Books, Records, and Customer Privacy

Regulators check a broker-dealer by reading its records. Customers check their own accounts by reading confirmations and statements. You need three things from this lesson: what a firm keeps, what it sends, and how it protects customer information and assets.

Books and records: what the firm keeps, and for how long

SEC Rule 17a-3 lists the records a broker-dealer must create. SEC Rule 17a-4 sets how long it keeps them. FINRA Rule 4511 adds a six-year default for any record with no stated period.

Three periods cover most exam questions:

• Life of the firm: records that define the firm. Articles of incorporation or partnership articles, the charter, minute books, and stock certificate books.
• Six years: the core money and account records. Blotters (the daily record of every trade, receipt, and payment), general ledgers, customer account ledgers, and the stock record.
• Three years: most of the rest. Order tickets, trade confirmations, trial balances, communications sent and received, advertising, and employment records.

The firm keeps the first two years of the six-year and three-year records in an easily accessible place. Customer account records under FINRA Rule 4512 run six years past the day the account closes.

Confirmations and account statements

A confirmation is the written record of one trade that the firm sends the customer. SEC Rule 10b-10 and FINRA Rule 2232 require one for every transaction, at or before completion of the transaction. Completion means settlement, and regular-way settlement has been T+1 since May 2024.

The confirmation gives the trade date, the security, the quantity, the price, and the firm's capacity as agent or principal. An agency confirmation also shows the commission.

An account statement reports the whole account rather than one trade. FINRA Rule 2231 requires one at least every calendar quarter for any account with a position, a money balance, or activity. Most firms send a statement monthly when the account had activity.

The exam likes to swap the two timings: confirmations per trade at or before settlement, statements at least quarterly.

Holding customer mail

A customer who travels can ask the firm to hold their mail. The firm needs written instructions that say how long.

FINRA Rule 3150 draws the line at three consecutive months. A request that runs longer must also give an acceptable reason, such as a safety or security concern. Convenience is not an acceptable reason.

Two more duties apply while the firm holds mail. It tells the customer in writing about other ways to get account information, such as electronic delivery. It also checks at reasonable intervals that the instructions still apply.

Older study guides give two months for a vacation and three months for travel abroad. Those numbers came from the retired NASD rule. Rule 3150 replaced them with one three-month threshold.

Business continuity plans

FINRA Rule 4370 requires every member firm to keep a written business continuity plan (BCP) for serving customers through an emergency or major disruption. The firm reviews it yearly and updates it after any material change.

The plan must address ten areas at a minimum, including these five:

• Data backup and recovery.
• Mission critical systems.
• Alternate communication with customers and staff.
• Alternate work locations.
• Prompt customer access to funds and securities if the firm cannot continue.

A member of senior management who is a registered principal approves the plan. The firm names two emergency contact people to FINRA. It discloses the plan at account opening, on its website, and by mail on request.

Customer protection and custody of assets

SEC Rule 15c3-3, the Customer Protection Rule, keeps customer cash and securities apart from the firm's own assets.

Possession or control comes first. The firm holds fully paid customer securities in a good control location: a clearing corporation, a qualifying bank, or its own vault. It may not lend or pledge them for its own borrowing. With margin securities the firm may pledge up to 140% of the customer's debit balance and segregate the rest.

The reserve requirement comes second. The firm compares what it owes customers with what customers owe it. It deposits the difference into a Special Reserve Bank Account for the Exclusive Benefit of Customers.

Rule 15c3-3 prevents the loss. SIPC responds only after a member firm has failed.

Regulation S-P: customer privacy

Regulation S-P is the SEC rule that controls how a broker-dealer handles a customer's private financial information. It carries out the privacy provisions of the Gramm-Leach-Bliley Act and reaches broker-dealers, investment advisers, and investment companies.

Nonpublic personal information (NPI) is the protected data. NPI covers what the customer tells the firm and what the firm learns from the relationship. That includes a Social Security number, account number, balances, income, and transaction history. Already public information, such as a listed phone number, is not NPI on its own.

The firm delivers an initial privacy notice when the relationship starts, and an annual notice while it continues. A firm may skip the annual notice when it has not changed its policy and shares NPI only in ways that carry no opt-out right.

Before the firm shares NPI with a nonaffiliated third party, it must give the customer notice and a reasonable way to opt out. Sharing with a service provider that helps process the customer's own transactions needs no opt out.

The safeguards rule requires written policies that protect customer records against loss and unauthorized access. A firm must also run an incident response program and tell affected customers about a breach of sensitive information, no later than 30 days.

How this gets tested

Most items name a document and ask for a number. You sort a record by what it describes. The firm's existence lasts the life of the firm, a blotter or ledger runs six years, and an order ticket or communication runs three years.

Privacy items usually test the opt out. A customer can stop the firm from sharing NPI with an unaffiliated company, but not the sharing the firm needs to settle their own trades.