Guidance

FINRA firms should be aware of a vulnerability in web applications built with React Server Components (RSC), which could allow unauthorized access to internal systems. Nation-state threat actors are purportedly exploiting this vulnerability to gain access to systems and sensitive files on servers built using RSC. The vulnerability has the potential to allow threat actors to take control of a firm’s entire system if exploited.

FINRA member firms should be aware of a security incident involving Gainsight, a customer success and customer management platform that integrates with Salesforce CRM. Given the third- and fourth-party risk the incident poses to member firms, FINRA recommends sharing this Cyber Alert with appropriate information technology and information security personnel as well as with any third-party vendors that may also leverage the services of Gainsight.

Within the securities industry, social media plays a prominent role in influencing investor behavior while providing opportunities for new forms of customer engagement and additional sources of data.

On this episode, FINRA leaders discuss the 2026 Regulatory Oversight Report, covering emerging threats from AI and crypto, evolving fraud schemes, cybersecurity risks, effective practices, and more. Learn how firms can leverage the information in the report for strengthened compliance planning.

The 2026 FINRA Annual Regulatory Oversight Report provides FINRA member firms with insight into findings from FINRA’s regulatory operations programs.

This latest report examines investor behaviors, attitudes, knowledge and experiences, including trends in new investor participation, use of financial influencers, risk tolerance and investor knowledge levels.

Engagement is a two-way street at FINRA. On this episode of FINRA Unscripted, two regional committee members speak with FINRA's Kayte Toczylowski about how FINRA listens to industry feedback and takes action. Discover how member firms can actively participate in shaping regulation, access valuable resources, and build meaningful relationships.

FINRA member firms should be aware of a security incident involving SitusAMC, a technology services company that provides solutions to commercial and real estate banks and financiers, many of which serve as vendors to member firms.

FINRA Forward is transforming cybersecurity defense through collaborative intelligence sharing and more. On this episode of FINRA Unscripted, discover how tabletop exercises and workshops, the Cyber and Operational Resilience program, and the forthcoming Financial Intelligence Fusion Center can help FINRA member firms prevent, prepare for and respond to evolving cyber threats.

This Cybersecurity Advisory reminds member firms of the upcoming compliance dates for the SEC’s amendments to Regulation S-P, and announces an upcoming FINRA webinar to assist member firms with their preparation for complying with these amendments. As discussed below, the compliance date for some member firms is Dec. 3, 2025.

In early October, FINRA CEO Robert Cook joined Small Firm Advisory Committee Chair Preston Haxo for a conversation at FINRA’s Small Firm Conference. The two spoke about FINRA Forward, the vital role of the SFAC, the practical ways firms can engage with FINRA, and more. On this episode of FINRA Unscripted, we tune in to that conversation.

FINRA is conducting a review of firm practices regarding public and private offerings of small-capitalized exchange-listed issuers with business operations in foreign jurisdictions, such as China (collectively “small-cap offerings”). Specifically, FINRA is reviewing certain member firms that have been involved in multiple small-cap offerings as either an underwriter, bookrunner, syndicate member, selling group member or placement agent, as well as certain member firms that have participated in initial and/or secondary market trading related to small-cap offerings, including firms with omnibus accounts trading in these securities.

FINRA member firms should be aware of a security incident involving Red Hat Consulting after threat actors breached a self-managed GitLab instance used by its consulting division. The breach exposed sensitive data about Red Hat customers—including configuration data, authentication tokens, infrastructure details and more—that could be abused to breach member firm customer networks.

Effective October 10, 2025, FINRA members may rely on the Central Registration Depository (CRD®) system to maintain for recordkeeping purposes the Form U4 (Uniform Application for Securities Industry Registration or Transfer) filings that individuals electronically sign through FINRA’s Financial Professional Gateway (FinPro GatewayTM).

FINRA member firms should be aware of a critical vulnerability that affects certain versions of Oracle E-Business Suite, a business management software platform. This Cybersecurity Alert includes a link to an Oracle Advisory that includes a detailed description of the vulnerability as well as recommendations to mitigate it.

As we kick off World Investor Week, we thought it was the perfect time to revisit some invaluable tips for investors looking to start the year off right with their financial goals. On this episode, which originally aired in January, FINRA’s Head of Investor Education Gerri Walsh shares insights on leveraging market trends and tools to achieve your money goals in 2025.

FINRA is making available updates to the Interpretations of Financial and Operational Rules (Interpretations). The updates include several new interpretations to Securities Exchange Act (SEA) Rules 15c3-1 and 15c3-3 that have been communicated to FINRA by the staff of the SEC’s Division of Trading and Markets.

FINRA member firms should be aware Cisco recently published numerous Security Advisories associated with different Common Vulnerability and Exposures (CVEs), several of them listed as critical.

FINRA is issuing this Notice to remind members and associated persons that, no matter where they are located, they are required to provide information and testimony in response to a request from FINRA staff pursuant to FINRA Rule 8210.

FINRA has developed a secure electronic portal to replace email as the primary method for the filing and service of documents in Office of Hearing Officers (OHO) proceedings. These amendments modernize service and filing processes in a manner that will protect investors and the public interest by promoting efficiency while preserving fair process in OHO proceedings. The amendments become effective on October 7, 2025.

As member firm activity increases in blockchain and crypto assets, FINRA is launching a Crypto and Blockchain Education Program designed to empower member firm compliance and combat crypto fraud.

FINRA member firms should be aware of a supply chain attack leveraging data exfiltrated from Salesloft Drift—a third-party platform that connects the Drift AI chat agent with a Salesforce or Google Workspace instance, among others. The breach described below exposed data that could increase the risk of credential stuffing, spear phishing and social engineering attacks against member firms and their vendors. To date, we are aware of multiple impacted third-party vendors used by FINRA firms. FINRA has notified the member firms who use the affected vendors or Salesloft.