The Vacant CCO Seat and the Certification Nobody Earned
Vantage Brokerage has 120 registered representatives, a December 31 fiscal year end, and a chief compliance officer position that has been vacant since October. The CFO is serving as interim CCO; she holds a Series 27 but not a Series 14 and has no compliance background. The firm's annual compliance meeting was folded into the February sales kickoff, and a recording was later emailed to representatives; 71 of 120 watched it. Vantage has never prepared a supervisory control system report or an annual CEO certification. Its written supervisory procedures were last updated in 2019 and do not mention Regulation Best Interest, and no branch has been inspected since 2022. With the certification cycle approaching, the CEO asks whether he can sign now based on the CFO's verbal assurances and fix the rest afterward.
1. Identify the program-level failures and distinguish the ones that can still be cured from those that cannot.
Read the worked answer
Failures:
- No qualified CCO. The compliance officer principal registration requires a Series 14; a Series 27 does not substitute. The firm has no designated, qualified CCO and has not addressed the vacancy with FINRA.
- Annual compliance meeting. Rule 3110(a)(7) requires each registered representative to participate at least annually in an interview or meeting. A recorded playback watched by 59% of the force is not a meeting, and it reached only 71 people.
- Stale WSPs. Rule 3110(b) requires procedures reasonably designed to achieve compliance with applicable rules. Procedures silent on Reg BI cannot be.
- No inspections since 2022. Rule 3110(c)(1) minimum cycles are being missed outright.
- No supervisory control system report and no certification. Rule 3120 and Rule 3130 obligations simply unmet.
Curable now: amended WSPs, a live annual meeting for all 120, a risk-based inspection schedule executed immediately, and a control system report covering the required period.
Not curable: the missed 2024 annual meeting and the absent prior certification are historical violations. They can be disclosed and remediated prospectively; they cannot be retroactively created.
2. Can the CEO sign the Rule 3130 certification? What is his exposure if he signs on verbal assurances?
Read the worked answer
No. The Rule 3130 certification is a personal representation that the CEO has reviewed the compliance processes, that the firm has in place processes to establish, maintain, review and test policies reasonably designed to achieve compliance, and that the control system report has been prepared. Every predicate is missing: no qualified CCO, no control system report, no inspections, stale procedures.
Exposure. Signing without a reasonable basis is a false certification and a standalone Rule 3130 violation, and it exposes the CEO individually. It also destroys the firm's ability to argue reasonable supervision later, because a certification is the firm's own statement that supervision was designed and tested. Verbal assurances from an interim CCO with no compliance background and no Series 14 give him nothing to rely on.
What to tell him: the certification is a conclusion that must follow the work, not a form to be cleared so the cycle can close. The path forward is to appoint a qualified CCO, produce the control system report, and then sign a certification that is accurate. If the firm cannot complete that before the deadline, document the gap, remediate immediately, and be prepared to explain the delay to examiners. A late accurate certification is survivable; a timely false one is not.
3. How would you sequence the first 90 days?
Read the worked answer
Days 1-15 - stabilize and designate. Appoint a qualified CCO (Series 14) or engage an outside compliance consultant with clear delegated authority; identify the designee to FINRA. Escalate the certification question to the CEO in writing so the advice is documented.
Days 16-45 - assess. Conduct a risk assessment across products, reps, offices and compensation. Pull complaint data, outside activity, and the 2022 inspection findings to see what has gone unreviewed. Interview the interim CCO about anything she saw but did not escalate.
Days 46-70 - rebuild. Rewrite the WSPs to reflect Reg BI, off-channel communications, and the current product mix. Execute inspections of the highest-risk offices first, then schedule the rest. Hold a live annual compliance meeting for all 120 representatives with attendance records.
Days 71-90 - test and certify. Prepare the supervisory control system report with actual testing results, not a narrative of intentions. Then the CEO signs a certification he can defend.
Throughout: keep a written remediation log with dates and owners. Examiners weigh documented self-correction heavily, and the log is the only evidence that the gap was closing rather than merely noticed.