Comment Letter Link: Final Letter

September 10, 2026

Via Electronic Submission

Jennifer Piorko Mitchell
Office of the Corporate Secretary
Financial Industry Regulatory Authority
1700 K Street, NW
Washington, DC 20006

Re: Regulatory Notice 26-14 — Proposed Amendments to FINRA Rule 2210 (Communications with the Public)

Dear Ms. Mitchell:

The Public Investors Advocate Bar Association (“PIABA”) appreciates the opportunity to comment on Regulatory Notice 26-14 and FINRA’s proposed amendments to Rule 2210. PIABA is a national, not-for-profit bar association whose members devote a significant portion of their practices to representing public investors in securities arbitration and litigation.

PIABA members regularly see what happens after a communication has harmed an investor: years later, the parties must reconstruct what was said, what supervisory review occurred, and what contemporaneous records survive. We therefore approach the proposal not only from the perspective of prospective compliance, but also from the perspective of accountability when supervision fails.

In principle, PIABA supports modernizing Rule 2210. Social media, automated digital engagement, generative artificial intelligence (“AI”), algorithmic personalization, and conversational interfaces cannot sensibly be regulated as though every communication were a printed advertisement or individually drafted email.

But technology changes more than firms’ compliance costs. It reduces the marginal cost of producing communications, enables individualized communications at enormous scale, permits increasingly precise targeting, and can place promotional content immediately adjacent to transaction execution. A defect embedded in an automated system can consequently affect thousands of customers before it is detected.

Those characteristics justify modernizing the method of supervision. They do not justify weakening preventive safeguards that serve the core investor-protection goals of the securities laws.

PIABA has three principal concerns with the proposal. First, replacing categorical pre-use review with firm-designed risk-based supervision risks weakening both oversight and the evidentiary record necessary to evaluate that oversight later. Second, FINRA’s economic analysis does not establish that relaxing preventive review will preserve investor protection. Third, proposed Rule 2210(d)(7) would eliminate concrete protections governing recommendation-related communications in favor of a substantially more general standard.

I. Preservation, Auditability, and Reconstruction Should Be Express Regulatory Obligations

FINRA proposes to replace much of the current principal pre-use approval requirement with one to have “reasonably designed” written supervisory procedures tailored to a member’s business, size, structure, and customers. Where a firm does not require pre-use review, the proposal relies instead on training, surveillance, documentation, and follow-up.

Risk-based supervision can be appropriate, particularly for low-risk standardized communications and dynamically generated content. But it also changes the record available when misconduct is later disputed.

Under the current regime, principal approval is ordinarily a discrete and identifiable event: a particular communication was reviewed by a particular supervisor before use. Under the proposal, the relevant inquiry may instead become whether the firm properly classified the communication, whether its procedures required review, whether the classification itself was reasonable, whether surveillance occurred, and whether the firm retained records sufficient to prove each step. All of these questions may make preservation and reconstructability more important, not less.

FINRA therefore should impose express requirements addressing at least three matters:

• Contemporaneous supervisory records. Where a communication is not subject to principal pre-use review, the firm should preserve the applicable supervisory classification, the basis for that classification, the responsible person or system, and the communication as actually disseminated.
• Version and provenance information for dynamic communications. Social-media content may later be edited, and generative AI may not reproduce the same response twice. Firms should preserve the actual content delivered to customers and sufficient information to identify the model, template, prompt, configuration, or other material inputs that produced it.
• Retention sufficient for later disputes. Records should remain available for a period reasonably corresponding to the period in which customer claims concerning those communications may arise. Records designed only for short-term supervisory review may be of little use in an arbitration filed several years later.

These obligations need not prevent firms from using sophisticated AI-assisted or risk-tiered supervisory systems. Modern supervision and a reliable audit trail are complementary.

The same principle should guide FINRA’s approach to AI more generally: a member that chooses a technology for communicating with customers should be required to deploy it in a manner that permits those communications to be supervised, preserved, and later reconstructed.

II. FINRA’s Economic Case for Relaxing Preventive Review Is Not Yet Persuasive

FINRA’s Preliminary Economic Impact Assessment contains useful descriptive data, but the Notice draws more from those data than they can presently support.

A. Filing-level averages may obscure the experience of the typical member.

FINRA reports that 593 members submitted an average of approximately 299 filings each, but the median member submitted only eight. That disparity indicates an extremely skewed distribution. A relatively small number of high-volume firms therefore may account for a large share of all filings. Accordingly, a statement that a particular percentage of filings was noncompliant does not tell us:

• what percentage of firms experienced violations;
• what the violation rate was at the typical firm;
• whether violations were concentrated among a few firms; or
• whether smaller firms, which may have fewer supervisory resources, performed differently from high-volume firms.

That distinction matters because the proposed rule applies to firms, not to an abstract pool of communications. FINRA should report firm-level as well as filing-level results, including the distribution of violation rates across members and the concentration of violations among firms.

The same issue bears on FINRA’s competition analysis. A risk-based supervisory system requiring substantial investment in AI review tools, surveillance, documentation, and model governance may create economies of scale favoring large firms. FINRA should examine that possibility rather than infer from aggregate cost reductions that firms of different sizes will benefit similarly.

B. The pre-use and post-use populations are selected and therefore not directly comparable.

FINRA reports that approximately 24 percent of communications filed before use were noncompliant, compared with approximately 10 percent of communications filed after use. That comparison does not establish that pre-use review is unnecessary. Brokers subject their communications to pre-use filing precisely because the rules identify reasons for heightened scrutiny.

The approximately 69 percent noncompliance rate for first-year filings illustrates the point. That figure does not show that pre-use review is ineffective. It demonstrates that the pre-use regime is identifying a substantial amount of noncompliant material before it reaches investors.

The same problem arises with self-published investment-company rankings and comparisons. FINRA reports a roughly 13 percent noncompliance rate for that category and treats the rate as comparatively low. But 13 percent is the rate observed while pre-use review is mandatory. Firms currently know that FINRA will review these communications before dissemination. That prospect itself may induce additional internal review, discourage aggressive claims, or cause firms to abandon questionable material. For these claims, then, the relevant counterfactual is not the observed 13 percent rate. It is the rate—and severity—of noncompliance that would occur after firms no longer face the same pre-use review requirement. The Notice does not estimate that counterfactual.

C. FINRA should examine what pre-use review actually prevents.

FINRA appears to possess data that could illuminate this question directly. For communications reviewed before use, FINRA should be able to determine:

1. what the firm initially proposed to distribute;
2. what deficiencies FINRA identified;
3. what changes FINRA required;
4. whether the firm revised or withdrew the communication; and
5. whether the original communication therefore never reached investors.

For the 176 noncompliant self-published ranking or comparison filings identified in the Notice, FINRA should report how many involved substantive rather than technical deficiencies, how many required material corrections, and how many were abandoned rather than distributed.

Those figures would provide a direct measure of the preventive benefit of pre-use review.

D. FINRA should measure investor exposure, not merely communications.

A communication is not necessarily the appropriate unit of economic analysis. One communication may reach thirty customers. Another may reach hundreds of thousands. A social-media post may be repeatedly viewed or algorithmically amplified. A single defect in an AI system may generate thousands of individualized but systematically erroneous outputs. The economically relevant concept is therefore closer to:

Expected Investor Harm      =    Probability of Material Defect
×    Investor Exposure
×    Expected Severity of Harm

FINRA’s current analysis principally measures the first factor—and even there combines substantive and technical violations within the same “noncompliant” category. FINRA should distinguish substantive from technical violations and, where feasible, consider:

• number of investors exposed;
• duration of exposure;
• resulting transactions;
• dollars invested;
• severity of the misstatement or omission; and
• whether corrective information reached investors before they acted.

E. Post-use review creates an exposure period that should be measured.

FINRA reports substantial improvements in review times. In 2025, average review time was approximately 17 business days for pre-use filings and 15 business days for post-use filings.

But for post-use review, filing-to-review time is not the relevant interval. The economically important period is:

first use → filing → FINRA review → correction

Under the proposal, a communication may be distributed before filing and need not be filed until as many as ten business days later. A deficient communication therefore may circulate for a substantial period before FINRA identifies it.

FINRA should report the actual time between first use and filing, and ultimately the time between first use and correction, for communications found materially noncompliant.

Nor is ex post remediation equivalent to prevention. Once a customer has invested in reliance on misleading information, correcting the communication does not necessarily reverse the transaction, restore the original price, eliminate opportunity costs, or ensure that the customer even sees the correction.

F. AI creates correlated errors that historical filing statistics do not capture.

AI also changes the nature of communications risk.

Traditional errors may often arise independently: one representative makes one mistake. Automated systems can create correlated failures. A flawed prompt, data source, system instruction, or model behavior can cause the same error to recur across thousands of communications.

A ten-percent error rate consisting of independent human mistakes presents a different risk from a ten-percent rate generated by a small number of systematic failures affecting large customer populations.

FINRA appropriately recognizes hallucinations, speed, volume, and the need to test AI systems elsewhere in the Notice. Its economic analysis should incorporate those same characteristics.

For automated systems, FINRA should consider the number of affected outputs, number of investors exposed, time to detection, effectiveness of monitoring, and the ability to suspend the system promptly.

These limitations do not establish that FINRA can never relax pre-use review. They establish that the current economic assessment has not yet shown that broad relaxation will preserve investor protection.

III. FINRA Should Not Eliminate Rule 2210(d)(7)’s Specific Protections Without Comparable Replacements

PIABA is also deeply concerned by the proposed changes to communications containing recommendations. Current Rule 2210(d)(7) includes a reasonable-basis requirement for securities recommendations, specified conflict disclosures, an obligation to furnish or offer supporting investment information, and detailed protections against selective presentation of profitable past recommendations. The proposal would delete those requirements and principally substitute a prohibition against referring to a past specific recommendation unless the recommendation is presented in a fair and balanced manner.

FINRA describes this change as harmonization with the SEC’s Investment Adviser Marketing Rule. PIABA supports sensible harmonization. But harmonization should compare regulatory systems, not isolated sentences.

The Investment Adviser Marketing Rule’s fair-and-balanced standard operates within a broader regulatory framework that includes restrictions addressing selective presentations, detailed requirements for performance advertising, rules governing testimonials and endorsements, and associated books-and-records requirements. FINRA’s proposal borrows the general standard while eliminating much of Rule 2210’s existing specificity without clearly supplying equivalent safeguards.

Specific requirements have important virtues. They tell firms what must be disclosed, give supervisors objective criteria, promote consistent examinations and enforcement, and provide a concrete standard when investors later challenge misleading communications. If FINRA concludes that particular disclosures in Rule 2210(d)(7) are obsolete or duplicative, it should identify them individually and explain why. It should not assume that a general fair-and-balanced obligation necessarily performs the same function.

The anti-cherry-picking protections are particularly important. Technology makes selective presentation easier. Firms can rapidly identify a successful recommendation, turn it into promotional content, target likely investors, and distribute it at negligible marginal cost. AI can perform the same selection dynamically. If FINRA adopts a principles-based standard, it should therefore retain an explicit prohibition against selecting past recommendations in a manner designed to emphasize favorable outcomes while obscuring unfavorable ones, together with adequate records to substantiate the presentation.

Finally, FINRA’s conclusion that deleting the existing provisions will have little economic effect also warrants more support. If FINRA believes other content standards and Regulation Best Interest fully duplicate each deleted requirement, it should identify the applicable alternative obligation and explain whether its scope, evidentiary requirements, and enforceability are actually equivalent.

IV. Responses to Selected Requests for Comment

• Supervision (Question 1). FINRA can modernize principal review without making meaningful pre-use supervision entirely a matter of firm discretion. Higher-risk categories—including recommendations, material performance claims, new-member communications, personalized solicitations, and certain automated communications—should remain subject to heightened requirements. Any risk-based regime should also include express preservation and reconstruction obligations.
• Social Media (Question 2). PIABA agrees that the static/interactive distinction has become difficult to defend. But the fluid and editable character of modern social media strengthens the need to preserve the content actually disseminated. Eliminating the distinction should therefore be accompanied by reliable as-used content capture.
• Artificial Intelligence (Question 3). FINRA should supervise AI at both the communication and system levels. Firms should approve material customer-facing use cases before deployment, test and monitor actual outputs, preserve sufficient provenance to reconstruct disputed communications, and maintain controls addressing systematic and correlated errors.
• Filing Requirements (Question 4). PIABA supports extending the first-year filing period so that it runs for a full year of actual public communications. We oppose moving self-published investment-company rankings and comparisons to post-use filing absent stronger evidence that investor protection will be preserved.
• Recommendations (Question 5). PIABA opposes deleting Rule 2210(d)(7)’s specific protections unless FINRA adopts functionally comparable safeguards addressing conflicts, substantiation, and cherry-picking.
• Ephemeral System-Generated Communications (Question 8). Any regulatory accommodation for automatically generated factual communications should depend on accurate, retrievable recordkeeping. “Ephemeral” may describe the customer interface; it should not describe the firm’s records.

V. Conclusion

PIABA supports a Rule 2210 designed for modern communications and modern technology. But modernization should not transfer the risks created by those technologies from firms to their customers.

We therefore urge FINRA to:

1. retain meaningful supervisory floors for higher-risk communications;
2. make preservation, auditability, and reconstructability explicit regulatory obligations;
3. require lifecycle supervision and adequate records for customer-facing AI systems;
4. reconsider the economic analysis using firm-level as well as filing-level data, an appropriate counterfactual, exposure-weighted measures of investor harm, and analysis of correlated automated errors;
5. retain pre-use filing for self-published investment-company rankings and comparisons unless further analysis establishes comparable protection under post-use review; and
6. preserve the substantive protections of Rule 2210(d)(7), or replace them with genuinely equivalent safeguards rather than a general standard standing alone.

The efficiencies of modern communications technology can benefit both firms and investors. Firms should not, however, receive the benefit of inexpensive, instantaneous, highly personalized communications while investors bear the resulting supervisory and evidentiary risks.

We would welcome the opportunity to discuss these comments further.

Respectfully submitted,

Michael C. Bixby
President, Public Investors
Advocate Bar Association