Quick Answer
FINRA requires customer identity, account responsibility, acceptance records, and applicable non-institutional information requests. The SEC separately requires copies of the account record for covered accounts at intervals no greater than 36 months. FINRA generally requires six years of retention after information is replaced or the account is closed. Keep furnishing, updating, and retention separate.
The customer-account-information requirement is the firm-level intake rule: it tells the broker-dealer (BD) what to collect at account opening and how long to keep it. Two scope notes:
- It does not address the customer's investment objectives or risk tolerance; those live under the suitability and Reg BI framework in a later unit
- The exam tests it as a recordkeeping and onboarding rule, paired with the SEC customer-account-record requirement
Required Customer Information for Every Account
The core record requirement obligates the firm to maintain a record for each account that includes:
- The customer's name and residence
- Whether the customer is of legal age (the age of majority in the customer's state of residence)
- The names of the associated person(s) responsible for the account (the registered representative) and the principal who accepted the account
- The customer's TIN (Social Security Number for individuals, Employer Identification Number for entities), a reasonable-efforts item, not an unconditional requirement
- The signature of the principal denoting acceptance of the account (the rule requires the principal's signature; it does not require the registered representative's signature)
Think of it this way: this core record is the spine of the account file. The principal must sign to accept the account, and the record also identifies the associated person responsible for it. The customer's identity and age anchor the file.
Exam Tip: Gotchas
- The rule requires the principal's signature to accept the account; it does not require the representative's signature. The record must still identify the associated person responsible for the account, but a sole-principal acceptance is complete.
- Legal age is determined by the customer's state of residence, not the firm's home state. A 19-year-old in Alabama (age of majority 19) can open an account; a 19-year-old in Mississippi (age of majority 21) cannot.
Additional Information for Non-Institutional Accounts
The customer-account-information requirement layers extra obligations on non-institutional accounts (retail individuals and most small entities). For each non-institutional account, the firm must make a reasonable effort to obtain:
- A Trusted Contact Person (TCP): the name and contact information of an individual at least age 18 whom the firm may contact about possible financial exploitation, cognitive impairment, or simple inability to reach the customer
- Employment status and employer details (employer name, occupation)
- Whether the customer is an associated person of another FINRA member firm (this triggers the employee-account-disclosure workflow elsewhere in FINRA's rulebook)
The TCP request is the most-tested feature of the customer-account-information requirement. The firm must ask for a TCP at account opening or at the next account update. The customer is not required to designate one; the firm satisfies the customer-account-information requirement by making the request and documenting the customer's response (designation or refusal).
Exam Tip: Gotchas
- The TCP request is mandatory for the firm; the TCP designation is optional for the customer. A firm that never asks violates the customer-account-information rule. A firm that asks and is refused complies.
- A TCP must be at least 18 years old. The exam tests this age floor; the customer cannot designate a 16-year-old child or grandchild as the TCP.
- The TCP is contact-only; the TCP cannot trade. Designation does not confer trading authority. Trading authority requires a separate written authorization under the discretionary-account requirement (discretion) or a power of attorney.
Discretionary, Custodial, and Margin Accounts
The customer-account-information requirement also addresses three account-type overlays:
- Discretionary accounts: The firm must keep a record of every customer who has given written discretionary authority and a separate record showing the dates each transaction was effected on a discretionary basis
- Custodial accounts under the Uniform Transfers to Minors Act (UTMA) / Uniform Gifts to Minors Act (UGMA): The firm must record the custodian's name and the minor's TIN; the minor's TIN is the reportable TIN, not the custodian's
- Margin accounts: The customer must sign a margin agreement and hypothecation agreement, obtained promptly after the first margin transaction (not before it); the customer's signature is the trigger for the firm's right to use customer securities as collateral
Exam Tip: Gotchas
- A custodial account uses the minor's TIN, not the custodian's. The exam will sometimes describe an UTMA account opened with the custodian's SSN and ask whether the file is correct. It is not.
- The margin agreement is obtained promptly after the first margin trade, not before it. The customer may place the first margin transaction before signing; the firm must then secure the signed margin and hypothecation agreements promptly after that initial transaction. A firm that lets margin trading continue for weeks without securing the agreements violates the requirement.
Verification, Update, and Retention Cycle
The retention provisions govern the lifetime of the record:
| Requirement | Frequency / Duration | Source |
|---|---|---|
| Furnish the account record for a covered account | At intervals no greater than 36 months | SEC customer-account-record requirement |
| Preserve superseded information | At least 6 years after replacement | FINRA customer-account-information rule |
| Preserve the most recent version after closure | At least 6 years after the account is closed | the customer-account-information rule and the SEC customer-account-record retention requirement |
| Easily accessible portion | Entire prescribed retention period | SEC natural-person account-record retention requirement |
For an account subject to the SEC furnishing requirement, send the required account-record copy or permitted alternative within the maximum interval. It must invite the customer to mark corrections and report future changes. An internal verification attempt does not replace that copy.
The SEC provision contains a separate coverage exception tied to whether a suitability determination has been required during the preceding 36 months; do not assume every silent or inactive account remains covered.
Customer refusal or inability to provide updated information can excuse obtaining that information. It does not, by itself, waive a furnishing obligation that still applies. Keep the firm's record-delivery duty separate from the customer's response.
Keep the versions distinct. Under FINRA, old information remains for six years after replacement, while the final information remains for six years after closure. The new version does not simply expire six years after creation. The SEC-prescribed account record has a six-year clock from the earlier of closure or replacement and must remain easily accessible throughout its required period. Apply both requirements to the actual records.
Exam Tip: Gotchas
- Distinguish verification from retention. Replacement starts the six-year period for superseded information; closure starts it for final information under FINRA.
- Sending the required account-record copy and receiving corrections are separate events. Customer silence does not excuse the copy for an account that remains covered. An internal request or review alone is not a substitute.
Scope: What the Customer-Account-Information Rule Does Not Cover
The customer-account-information requirement captures firm-level account data: identity, contact, tax, employment, TCP. It does not capture suitability or recommendation profile data: investment objectives, risk tolerance, time horizon, liquidity needs.
Those data elements are required by the FINRA suitability requirement and Reg BI (Care Obligation), both addressed in the Recommendations and Disclosures unit. A firm that records a customer's name and TIN but never captures investment objectives violates the suitability / Reg BI framework, not the customer-account-information rule.
Exam Tip: Gotchas
- The customer-account-information rule = identity and contact; the suitability / Reg BI framework = investment profile. The exam will sometimes mix the two and ask which rule a missing risk-tolerance field violates. The answer is the suitability / Reg BI framework, not the customer-account-information rule.
What Should You Check on Exam Day?
- Do you know the firm must ask every non-institutional customer for a Trusted Contact Person, even though the customer may refuse to designate one?
- Can you state the Trusted Contact Person age floor of 18, and that the designation carries no trading authority?
- Can you distinguish the 36-month verification cycle from the 6-year retention period after an update or account closure?
- Do you know a custodial account under the Uniform Transfers to Minors Act records the minor's taxpayer identification number, not the custodian's?