60 Series 26 Exam Concepts You Need to Know Before Test Day

The Form U4 opens and maintains a person's registration in CRD; the Form U5 closes it. When a candidate joins, the member files the U4 through CRD, and registration attaches once the person passes the required exam and the filing is complete. Material changes must be amended on the U4 within 30 days of the member learning the facts — a new customer complaint, disciplinary event, criminal charge, or financial event such as a bankruptcy. When the person leaves, the firm files a U5 within 30 days of termination, stating the reason. Only the terminating firm files and amends the U5; a departing associated person who disputes the language may add a written comment but cannot delete the firm's statement.

Memory hook:U4 opens and amends; U5 closes. Thirty days from knowledge, not occurrence.

A person convicted of any felony, or of a misdemeanor involving the purchase or sale of securities, fraud, false statements, bribery, or similar misconduct, or subject to certain SEC or judicial orders, is statutorily disqualified under Exchange Act Section 3(a)(39). A member may not permit that person to associate with the firm unless the SEC grants relief. When a member proposes to admit or continue such a person, the SRO files a notice with the SEC under Section 19h-1, and the SEC may approve, disapprove, or impose conditions. The firm typically must also submit a continuance in membership application and often pairs the arrangement with heightened supervision. The disqualification attaches automatically from the triggering event; nothing short of SEC relief cures it.

Memory hook:Any felony or covered misdemeanor slams the door; only the SEC holds the key.

When a firm associates a person subject to disqualification, FINRA Rule 3110(e) requires the member to adopt and implement written heightened supervisory procedures for that person. The procedures must be in place before the person begins activity, must be tailored to the specific misconduct, and must designate a supervisor responsible for enforcing them. Typical controls include on-site supervision, co-signing of new account forms and correspondence, restricted product lines, and documented periodic reviews. The firm must keep records showing the procedures were actually followed, not merely written. A principal reviewing this area should be able to point to the plan, the named supervisor, and evidence of each required review.

Memory hook:Disqualified rep means a written plan, a named supervisor, and proof it was followed.

What a person may do depends on the registration category, not the job title. A Series 6 representative can offer and sell investment company shares and variable contracts, nothing else; a Series 7 representative covers the full range of securities; a Series 26 principal supervises investment company and variable contracts activity. Non-registered associated persons may perform clerical or ministerial functions — processing paperwork, answering phones, entering orders without exercising judgment — but they cannot solicit customers, make recommendations, or accept orders. Certain exempt persons under Rule 1230, such as those whose functions are solely clerical, fall outside registration entirely. The principal's job is to match each person's actual duties against the boundary of their registration.

Memory hook:Series 6 sells funds and variable contracts only; no registration means no soliciting.

A broker-dealer effects transactions in securities and registers under Exchange Act Section 15(b); an investment adviser is paid to advise about securities and registers under Advisers Act Section 203. The compensation pattern is the tell: commissions, markups, and sales loads point to broker-dealer status, while an ongoing fee for advice points to adviser status. Under Section 202(a)(11), a broker-dealer that receives special compensation for investment advice is treated as an adviser for that activity. Many firms are dual registrants, which means the principal must keep the two hats straight — the same rep may owe a customer brokerage obligations on one trade and advisory duties on the same account.

Memory hook:Broker-dealer sells, adviser tells; commissions versus fees decides who registers where.

SEA Rule 17f-2 requires fingerprinting of a broker-dealer's officers, partners, directors, and employees who have access to securities or customer funds, or supervisory authority over anyone who does, along with registered persons. Fingerprints are submitted through the FBI system, and while results are pending, the person is deemed registered or approved for a limited period. Exemptions exist for persons whose functions are solely clerical or ministerial and for certain employees of banks and other financial institutions. Under Rule 17f-2(d), the firm must maintain records showing who was checked, when, and the disposition of results. A principal should be able to reconcile the firm's roster against its fingerprint file.

Memory hook:Touch the money or supervise someone who does — get fingerprinted; pure clerical staff skip it.

FINRA Rule 1240 splits continuing education into two pieces. The Regulatory Element is FINRA-administered online training that each registered person must complete on the schedule FINRA assigns; miss the deadline and the person's registration becomes inactive, which bars all registered activity until it is finished. The Firm Element is training the firm itself designs after conducting a needs analysis, covering topics like product knowledge, ethics, and regulatory developments, delivered at least annually. The principal's practical role is tracking: knowing who has a pending Regulatory Element, verifying Firm Element completion, and understanding that inactivity from missed CE is automatic, not discretionary.

Memory hook:Regulatory Element is FINRA's test; Firm Element is your training. Miss FINRA's, go inactive.

FINRA Rule 3110.04 requires each member to hold at least one compliance meeting in every calendar year. Registered persons must attend, and the meeting must cover topics relevant to the firm's business and applicable regulatory obligations — new rules, sales practice concerns, ethics, and firm procedures are all fair material. The firm must document the meeting: when it was held, who attended, and what was covered. Attendance can be in person or by electronic means the firm can verify. A principal should treat the record as the compliance deliverable; an undocumented meeting is treated as a meeting that did not happen when an examiner asks for proof.

Memory hook:One compliance meeting every calendar year — hold it, cover the rules, write down who came.

FINRA Rule 8312 governs BrokerCheck, the public reporting system that lets anyone pull a report on a member firm or registered person, including disclosures, complaints, and terminations. Members must disclose BrokerCheck's availability and provide the report when a customer requests it. Separately, Rule 1122 makes it a violation to file false or misleading information on any Uniform Form — U4, U5, BD, or BDW — or in any CRD filing. The member firm bears responsibility for accuracy of what it files, and a rep's false answers on the U4 become the firm's problem if it knew or should have known. Accurate filings are a supervisory obligation, not a clerical chore.

Memory hook:BrokerCheck shows the public record; Rule 1122 makes the firm own every filing's accuracy.

Rule 3110(a) requires every member to establish and maintain a system of supervisory policies and procedures reasonably designed to achieve compliance with applicable rules. Rule 3110(b) adds the written layer: written supervisory procedures tailored to the firm's actual business, designating each supervisor, assigning their responsibilities, and describing how customer accounts, trading, correspondence, and registered persons' outside activities will be reviewed. The key phrase is reasonably designed — the system need not guarantee that no violation ever occurs, but it must fit the firm's products, size, and structure. Generic off-the-shelf manuals fail because they do not map to what the firm actually does. The principal is the person who makes the map real.

Memory hook:Rule 3110(a) is the system; 3110(b) is the written version; both must fit the firm.

Rule 3110(d) requires a member to review its securities transactions to detect and prevent insider trading, trading ahead of research, and other violations, using current reports and exception reports rather than hindsight. Rule 3110.12 defines what makes that review reasonable: the firm must identify red flags in the reports it uses, investigate the anomalies, escalate what cannot be explained, and document both the review and the follow-up. The standard is process, not omniscience — a firm is not expected to catch everything, but it is expected to chase what its own tools flag. Ignoring an exception report that shows a rep concentrating in a stock ahead of a customer block order is the classic failure.

Memory hook:See the flag, chase the flag, write down the chase — that is Rule 3110.12's reasonable review.

Rule 5270 bars a member from trading for its own account, or for certain related accounts, while it possesses nonpublic market information about a customer's pending block order, unless an exception applies. The concern is that the member could profit from knowledge of the price pressure the block will create. The exceptions are narrow and enumerated — for example, transactions that are bona fide hedging, or orders the member shows are independent of the block information. The burden is on the member to show the exception is genuine. For a Series 26 firm, the practical exposure is the trading desk or a principal's personal account acting on knowledge of a large fund order.

Memory hook:Know about the block, stay out of the market — Rule 5270.

Four rules divide the personal-trading territory. Rule 3210 requires an associated person who opens a securities account at another broker-dealer or financial institution to notify the employer and have duplicate statements sent. Rule 3240 generally prohibits borrowing from or lending to a customer unless the arrangement fits defined conditions, such as with immediate family or under a regulated lending relationship. Rule 3270 requires written notice of outside business activities before they begin. Rule 3280 covers private securities transactions: written notice to the firm always, and written approval plus compensation disclosure if the person is paid. The principal's job is matching each situation to the right rule and its trigger.

Memory hook:3210 duplicates; 3240 no borrowing; 3270 notify; 3280 notice and maybe approval.

Rule 2060 addresses information a member acquires in a fiduciary capacity — for example, while serving as trustee, executor, or guardian for a customer. The member may not use that information to solicit the customer's business for the firm or for personal benefit, and may not induce the customer to move assets, unless the person entitled to consent agrees. The restriction follows the source of the information: because it was entrusted for the customer's benefit, not the firm's, it cannot be repurposed. A principal supervising trust or estate relationships should confirm that reps working with fiduciary accounts are not mining them for sales leads.

Memory hook:Learned it as a fiduciary, cannot use it as a salesman.

Rule 2210 sorts communications by audience. A retail communication goes or is made available to more than 25 retail investors within any 30-day period. Correspondence goes to 25 or fewer retail investors in that same window. Institutional communications go to institutions — banks, insurance companies, registered investment companies, and similar qualified buyers — regardless of count. The classification drives the obligations: retail communications face principal review and, for some categories, FINRA filing; institutional communications need only a reasonable basis to believe the recipient is qualified; correspondence is supervised under the firm's review procedures rather than pre-approved. The principal's first move on any piece is counting recipients and checking their status.

Memory hook:More than twenty-five retail investors in thirty days is retail communication; twenty-five or fewer is correspondence.

Rule 2211 sets content and review standards for communications about variable life insurance and variable annuities. A registered principal must review and approve the material before use, and it must not be misleading. The communication must disclose the product's charges, surrender provisions, and tax consequences where relevant. If performance is shown, it must reflect both maximum and current charges, so the illustration is not dressed up with unrealistic fee assumptions. Filing obligations attach to certain retail communications: those containing performance or rankings must be filed with FINRA at least 10 business days before first use, while others generally must be filed within 10 business days of first use. The principal's pre-approval does not replace the filing requirement — both apply.

Memory hook:Variable product ads: principal first, always; performance or rankings means FINRA gets it ten days early.

Rule 2212 governs how a member may use mutual fund rankings in retail communications. The ranking must be based on total return, not some flattering subset of the data. The communication must identify the fund, the period the ranking covers, the source of the ranking, and the category or peer group in which the fund was ranked. If the ranking covers a period of one year or more, the ad must include rankings for all applicable standardized periods — you cannot cherry-pick the one strong year. The point of the rule is comparability: the prospect should be able to see the full context, not a curated highlight.

Memory hook:Rankings ride on total return; disclose name, period, source, and category — no cherry-picking.

Rule 482 is the SEC's safe harbor that lets an investment company advertise without delivering a prospectus, provided the content meets the rule's conditions — for example, performance presentations must be consistent, fees disclosed, and the material accompanied by required disclosures. It satisfies Section 10 of the Securities Act for that purpose. Rule 156 works the other direction: it lists factors that make investment company sales literature misleading, such as performance projections, incomplete disclosure of charges, or claims a reasonable investor would misread. A principal should run every fund advertisement through both — does it qualify under 482, and does anything in it trip the 156 factors?

Memory hook:Rule 482 lets funds advertise; Rule 156 keeps the advertising honest.

Telemarketing sits at the intersection of FINRA Rule 3230 and the federal Telemarketing Sales Rule. Firms must maintain a company-specific do-not-call list, honor the National Do Not Call Registry, and scrub calling lists against both. Solicitation calls are limited to between 8 a.m. and 9 p.m. at the called person's local time, callers must identify themselves and the firm, and caller ID information must be transmitted. An established business relationship with a customer provides a limited exemption from the registry rules, but a person who has asked not to be called stays off-limits. Written records of the list, the requests, and the training must be kept.

Memory hook:Eight to nine local time; check both lists before you dial.

Under Rule 2210, a public appearance is an unscripted, live interaction with an audience — a seminar, an investor forum, a radio or television interview. The appearance itself does not require principal pre-approval, but the speaker must still follow the rule's content standards, and the firm supervises what is said. The trap is the handout: slides, scripts, and written materials distributed at a seminar are retail communications that do require principal approval before use. On designations, a rep may use a legitimately earned and accredited credential such as CFP or CFA, but titles implying special expertise with seniors or retirees are prohibited unless they meet accreditation standards.

Memory hook:Speak freely at the podium; every handout still needs the principal's signature first.

Rule 2111 stacks three separate obligations on every recommendation. Reasonable-basis means the firm and the rep must understand the product well enough to conclude it could suit at least some investors; you cannot recommend what you have not investigated. Customer-specific means the profile facts you gathered must support the conclusion that this product fits this customer. Quantitative targets a series of trades whose costs are excessive relative to the customer's resources, such as churning or mutual fund switching. For recommendations to hold, the rule treats the hold as a recommendation for reasonable-basis and customer-specific purposes only; the quantitative obligation does not apply, and the customer must actually be holding the security.

Memory hook:Reasonable-basis fits the product, customer-specific fits the person, quantitative fits the pattern; holds skip the pattern test.

Regulation Best Interest, adopted under Exchange Act Section 15l, imposes four component obligations on a broker-dealer recommending a securities transaction or account strategy to a retail customer: disclosure, care, conflict of interest, and compliance. The care obligation folds in the familiar suitability concepts, including reasonable-basis, customer-specific, and quantitative care, plus a cost consideration. Form CRS, the relationship summary, is filed with the SEC and delivered to retail customers at or before the earliest of a recommendation of an account type or a rollover, placing an order, or opening a new account. When the summary is materially changed, the firm must deliver an updated version within 60 days.

Memory hook:Four Reg BI obligations: Disclose, Care, Conflicts, Comply; Form CRS arrives at the earliest trigger.

For mutual fund purchases, the prospectus must be delivered on or before completion of the transaction, which in practice means it accompanies or precedes the confirmation; a follow-up delivery after settlement is too late. The statement of additional information, the SAI, is not automatically sent. It is available to any investor on request, free of charge, and the prospectus must say so. Shareholder reports follow a fixed rhythm: the annual report goes out within 60 days after the fund's fiscal year end, and the semiannual report within 60 days after the mid-year period end. These documents are the backbone of ongoing disclosure, so principals should verify delivery logs, not assume compliance.

Memory hook:Prospectus with the trade, SAI on request, shareholder reports within 60 days of each period end.

Rule 2330 gives principals a hands-on role in every deferred variable annuity transaction. A registered principal must review and approve the transaction before the application is submitted to the insurer; where state law forces submission first, approval must occur no later than seven business days after submission. Exchanges of existing annuities get specific principal approval, supported by disclosure of the comparative costs and consequences. The rule applies a two-part suitability standard, reasonable-basis and customer-specific, without the quantitative component. Principals also carry a supervisor training obligation and must document the basis for approving each transaction, so the file must show analysis, not just a signature.

Memory hook:2330: approve before submission, or seven business days after; exchanges get their own approval.

Rule 2090 and Rule 2111 answer different questions. Know Your Customer requires the firm to use reasonable diligence to know the essential facts about every customer, enough to service the account and act on any authority the customer grants. It applies whether or not a recommendation is ever made. Suitability, by contrast, is triggered only when there is a recommendation; no recommendation, no suitability obligation. The two rules share raw material, though: the profile data you collect. That data must stay current. Customer account records must be updated no less frequently than every 36 months, and firms should refresh essential facts promptly when circumstances change materially rather than waiting out the cycle.

Memory hook:KYC is always on; suitability needs a recommendation; refresh records at least every 36 months.

Rule 3260 governs when a rep may trade without the customer's specific go-ahead. Full discretion, deciding what to buy or sell and whether to trade at all, requires written authorization from the customer and written acceptance by the firm, and only registered persons may exercise it. Exchange Act Rule 15c1-7 draws the boundary: discretion limited to price and timing does not make an account discretionary, so no written authorization is needed, but the customer must be promptly informed of the transaction. Discretionary accounts also demand heightened supervisory attention, including review of the trading activity for suitability and patterns, since the customer is not approving each trade.

Memory hook:Price and time, no written line; what and whether, write it down.

Rule 3220 caps what associated persons may give to, or receive from, employees of other firms: no more than 100 dollars in gifts per person per year. The limit is per giver per recipient, so a firm with several reps cannot each stack 100 dollars onto the same bank employee. The rule reaches gifts in any form, including things converted into gifts, like event tickets the recipient does not attend. Business entertainment is treated separately: ordinary and customary entertainment, such as a working meal or a sporting event the giver attends, is not counted against the 100 dollars, provided it is not so frequent or lavish that it raises questions about the recipient's objectivity.

Memory hook:One hundred dollars per person per year; entertainment must be shared to be exempt.

Rules 2341 and 2320(g) police non-cash compensation tied to investment company and variable product sales. The baseline limit is 500 dollars of non-cash compensation per associated person per year from a single provider, plus one training and educational meeting per person per year. Meeting expense reimbursement is confined to transportation, hotel, meals, and meeting materials; entertainment and guest expenses are out. Sales contests are permitted only when the basis is total production of the relevant product category, not sales of a specific fund, a specific fund family, or a specific product. The point is to prevent a manufacturer from steering reps toward one product with goodies.

Memory hook:Five hundred dollars, one meeting, no entertainment; contests score total production only.

Rule 2040 bars member firms from paying compensation to unregistered persons for activities that require registration. Two doors stay open. First, payments for clerical or ministerial functions, work that is administrative and involves no selling, soliciting, or securities judgment. Second, referral fees may go to persons who are not subject to FINRA registration and whose involvement stops at referring a prospective customer, with no participation in the sale. The compensation test is critical: a permissible referral fee cannot be conditioned on whether the referral results in a sale or scaled to the size of the resulting business. Tie the fee to outcomes and you have crossed into paying for securities activity.

Memory hook:Ministerial is fine; referral fees must ignore whether the sale ever happens.

Rule 3160 lets a member sell securities on the premises of a bank or other financial institution, but only within conditions. The arrangement is permissible if the financial institution is itself a registered broker-dealer, or if the associated person conducting the securities business is registered with the member, or if the arrangement stays limited to referrals. Bank employees who merely refer customers to the member's registered persons may be compensated, but their compensation cannot be transaction-based; flat referral fees are the safe structure. Any bank employee who solicits or effects securities transactions must be registered with the member. The principal's job is confirming the arrangement and the compensation structure both fit.

Memory hook:Networking works three ways: registered bank, registered person, or referrals only; referral pay stays flat.

Rule 3270 requires a registered person to provide written notice to the firm before engaging in any outside business activity for compensation, and the firm may impose conditions or prohibit it outright. Rule 3280 covers selling away: before participating in a private securities transaction outside the firm, an associated person must give written notice and, if the person will receive compensation, obtain the firm's written approval. Once approved with compensation, the person is treated as if engaged in the securities business, and the transaction falls under the firm's supervision. Where no compensation is involved, such as gifting securities to a family member, notice is still required but approval is not.

Memory hook:Outside business: notice first. Selling away with pay: notice plus written approval; no pay, notice only.

Rule 10b5-1 supplies the trading test: a person trades on the basis of material nonpublic information when aware of it, and pre-existing trading plans adopted before awareness can serve as an affirmative defense. Rule 10b5-2 extends liability to misappropriation by defining duties of trust or confidence, covering family members, professionals under confidentiality obligations, and parties to confidentiality agreements. Exchange Act Section 20A creates civil liability to contemporaneous traders who bought or sold the same security, while Section 21A authorizes civil penalties for the violator up to three times the profit gained or loss avoided. Together they give both a liability hook and a penalty multiplier.

Memory hook:10b5-1 trades on awareness, 10b5-2 defines who owes trust; 20A pays contemporaries, 21A triples the profit.

Section 15(f) pushes insider trading prevention onto the firm itself. Every registered broker-dealer must establish, maintain, and enforce written policies and procedures reasonably designed to prevent the misuse of material nonpublic information, taking into account the nature of its business, whether it is an insider, and whether it regularly receives inside information from issuers or others. The firm must hold such information in confidence and reasonably supervise its associated persons. In practice this translates into information barriers, watch lists and restricted lists, preclearance for employee trades, and documented review of trading in securities on the lists. A principal should be able to show the controls operate, not just exist on paper.

Memory hook:15(f) makes the firm the gatekeeper: written policies, watch lists, barriers, supervision.

The 8000 series governs investigations: FINRA can inspect books and records, require the production of documents and information, and take sworn written testimony, and members and associated persons must cooperate. When investigation ripens into a charge, the 9000 series Code of Procedure takes over. The Department of Enforcement files a complaint; the respondent files an answer; the matter is heard by a hearing panel, which issues a decision. Rule 9300 provides the appeal path to the National Adjudicatory Council, and from there a respondent may seek SEC review. Rule 9600 covers procedures for exemptions from various rules, a separate door that is easy to overlook.

Memory hook:8000 investigates, 9000 prosecutes: complaint, answer, panel, NAC, then SEC.

Leaving a firm does not close the book. Under the FINRA By-Laws, Article IV Section 6 for members and Article V Section 4 for associated persons, FINRA retains jurisdiction over a member or associated person for up to two years after termination of membership or association, for conduct that occurred while the person was associated. The two-year clock runs from termination, which is why resignations never outrun discipline for in-house violations. Rule 5240 supplies the shield side: no member or person may intimidate, threaten, or coerce, or attempt to, anyone who provides information to FINRA, the SEC, or another regulator. Retaliation against a witness is itself a violation.

Memory hook:Two years of jurisdiction after you leave; never touch the witness under Rule 5240.

Section 37 of the Investment Company Act criminalizes theft from a fund itself. Any officer, director, employee, investment adviser, depositor, underwriter, or transfer agent of a registered investment company who embezzles, steals, abstracts, purloins, willfully misapplies, or converts any moneys, funds, securities, or property of the company faces a misdemeanor, punishable on conviction by a fine of up to 10,000 dollars, imprisonment for up to five years, or both. The provision covers the whole chain of people with hands on fund assets. When a principal discovers or suspects such conduct, escalation is mandatory: prompt internal reporting up the supervisory line and required regulatory reporting, never quiet handling.

Memory hook:Section 37: anyone touching fund assets who steals faces 10,000 dollars and five years; escalate, never bury it.

Rule 4512 sets the contents of the customer account record: the customer's name, address, and taxpayer identification number, year of birth, employment status and occupation, financial data such as annual income and estimated net worth, investment objectives, and the signature of the registered representative, along with principal approval of the account. The record is not a one-time form. Exchange Act recordkeeping rules require the firm to update the essential facts no less frequently than every 36 months, and sound practice refreshes sooner when circumstances change materially. The principal's review confirms the record is complete at opening and still accurate years later, because stale data undermines both KYC and suitability.

Memory hook:Open it fully under 4512, then refresh the essentials at least every 36 months.

In a cash account the customer pays in full; no credit is extended. Regulation T sets the payment period, requiring payment within five business days after the trade date. If a customer legitimately needs more time, the firm must request an extension from its designated examining authority before the period expires, not after. When payment still does not arrive, the account is frozen for 90 days, during which the customer must pay for any new purchases in full before or on the day of the trade. Mutual funds carry their own clock under Rule 2341: payment within three business days after trade date, unless the customer is selling other securities to fund the purchase.

Memory hook:Five days Reg T, three days funds, extension before it lapses, freeze lasts ninety.

Account transfers run on a fixed ACATS schedule. The receiving firm submits the transfer instruction form, and the delivering firm must validate or reject it within one business day. Once validated, the transfer must be completed within three business days after validation, meaning the whole move ordinarily wraps inside about four business days. Rule 2140 polices the employment-dispute angle: a member may not use promissory notes, training-repayment agreements, or any other restriction to interfere with a customer's decision to transfer an account to another firm. The customer's right to move belongs to the customer, and the firm's remedies against a departing rep are separate.

Memory hook:Validate in one, finish in three; never hold the customer hostage in a rep dispute.

Every transaction in a customer account generates a confirmation, governed by FINRA Rule 2232 and Exchange Act Rule 10b-10. The required content lets the customer audit the trade: the security's name and description, the trade date, the number of shares or units, the price, the settlement date, and the firm's capacity, meaning whether it acted as agent or as principal. In an agency trade the commission is disclosed; in a principal trade the confirmation shows that the firm sold to or bought from the customer. Delivery must occur at or before completion of the transaction, so the confirmation accompanies settlement rather than trailing it by days.

Memory hook:Confirmations show capacity, price, commission, dates, and arrive by completion, never after.

Rule 2231 requires the firm to send account statements to customers at least quarterly, but only when there was activity in the account during that period. Rule 4515 covers the other side of account maintenance: whenever the name or designation on an account changes, adding a TOD beneficiary, retitling after a divorce, moving assets into a trust, or transferring between internal accounts, the firm must approve and document the change. The record shows who authorized it, when, and the supporting basis. Under SEC Rule 17a-3(a)(17), customer account records must also be updated within 30 days when account information changes. Together these rules keep customers informed and create a paper trail that deters unauthorized retitling of assets.

Memory hook:2231 tells the customer quarterly; 4515 proves who approved the name change.

Regulation S-P drives two separate duties. First, notice: the firm delivers an initial privacy notice at account opening and annually thereafter, and it must give customers a reasonable opportunity to opt out before sharing nonpublic personal information with nonaffiliated third parties. Second, safeguards: the firm needs a written program designed to protect customer records and information, with employee training, risk assessment, and testing of controls. FINRA Rule 3150 handles mail holds. Mail may be held only at the customer's request, for an initial period of up to two months, extendable in two-month increments up to a total of six months. The customer can also direct mail to a third-party address. The exam wants you to separate the privacy notice rules from the safeguarding program and the mail-hold mechanics.

Memory hook:Mail holds: two months on request, six months max. Privacy: notice at start, then yearly.

FINRA Rule 3310 requires every member to maintain a written anti-money laundering program reasonably designed to achieve and monitor compliance with the Bank Secrecy Act. The program has four working parts: it must be approved in writing by senior management, it must designate a qualified AML compliance officer, it must be tested for adequacy at least annually on an independent basis, and it must include ongoing employee training. PATRIOT Act Section 352 imposes essentially the same requirements on financial institutions generally, so the rule and the statute reinforce each other. The program must also be tailored to the firm's actual business. A firm selling mutual funds and variable products faces different risks, such as third-party wire activity, than a firm trading equities.

Memory hook:AML program: written, approved up top, independent test, trained staff.

Section 326 requires a written Customer Identification Program in place before accounts are opened. At account opening, the firm must collect four identifying elements: name, date of birth, address, and an identification number such as a taxpayer ID or Social Security number. Verification comes next, within a reasonable time, using documentary methods like a driver's license or non-documentary methods such as credit database checks. The firm must also check the information against government lists, give customers notice that their information is being collected to verify identity, and keep records: identifying information is retained five years after the account closes, and descriptions of verification documents for five years after the record is made. If verification fails, the account should not be opened, and suspicious attempts feed the SAR process.

Memory hook:CIP collects name, birthdate, address, ID number; then verify, list-check, notice, keep.

These two reports are easy to cross on the exam, so anchor the numbers. A Currency Transaction Report goes to FinCEN when currency transactions total more than $10,000 in a single business day, including related transactions that the firm knows or should know are connected, and it must be filed within 15 days. A Suspicious Activity Report applies when a broker-dealer knows or suspects a transaction of at least $5,000 involves funds from illegal activity, is designed to evade BSA rules, or has no apparent lawful purpose. SARs are filed within 30 days, extended to 60 days if no suspect has been identified. Confidentiality is absolute on the SAR side: the firm cannot tell the customer a SAR was filed, and a copy is retained for five years. Structuring transactions to stay under $10,000 is itself suspicious and reportable.

Memory hook:Ten thousand cash in 15 days; five thousand suspicious in 30; never tell the customer.

OFAC operates on a different logic than the rest of the AML framework. There is no minimum transaction size and no suspicious-activity threshold; the Specially Designated Nationals list applies to any dealing with a listed person, entity, or their property interests. Screening must cover new customers and ongoing transactions, and the standard is strict liability, meaning a firm cannot defend a violation by showing it tried reasonably hard. When a match is confirmed, the transaction is blocked: the assets are frozen and placed in a blocked account, not turned over to anyone, and blocked property must be reported to OFAC within 10 business days. Rejected transactions, where no blockable interest exists, must still be documented. Penalties are severe and per-violation, which is why screening is automated and repeated at onboarding and settlement.

Memory hook:OFAC has no dollar floor and no oops defense; screen everyone, block and report.

Regulation S-ID requires financial institutions and creditors that offer covered accounts to maintain a written identity theft prevention program. The program must identify relevant red flags, such as alerts from consumer reports, suspicious documents, or account takeover patterns; detect those red flags in day-to-day operations; respond appropriately to prevent and mitigate identity theft; and be updated periodically with board or designated senior approval. PATRIOT Act Section 314 is a different animal. Under 314(a), FinCEN periodically circulates lists of persons or entities that may be involved in money laundering or terrorist activity, and firms must search their records and respond promptly when they find a match. Under 314(b), sharing identity and transaction information with other financial institutions to spot suspicious activity is permitted but voluntary.

Memory hook:314(a) you must search; 314(b) you may share.

Rule 3120 sits on top of Rule 3110. Having written supervisory procedures is not enough; the firm must also maintain a supervisory control system that tests those procedures for adequacy. Testing occurs at least annually for each applicable category of the firm's business, with the frequency and scope shaped by the size and nature of that business, and it must be performed by qualified personnel. The results then flow upward: at least annually, the firm must provide a written report to senior management summarizing the test results, any material changes or amendments made to the supervisory procedures, and a summary of customer complaints received. Senior management must review and date the report, and it is preserved under the firm's books and records rules. This is the feedback loop that turns a static manual into a functioning system.

Memory hook:3120: test yearly, report yearly; results, revisions, complaints go up top.

Rule 3130 puts a name on compliance accountability. Once each calendar year, the firm's CEO must certify that the member has in place processes to establish, maintain, review, test, and modify written compliance policies and written supervisory procedures, and processes to enforce and communicate them to associated persons. If the firm has no CEO, the most senior officer with a similar role signs. The certification must be based on the certifying officer's own review; it cannot simply be delegated to a subordinate or rubber-stamped. Note what is and is not certified: the officer certifies that processes exist, not that no violations occurred during the year. The annual compliance meeting required by Rule 3110.04 is a supporting practice, but it does not substitute for the certification, and the certification is retained under the firm's recordkeeping rules.

Memory hook:3130: the top officer certifies the process, not perfection.

Rule 3110(c) sets the inspection clock. Offices where supervisory activities occur, such as OSJs, must be inspected at least annually. Offices with no supervisory activity follow the general presumption in Rule 3110.13: inspection at least every three years, with the schedule adjusted based on risk factors like customer complaints, personnel changes, or new business at the location. Inspector eligibility is the second half. The person who exclusively performs, or is directly or indirectly responsible for, supervisory activities at a location cannot conduct that location's inspection; self-inspection defeats the purpose. Rule 3110.14 carves out a narrow exception, allowing a firm with only one office location to have its sole supervisory person conduct the inspection. Every inspection must be documented in supervisory files.

Memory hook:Supervision on site? Inspect yearly. No supervisor? Three years. Never inspect your own desk.

Classification drives everything downstream: registration, inspection frequency, and signage. An office of supervisory jurisdiction is any location where one or more associated persons conduct supervisory functions. A branch office is a location that is identified to the public as an office of the member and where one or more associated persons conduct business, including certain home offices that meet the definition. A non-branch location is one not identified to the public, such as an administrative back office or a home office used with limited customer contact. Branch offices are registered through Form BR. On signage, a branch must display a sign identifying the member firm that is visible and legible from the public area, and the firm must never use FINRA in its name or signage in a way that suggests FINRA endorsement or membership in FINRA itself.

Memory hook:If customers know it is an office, it is a branch; sign the firm name, never FINRA.

Correspondence gets a different supervisory treatment than retail communications. Rule 3110.06 requires review of correspondence and internal communications on a risk-based basis, consistent with the firm's supervisory system and written procedures, rather than mandatory pre-approval of every item. Rule 3110.07 requires evidence of that review, which can be a signature or initials, manual or electronic, or another documented system showing when and by whom review occurred. Rule 3110.08 permits delegation: the firm may assign review functions to a registered person who is not a principal, provided that person is qualified and appropriately trained, and the delegation does not relieve the principal of ultimate responsibility. Rule 3110.09 sets retention of correspondence and internal communications at three years. Retail communications remain a separate standard requiring principal approval before use under Rule 2210.

Memory hook:Correspondence: review by risk, prove it, delegate it, keep it three years.

Rule 4370 requires every member to maintain a business continuity plan reasonably designed to permit the firm to meet its obligations to customers in an emergency or significant business disruption. The plan must address, at minimum: data backup and recovery; all mission critical systems; financial and operational assessments; alternate physical locations of employees and communication capabilities; communications with customers, employees, regulators, and media; regulatory reporting; and how the member will assure customers' prompt access to funds and securities in the member's possession. The plan must be reviewed annually and updated where necessary, and the firm must provide FINRA with emergency contact information, updating it promptly when personnel or details change. The plan is scaled to the firm's size and business, so a small mutual fund distributor's plan will look different from a clearing firm's.

Memory hook:4370: back up data, relocate, tell everyone, get customers their money; review yearly.

The SEC framework splits the job. Rule 17a-3 tells you which records to make: customer account information, blotters, order tickets, confirmations, and complaint records, with customer account records updated within 30 days when information changes. Rule 17a-4 tells you how long to keep them: most records for six years, the first two in an easily accessible place, while certain records such as correspondence run three years. FINRA Rule 4510 incorporates these requirements for members. Electronic storage is permitted, but the medium must preserve records in a non-rewriteable, non-erasable format, commonly called WORM, or use an audit-trail system that prevents alteration. The firm also needs an index of stored records and, under 17a-4(d), an undertaking from a third party to provide access if the firm fails to.

Memory hook:17a-3 writes it, 17a-4 keeps it: six years, first two handy, WORM or audit trail.

A breakpoint sale is the practice of selling investment company shares in a dollar amount just below a point at which the sales charge is reduced, so the customer pays a higher sales charge than necessary. Rule 2342 does not merely prohibit the practice; it imposes affirmative supervisory duties. The firm must establish, maintain, and enforce written procedures reasonably designed to detect and prevent breakpoint sales, which in practice means exception reporting on transactions that fall just under a breakpoint and principal follow-up on any pattern. Firms must also make breakpoint schedules available to customers and disclose the tools that let customers reach breakpoints: rights of accumulation, which aggregate existing holdings, and letters of intent, which commit to a future purchase level. A rep who ignores a customer's existing fund family holdings to charge a full load is the classic fact pattern.

Memory hook:Just under the breakpoint, the sales charge jumps, and so does FINRA's interest.

Complaints travel on two tracks. Internally, Rule 4513 requires the firm to keep records of written customer complaints. Externally, Rule 4530.08 requires reporting complaints to FINRA, with complaints alleging sales practice violations reported on a quarterly cycle. On the front end, Rule 2268 governs predispute arbitration agreements: the customer must receive disclosures explaining that arbitration is final and binding, that it waives court and jury rights, and that signing is not required to open the account. The agreement cannot be forced as a condition of doing business. On the back end, expungement under Rule 2080 is deliberately narrow. It requires an arbitration award or court order confirming one, review by FINRA in executive session, notice to the customer who filed the complaint, and grounds limited to the claim being factually impossible or clearly erroneous, or the wrong person being named.

Memory hook:Log it and report it quarterly; arbitration is optional to sign; expungement is a narrow door.

Net capital is the firm's financial cushion, and SEC Rule 15c3-1 sets the floor two ways. The basic test requires net capital to equal at least 15 percent of aggregate indebtedness, meaning the ratio of debt to net capital cannot exceed roughly 6.67 to 1. Firms that do not carry or hold customer funds can use an alternative computation with a lower percentage of aggregate indebtedness. Dollar minimums vary with the firm's business, and FINRA Rule 4110 imposes its own capital compliance floor for members. The notification mechanics matter most on the exam. Under Rule 17a-11, the firm must notify the SEC and FINRA within 24 hours if net capital falls below the minimum, which also triggers a business curtailment, and an early warning notice is required when net capital drops below 120 percent of the minimum. Rule 4120 governs the resulting curtailment of business.

Memory hook:Net capital equals 15 percent of aggregate debt; below 120 percent warn, below 100 percent stop.

SIPC protects customers when a broker-dealer fails, not when investments lose value. Coverage runs up to $500,000 per customer in each separate legal capacity, of which no more than $250,000 can cover claims for cash balances. Anything above those limits becomes a general creditor claim against the failed firm's estate. Disclosure duties follow: FINRA Rule 2266 requires a statement of SIPC membership on customer confirmations and account statements, and SIPA itself prohibits advertising SIPC membership in any way that suggests it protects against loss caused by the market. FDIC disclosures run on a parallel track: securities are never FDIC insured, and firms must not blur the line. When a sweep program moves cash into a bank deposit, the firm must clearly disclose that FDIC coverage attaches to the bank deposit, not to the securities account.

Memory hook:SIPC: $500K total, $250K cash, zero market loss; FDIC covers deposits, never securities.

Rule 1017(c) governs material changes in business operations. Before a member expands into a new product or business line that is not within the scope of its existing membership, it must file a continuing membership application with FINRA and receive approval. FINRA weighs whether the new business fits the member's current scope, whether the associated persons who will sell it are registered and qualified for that activity, and whether the firm's systems, compliance infrastructure, and supervision can handle it. The due diligence piece runs in parallel: before introducing any new product, the firm must perform reasonable diligence on its features, risks, fees, and complexity, and adopt the policies, procedures, and controls to supervise it, including principal approval and training. Offering first and researching later is the violation pattern to recognize.

Memory hook:New business line? Ask FINRA first; 1017(c) comes before the first trade.

When customers hold fund shares in street name, the firm sits between the shareholder and the issuer. FINRA Rule 2251 requires the member to forward proxy statements and other issuer-related materials, such as annual and semiannual reports, to beneficial owners promptly upon receipt, and to solicit voting instructions from those customers before shareholder meetings. Charges to the customer for this service are limited by the rule. On the fund side, registered investment companies must deliver annual and semiannual shareholder reports, which is why the firm's forwarding function matters. On the financial side, the FOCUS report is the firm's core financial filing: quarterly FOCUS reports are due within 17 business days after quarter end under Rule 17a-5, supplemented by the annual audited report and by Rule 4524's supplemental FOCUS information. Missed or late filings are themselves violations.

Memory hook:Street name means the firm forwards proxies; FOCUS quarterly, 17 business days.