Study guide
This chapter covers the sixth topic of the official NASAA outline: how firms and agents must communicate with customers and prospects. It covers required disclosures, account agreements, advertising and social media, and the cybersecurity and privacy rules that govern customer communications and data.
Required Disclosures and Unlawful Representations
Fair dealing starts with telling customers what they are buying. Agents must ensure customers receive required offering documents, such as a prospectus for a new issue or mutual fund, and must disclose material facts about products: sales charges and the availability of breakpoints (quantity discounts on mutual fund sales loads), surrender charges on variable products, early withdrawal penalties on brokered CDs, call features on bonds, and the risks that make a product unsuitable to hide. Failing to mention breakpoints so a client buys just below a discount threshold is a classic dishonest practice. Two categories of statements are flatly unlawful. First, misrepresenting registration status: it is illegal to tell a customer that a registration of an agent, firm, or security means the Administrator or SEC has approved, endorsed, or passed on the merits or accuracy of anything. Registration means only that filing requirements were satisfied. Saying I am state-approved or this fund was cleared as a good investment by the state violates the act even if said carelessly rather than maliciously. Second, performance guarantees are prohibited. An agent may never guarantee a customer against loss, promise a specific return on a non-guaranteed product, or offer to buy back a security at cost if it disappoints. The word guaranteed has exactly one legitimate use: describing a security whose principal, interest, or dividends are guaranteed by a third party, such as a parent company guaranteeing a subsidiary's bond, and even then the guarantee covers payment, never market price. Example: Tomas tells a prospect this utility stock cannot lose more than 5 percent, I will personally cover anything beyond that. That is a prohibited guarantee regardless of Tomas's sincerity.
Customer Account Agreements
The outline names three agreements: new account, margin, and options. Opening a new account requires collecting the information that makes suitability possible: identity, address, employment, financial situation, risk tolerance, and investment objectives, along with legal documentation such as corporate resolutions or trust documents for entity accounts. Firms must also make reasonable efforts to obtain the name of a trusted contact person, an individual the firm may reach if it suspects the customer is being exploited or losing capacity; the customer may decline, and the account can still be opened. Customers can refuse to supply some financial details, but the firm may then be limited in what it can recommend. A margin account lets the customer borrow from the firm to buy securities, with the securities as collateral. Before or promptly after the first margin transaction, the customer must sign the margin agreement, whose key components are the credit agreement (loan terms and interest), the hypothecation agreement (pledging the customer's securities as collateral, which the firm may rehypothecate to finance the loan), and an optional loan consent permitting the firm to lend out the customer's securities. Margin documentation cannot wait indefinitely, and margin is unsuitable for many conservative investors. Options accounts add a third layer: the customer must receive the options disclosure document at or before account approval by a qualified supervisor, and the signed options agreement must be returned within 15 days after approval. Trading may begin upon approval, but if the agreement is not received within the 15-day window, the firm may accept only closing transactions in the account. Trading before required approvals or documentation is a violation even if the trades are profitable.
Advertising, Social Media, Digital Communications, and Cybersecurity
The June 2023 outline elevated correspondence and advertising — social media, email and digital messaging, and website communications — into named topics; cybersecurity appears here as supplemental context because regulators test it through the broader supervision and privacy rules. Any communication distributed to customers or prospects, whether a seminar slide deck, a website, an email blast, or a social media post, is subject to the same core rules: it must be fair, balanced, and free of misleading claims, exaggerated performance, or promises of results, and firm procedures govern approval and retention. Administrators may require filing of sales literature, though literature for exempt and federal covered securities is generally not filed. Social media analysis on the exam usually turns on two distinctions. Static content, like a profile page or a posted article, functions as advertising and typically requires principal approval before use. Interactive content, like real-time replies and comments, is treated like correspondence, subject to supervision and review rather than pre-approval. Business communications sent through personal accounts or texting apps are still firm business: agents may not evade supervision by moving client conversations to a personal channel, and firms must capture and retain business-related digital messages just like letters. Liking or reposting a customer's claim can make it the agent's own statement. Cybersecurity and data protection obligations flow from privacy rules such as SEC Regulation S-P: firms must deliver initial and annual privacy notices, give customers the right to opt out of sharing nonpublic personal information with nonaffiliated third parties, and maintain written safeguards for customer records. Under the amended federal rules now fully in effect, firms must maintain incident response programs and notify affected individuals within 30 days of becoming aware of a breach of sensitive customer information. Agents contribute by protecting credentials, verifying wire instructions, and reporting suspected intrusions immediately.
Key terms
- Breakpoint
- — A quantity discount on mutual fund sales charges; concealing breakpoints or selling just below one to earn more commission is a dishonest practice.
- Guarantee prohibition
- — Agents may never guarantee customers against loss or promise performance; guaranteed properly describes only third-party guarantees of principal, interest, or dividends.
- Trusted contact person
- — An individual the customer names whom the firm may contact about suspected exploitation or diminished capacity; firms must make reasonable efforts to obtain one.
- Hypothecation agreement
- — The margin document pledging the customer's securities as collateral for the margin loan.
- Options disclosure document (ODD)
- — The risk booklet delivered at or before options account approval; the signed options agreement is due within 15 days after approval, after which only closing transactions may be accepted.
- Static vs. interactive content
- — Fixed social media content treated like advertising needing prior approval, versus real-time posts treated like correspondence subject to supervision and review.
- Regulation S-P
- — The federal privacy rule requiring privacy notices, opt-out rights, safeguards for customer data, and notification to affected individuals within 30 days of a breach.
Exam tips
- Registration is never an endorsement. Any statement implying the Administrator or SEC approved, cleared, or vouched for a security or its merits is an automatic violation.
- Watch the word guaranteed: its only proper use is a third party guaranteeing payment of principal, interest, or dividends — never market price and never performance.
- Static social media content (a profile, a posted article) needs prior principal approval like advertising; interactive content (replies, comments) is supervised like correspondence after the fact.
- Know the account-agreement deadlines: options agreements are due within 15 days of approval (closing transactions only after that), and breach notification under Regulation S-P is due within 30 days.