FINRA Rule 8210 Can Reach You Overseas: Are You Ready?
When FINRA released Regulatory Notice 25-11, it made one thing clear: jurisdiction doesn’t stop at the shoreline. The notice reinforces that FINRA Rule 8210 — which empowers the regulator to demand documents, data, and testimony — applies anywhere FINRA-registered firms and associated persons operate. Even if local data-protection laws make compliance difficult, the obligation stands.
During a recent webinar, Brian Rubin, Partner at Eversheds Sutherland, summed up the reminder in plain terms:
“FINRA reminded firms and associated persons that no matter where they’re located, they are required to provide information and testimony in response to 8210 requests. FINRA firms maintain registered persons in about 75 countries — and in some jurisdictions like France, Switzerland, and China, local law actually restricts what can be shared. Firms are going to have to do an assessment and figure out if they want to operate in one of those countries.”
Why FINRA Rule 8210 matters
FINRA issued the notice to reinforce that Rule 8210 is fundamental to its authority. Unlike government agencies, FINRA lacks subpoena power. The rule is its primary mechanism to compel cooperation. Failure to respond, or to respond truthfully or completely, can result in expulsion or an industry bar.
FINRA acknowledged that certain jurisdictions, including China, France, and Switzerland, have blocking statutes that may restrict data transfers to foreign regulators. Even so, the notice states that Rule 8210 “does not provide any exception based on foreign law.” Firms are still required to find lawful ways to comply.
The reminder also links 8210 to Rule 3110 (Supervision). Members must maintain supervisory systems designed to ensure compliance with 8210 even when books, records, or personnel are overseas. That means firms must test whether their supervision and record-access procedures allow them to produce materials held abroad.
How can firms comply with FINRA Rule 8210
The notice makes clear that compliance with 8210 may require firms or individuals to:
- Produce books, records, and accounts in their “possession, custody, or control”
- Provide testimony under oath at a FINRA-specified location, often in the US
- Produce records tied to outside business activities, private securities transactions or possible violations of just and equitable principles of trade, as well as other FINRA rules
- Allow FINRA staff to inspect and copy original records wherever they are maintained
As Rubin noted during the webinar, “FINRA may be pushing jurisdictional boundaries — or at least making folks aware of them.” The takeaway: global structure does not dilute domestic accountability.
FINRA Rule 8210 best practices for firms with a global presence
This notice makes it clear that FINRA-regulated firms are expected to follow Rule 8210 even if their offices are in non-US jurisdictions. Fortunately, it's not a heavy lift when the following best practices are followed:
- Map global data flows and personnel: Identify where regulated records and employees reside, and how those data move across borders.
- Pre-approve transfer mechanisms: Work with counsel to establish lawful gateways (e.g., standard contractual clauses) for cross-border production.
- Integrate compliance into supervision: Under Rule 3110, test whether your supervisory systems and vendor contracts ensure full access to records “in your possession, custody, or control.”
- Build a cross-border 8210 response plan: Define who responds, what information can be shared, and how to escalate when local law conflicts.
- Document good-faith diligence: If restrictions apply, regulators may expect evidence of proactive effort, not silence.
“Distance is no defense,” Rubin warned. “Firms operating internationally need to assume FINRA will look beyond US borders and be ready to respond quickly and compliantly.”
In other words, the world just got smaller for compliance.
How Smarsh helps firms comply with FINRA Rule 8210
Smarsh offers powerful technology to help your firm meet the requirements of Rule 8210 and maintain a robust supervisory program:
- Archiving and retention: Automatically capture, archive, and retain email, instant messages, social media, and other digital communications across multiple channels.
- Supervision and review tools: Efficiently review and monitor communications for compliance with WSPs using customizable workflows and advanced search capabilities.
- AI-powered surveillance: Use machine learning to detect potentially risky or non-compliant behavior in communications before it becomes a problem.
- Audit-ready reports: Maintain comprehensive audit trails and generate reports to demonstrate supervisory activity and regulatory readiness.
- Cloud-scalable infrastructure: Whether your firm is growing or adapting to hybrid work, Smarsh solutions scale securely and cost-effectively.
Share this post!
- Vendor Oversight Insights from the FINRA Small Firm Conference - November 20, 2025
- When Policies Fail, People Pay — Personal Liability Is Back - November 13, 2025
- Off-Channel Still Isn’t Over: When Archiving Gaps Create Compliance Headaches - November 6, 2025
Smarsh Blog
Our internal subject matter experts and our network of external industry experts are featured with insights into the technology and industry trends that affect your electronic communications compliance initiatives. Sign up to benefit from their deep understanding, tips and best practices regarding how your company can manage compliance risk while unlocking the business value of your communications data.
Ready to enable compliant productivity?
Join the 6,500+ customers using Smarsh to drive their business forward.
More Resources
Subscribe to the Smarsh Blog Digest
Subscribe to receive a monthly digest of articles exploring regulatory updates, news, trends and best practices in electronic communications capture and archiving.
Smarsh handles information you submit to Smarsh in accordance with its Privacy Policy. By clicking "submit", you consent to Smarsh processing your information and storing it in accordance with the Privacy Policy and agree to receive communications from Smarsh and its third-party partners regarding products and services that may be of interest to you. You may withdraw your consent at any time by emailing [email protected].
FOLLOW US