FINRA Remote Inspections Pilot: What Microsoft 365 Evidence Is Needed?

Quick answer. As of October 2026, FINRA’s Remote Inspections Pilot Program under Rule 3110.18 lets a participating firm inspect its offices without an on-site visit until the program’s scheduled end on June 30, 2027, and FINRA’s Board of Governors has approved a proposal to make the program permanent that FINRA says will be filed with the SEC, according to FINRA’s Remote Inspections Pilot Program page and the report from its June 2026 Board of Governors meeting. On either path, a participating firm must document an office-specific risk assessment against the factors FINRA lists and keep written supervisory procedures that name the technology it uses, which in a Microsoft 365 tenant draws on Teams retention to keep the chat and channel record, Purview eDiscovery to search, hold and export it, Purview Communication Compliance as one source of conduct signals, and SharePoint to hold the risk-assessment and procedure documents. A firm that does not participate must still inspect every office of supervisory jurisdiction, branch office and non-branch location on site, according to FINRA.

The compliance team has asked a question the IT team cannot answer from the tenant yet: if FINRA asks how the firm inspected a branch remotely last year, what record shows it? The question has two possible futures attached to it. The pilot’s scheduled end date is June 30, 2027. FINRA’s Board has already voted to make the program permanent, but according to the report from its June 2026 Board of Governors meeting, that vote produced a proposal that “will be filed with the SEC,” not a finished rule. A firm cannot plan around a certain end date, and it cannot plan around a done deal. It can build the evidence that both paths need.

What the pilot allows, and what a firm outside it must still do

Before any tenant work, the first decision is whether the firm is in the program at all, because the two answers carry different obligations. FINRA’s Regulatory Notice 24-02, which adopted the rule, states that “Rule 3110.18 establishes a voluntary, three-year remote inspections pilot program (Pilot Program) to allow eligible member firms to fulfill their Rule 3110(c)(1) inspection obligation of qualified branch offices, including OSJs and non-branch locations remotely, without an on-site visit to such offices or locations, subject to specified terms.” FINRA’s Remote Inspections Pilot Program page states that the program “began on July 1, 2024 and ends on June 30, 2027.” Participation is an election, not a default: according to FINRA’s Regulatory Notice 24-02, a firm “must affirmatively elect to participate in the Pilot Program by providing FINRA with an” opt-in notice, and it must give an opt-out notice to withdraw.

Those specified terms are where the IT work sits. FINRA’s program page states: “Under the Pilot Program, eligible member firms have the flexibility to satisfy their inspection obligation under Rule 3110(c)(1)(A), (B) and (C) without an on-site visit to the office or location, subject to specified terms that include conducting and documenting a risk assessment, and producing written supervisory procedures for conducting remote inspections and inspection data to FINRA.”

A firm outside the program has no remote option to fall back on. The temporary rule that allowed remote inspections before the pilot is gone: FINRA’s Remote Inspections Pilot Program page states that “FINRA reminds firms that Rule 3110.17, the temporary remote inspections rule, ended on June 30, 2024.” It continues: “Thus, a firm that does not participate in the Pilot Program cannot satisfy its obligations under Rule 3110(c)(1)(A), (B) and (C) remotely.” Citing Regulatory Notice 11-54, the same page states that “such member firm must conduct on-site inspections of each of its offices of supervisory jurisdiction (OSJs), supervisory branch offices, non-supervisory branch offices and non-branch locations” and that requirement is not optional for a firm that has not opted in.

Whether a specific firm or a specific office is eligible is a determination for the firm’s compliance function and counsel against FINRA’s current text, not something this guide decides.

The risk assessment: FINRA’s factors, and where the tenant holds evidence for them

A remote inspection that cannot show why that office was judged safe to inspect remotely is the failure this section exists to prevent. FINRA’s Remote Inspections Pilot Program page states that “A firm that participates in the Pilot Program (Pilot Program participant) must conduct and document a risk assessment for that office or location.” It adds that “Rule 3110.18(b)(2) enumerates a non-exhaustive list of factors a Pilot Program participant must consider as part of the risk assessment.” FINRA’s page lists those factors as follows:

• The volume and nature of customer complaints.
• The volume and nature of outside business activities, particularly investment-related.
• The volume and complexity of products offered.
• The nature of the customer base, including vulnerable adult investors.
• Whether associated persons are subject to heightened supervision.
• Failures by associated persons to comply with the member’s written supervisory procedures.
• Any recordkeeping violations.

The list is FINRA’s and it is non-exhaustive; the assessment must also take in the Rule 3110.12 factors and any higher-risk activity or person at that office, according to FINRA’s program page. And the assessment can point the other way: according to FINRA, “a Pilot Program participant should conduct on-site inspections or make more frequent use of unannounced, on-site inspections for high-risk offices or locations or where there are indicators of irregularities or misconduct” such as red flags.

A Microsoft 365 tenant does not perform any of this. What it can do is hold part of the evidence each factor is judged on, for the offices whose business runs through it. Three connections are direct:

• Recordkeeping violations as a factor depends on records existing to be reviewed. Microsoft’s Manage retention policies for Microsoft Teams page states that “Teams supports retention policies for chat and channel messages so that as an admin, you can decide proactively whether to retain this data, delete it, or retain it for a specific period of time and then delete it.” A policy set to delete before the next inspection removes the record that inspection would read.
• Complaints, outside business activity and conduct signals that surface in electronic communications can be found in the tenant. Microsoft’s Learn about Communication Compliance page states that “Microsoft Purview Communication Compliance provides the tools to help organizations detect regulatory compliance (for example, SEC or FINRA) and business conduct violations such as sensitive or confidential information, harassing or threatening language, and sharing of adult content.” For this page, that is one input to an office’s risk assessment, nothing more.
• The assessment itself, the factors considered and the conclusion reached for each office, is a document the firm writes and keeps. A SharePoint site the compliance function controls is where that record, its versions and its sign-off can live alongside the procedures it refers to.

Everything else on FINRA’s list, such as the product mix, the customer base and who is under heightened supervision, comes from the firm’s own books, registration and supervision records, which can sit entirely outside Microsoft 365. The firm’s compliance function performs the assessment and owns its conclusion; Microsoft’s tools keep and surface part of the evidence.

The written supervisory procedures: the technology has to be named

When the procedures describe remote inspections in general terms and never say which systems the inspector used, the gap sits in the first item FINRA lists. According to FINRA’s Remote Inspections Pilot Program page, Rule 3110.18 sets out areas a participant’s written supervisory procedures must cover, and they include:

• “the methodology, including technology, that may be used to conduct remote inspections”
• the factors considered in the risk assessment
• the other risk-based systems the firm uses to identify and prioritize for review the areas of greatest risk
• “procedures for escalating significant findings”
• procedures for new hires
• procedures for supervising brokers with a significant history of misconduct
• procedures related to outside business activities and doing business as designations
• compliance with the data and information collection and transmission requirements of Rule 3110.18(h)

For the IT Director, the first item is the one that lands on the IT desk. If the inspection reads Teams chats and channel messages, the procedures should say so, and say how long they are kept. If it searches and exports content across mailboxes, Teams and SharePoint, the procedures should name Purview eDiscovery as the tool that does it and who in compliance holds the permission. If Communication Compliance is one of the risk-based systems the firm relies on, it belongs under that item by name. The procedures are the firm’s own document, written and approved by its compliance function; the IT team’s job is to make sure what they say about the technology matches how the tenant is configured.

According to FINRA’s program page, participants in Pilot Years 2 through 4 must provide FINRA with the written supervisory procedures for conducting remote inspections and quarterly inspection data on set dates, so a mismatch between the procedures and the tenant is not a private problem.

When the inspection runs: the evidence chain and where it breaks

The inspection is the moment the tenant’s settings stop being theoretical. A remote inspector reviewing a branch needs that office’s communications and documents for the period under review, found, preserved and exported. Microsoft’s Learn about eDiscovery page describes the tool for that step: “Use Microsoft Purview eDiscovery to identify, review, and manage content in Microsoft 365 services to support your investigations.” The same page lists Exchange Online, Microsoft Teams, Microsoft 365 Groups, OneDrive, SharePoint and Viva Engage as the supported services.

In practice the chain breaks in two predictable places.

First, retention: eDiscovery can only find what is still there. Microsoft’s Manage retention policies for Microsoft Teams page states that “The start of the retention period for these actions is always based on when a message is created.” It also states what happens when a user edits or deletes a message under a retain policy: “Although users no longer see their edited or deleted messages in Teams, data from these messages is stored in a secured location designed for eDiscovery searches by compliance administrators.” That protection only exists if a retain policy covers the user. Check the Teams retention period against the firm’s own inspection cycle for each office, before assuming the chat history an inspector needs will still be there when the inspection runs.

Second, the eDiscovery tier. Microsoft’s Learn about eDiscovery page ties its premium case-management and analysis features to specific subscriptions. Confirm which eDiscovery capabilities the tenant is licensed for, and that the compliance staff who run inspections hold the permissions to use them, before the procedures describe a search-and-export workflow the tenant cannot run. Which license includes which eDiscovery feature is a separate question from this guide’s.

The permanence proposal: what FINRA has said, and what it has not

If a firm reads only FINRA’s program page, it will plan for an ending that may not come; if it reads only the headlines about the Board vote, it will plan for a rule that does not exist yet. FINRA’s report from its June 2026 Board of Governors meeting lists remote inspections among “the rule proposals approved by the Board, which will be filed with the SEC,” and states: “The proposal would make permanent the Remote Inspections Pilot Program before it expires to preserve the ability of member firms to conduct remote inspections of their offices.” The same report states: “The proposal is informed by the data collected during the pilot program, incorporates feedback received in response to Regulatory Notice 25-07 and recognizes the evolution of the modern workplace.” Regulatory Notice 25-07 is FINRA’s request for comment on modernizing its rules for the organization and operation of member workplaces.

Two things are true at once as of October 2026. FINRA’s Board has approved a proposal to make the program permanent. And FINRA’s Remote Inspections Pilot Program page, read for this guide on the same day, still describes a voluntary three-year program ending on June 30, 2027, with no reference to the Board’s vote. No primary source read for this guide shows the SEC acting on the proposal, so this guide states the status as FINRA states it and nothing further. Check FINRA’s current pages for the proposal’s status before any decision that depends on it.

What this means for the tenant is the useful part: nothing in the evidence chain depends on which path wins. If the program ends on June 30, 2027 and no permanent rule replaces it, the firm needs a clean record of how its remote inspections were run while it participated. If a permanent rule is approved, the firm keeps running remote inspections and keeps needing the same risk-assessment record, procedures and retrievable evidence, subject to whatever terms the final rule sets.

The dates that matter before June 30, 2027

If the firm is weighing its next step, the nearest decision is not the end date. FINRA’s Remote Inspections Pilot Program page sets out the remaining Pilot Year 4 dates:

• December 27, 2026: the deadline to opt in to Pilot Year 4, and the deadline to withdraw from participating in Pilot Year 4.
• April 15, 2027: the deadline for Pilot Year 4 participants to provide the written supervisory procedures for conducting remote inspections and first-quarter inspection data.
• June 30, 2027: the program’s scheduled end, unless a permanent rule is approved.
• July 15, 2027: the deadline for Pilot Year 4 second-quarter inspection data.

According to FINRA’s program page, Pilot Year 4 filings for a firm that joins at the December 27, 2026 deadline are “First filings not due until April 15, 2027,” so the procedures that describe the technology need to be right before that date, whichever path the program takes afterwards.

The order of work

Before anything in the tenant changes, settle the order. The sequence in this section is this guide’s own recommendation, drawn from the requirements on FINRA’s Remote Inspections Pilot Program page and Microsoft’s documented behavior described in this guide; it is not a sequence FINRA or Microsoft publishes.

1. Confirm with compliance whether the firm participates in the current pilot year, and whether it intends to opt in to or withdraw from Pilot Year 4 before December 27, 2026.
2. Check the Teams retention policies that cover each office’s users against the firm’s own inspection cycle, and against the recordkeeping factor in the risk assessment.
3. Confirm the eDiscovery capabilities the tenant is licensed for, and the permissions the inspecting staff hold, before assuming the search-and-export workflow exists.
4. Give compliance an accurate description of the technology used for remote inspections, so the written supervisory procedures name it, as the first item on FINRA’s list requires.
5. Put the risk-assessment records and the procedures in a SharePoint location compliance controls, with version history, so each office’s assessment and each revision can be shown.
6. Treat the permanence proposal as a reason to keep building, not a reason to stop: no primary source read for this guide shows the program already extended, or a permanent rule in force.

When this guide is the wrong starting point

Some readers arrive at this guide with a different problem, and it is worth saying so before they spend time on this one. A firm that has never participated in the pilot and has no plan to has a simpler obligation: the program is voluntary, and according to FINRA’s Remote Inspections Pilot Program page, a non-participant cannot meet its inspection obligation remotely and must inspect every office on site. The tenant still matters to that firm, but for its ordinary recordkeeping, which is a separate duty from inspections and is not covered in this guide. A reader who wants certainty that remote inspections will still be allowed after June 30, 2027 will not find it in any source read for this guide; the honest answer is a Board-approved proposal that FINRA says will be filed with the SEC, not a settled rule. A reader whose question is the ongoing review of correspondence and communications, rather than the periodic inspection of an office, is asking about a different part of Rule 3110. And a firm that is also regulated by the New York Department of Financial Services, or that handles export-controlled technical data in Teams, carries separate obligations on separate schedules that this page does not address.

What to ask of whoever builds it with you

Whoever does this work with you, inside the firm or outside it, hold it to these criteria, stated as what they should be able to show you:

• A risk assessment for each office that documents every factor on FINRA’s list, not a generic template.
• Written supervisory procedures that name the actual technology and methodology used for remote inspections.
• The Teams retention period for each office’s users, measured against the firm’s own inspection cycle, not assumed.
• The eDiscovery capabilities and permissions confirmed in the tenant, not assumed.
• A plan that does not depend on guessing whether the permanence proposal is approved before June 30, 2027.

No supervisory-technology product or firm is named or compared in that work.

How i3solutions answers

i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. For a remote-inspection program, that means a project, with embedded specialists where the firm’s team needs them, that configures Teams retention, Purview eDiscovery and Communication Compliance, and SharePoint as the evidence chain, and gives the compliance function an accurate description of that technology for the risk assessments and procedures it writes and signs itself. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. i3solutions governs identity and access for regulated Microsoft estates with senior, U.S.-based engineers and leaves an audit-defensible record. i3solutions has been a Microsoft Partner with 30 years of enterprise technology delivery experience and has delivered 1,500+ Microsoft engagements across aerospace and defense, financial services, and health sciences.

The supervision stays with the firm. An i3solutions project engagement does not by itself include ongoing support of what it delivers, which i3solutions scopes separately as Application Managed Services, and it is not a replacement for the internal team, open-ended scope expansion, or vendor lock-in. i3solutions does not perform the risk assessment, write the written supervisory procedures, or run the inspection program; those remain the firm’s compliance function’s own work and judgment.

For the Purview implementation engagement itself, see Microsoft Purview compliance consultants. For the wider governance picture, including the broader broker-dealer questions, see enterprise governance and compliance solutions.

Key Takeaways

Every fact in this section is drawn from FINRA’s Remote Inspections Pilot Program page, the report from its June 2026 Board of Governors meeting and Microsoft’s pages cited in this guide, all re-read in October 2026:

• FINRA’s Remote Inspections Pilot Program is voluntary and scheduled to end on June 30, 2027; FINRA’s Board has approved a proposal to make it permanent, which FINRA says will be filed with the SEC.
• A participating firm must document an office-specific risk assessment against FINRA’s listed factors and keep written supervisory procedures that name the technology used.
• A non-participating firm must inspect its offices on site.
• Teams retention, Purview eDiscovery, Purview Communication Compliance and SharePoint hold and surface part of the evidence; the firm’s compliance function performs the assessment.
• The Pilot Year 4 opt-in and opt-out deadline is December 27, 2026, and its first filings are due April 15, 2027.
• The evidence chain is needed on either path, so the permanence proposal is a reason to keep building it.

Frequently Asked Questions

Does FINRA still require on-site branch inspections?

For a firm that does not participate in the pilot, yes. According to FINRA, the temporary remote inspections rule ended on June 30, 2024, and a firm outside the Remote Inspections Pilot Program cannot meet its inspection obligation remotely and must inspect its offices of supervisory jurisdiction, branch offices and non-branch locations on site.

When does FINRA’s Remote Inspections Pilot Program end?

According to FINRA, the program began on July 1, 2024 and is scheduled to end on June 30, 2027. FINRA’s Board of Governors has also approved a proposal to make the program permanent, which FINRA says will be filed with the SEC, so the end date holds only if no permanent rule replaces it.

Is FINRA making the Remote Inspections Pilot Program permanent?

According to FINRA’s report from its June 2026 Board of Governors meeting, the Board approved a proposal that would make the program permanent before it expires, informed by pilot data and Regulatory Notice 25-07 feedback, and that proposal will be filed with the SEC. That is a Board-approved proposal, not a completed rule change.

What must a firm document to use remote inspections under Rule 3110.18?

According to FINRA, a participating firm must conduct and document a risk assessment for each office or location, considering the factors in Rule 3110.18(b)(2), and its written supervisory procedures must cover areas that include the methodology, including technology, used for remote inspections and procedures for escalating significant findings.

Which Microsoft 365 tools support a FINRA remote-inspection risk assessment?

According to Microsoft, Teams retention policies keep or delete chat and channel messages for a set period, Purview eDiscovery identifies, reviews and manages content across services including Teams and SharePoint, and Purview Communication Compliance provides tools for detecting regulatory compliance and business conduct violations. They hold and surface evidence; the firm’s compliance function performs the assessment.

Does Purview Communication Compliance replace a branch inspection?

No. According to Microsoft, Communication Compliance provides tools for detecting regulatory compliance and business conduct violations in communications, which is ongoing review, while a Rule 3110.18 remote inspection is the periodic inspection of an office under FINRA’s program, with its own risk assessment and written supervisory procedures.