Study guide
The exam's third function, worth 45 of the 110 scored questions, covers the operational backbone of the firm: records, anti-money laundering, account processes, financial responsibility, and the annual compliance cycle. A Series 26 principal may not perform every one of these tasks personally, but the exam expects fluency in the requirements and the deadlines that keep a firm out of trouble.
Books and Records: SEA Rules 17a-3 and 17a-4 and FINRA Rule 4511
Securities Exchange Act Rule 17a-3 lists the records a broker-dealer must create: blotters recording daily purchases, sales, and movements of cash and securities; general ledgers; order memoranda showing the terms and time of each order; customer account records; and records of associated persons, among others. For each account owned by a natural person, the firm must furnish the customer a copy of the account record information, including the suitability profile, within 30 days of opening and at least every 36 months thereafter, so the customer can correct errors. Rule 17a-4 sets retention periods. Blotters, general ledgers, and customer account records are kept six years; most other records, including communications and order tickets, are kept three years, with the first two years in an easily accessible place; organizational documents such as articles of incorporation and minute books are kept for the life of the firm. Records may be stored electronically if the system preserves them in a non-rewriteable, non-erasable format or, under amendments adopted in 2022, in an electronic system with a complete time-stamped audit trail. FINRA Rule 4511 adds a catch-all: firms must preserve records required under FINRA rules for at least six years when no specific retention period is stated. For the exam, anchor a few pairs in memory: blotters six years, communications three years, corporate charter documents for the life of the enterprise, and the 30-day and 36-month customer account record cycle.
Anti-Money Laundering: The AML Program, CIP, SARs and CTRs
The Bank Secrecy Act, administered by FinCEN, and FINRA Rule 3310 require every firm to maintain a written anti-money laundering program approved by senior management. The program's required elements include policies and internal controls reasonably designed to detect and report money laundering, designation of an AML compliance officer whose identity is provided to FINRA, ongoing training, independent testing of the program (annually for most firms, though every two years may suffice for firms that neither hold customer accounts nor execute customer transactions), and risk-based customer due diligence, including identifying beneficial owners of legal entity customers, generally anyone owning 25 percent or more plus a control person. The customer identification program (CIP) requires collecting at minimum the customer's name, date of birth for individuals, address, and identification number such as a Social Security number, verifying identity through documents or non-documentary means within a reasonable time, checking government lists of known or suspected terrorists, and retaining CIP records for five years. Two reports carry tested thresholds. A suspicious activity report (SAR) must be filed with FinCEN within 30 days of detecting a suspicious transaction involving 5,000 dollars or more, and the filing is strictly confidential; telling the customer, called tipping off, is prohibited. A currency transaction report (CTR) is required for cash transactions exceeding 10,000 dollars in a single business day, and structuring deposits to evade the threshold is itself a crime and a SAR trigger. Firms also respond to FinCEN 314(a) information requests and may share information with other institutions under 314(b) safe harbor procedures.
Account Opening, Transfers and Privacy under Regulation S-P
Opening an account generates immediate obligations. The firm collects the information required under the books and records rules and FINRA Rule 4512, including the customer's name, address, whether the customer is of legal age, the associated person responsible for the account, and, for recommendations, the suitability profile: age, other investments, financial situation, tax status, objectives, time horizon, liquidity needs, and risk tolerance. Rule 4512 also requires firms to make reasonable efforts to obtain the name of a trusted contact person, and FINRA Rule 2165 permits a temporary hold on disbursements when the firm reasonably suspects financial exploitation of a senior or otherwise vulnerable adult. In a Series 6 firm, final acceptance of new accounts is an OSJ function performed by a principal. Account transfers between firms run through the Automated Customer Account Transfer Service (ACATS): upon receiving a transfer instruction, the carrying firm must validate the positions or take exception within one business day and complete the transfer within three business days of validation, and a firm may not impede a customer's transfer to retain the business. Regulation S-P governs privacy: customers receive an initial privacy notice at account opening and generally annual notices thereafter, though a firm that shares nonpublic personal information only under the exceptions that do not trigger opt-out rights, and whose practices have not changed since its last notice, is excused from the annual notice; customers must be given a reasonable opportunity to opt out before nonpublic personal information is shared with nonaffiliated third parties outside the exceptions, and the firm must maintain written safeguards for customer records. SEC amendments adopted in 2024 further require incident response programs and notification to affected customers of significant data breaches, generally within 30 days of discovery, requirements that phased in for firms of different sizes through mid-2026.
Financial Responsibility, SIPC and the Fidelity Bond
SEA Rule 15c3-1, the net capital rule, requires broker-dealers to maintain minimum liquid capital so they can meet obligations to customers. Minimums vary by business model, from 5,000 dollars for firms that do not handle customer funds or securities up to 250,000 dollars for firms that carry customer accounts. Many firms limited to mutual funds and variable contracts operate on an application-way or subscription-way basis, sending customer checks made payable to the fund or insurer directly to the issuer, which keeps them out of the custody business and within lower minimums and exemptions from the customer protection rule, SEA Rule 15c3-3. Firms approaching financial trouble face early warning requirements under Rule 17a-11, which trigger notices to regulators and can restrict business expansion. The Securities Investor Protection Corporation (SIPC), created by the Securities Investor Protection Act of 1970, protects customers if a broker-dealer fails with customer assets missing: coverage runs up to 500,000 dollars per separate customer, of which no more than 250,000 dollars may be cash. SIPC does not protect against market losses, and exam questions frequently test that distinction. Member firms pay assessments and must disclose SIPC membership and contact information to customers. FINRA Rule 4360 requires most member firms to carry a fidelity bond covering losses from employee dishonesty, forgery, and misplacement of securities, with minimum coverage tied to the firm's net capital requirement and an annual review of the bond's adequacy. A principal should understand these safeguards well enough to explain, for example, why a failed firm's customers recover through SIPC while a fraud loss inside a solvent firm may be a fidelity bond claim.
Business Continuity, the Annual Compliance Cycle and Regulatory Examinations
FINRA Rule 4370 requires every firm to maintain a written business continuity plan (BCP) addressing data backup and recovery, mission-critical systems, financial and operational assessments, alternate communications with customers and employees, alternate physical locations, critical vendor arrangements, regulatory reporting, and how customers will access their funds and securities in a disruption. The firm must disclose a BCP summary to customers in writing at account opening, post it on its website, and mail it on request, and must review and update the plan annually and upon material change. The firm also designates two emergency contact persons with FINRA, both associated persons of the firm; at least one must be a member of senior management and a registered principal, and the second, if not a registered principal, must be a member of senior management with knowledge of the firm's business operations. The annual compliance cycle ties earlier chapters together: every registered representative and registered principal must participate in an annual compliance meeting or interview under Rule 3110, the Rule 3120 supervisory controls report goes to senior management each year, and the chief executive officer executes the annual Rule 3130 certification after meeting with the chief compliance officer. Finally, principals manage the firm's side of regulatory oversight. FINRA Rule 8210 empowers FINRA staff to require testimony, documents, and information from member firms and associated persons; there is no right to refuse, and failure to respond typically results in a bar from the industry. Firms undergo routine cycle examinations and, when red flags arise, cause examinations. The principal's job is to respond completely and truthfully by the deadline, centralize document production, never alter or destroy responsive records, and treat examination findings as a punch list for corrective action, because repeat findings draw escalating sanctions.
Key terms
- SEA Rule 17a-3
- — The SEC rule listing required broker-dealer records, including blotters, ledgers, order memoranda, and customer account records with a 30-day and 36-month furnishing cycle for account information.
- SEA Rule 17a-4
- — The SEC retention rule: six years for blotters, ledgers, and account records; three years for most records including communications; lifetime for organizational documents; electronic storage permitted with audit-trail or non-erasable formats.
- FINRA Rule 4511
- — FINRA's general recordkeeping rule requiring preservation of FINRA-required records for at least six years when no other retention period is specified.
- Customer identification program (CIP)
- — The AML requirement to collect and verify at minimum name, date of birth, address, and identification number for new customers, check government lists, and keep records for five years.
- Suspicious activity report (SAR)
- — A confidential report filed with FinCEN within 30 days of detecting a suspicious transaction of 5,000 dollars or more; disclosing the filing to the customer is prohibited.
- Currency transaction report (CTR)
- — A report required for currency transactions exceeding 10,000 dollars in a single business day; breaking transactions apart to evade it is structuring, a crime.
- Regulation S-P
- — The SEC privacy rule requiring initial and annual privacy notices, opt-out rights before sharing nonpublic personal information with nonaffiliated third parties, safeguards, and, under 2024 amendments, breach response and customer notification.
- ACATS
- — The automated system for customer account transfers; the carrying firm must validate within one business day and complete the transfer within three business days of validation.
- SIPC
- — The Securities Investor Protection Corporation, which protects customers of failed broker-dealers up to 500,000 dollars per customer, including a 250,000 dollar limit on cash; it does not cover market losses.
- Fidelity bond
- — Insurance required by FINRA Rule 4360 covering losses from employee dishonesty, forgery, and misplacement of securities, with coverage reviewed annually.
- Business continuity plan (BCP)
- — The written plan required by FINRA Rule 4370 for continuing operations during a disruption, summarized for customers at account opening and supported by two designated emergency contacts.
- FINRA Rule 8210
- — FINRA's investigative authority to compel testimony, documents, and information from firms and associated persons; failure to respond typically results in a bar.
Exam tips
- Pair each record with its retention period: blotters and ledgers six years, communications and most records three years with two easily accessible, organizational documents for the life of the firm, and six years as the FINRA 4511 default.
- Keep SARs and CTRs straight: SARs are suspicion-based at 5,000 dollars with a 30-day filing window and strict confidentiality; CTRs are mechanical at over 10,000 dollars in currency in one day.
- SIPC numbers are free points: 500,000 dollars per separate customer including no more than 250,000 dollars in cash, and no protection against market losses.
- The annual cycle appears across question banks: annual compliance meeting for every registered person, annual 3120 report to senior management, annual 3130 CEO certification, annual BCP review, and annual fidelity bond review.
- Treat Rule 8210 as absolute on the exam: an associated person who refuses to testify or produce documents faces a bar, and there is no privilege against responding comparable to court proceedings.