Books and records: six years, three years, two accessible

A shorter period applies to a defined group of transaction records. Order tickets, customer confirmations and similar trade documentation must be preserved for at least three years. These are the records of individual transactions rather than the ongoing books of the firm, and the shorter period reflects how quickly a trading question is normally raised.

Some records carry a period of their own, and a named period comes before the default. Account cards and records about opening and maintaining a customer account are kept for at least six years after the account closes, and a firm keeps its file of written customer complaints for at least four years. The six-year default is for records no rule addresses.

For the six-year records and the three-year records that SEC Rule 17a-4 lists, the first two years must be kept easily accessible. That is a separate requirement about where the record is, not about how long it is held: a firm may not answer a request by saying the record exists in deep storage and will take weeks to produce. Two years in an accessible place, then the balance of the period wherever the firm keeps its archive.

A last distinction the exam tests is what the customer receives. A confirmation reports one transaction and must be sent at or before completion of that transaction. An account statement reports a period, showing positions and activity, and is sent periodically. Both are records the firm must keep, and only one of them arrives after every trade.

A municipal confirmation also has to identify the security traded. For a municipal securities trade, MSRB Rule G-15 sets out that securities identification, which includes the issuer’s name and the CUSIP number, if one is assigned. A CUSIP number is a nine-character code that identifies a security, and it helps with clearance and settlement. In the municipal market each maturity of an issue gets its own number, and the underwriter of a new issue applies for them. The number names the security; it does not approve or rate it.

Holding a customer’s mail has its own rule and its own clock. A firm may hold mail only if it has written instructions from the customer stating the period, has told the customer about other ways to get account information and obtained confirmation of that, and verifies at reasonable intervals that the instruction still stands. Convenience will carry it for up to three consecutive months and no further: beyond three months the instruction must give an acceptable reason, such as a safety or security concern. Throughout, the firm must still communicate important account information in a timely way and take steps to ensure the mail is not tampered with, held without consent, or used by an associated person in a way that would breach the rules.

Keeping the records is one duty; keeping the customer’s property separate is another, and two rules do that work. The customer protection rule requires a broker or dealer promptly to obtain, and thereafter maintain, physical possession or control of all fully-paid securities and excess margin securities carried for the account of customers — so a customer’s paid-for shares are not available to the firm’s own business. The same rule requires a Special Reserve Bank Account for the Exclusive Benefit of Customers, held at a bank, separate from every other account of the firm, into which it deposits cash or qualified securities in an amount computed by a prescribed formula.

The net capital rule is often confused with that and asks an entirely different question. It says nothing about customers: every broker or dealer must at all times have and maintain net capital no less than the highest minimum requirement applicable to it. One rule keeps the customer’s property out of the firm’s business; the other keeps the firm itself solvent. A firm can satisfy the second while breaching the first, which is exactly why both exist.

Firms must also plan for disruption. FINRA Rule 4370 requires every member to create and maintain a written business continuity plan with procedures for an emergency or significant business disruption, reasonably designed to let the firm keep meeting its obligations to customers. The plan must cover, at a minimum, matters such as data back-up and recovery and all mission-critical systems. It must be updated after any material change to the firm’s operations, structure, business or location, reviewed every year, and made available promptly to FINRA on request. The firm must also give FINRA emergency contact information.

That is why quietly editing an order record after a complaint is not a small administrative sin: the rule is built so that the edit itself leaves a mark, and a firm that has arranged its systems properly cannot lose the original version.