What to Expect From a Compliance Vendor After Signing

Updated October 2026. First published February 2024. The original described our own client-engagement plans. This version covers what you should expect from any compliance vendor, including us.

Most vendor diligence happens before the contract: the questionnaire, the SOC report, the security review. FINRA expects it to continue after. Regulatory Notice 21-29 reminds firms that outsourcing an activity "does not relieve members of their ultimate responsibility" for compliance. It lists ongoing oversight practices too, such as monitoring the quality of a vendor's work and following news of vendor deficiencies.

Day to day, much of that oversight falls on the operations team that uses the product. Here is what that team should get from a compliance vendor once the contract is signed, and where each expectation comes from. For the questions to ask before signing, see How to Choose a Workflow Platform Your Examiners Will Actually Trust.

A Person Who Knows Your Workflow

You should have a named contact who knows your process, your counterparties, and your procedures, plus a written escalation path with response times. For a counterparty workflow, the vendor's staff should also keep the contact data current. That means knowing which desk at a custodian takes letters for which account range, and which lender wants its confirmations by email. A stale directory sends your requests to the wrong place while your deadline keeps running.

Notice Before a Change Reaches Production

FINRA Rule 3110(b)(1) requires written supervisory procedures, and yours probably describe the process down to the statuses a user sees. A vendor release that renames a status, changes a default, or adds an approval step changes your process. Expect release notes in advance and a test window long enough to update the procedures before the change goes live.

Breach Notice Within 72 Hours

Suppose a vendor maintains a customer information system for you. Regulation S-P, as amended in 2024, requires your policies to make sure that vendor notifies you as soon as possible, and no later than 72 hours after it becomes aware of a breach that gave someone unauthorized access to the system (17 CFR 248.30(a)(5)). Your firm then starts its own incident response program. Notice to affected customers stays your responsibility, even if the vendor sends it for you. Put the 72 hours in the contract.

FINRA's 2026 oversight report says it has seen an increase in reported cyberattacks and outages at firms' third-party vendors. Ask your vendor how it would tell you about an outage, not only a breach, and how fast.

Records on Request, in a Usable Format

Rule 17a-4(j) requires your firm to furnish records promptly when the SEC asks, and electronic records in a reasonably usable electronic format if requested. If the records sit in a vendor's system, your response time depends on the vendor's. FINRA's 2026 report lists a practice worth copying: test a recordkeeping vendor by simulating a regulator's examination and requesting records (books and records section). Pick a date range and one counterparty, ask for every request, response, and status change, and time the answer.

Ask the vendor which role it plays. A third party that prepares or maintains your required records files a written undertaking under Rule 17a-4(i). A vendor that keeps its own copies of what it processes, while you keep yours, is in a different position. Find out which applies before an examiner asks.

A Current Assurance Report Every Year

Notice 21-29 lists reviewing a vendor's SOC 2 report among due diligence practices. Expect a new report each year and a bridge letter covering the months between the report's period end and today. Expect an answer, too, for each exception the auditor noted. If the vendor sits inside a process that touches your books, ask for a SOC 1 report as well.

Plain Answers About AI in the Product

The same FINRA report lists assessing a vendor's use of generative AI in its products or services. It also lists contract language that prohibits firm or customer sensitive information from being ingested. Ask where the product uses AI, what data the model sees, and what a person reviews before the output becomes part of a record.

An Exit You Could Carry Out

Notice 21-29 says contracts may address "ownership and disposition of firm and customer data at the end of the Vendor relationship." It also asks whether the firm has contingency plans for an interruption or end of vendor services. FINRA's 2026 report adds revoking vendor access when the relationship ends. Expect the vendor to state in writing what format your data comes back in, how long the transfer takes, and how it confirms destruction afterward.

Our own answers to these questions, including the audited SOC 1 and SOC 2 Type II reports we provide under NDA, are on our vendor due diligence page.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.