Quick Answer
Broker-dealers must keep records for set periods (blotters, ledgers, and account records for 6 years; complaints for 4; confirmations and communications for 3), send confirmations by settlement and statements monthly or quarterly, honor privacy opt-outs under Regulation S-P, and only call between 8 AM and 9 PM in the customer's time zone. Lock in the exact numbers.
The whole compliance unit on one sheet: what firms keep, what they send, and the exact windows the exam loves to test.
Core Concepts
- Books and records: two SEC rules. One says which records to create (blotters, ledgers, account records); one says how long to retain them. FINRA default for any record with no set period is 6 years.
- Confirmations: the trade receipt, sent at or before completion of the transaction (settlement date). Must state firm capacity (agent = commission, principal = markup/markdown) and whether the trade was solicited or unsolicited.
- Communications: three categories by audience and count. Retail (more than 25 retail investors in 30 days) needs principal approval before first use; correspondence (25 or fewer) is firm-supervised; institutional needs no pre-use approval but must still be supervised. Same content standards apply to all three.
- Regulation Best Interest (Reg BI): SEC standard for broker-dealer recommendations to retail customers. Four obligations: Disclosure, Care, Conflict of Interest, Compliance. Higher bar than FINRA suitability.
- Regulation S-P: privacy framework for nonpublic personal information (NPI). Default is sharing ON; the customer must opt out to stop sharing with non-affiliated third parties.
- Customer Protection Rule: fully paid customer securities must be in the firm's possession or control; customer cash sits in a Special Reserve Bank Account for the exclusive benefit of customers. Never commingle.
- Business continuity plan (BCP): every member firm needs one, no small-firm exemption.
One-Liners That Win Points
- Confirmation goes out by settlement, not trade date. Order ticket marked solicited or unsolicited every time.
- Statements: monthly if there was activity, otherwise quarterly minimum. A price change is not activity.
- The magic communications number is 25, measured over a rolling 30-calendar-day window.
- Opt-out is opt-out, not opt-in, and it never expires. Sharing with affiliates needs no opt-out.
- Account numbers and access codes can never be shared for marketing, opt-out or not.
- Reg BI standard = best interest; FINRA suitability standard = suitable (lower). Know Your Customer (KYC) applies to every customer, even self-directed.
- SIPC (Securities Investor Protection Corporation) protects against firm failure, not market losses.
Numbers to Lock In
| Item | Value |
|---|---|
| Blotters, general ledger | 6 years |
| Customer account records | 6 years after account closure |
| Suspicious Activity Reports (SARs) | 5 years |
| Customer complaints | 4 years |
| Trade confirmations, communications | 3 years |
| Written supervisory procedures | 3 years after last use |
| Easily-accessible format | first 2 years of any retention period |
| Statement with activity | monthly |
| Statement, holdings but no activity | quarterly (minimum) |
| Retail communication threshold | more than 25 retail investors in 30 days |
| Options communications filing | 10 calendar days before first use |
| Telemarketing calling hours | 8:00 AM to 9:00 PM, customer's time zone |
| Do-not-call request honored within | 30 days (FINRA standard) |
| Existing business relationship exception | 18 months |
| Recent inquiry exception | 3 months |
| Regulation S-P breach notice | no later than 30 days after firm becomes aware |
| Mail hold default maximum | 3 months |
| Form CRS length | 2-4 pages |
| SIPC coverage | $500,000 per customer, $250,000 cash sublimit |
Memory Aids (verbatim)
- 6-5-4-3: the "big three" financial records (blotters, ledgers, accounts) get 6 years; SARs get 5; complaints get 4; communications and confirmations get 3.
- SIPC suitcase: the whole suitcase holds up to $500,000, but the cash pocket inside maxes out at $250,000 (exactly half).
Top Gotchas
- Customer complaints are 4 years, not 3 or 6. Standalone trap.
- The 2-year easily-accessible rule sits inside every longer period, not next to it.
- The 30-day communications window is cumulative: 13 retail investors on Day 1 plus 13 on Day 15 equals 26, so it is a retail communication.
- New firms file everything for their first year; established firms generally do not.
- Reg BI does not apply to institutional customers or unsolicited trades. An unsolicited trade triggers neither Reg BI nor suitability.
- Calling hours follow the customer's time zone, never the caller's.
- Firm-specific do-not-call requests last indefinitely; you cannot block caller ID.
- Mail hold needs written instructions; "for convenience" caps the hold at 3 months regardless of the request.
- The Special Reserve Bank Account is untouchable; commingling is always prohibited.
- BCP needs annual review plus updates on material change, approved by someone who is both senior management and a registered principal.
One-Breath Recap
Keep records 6-5-4-3, send confirmations by settlement and statements monthly-or-quarterly, get a principal to approve anything hitting more than 25 retail investors, respect the never-expiring Regulation S-P opt-out, call only 8-to-9 in the customer's time zone, and keep customer assets fully segregated. Nail the numbers and this compliance-heavy unit answers itself.
Need more than the recap? This is a condensed summary. If it is not enough, read the full Books, Records, Privacy and Communications unit for the complete lesson.