Beyond the Checklist: When the Procedure Isn't the Control

Updated October 2026. First published April 2025. The first version described firms as Loffa clients, with results that never happened. This version replaces those examples with public cases.

The Exchange Act already separates a procedure from a control. Under Section 15(b)(4)(E), a supervisor isn't deemed to have failed reasonably to supervise if "there have been established procedures, and a system for applying such procedures" that would reasonably be expected to prevent and detect the violation, and the supervisor reasonably carried out the duties they set "without reasonable cause to believe that such procedures and system were not being complied with." The written procedure is one part of that defense. The rest is a system that applies it and some way to know it's being followed. FINRA Rule 3110(b) says the same thing in three verbs: a firm has to establish, maintain, and enforce its written procedures.

The four cases below were decided between October 2025 and September 2026. In each one, the firm had a written step or a recurring process covering the thing that went wrong, and each one fails a different test.

A "Reviewed" Flag Anyone Could Set

Jose Centeno worked in the trading compliance group at Canaccord Genuity LLC, a market maker in over-the-counter securities, from July 2017 to September 2021. His daily work included five categories of exception reports, three of them designed to help detect market manipulation. To complete a review, he had to open each report, analyze the transactions on it (dozens, hundreds, or thousands), investigate anything unusual, add notes, and mark the report "Reviewed."

FINRA's National Adjudicatory Council found that he marked 374 reports as reviewed without reviewing them, 269 of them reports designed to detect manipulation. FINRA's December 2025 summary says he often went weeks or months without marking any report, then marked them in batches, often within minutes of each other. At his hearing he said, "I knew that it wouldn't be possible for me to review the amount of transactions that were in the report." Canaccord's internal review led to his termination in September 2021, and the firm reported its findings to FINRA. FINRA suspended him for 12 months and fined him $10,000. On September 30, 2026, the SEC affirmed the suspension and the fine. Commissioner Peirce dissented from that part of the decision.

The status field was the firm's record that the work happened, and the reviewer could set it himself. The proof came from audit trail data, which FINRA's investigator used to show discrepancies in every category of report Centeno covered. Centeno also argued that Canaccord gave him too much work and too little training. The Commission said neither claim outweighed his own conduct.

A Review That Ran on an Incomplete List

From at least December 2017 to March 2022, Interactive Brokers showed customers who didn't pay for real-time market data an incomplete display at order entry, on a 15-minute delay. That violated the Vendor Display Rule, Rule 603(c) of Regulation NMS. In June 2021 the firm adopted written procedures requiring a review of the order entry points on its trading platforms, and it ran those reviews from June 2021 to December 2022. In the fourth quarter of 2022 it found 22 order entry points the reviews had never covered. FINRA fined the firm $150,000 on October 31, 2025.

The procedure said what to review. Nothing checked that the review list matched every order entry point the firm had. A review only covers what's on its list, and anything left off stays unreviewed however carefully the rest is done.

A Daily Check That Measured the Wrong Thing

CIBC World Markets reports large over-the-counter options positions to the Large Options Positions Reporting system (LOPR) under FINRA Rule 2360(b)(5). Between April 2019 and September 2025, it reported 7,501 positions inaccurately or not at all, in 1,418,430 instances (one position on one day is one instance). The firm monitored its LOPR reporting every day, including rejected positions. According to the AWC, it had no supervisory process for checking that the reports were accurate and complete.

The second of three causes looks familiar to anyone who runs an exceptions queue. The firm's LOPR logic wouldn't submit a record without a Tax ID number, so trades for accounts onboarded without one went into an internal queue "for further review and escalation." The quarantined trades weren't reviewed, and no supervisory process made sure they were. From October 2020 to September 2022, 2,478 positions went unreported. The firm added daily oversight of the queue to its procedures in November 2022, hired someone in January 2025 to build secondary oversight of LOPR reporting, and began a daily reconciliation of its submissions against its trading records in July 2025. FINRA fined it $425,000 on October 29, 2025.

A daily check that counts what went out and what bounced back measures completion. Accuracy takes a comparison with the source records, which is what the 2025 reconciliation added. The queue needed someone responsible for working it, and for almost two years nothing made sure anyone did.

A Weekly Computation Nobody Checked

Vision Financial Markets, a clearing firm in Stamford, Connecticut, with about 50 registered representatives, computed its customer reserve every week, as Rule 15c3-3 requires. At times between April 2020 and November 2022, the computations were wrong. Some used net positions that foreign omnibus introducing brokers sent after the close on the last business day of the week, where the rule calls for settled positions and balances on the firm's own books as of that close. One concentrated margin debit computation treated each partner in a general partnership as a separate customer. Six broker-dealer proprietary trading accounts were coded as non-customer accounts, so their balances never reached the PAB reserve computation.

The hindsight deficiencies generally ran from $499,000 to $7.7 million, and reached $32 million on December 31, 2020. The AWC says the firm "lacked any supervisory process to verify that its weekly customer and PAB reserve computations were accurate." FINRA fined it $250,000 on October 24, 2025.

A weekly computation is easy to mistake for a control because it never misses a week. Its weak points are the inputs: where the positions came from and how each account is coded. Those need a check of their own.

What a Control Has That a Checklist Doesn't

Read together, the four orders describe what a review has to leave behind before it counts as a control.

Evidence of the work, kept apart from the sign-off: when each item was opened, what was examined, and the notes. A reviewer can't produce that with one click, and at Canaccord it was the audit trail that showed the gap.
A population that gets reconciled. Each cycle, compare the list under review with the inventory it's meant to cover, whether that's order entry points, mailboxes, or accounts.
A test of accuracy as well as completion. "Submitted and not rejected" and "computed on Friday" are completion checks. Accuracy takes a comparison with source records, like the daily reconciliation CIBC added in 2025.
An owner and an age limit for every exception queue. When an item sits past its limit, someone above the queue should hear about it.
A workload the reviewers can finish. Centeno said the volume was more than he could review, and when reviewers can't get through the work, the sign-off is where it shows first.

If one of your exception queues holds Letters of Free Funds, Freefunds Verified Direct (FVD) gives each request a status, tracks its deadline, escalates exceptions, and keeps a timestamped log of every action and the user who took it. That log is the record you pull when an examiner asks whether a request was handled and by whom.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.