FINRA has rulemaking authority.  Nevertheless, the trend would appear to be that FINRA is making its rules through the enforcement process.  Read this blog for insightful thoughts on this issue.