Institutional Communication Supervision Procedures

FINRA Rule 2210(b)(1)(B) requires your broker-dealer to maintain written supervisory procedures for a qualified registered principal to review the firm’s institutional communications, designed to ensure those communications meet applicable content standards. You operationalize this by defining what counts as “institutional,” assigning principal reviewers, setting a review cadence (pre-use or post-use), and keeping review evidence and communications records. (FINRA Rule 2210)

Key takeaways:

• You need written procedures tailored to your business that govern principal review of institutional communications. (FINRA Rule 2210)
• Pre-use approval is not mandatory, but your review program must be reasonably designed to catch non-compliant content. (FINRA Rule 2210)
• Examiners will look for clear scoping, accountable reviewers, a workable workflow, and retained proof of review decisions. (FINRA Rule 2210)

Institutional communications are often treated as “lower risk” than retail communications, and that’s where firms get into trouble. FINRA Rule 2210(b)(1)(B) does not give you a free pass. It requires written procedures for review by a qualified registered principal of institutional communications used by the firm, with procedures reasonably designed to ensure compliance with applicable standards. (FINRA Rule 2210)

For a CCO or GRC lead, the operational goal is straightforward: make sure every channel your firm uses to communicate with institutional investors is captured in scope, reviewed under an identified supervisory method, and auditable after the fact. This includes one-to-many materials (pitch decks, market commentary, institutional brochures) and can include one-to-one institutional emails or messages if your firm treats them as “institutional communications” under its program. Your biggest design decision is review timing (pre-use for higher-risk categories, post-use sampling for lower-risk categories) and how you prove “reasonable design” with evidence, escalation, and repeatable QC.

This page gives requirement-level implementation guidance you can put into procedures, workflows, and exam-ready artifacts without guessing. (FINRA Rule 2210)

Regulatory text

Requirement (verbatim): “Each member shall establish written procedures for the review by a qualified registered principal of institutional communications used by the member, reasonably designed to ensure compliance with applicable standards.” (FINRA Rule 2210)

Operator interpretation:
You must have written supervisory procedures (WSPs) that (1) identify institutional communications in your environment, (2) require review by a qualified registered principal, and (3) describe a review approach that is reasonably designed to ensure the content meets FINRA’s communications standards. The rule focuses on the procedures and supervisory system, not a specific mandated timing. Pre-use approval is not required by this provision, but your procedures must still prevent or detect problematic content in a way a regulator can accept as “reasonably designed.” (FINRA Rule 2210)

Plain-English requirement: what this means in practice

You need a repeatable, documented supervision process for communications directed to institutional audiences, with an identified principal reviewer (or reviewers) and a defined workflow. “Reasonably designed” means you can explain, and show evidence of, why your approach fits:

• your product set (plain-vanilla vs complex),
• your distribution model (relationship-driven vs high-volume),
• your channel mix (email, decks, web portals, events),
• your use of third parties (marketing agencies, placement agents, consultants).

If you cannot show which communications were in scope, who reviewed them, what standards were applied, and what happened to exceptions, your procedures may exist on paper but fail in execution. (FINRA Rule 2210)

Who it applies to

Entity scope

• FINRA member broker-dealers must establish the procedures. (FINRA Rule 2210)
• Qualified registered principals must perform the review described in the procedures. (FINRA Rule 2210)

Operational scope (where this shows up)

Applies anywhere your firm creates, edits, approves, or distributes institutional communications, including:

• institutional pitch books, due diligence decks, and product sheets
• market updates and thought leadership distributed to institutional lists
• RFP responses and standardized institutional sales collateral
• scripts or talking points for institutional roadshows and webinars
• content posted to institutional portals or shared data rooms

Also include operational realities that break supervision if ignored:

• Rep-created decks built from templates
• One-off claims added at the last minute before a meeting
• Third-party drafted content that your firm brands and distributes

What you actually need to do (step-by-step)

1) Define “institutional communication” for your firm’s channels

Write down a practical definition and examples. Your goal is scoping, not theory. Include:

• channels (email, PDF, PPT, website pages behind login, webinars)
• distribution patterns (one-to-many vs bespoke one-to-one)
• “gray zone” items (calendar invites with talking points, follow-up emails containing performance statements)

Control outcome: a scope statement that lets a reviewer decide quickly whether an item enters the institutional supervision workflow. (FINRA Rule 2210)

2) Assign responsible reviewers and confirm principal qualification

In your WSPs and org chart, specify:

• the title/role of the qualified registered principal(s) who reviews institutional communications
• coverage model (primary reviewer, backup reviewer, and escalation reviewer)
• independence boundaries (for example, whether the content owner can self-review; many firms prohibit this for higher-risk material)

Control outcome: an accountable person with the right registration, and no “everyone owns it” ambiguity. (FINRA Rule 2210)

3) Create a risk-based review approach (pre-use vs post-use)

FINRA Rule 2210(b)(1)(B) does not require pre-use approval for institutional communications, so design a model you can defend:

• Pre-use review for higher-risk categories: new product launches, complex products, performance presentations, comparisons, back-tested or model results, or any claim that historically draws scrutiny in your program.
• Post-use review and sampling for lower-risk, templated materials: recurring market commentary with standardized disclosures, template-driven emails, or previously approved decks reused without edits.

Document the decision logic in the WSPs so the program does not rely on tribal knowledge. (FINRA Rule 2210)

4) Standardize review criteria (what the principal checks)

Build a simple checklist aligned to “applicable standards” under your communications program. At minimum, your principal review criteria should address:

• accuracy of statements and avoidance of misleading implications
• balanced presentation of risks and benefits
• consistency with offering documents and internal product facts
• required disclosures where your firm’s policies require them (for example, conflicts, limitations, assumptions)
• version control: ensuring the distributed file matches the reviewed file

Make the checklist short enough that it gets used, but specific enough that two principals would reach similar outcomes. (FINRA Rule 2210)

5) Implement an intake-to-approval workflow

Put the process into a system or at least a controlled mailbox and tracker. A workable workflow has:

1. Submission (content owner provides final draft, target audience, channel, intended send date)
2. Classification (institutional vs other; pre-use vs post-use)
3. Principal review (approve, approve with changes, reject)
4. Remediation (content owner revises; principal re-checks deltas)
5. Release (controlled distribution; lock the reviewed version)
6. Archiving (store the final approved artifact and evidence)

If you want to reduce operational drag, Daydream can centralize intake, route to the correct principal, and preserve the audit trail without reviewers maintaining manual trackers.

6) Establish sampling rules and surveillance for post-use review

If you allow post-use review, define:

• the population (which channels and teams are included)
• how items are selected (random, risk-weighted, event-triggered)
• how exceptions are tracked, corrected, and trended
• consequences for repeated violations (training, heightened supervision, pre-use gating)

Your documentation should show a closed loop: review → findings → fixes → preventive action. (FINRA Rule 2210)

7) Train creators and reviewers, then test understanding

Training should be role-based:

• content creators: what must be submitted, what is prohibited, how to use templates, how to handle last-minute changes
• principals: review checklist, escalation paths, documentation expectations
• supervisors: how to enforce adherence when business pressure rises

Add a lightweight knowledge check or attestation so you can prove training completion and comprehension in an exam context.

8) Add governance: periodic QA of the supervision program

Run periodic quality control on:

• whether items in scope are actually entering the workflow
• reviewer consistency and turnaround times
• repeat findings by team, product, or channel
• whether the WSPs match actual practice

Document changes to procedures as your business changes. “Reasonably designed” depends on current reality, not last year’s structure. (FINRA Rule 2210)

Required evidence and artifacts to retain

Maintain evidence that proves your procedures operate:

• Written Supervisory Procedures covering institutional communication review, timing, scope, and escalation. (FINRA Rule 2210)
• Reviewer qualifications: registration/role evidence for “qualified registered principal” reviewers. (FINRA Rule 2210)
• Inventory of institutional communication types and channels (a living register works well).
• Review logs: submission date, reviewer name, decision, notes, and version identifier.
• Redlines/comments or annotated checklists showing what was reviewed and what changed.
• Final approved version of the communication, locked to a unique version ID.
• Exception register: rejected items, policy breaches, remediation actions, and outcomes.
• Training records for creators and principals.
• QA/testing reports that show your sampling approach and trend remediation.

Common exam/audit questions and hangups

Expect examiners or internal audit to press on:

• “Show me your written procedures for institutional communications and where principal review is documented.” (FINRA Rule 2210)
• “How do you decide which items require pre-use approval versus post-use review?”
• “How do you know reps aren’t sending unreviewed decks or ‘customized’ versions?”
• “How do you handle edits made after approval?”
• “Show me evidence that the reviewer is a qualified registered principal.” (FINRA Rule 2210)
• “What happens when you find an issue? Do you retrain, revise templates, or escalate supervision?”

Hangup to anticipate: firms often have a policy that sounds good, but cannot produce a clean audit trail tying (a) the reviewed version to (b) what was actually sent.

Frequent implementation mistakes and how to avoid them

1. WSPs describe a process no one follows
   Fix: map the real workflow first, then write WSPs that match it; add governance to keep them aligned. (FINRA Rule 2210)

2. No clear definition of “institutional communication” by channel
   Fix: define scope with examples; include “gray zone” cases and who decides classification.

3. Approval captured in email threads with no version control
   Fix: require a unique version ID and archive the final approved artifact alongside the approval record.

4. Post-use sampling with no rationale or closed loop
   Fix: document selection logic; track findings to remediation; escalate repeat issues into heightened supervision. (FINRA Rule 2210)

5. Third-party content slips through
   Fix: treat third-party drafted material as in scope once your firm brands, edits, or distributes it; require principal review before distribution.

Enforcement context and risk implications

No public enforcement case sources were provided for this requirement, so this page does not cite specific cases. The practical risk is predictable: weak procedures or weak evidence typically lead to findings framed as supervisory control failures, which can expand into a broader review of your communications program. Focus on provable controls: scope, principal review, and records. (FINRA Rule 2210)

Practical execution plan (30/60/90)

First 30 days (stabilize scope and accountability)

• Identify institutional communication channels and owners; draft a channel inventory.
• Name qualified registered principal reviewers and backups; document responsibilities. (FINRA Rule 2210)
• Implement a basic intake and review log with version control.
• Freeze and standardize core templates (pitch deck, market commentary) to reduce one-off drafting.

Next 60 days (make it repeatable and testable)

• Finalize WSP updates: definitions, review timing model, escalation, and sampling design. (FINRA Rule 2210)
• Build the principal review checklist and exception register.
• Train creators and reviewers; require attestations.
• Start post-use sampling (if used) and document findings and remediation.

By 90 days (prove it works under pressure)

• Run a QA review: pick a set of institutional communications and prove end-to-end traceability from draft to approval to distribution record.
• Trend issues by team/product and tighten controls where findings cluster.
• Decide whether tooling is needed; if manual tracking is fragile, move workflow and evidence capture into a system such as Daydream to reduce gaps and speed exams.

Frequently Asked Questions

Do we have to pre-approve all institutional communications?

FINRA Rule 2210(b)(1)(B) requires written procedures for principal review that are reasonably designed; it does not mandate pre-use approval for every institutional communication. Your firm still needs a defensible approach for when you do pre-use review versus post-use review and sampling. (FINRA Rule 2210)

Who qualifies as the reviewer under this requirement?

The rule specifies review by a “qualified registered principal.” Your procedures should name the role(s), document coverage and backups, and retain evidence that the reviewer is in fact a qualified registered principal. (FINRA Rule 2210)

What’s the minimum evidence we should be able to produce in an exam?

Produce the WSP section covering institutional communications, a review log showing principal review and disposition, and the final approved version tied to that approval record. Gaps usually appear around version control and proof of what was actually distributed. (FINRA Rule 2210)

How do we handle last-minute edits before an institutional meeting?

Treat edits as a new version that requires the level of review your WSPs assign to that risk category. If the edits are substantive, require re-review by the qualified registered principal before distribution. (FINRA Rule 2210)

Do third-party drafted pitch materials need to go through our review?

If your firm uses the material as an institutional communication, your procedures should bring it into scope and require principal review. Branding, editing, or distributing third-party content generally creates supervision expectations you must control through WSPs and evidence. (FINRA Rule 2210)

How do we keep institutional communications from slipping into “one-off” rep behavior?

Combine controls: standardized templates, required intake routing, spot checks of outbound channels, and escalation for repeat exceptions. Most programs also need clear consequences and heightened supervision triggers written into WSPs. (FINRA Rule 2210)