A written programme and an independent test are different controls. The rule also distinguishes testing frequency according to a firm’s activities.

What the primary record establishes

FINRA Rule 3310 requires a written AML programme approved in writing by senior management. It generally requires independent testing on a calendar-year basis, while specified firms without customer execution, customer accounts or introducing activity qualify for a two-year cycle. FINRA Rule 3310 — Anti-Money Laundering Compliance Program ↗

The supplementary material excludes testing by the person performing the tested functions, the designated AML compliance person, or someone reporting to either. It also calls for more frequent testing when circumstances warrant. FINRA Rule 3310 — Anti-Money Laundering Compliance Program ↗

What the distinction changes

WFN’s operational interpretation is that changing the title of a reviewer does not create independence if the same reporting relationship remains. The tested activity and the reviewer’s responsibilities must be mapped.

A testing report also needs a defined scope. Completing a document review does not demonstrate that every operational process worked throughout the year; the evidence and period should be explicit.

What to check before drawing a conclusion

Retain the activity-based frequency assessment, tester responsibilities, work performed and follow-up on findings. If a firm invokes the two-year exception, document how its actual activities fit the stated conditions.

This article describes the US FINRA framework without assessing a particular firm’s programme. Technology can support a test, but a vendor label cannot establish the required separation or replace the programme’s documented implementation and monitoring.