 and 3130)

Rule 3110 requires the system; Rule 3120 requires the firm to test it. Each member designates principals who establish supervisory control policies that "test and verify" that its procedures are reasonably designed, and who submit to senior management, "no less than annually," a report on the controls, the test results and significant exceptions, and any new or amended procedures^[3]. If the member reported $200 million or more in gross revenue in the prior year, the report must also tabulate customer complaint and internal-investigation reports made to FINRA and discuss compliance efforts in trading, investment banking, sales practices, finance and operations, supervision and anti-money laundering^[3].

Rule 3130 adds two people. Each member must designate a chief compliance officer, and its chief executive officer must "certify annually" that the member has processes to establish, maintain, review, test and modify its written compliance policies and supervisory procedures^[4]. Each certification must be made no later than the anniversary of the previous one^[4], and the CEO must meet with the CCO at least annually to discuss the matters certified^[4]. The certification is about processes, not a guarantee of compliance — another place where an "ensures no violations" option is a trap.

Business continuity (Rule 4370)

Each member must maintain a written business continuity plan, update it after any material change, and review it annually^[5]. At a minimum it addresses data back-up and recovery; mission-critical systems; financial and operational assessments; alternate communications with customers and with employees; alternate physical location of employees; the impact on critical business constituents, banks and counterparties; regulatory reporting; communications with regulators; and how customers will get prompt access to their funds and securities if the firm cannot continue^[5]. The plan is approved by a member of senior management who is a registered principal^[5]. Customers get a written summary at account opening, on the firm's website and by mail on request^[5]. The firm also designates two emergency contact persons, at least one of whom is a member of senior management and a registered principal^[5].

2.2 Supervising the conduct of associated persons

The general standards

Rule 2010 requires members, "in the conduct of its business," to "observe high standards of commercial honor and just and equitable principles of trade"^[6]. Rule 2020 forbids effecting transactions or inducing purchases or sales "by means of any manipulative, deceptive or other fraudulent device or contrivance"^[7]. Many enforcement cases that do not fit any specific rule are brought under Rule 2010.

Guarantees and sharing in accounts (Rule 2150)

No member or associated person may "guarantee a customer against loss"^[8]. Sharing in a customer's profits or losses is prohibited unless the associated person has prior written authorization from the member and from the customer, and shares "only in direct proportion to the financial contributions made to such account"^[8]. The proportional-share condition is the one the exam tests: a representative who contributed 20% of the money may share in 20% of the profit, not half.

Borrowing and lending (Rule 3240)

A registered person may not borrow from or lend to a customer unless the firm's written procedures allow it and the arrangement fits one of five categories: an immediate family member; a financial institution regularly in the lending business acting in the course of that business; another registered person of the same member; a bona fide, close personal relationship formed before and maintained outside the broker-customer relationship; or a bona fide business relationship outside the brokerage relationship^[9]. For the last three categories the representative must notify the firm in writing and obtain its written approval before entering into the arrangement, and again before modifying or extending it^[9]. Since April 28, 2025, the rule also reaches a representative who wants to open a brokerage relationship with someone he or she already has a loan with: that too requires written notice and approval first^[9]. A "customer" includes anyone who had an account assigned to the representative within the previous six months^[9].

Accounts at other firms (Rule 3210)

An associated person may not open an account at another member or other financial institution in which securities transactions can be effected and in which he or she has a beneficial interest "without the prior written consent of the member"^[10]. The person must also tell the other firm of the association, and on request the executing member sends duplicate confirmations and statements^[10]. A new hire with existing outside accounts has 30 calendar days after association to obtain consent^[10]. The rule presumes a beneficial interest in accounts of a spouse and of children who live in the same household or are financially dependent^[10]. Accounts limited to mutual funds, variable contracts, unit investment trusts and 529 plans are outside the rule^[10], and since June 17, 2026 so are accounts under Section 530A of the Internal Revenue Code^[10].

Outside business activities (Rule 3270)

A registered person may not be employed by, or accept compensation from, any other person for business outside the scope of the firm relationship "unless he or she has provided prior written notice to the member"^[11]. Passive investments are exempt. Notice is the requirement, not approval — but on receiving notice the firm must consider whether the activity will interfere with the person's duties or be viewed by customers as part of the firm's business, and decide whether to impose conditions or prohibit it^[11].

Private securities transactions (Rule 3280)

"Selling away" is the most heavily tested conduct rule in this task. Before participating in any private securities transaction, an associated person must give the firm written notice "describing in detail the proposed transaction and the person's proposed role therein and stating whether he has received or may receive selling compensation"^[12].

• With selling compensation, the firm must approve or disapprove in writing. If it approves, the transaction "shall be recorded on the books and records of the member and the member shall supervise the person's participation in the transaction as if the transaction were executed on behalf of the member"^[12]. If it disapproves, the person may not participate in any manner^[12].
• Without selling compensation, the firm provides prompt written acknowledgment and may impose conditions^[12].

"Selling compensation" is broad: commissions, finder's fees, securities or rights to acquire them, profit participation, tax benefits and even expense reimbursements^[12].

Insider trading and manipulation

The outline lists the insider trading provisions of the Exchange Act because a principal must supervise for them. Rule 10b-5 makes it unlawful "To employ any device, scheme, or artifice to defraud" or to make untrue statements of material fact in connection with the purchase or sale of any security^[13]. Rule 10b5-1 defines trading "on the basis of" material nonpublic information as trading while "aware" of it^[14]. A court may impose a civil penalty of up to three times the profit gained or loss avoided^[15], and a controlling person — which can be the firm or a supervisor — faces its own penalty of up to the greater of $1,000,000 or three times the profit gained or loss avoided if it "knew or recklessly disregarded" that the controlled person was likely to violate and "failed to take appropriate steps to prevent" it^[15]. Criminal penalties for willful violations reach $5 million and 20 years for individuals and $25 million for entities^[16].

Rule 3110(d) turns this into a supervisory duty: firms must have a process to review trades in firm accounts, employee accounts and "covered accounts" (spouses, dependent children and similar) to identify insider trading, and must "conduct promptly an internal investigation into any such trade"^[2]. A firm engaged in investment banking must file quarterly reports on those investigations within ten business days after each quarter ends, and a report within five business days of completing an investigation that found a violation^[2].

Issuer repurchases (Rule 10b-18). An issuer buying back its own stock gets a safe harbor from manipulation liability if it meets four conditions on the same day: purchases through one broker or dealer; no opening purchase and none in the final 10 minutes of the session for actively traded securities (30 minutes for others); a price no higher than the highest independent bid or last independent transaction price; and volume no more than 25% of average daily trading volume^[17].

Sources cited in this excerpt

1. General Securities Principal Qualification Examination (Series 24) Content Outline (© 2023 FINRA; PDF last modified 2026-03-31). 2023 (read 2026-09-24). https://www.finra.org/sites/default/files/Series_24_Outline.pdf
2. FINRA Rule 3110. Supervision. FINRA (FINRA Manual), version in force: Nov 26, 2024 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3110
3. FINRA Rule 3120. Supervisory Control System. FINRA (FINRA Manual), version in force: only version (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3120
4. FINRA Rule 3130. Annual Certification of Compliance and Supervisory Processes. FINRA (FINRA Manual), version in force: only version (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3130
5. FINRA Rule 4370. Business Continuity Plans and Emergency Contact Information. FINRA (FINRA Manual), version in force: Feb 12, 2015 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/4370
6. FINRA Rule 2010. STANDARDS OF COMMERCIAL HONOR AND PRINCIPLES OF TRADE. FINRA (FINRA Manual), version in force: only version (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/2010
7. FINRA Rule 2020. Use of Manipulative, Deceptive or Other Fraudulent Devices. FINRA (FINRA Manual), version in force: only version (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/2020
8. FINRA Rule 2150. Improper Use of Customers' Securities or Funds; Prohibition Against Guarantees and Sharing in Accounts. FINRA (FINRA Manual), version in force: Apr 03, 2017 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/2150
9. FINRA Rule 3240. Prohibition on Borrowing From or Lending to Customers. FINRA (FINRA Manual), version in force: Apr 28, 2025 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3240
10. FINRA Rule 3210. Accounts At Other Broker-Dealers and Financial Institutions. FINRA (FINRA Manual), version in force: Jun 17, 2026 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3210
11. FINRA Rule 3270. Outside Business Activities of Registered Persons. FINRA (FINRA Manual), version in force: Sep 21, 2015 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3270
12. FINRA Rule 3280. Private Securities Transactions of an Associated Person. FINRA (FINRA Manual), version in force: Apr 03, 2017 onwards (read 2026-09-24). https://www.finra.org/rules-guidance/rulebooks/finra-rules/3280
13. 17 CFR § 240.10b-5 Employment of manipulative and deceptive devices. eCFR (Office of the Federal Register / GPO), eCFR text as of 2026-09-23. https://www.ecfr.gov/current/title-17/section-240.10b-5
14. 17 CFR § 240.10b5-1 Trading “on the basis of” material nonpublic information in insider trading cases. eCFR (Office of the Federal Register / GPO), eCFR text as of 2026-09-23. https://www.ecfr.gov/current/title-17/section-240.10b5-1
15. 15 U.S.C. § 78u-1: Civil penalties for insider trading. Office of the Law Revision Counsel, U.S. House of Representatives (U.S. Code), current as shown 2026-09-24. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section78u-1&num=0&edition=prelim
16. 15 U.S.C. § 78ff: Penalties. Office of the Law Revision Counsel, U.S. House of Representatives (U.S. Code), current as shown 2026-09-24. https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section78ff&num=0&edition=prelim
17. 17 CFR § 240.10b-18 Purchases of certain equity securities by the issuer and others. eCFR (Office of the Federal Register / GPO), eCFR text as of 2026-09-23. https://www.ecfr.gov/current/title-17/section-240.10b-18