FINRA Highlights Compliance Risks for Broker-Dealers Engaging in Crypto AssetActivities

By Jonathan Hall, Esq.

Crypto assets, or “digital assets,” continue to draw regulatory attention as firms and associated persons increasingly engage in crypto-related activities. While FINRA’s jurisdiction extends only to its member firms and associated persons, federal securities laws and FINRA rules may apply to member firm activities involving crypto assets that are securities, including those offered and sold as investment contracts. Firms operating in this space should carefully evaluate whether their supervisory systems, communications practices, and compliance frameworks are reasonably designed to address the unique risks presented by digital assets.

Federal securities laws and FINRA rules generally apply when a crypto asset meets the definition of a security. FINRA has specifically highlighted compliance considerations under FINRA Rule 2210, FINRA Rule 3110, FINRA Rules 3270 and 3280, FINRA Rule 3310, FINRA Rule 11870, and FINRA Rule 2010, each of which may be implicated depending on the nature of the crypto-related activity.

FINRA has also pointed to ongoing legislative and SEC policy developments in this rapidly evolving area, including guidance addressing crypto asset exchange-traded products, broker-dealer custody of digital asset securities, stablecoins, and crypto-related securities offerings. Important developments include the enactment of the GENIUS Act, which establishes a regulatory framework for certain stablecoins, as well as multiple SEC staff statements addressing crypto asset markets and distributed ledger technology.

In its recent guidance, FINRA has identified recurring compliance issues involving member firm and associated person participation in crypto-related activities.

Under Rule 2210, FINRA has observed promotional materials that failed to include appropriate risk disclosures, contained false or misleading statements, or omitted material information about the risks associated with crypto assets. Some communications improperly compared crypto assets to traditional investments without a sound basis or made misleading statements regarding the extent of customer protections, including SIPC coverage. FINRA has also cautioned firms regarding social media communications and influencer marketing that are not fair and balanced or that make promissory or exaggerated claims.

Supervisory failures under Rule 3110 have also drawn scrutiny. Firms recommending crypto asset securities or crypto-related private placements must conduct appropriate due diligence, including understanding the issuer, the underlying technology, conflicts of interest, token mechanics, supply limitations, and custody arrangements. Inadequate investigation of these issues, or failure to tailor supervision to crypto-related risks, may expose firms to regulatory action.

FINRA has further highlighted compliance risks involving outside business activities and private securities transactions when associated persons engage in crypto mining ventures, solicit investments in digital asset projects, or receive compensation in connection with crypto offerings without proper written notice and firm approval. Where compensation is involved, firms must record and supervise those transactions as if they were executed on the firm’s behalf.

Anti-money laundering obligations remain critical. Under Rule 3310, firms must maintain AML programs reasonably designed to detect and report suspicious crypto-related transactions occurring by, at, or through the broker-dealer. Given the pseudonymous and cross-border nature of blockchain transactions, regulators have emphasized the importance of risk-based monitoring and escalation procedures.

FINRA has encouraged firms to adopt enhanced controls tailored to crypto-related risks, including conducting robust due diligence before recommending unregistered crypto offerings, reviewing exemption reliance and use of proceeds, performing risk-based on-chain monitoring where appropriate, and clearly informing customers about the differences between brokerage accounts and affiliated crypto accounts, particularly with respect to regulatory oversight, supervision, and SIPC protections.

Crypto asset activities continue to evolve rapidly, but regulatory expectations remain grounded in existing securities laws and FINRA rules. Firms engaging in crypto-related business must ensure that their supervision, communications review processes, AML programs, and due diligence practices are reasonably designed to address the risks regulators have identified. As enforcement actions and policy guidance continue to develop, firms should proactively evaluate whether their compliance frameworks adequately account for crypto-related exposure.

If you have questions about FINRA and SEC expectations concerning crypto asset activities, including supervision, communications, AML compliance, and investor protection risks, please contact a securities attorney at inquiry@galbraithlawfirm.com or 212.203.1249.