On January 28, 2025, FINRA published its annual regulatory oversight report for 2025 (Report), which highlights observations and findings from FINRA’s oversight programs. The Report covers 24 topics, and for each topic it identifies the relevant rule(s), summarizes noteworthy findings or observations, outlines effective practices observed, and provides additional resources that may be helpful to firms in reviewing their supervisory procedures and controls and fulfilling their compliance obligations. The topics reflect areas where FINRA has observed gaps in firm compliance programs as well as areas of emerging or increased risk.

Two new topics are covered in the Report for 2025—the third-party vendor risk landscape and extended hours trading. The Report notes that FINRA has observed an increase in cyberattacks and outages at third-party vendors used by member firms, and given the financial industry’s reliance on third-party vendors to support key systems and covered activities, an attempted cyberattack or an outage at a third-party vendor could potentially impact a large number of firms. Regarding extended hours trading, the Report notes that FINRA has observed that trading in National Market System (NMS) stocks and other securities has increasingly stretched beyond regular trading hours. The Report reminds firms that offer extended trading hours of the requirements of FINRA Rule 2265 (Extended Hours Trading Risk Disclosure), including the requirement to provide customers with disclosure statement. The Report also highlights new content regarding perennial topics in the annual report, including content related to generative artificial intelligence and investment fraud by bad actors targeting investors directly.

FINRA advises members firms to review the Report and consider incorporating relevant elements into their compliance programs in a manner tailored to the firm’s activities and applicable regulatory requirements.

The Report can be found here.