Quick Answer
A firm with market access must establish, document and maintain a system for regularly reviewing the effectiveness of its controls and promptly addressing any issues. It reviews its market access business activity no less frequently than annually, under written procedures, and documents that review. Its chief executive or an equivalent officer certifies compliance and that review annually.
Building the controls is not the end of the duty. The rule adds a standing review obligation, a dated annual review inside it, and a signature from the top of the firm.
What Must the Review System Do?
A firm subject to the general market access duty must establish, document, and maintain a system for regularly reviewing the effectiveness of the risk management controls and supervisory procedures the rule requires, and for promptly addressing any issues.
The scope reaches both layers: the general duty to build a reasonably designed system, and the specific financial and regulatory elements that system must include.
The same paragraph carries the supervision of an allocation. Where a firm has allocated control over specific regulatory controls to a registered broker-dealer customer, staff read this review requirement to make the allocating firm establish, document and maintain a system to regularly review that customer's performance under the written contract. The release adds the effectiveness of the allocated controls and procedures to what that system reviews.
That review must also promptly address any performance weaknesses, including terminating the allocation arrangement if warranted.
Exam Tip: Gotchas
- Regular review and prompt correction are two duties in one sentence. A firm that reviews on schedule but leaves the issues it finds unaddressed has met the review limb and failed the duty to promptly address any issues, so its system still falls short.
- The review system is where an allocation gets supervised. The allocating firm reviews the broker-dealer customer's performance under the contract and the effectiveness of the allocated controls, not only its own.
What Does the Annual Business-Activity Review Cover?
The annual review is introduced by the words "among other things", so it is one component of the regular review rather than the whole of it.
The firm must review, no less frequently than annually, the business activity of the firm in connection with market access, to assure the overall effectiveness of the risk management controls and supervisory procedures.
Two requirements attach to how it is done. The review shall be conducted in accordance with written procedures, and it shall be documented.
Both outputs are then preserved as part of the firm's books and records, in two different categories of the records retention rule.
| What is preserved | Retention treatment |
|---|---|
| The written procedures for the review | The compliance, supervisory and procedures manual category, kept in an easily accessible place until three years after the termination of the use of the manual |
| The documentation of each such review | Not less than three years, the first two years in an easily accessible place |
Annual is a floor, not the standard. The surrounding requirement is regular review of effectiveness with prompt correction, and a firm whose business changes mid-year cannot point to a calendar to excuse waiting.
Retention periods and the wider books and records framework are covered in the unit on creating, retaining and reporting required records of orders and transactions.
Exam Tip: Gotchas
- The two review outputs are preserved under different periods. The written procedures follow the manual category, while the documentation of each review follows the three-year category.
- "No less frequently than annually" sets a minimum. A firm that reviews exactly once a year has met the floor, not necessarily the regular-review requirement above it.
What Must the Chief Executive Officer or Equivalent Officer Certify?
The Chief Executive Officer (CEO), or equivalent officer, of the firm must, on an annual basis, certify two things.
- That the risk management controls and supervisory procedures comply with the rule's general duty and its required financial and regulatory elements
- That the firm conducted such review
Those certifications are preserved as part of the firm's books and records for not less than three years, the first two years in an easily accessible place.
Read the certification from the rule's own text. The adopting release carries both limbs and loosens only the first, saying the controls comply with the market access rule where the rule names its two paragraphs. The staff responses go further and state the compliance limb alone, so a question turning on the exact wording is asking for both limbs, not one.
Exam Tip: Gotchas
- The certification has two limbs, not one. Compliance of the controls is the first; that the firm conducted the review is a separate statement in the same sentence.
- An equivalent officer may sign. The rule names the Chief Executive Officer or equivalent officer, so a firm without that exact title is not excused and is not free to delegate downward.
What Should You Check on Exam Day?
- Confirm the review system is established, documented and maintained, and that it promptly addresses the issues it surfaces.
- Treat the annual business-activity review as a floor inside a broader regular-review duty, not as the whole obligation.
- Check the review was conducted under written procedures and documented, since both are required.
- Confirm the certification covers both the controls' compliance and the fact that the review was conducted.
- Look for the Chief Executive Officer or an equivalent officer as the signer, on an annual basis.