Does a firm need to know about the misconduct to be held liable?

No. Under FINRA rules, firms are responsible for establishing systems to prevent and detect misconduct. Ignorance is not a defense.