60 Series 99 Exam Concepts You Need to Know Before Test Day

CIP and KYC get used interchangeably in casual conversation, but they come from different rulebooks and do different jobs. CIP is the Bank Secrecy Act obligation under USA PATRIOT Act Section 326: before an account opens, the firm must collect and verify identity data, including name, date of birth, address, and an identifying number such as a Social Security number or EIN. It is a one-time identity check. KYC under FINRA Rule 2090 is broader and ongoing: the firm must know the essential facts about each customer to service the account and spot red flags. CIP answers who is this person; KYC answers what does this account need.

Memory hook:CIP = Confirm Identity at opening; KYC = Keep Knowing the Customer.

Rule 2090 requires reasonable diligence to know the essential facts about each customer and the authority of anyone acting on the customer's behalf. It applies to all customers, not only natural persons. It is triggered at specific points: opening the account, maintaining the account, exercising investment discretion, and making recommendations, where the suitability analysis overlays it. Operations staff feel it most at opening, when paperwork must be complete before activity begins. The rule does not demand a suitability determination on every trade; it demands knowing enough to service the account and meet obligations. Institutional customers get relief through Rule 2111(b), which eases only the recommendation and suitability analysis, not the underlying duty to know the customer.

Memory hook:2090: know the customer, not the trade. Triggers: open, maintain, recommend, or exercise discretion.

RMDs generally begin at the required beginning date, which is tied to the owner reaching the applicable RMD age (72 under the SECURE Act, later adjusted by SECURE 2.0) or, for many employer plans, retirement. The still-working exception lets an employee delay plan RMDs while employed, but it never applies to IRAs and never applies to a more-than-5% owner of the business sponsoring the plan. A 5% owner must take RMDs on schedule even while working full time. Roth IRAs have no lifetime RMDs for the original owner. Operations must code accounts correctly and track distributions against the schedule.

Memory hook:5% owners and IRA owners cannot hide: still-working relief is for plan participants only.

A direct transfer moves retirement money trustee to trustee, so the customer never touches the funds: no withholding, no tax exposure, and no limit on frequency. A 60-day rollover pays the distribution to the customer, which changes everything. The custodian must withhold 20% of an eligible rollover distribution, the customer has only 60 days to redeposit, and only one such rollover is allowed per 12-month period across all of a person's IRAs. To roll the full amount, the customer must make up the withheld 20% from other funds and reclaim it at tax time. Operations should almost always steer customers toward a direct transfer.

Memory hook:Direct transfer: never touched, never withheld, never counted. 60-day rollover: 20% gone, clock ticking.

SSIs are the pre-agreed standing instructions that tell operations where a client's funds and securities settle, typically a custodian or bank account established at onboarding. Their value is that routine settlements do not need fresh instructions each time. Their danger is that changing them is a favorite fraud vector: a criminal who compromises an email account sends a convincing request to redirect future settlements to a new account. The control is independent verification, meaning a call back to a previously known contact using a known number before any change takes effect. New instructions should also carry a delay before first use.

Memory hook:An SSI change is a red flag wearing a nice suit. Call back on a known number first.

Escheatment is the process of turning abandoned customer property over to the state. When an account shows no activity and the firm cannot reach the owner after required notice attempts, cash and securities eventually escheat to the customer's state of residence, which holds them until the owner claims them. The firm must follow state dormancy periods, send due diligence notices, and never simply absorb the assets. Separately, accounts of associated persons are governed by FINRA Rule 3210: before opening or maintaining a securities account at another member firm or bank, the associated person must notify the employer in writing and obtain the employer's written permission, and the employer must receive duplicate statements and confirmations so it can monitor for misuse of inside information or trading abuses.

Memory hook:Dormant assets go to the state, never the firm. Employee outside accounts need notice, permission, and duplicates.

ACATS automates full or partial transfers between firms. The receiving firm submits the request; the carrying firm must validate the customer's identity and asset details within one business day, and the transfer must be completed within three business days, with assets delivered within four. Rule 11870 underlies the process: the carrying firm is contractually obligated to validate and deliver, and cannot cherry-pick which assets move or sit on the request. Rejects are permitted only for defined reasons, such as bad customer information, restricted assets, or a mismatch, never for convenience. Non-ACATS transfers, such as certain retirement or direct registration moves, follow manual timelines.

Memory hook:ACATS clock: validate 1, complete 3, deliver 4, and never interfere.

Assets sometimes arrive after an ACATS transfer is complete: a late dividend, a corporate action payout, interest, or fractional shares. These are residuals. The delivering firm must identify them and forward them to the receiving firm, generally within two business days of receipt, rather than keeping them or forcing the customer to file a new transfer. On the receiving side, a residual credit is posted to the customer's account once it arrives, so the customer is made whole without starting over. Operations staff monitor residual reports daily; a residual sitting unprocessed is both a customer service failure and a reconciliation break.

Memory hook:Residuals chase the account: late money follows the customer automatically.

A medallion signature guarantee and a notarization look similar on paper but carry completely different weight. A notary confirms the signer appeared and proved identity; the notary takes on no financial liability. A medallion guarantee, offered under an SEC-approved program by institutions with surety coverage, guarantees both the signature and the financial capacity of the person making the request, and the guarantor is on the hook if the transfer turns out to be fraudulent. That is why transfer agents require medallion stamps before re-registering securities: they need someone with financial backing standing behind the instruction. A notarized form will be rejected where a medallion is required.

Memory hook:Notary = name only. Medallion = name plus money behind it.

A Currency Transaction Report must be filed when a firm receives or dispenses more than $10,000 in currency, meaning actual cash, from or to the same customer in one business day. The threshold applies to the aggregate day total, so cash deposits of $6,000 and $5,000 in one day cross the line together. Structuring is the deliberate act of breaking cash into smaller amounts to stay under the threshold; it is illegal even if the money itself is clean, and the CTR obligation is assessed on the transaction regardless of the customer's apparent intent. Suspicious activity may separately trigger a SAR.

Memory hook:One day, one customer, all cash added up: over $10,000 means a CTR.

A letter of authorization is a customer's written, signed instruction permitting a specific action, commonly moving money to a party outside the account. Because third-party payments are a classic fraud and money-laundering channel, firms restrict them heavily. Checks payable to the customer generally cannot be redirected to a third party without an LOA, supervisory approval, and documentation of the reason. Incoming third-party checks get equal scrutiny, since commingling funds can mask beneficial ownership. Operations should confirm the LOA is current, signed by an authorized party, and consistent with the account registration, and escalate anything that looks like an unexplained pattern.

Memory hook:Money leaves the account to a stranger only on paper: LOA, approval, documentation.

Rule 2140 bars a firm from delaying or blocking the transfer of a customer account because of an employment dispute, for example when a registered rep leaves for a competitor and the old firm wants to hold the accounts hostage. The customer, not the firm, owns the relationship. The other prohibited cashiering conduct is equally mechanical: kiting means writing checks or ordering transfers against funds that have not yet collected, creating false balances, and holding checks means deliberately delaying deposit or processing to manipulate float or cover shortfalls. Each turns the cashiering function into a tool for deception, which is why daily blotters, reconciliation, and supervisory review exist.

Memory hook:Reps leave, accounts go under Rule 2140. Kites float, holders stall, both are fraud.

Rule 15c3-3(b) requires a broker-dealer to maintain possession or control of fully paid customer securities and the excess margin securities in customer accounts. Fully paid means nothing is loaned against them; excess margin means the portion above what could be called under Regulation T. The firm has three ways to satisfy the rule: physically possess the securities, have a control arrangement with the depository or counterparty, or deposit cash or securities under the reserve formula. The point is simple: customer assets cannot be hypothecated, lent, or pledged without the customer's consent and required collateral behind it. Operations monitors daily possession-or-control exceptions and resolves them within permitted windows.

Memory hook:Fully paid and excess margin: possess it, control it, or reserve for it.

The customer reserve formula under Rule 15c3-3(c) is a periodic computation, typically weekly, that asks one question: if the firm failed today, would customer-related cash and securities on the balance sheet cover what customers are owed? The firm computes the reserve requirement from customer-related ledger balances, compares it to the cash and qualified securities it holds, and if the requirement exceeds what is held, must deposit the shortfall into a Special Reserve Bank Account for the Exclusive Use of Customers within one business day. That account is segregated, and the firm cannot touch it for its own needs. The computation is where FINOP and operations intersect.

Memory hook:Reserve formula: customers' money, customers' bank account, firm's hands off.

FINRA Rule 4522 requires members with custody or control of securities to count what they actually hold and prove it matches the stock record. Members carrying margin accounts for customers, or otherwise holding securities, count quarterly; others verify on an annual cycle. The count is physical, meaning someone examines the securities in vaults, safe deposit boxes, or with outside custodians. It is followed by a verification, where a supervisory person confirms the count was properly performed, and a comparison, reconciling the count to the stock record and to any carrying or clearing firm's records. Discrepancies are investigated and resolved, not written off. Uncounted custody is where theft and misplacement hide.

Memory hook:Count it, verify it, compare it. No physical count, no compliance.

Street name registration means securities are recorded in the broker-dealer's nominee name and held at the depository, so ownership moves by electronic book entry rather than by shipping certificates. DRS, the Direct Registration System, holds shares directly on the issuer's transfer agent's books in the investor's own name, with no physical certificate and no broker-dealer layer. DWAC, Deposit/Withdrawal at Custodian, is the mechanism that moves shares between the depository and the transfer agent's DRS position, often for same-day movement. The practical difference matters to operations: street name positions settle through the depository, while DRS positions move only when the transfer agent processes the instruction.

Memory hook:Street name = depository nominee; DRS = your name at the agent; DWAC = the shuttle between them.

Good delivery means a certificate meets the requirements a transfer agent will accept: correct denominations, proper registration, no restrictive legends, and valid endorsements. When the registered owner cannot sign the certificate itself, a stock power or bond power supplies the assignment authority, and it must be guaranteed, typically with a medallion stamp. The transfer agent is the gatekeeper: it validates the certificate, confirms the endorsement and guarantee, cancels the old certificate, and issues the new registration. Operations checks delivery requirements before sending anything out, because a bad delivery comes back as a reject, a fail, and a settlement problem that someone has to unwind.

Memory hook:Good delivery: clean certificate, guaranteed signature or power, transfer agent's stamp of approval.

When a certificate is discovered missing, lost, stolen, or counterfeit, SEC Rule 17f-1 requires prompt reporting to the SEC's designated central reporting system, generally within one business day of discovery, so the certificate can be flagged before it is negotiated somewhere else. The firm also notifies the transfer agent and places a stop, and a police report is commonly filed for stolen certificates. The report protects the firm and the market: once a certificate is on the lost securities list, a transfer agent will refuse to re-register it. Counterfeits are reported the same way. The error to avoid is waiting, because a certificate reported late can be cashed before anyone knows it is hot.

Memory hook:Lost or fake certificate: one business day to the central system, or it is gone.

Rule 144 governs how restricted securities, meaning shares acquired in unregistered, private transactions, can be resold into the public market. The holding period runs from the date the securities were fully paid for: six months for issuers that file with the SEC, and twelve months for non-reporting issuers. Satisfying the holding period removes restricted status only for non-affiliates; affiliates remain subject to Rule 144's volume limits, manner-of-sale conditions, and Form 144 notice requirements no matter how long they hold. For operations, the practical job is the legend: a restrictive legend stays on the certificate until the holding period is satisfied and the issuer's counsel or transfer agent clears it.

Memory hook:Six if they file, twelve if they do not; affiliates wear Rule 144 forever.

Rule 5310 requires reasonable diligence to execute customer orders so the customer gets the best result available, considering price, speed, and overall execution quality across the market. Interpositioning is the specific sin: inserting a third party between the customer and the best available market, which almost always adds a markup or an extra fee. It is prohibited unless it is genuinely necessary to achieve best execution and imposes no additional cost on the customer. Operations sees this in trade review and corrections: if a fill came through an intermediary when a direct execution was available at equal or better terms, the firm has a best execution problem and a potential customer refund.

Memory hook:Best execution means no middleman markup: interpose only if free and necessary.

Rule 5320 blocks a member firm from trading for its own account ahead of a customer's marketable order in the same security unless the customer explicitly consents. The logic is simple: if a customer wants to buy at the offer, the firm cannot grab that offer first for its proprietary account and leave the customer with a worse fill. The rule applies to marketable limit and market orders in NMS stocks and options. Two narrow exceptions exist: the firm may trade ahead to fill a customer's not-held order after the order is no longer marketable, and institutional customers can provide written consent allowing the practice. Absent consent, the customer's order must be executed first.

Memory hook:5320: customer's marketable order goes first; only explicit consent lets the firm cut in line.

Rule 5270 prohibits a firm from trading for its own account, or an affiliated person trading for their own account, while in possession of material nonpublic information about an impending block transaction in the same or related security. The mechanism is informational: once the firm knows a large institutional buy or sell order is coming, the market will likely move when it hits, so trading ahead of it is a form of front running that exploits the customer's own order. The rule reaches related securities and derivatives, not just the underlying stock. Exceptions exist for risk hedging tied to facilitating the block and for transactions genuinely independent of the nonpublic information, but the firm carries the burden of fitting within them.

Memory hook:5270: knowledge of the coming block; 5320: the marketable order already in hand.

An error account is a legitimate operational tool: when a trade is executed in error, such as the wrong quantity, wrong security, or wrong account, the firm moves the position into the error account so the customer is made whole and the mistake is tracked and reviewed. What makes it legitimate is genuine error plus documented supervisory review and prompt resolution. The prohibited use is concealment: parking trades in the error account to hide unauthorized or personal trading, to defer losses, to avoid markup disclosure, or to disguise trades for unregistered persons. Supervisors must review error account activity for patterns, because frequent errors or positions parked for extended periods signal that the account is being abused rather than used for correction.

Memory hook:Error accounts fix mistakes; they must never become a hiding place for trades someone wants unseen.

When a trade is reported late or a correction must be processed after the original settlement date has passed, the firm books an as/of transaction, so named because the trade is reported as of the original trade date even though the report occurs later. Because as/of entries can be used to manipulate trade reporting, disguise errors, or backdate activity, firms must maintain tight controls: the correction requires documented supervisory approval, a record of the original error and its cause, and supporting documentation linking the as/of entry to the bona fide trade it corrects. Past settlement date corrections get heightened scrutiny because money has already moved, so the firm must also correct the cash and position side and document the reconciliation.

Memory hook:As/of means reported late but dated as of the original trade date; approval and paperwork make it legal.

Churning is excessive trading in a customer account that serves the representative's interest in commissions rather than the customer's objectives. Because intent is hard to prove directly, supervisors rely on quantitative red flags. The classic measure is turnover ratio, annualized cost of equity purchases divided by average account equity; a high ratio suggests positions are being rapidly replaced. Another is the break-even calculation: annual commissions and other costs divided by the account's average equity shows the return the account must earn just to cover expenses. Other flags include a high commission-to-equity ratio, frequent in-and-out trading inconsistent with stated objectives, and use of costless or unnecessary switches between similar products.

Memory hook:Turnover equals purchases over equity; break-even equals costs over equity; both high means churn alarm.

Mutual funds with front-end sales charges use breakpoint schedules: as the investment amount rises, the percentage sales load falls. A breakpoint sale occurs when a representative recommends a purchase in an amount just below a breakpoint, such as 9,500 dollars when 10,000 dollars earns a lower load, without informing the customer that a slightly larger purchase would reduce the sales charge. Rule 2342 treats this as a prohibited sales practice because the customer pays a higher load than necessary. The exception is genuine customer benefit: if the customer independently chose the amount, or the representative disclosed the breakpoint and the customer declined to increase the investment, no violation occurs. Disclosure is the dividing line.

Memory hook:Just under the breakpoint plus no disclosure equals a Rule 2342 breakpoint sale violation.

Regulation Best Interest imposes on broker-dealers a duty to act in the retail customer's best interest when recommending securities transactions or account types. Its four component obligations work together: disclosure of material facts and conflicts; care, meaning reasonable diligence to understand and recommend suitable products; conflict of interest, addressing and eliminating or mitigating incentives that conflict with the customer's interest; and compliance, written policies reasonably designed to achieve compliance. Form CRS, required under SEC Rule 17a-14, is the relationship summary that must be delivered to retail customers at or before the earliest of a recommendation, an account opening, or a transaction, and existing customers must receive it within a set transition window, with updated versions delivered when material changes occur.

Memory hook:Reg BI: disclose, care, conflicts, comply; Form CRS arrives at or before the earliest of recommend, open, or transact.

Margin requirements operate on two levels. Regulation T is the Federal Reserve's initial requirement, historically 50 percent for exchange-listed marginable equities, meaning a customer buying 10,000 dollars of stock must deposit 5,000 dollars. Different security types carry different treatment: options, low-priced securities, and municipal or government securities have their own rules, and some products cannot be margined at all. Separately, FINRA's maintenance rules require customers to keep minimum equity in the account after opening; the standard maintenance figure for long margin accounts is 25 percent of market value, with higher requirements for concentrated or low-priced positions. The exam split to remember: Reg T governs the initial deposit, FINRA maintenance governs the ongoing equity floor.

Memory hook:Reg T is the entry fee at purchase; maintenance is the ongoing floor you must keep.

A pattern day trader is any margin account customer who executes four or more day trades within five business days, provided those day trades represent more than six percent of total trades in that account over the same period. Once labeled a pattern day trader, the account must maintain minimum equity of 25,000 dollars, and if equity falls below that level, day trading is restricted until the account is restored. The reward for meeting the floor is day trading buying power of four times the excess over the maintenance requirement, compared with the two times excess available to a regular margin account. The day trading call must generally be met within five business days, and the account's activity is monitored on a rolling basis.

Memory hook:Four day trades in five days, six percent filter, 25,000 dollars equity, four times buying power.

Continuous net settlement is the mechanism used by the clearing corporation to streamline settlement. Instead of delivering securities and money trade by trade, CNS nets each participant's obligations in two dimensions. First, it nets by security: all of a firm's buys and sells of the same security on the same settlement day are offset, so the firm delivers or receives only the net share position. Second, it nets across settlement days: a firm's net long position from one day can be applied against its net short position from another day, so deliveries roll forward rather than requiring separate movement of shares. The result is a massive reduction in the volume of certificates and cash that must actually change hands, which lowers cost and operational risk.

Memory hook:CNS nets by security and rolls positions across settlement days; trade-for-trade settles one by one.

When a firm receives a comparison, which is the clearing corporation's or counterparty's record of a trade, and does not recognize the transaction, it issues a DK notice, short for don't know. The DK process under the FINRA Rule 11200 series is the formal mechanism for disputing a trade: the firm must compare its own records against the incoming confirmation, and if the details do not match on security, quantity, price, date, or counterparty, the firm sends the DK within prescribed timeframes. The notice identifies the specific discrepancy, and the parties must then resolve the difference, because an unresolved mismatch would otherwise settle as a fail. Using a DK requires an actual discrepancy, not mere inconvenience.

Memory hook:DK means don't know the trade; it disputes a comparison, it never delays a valid one.

When a seller fails to deliver securities by settlement, the buyer can enforce delivery through a buy-in: purchasing the shares elsewhere and charging the failing seller the cost. Close-outs are the seller-side remedy for a fail to receive. Regulation SHO adds a short sale discipline layer. Before selling short, the firm must locate or borrow the security, documented through a locate, to avoid naked short selling. Rule 204 then requires a firm that fails to deliver a short sale position to close it out by purchasing securities of like kind and quantity, generally no later than the beginning of regular trading hours on the settlement day following the fail. Persistent fails lead to the security being placed on the threshold list with further restrictions.

Memory hook:Locate before the short sale; Rule 204 close-out purchase after the fail, by the next settlement day's open.

Delivery versus payment is a settlement method in which the transfer of securities and the transfer of cash happen simultaneously, so neither party is exposed to the risk of paying without receiving. It is the standard arrangement for institutional transactions settled outside the continuous net settlement system, such as trades between a broker-dealer and an institutional customer that settle directly with the customer's custodian bank. The mechanics depend on standing settlement instructions: the institution tells the broker where to deliver securities and where funds should flow, and the custodian releases cash only when securities are received. Because DVP settles trade by trade rather than through netting, each transaction's details must match exactly or the settlement DKs and becomes a fail.

Memory hook:DVP: securities and cash swap hands at the same moment; no delivery, no payment.

A repurchase agreement is economically a collateralized loan, not a securities trade. In a classic repo, one party sells securities to a counterparty and simultaneously agrees to repurchase the same securities at a higher price on a set future date. The difference between the sale and repurchase price is the interest, and the securities serve as collateral. From the buyer's perspective the same transaction is a reverse repo or resale: the party buys now expecting to sell back later, in effect lending cash. The reason these are treated as financings is that the intent is temporary use of funds, not a change in beneficial ownership, and the repurchase price is fixed at the outset, so market movement does not change the economics.

Memory hook:Repo: sell now, buy back later at a higher price; the spread is interest, the securities are collateral.

A securities fail exists when delivery is due but not completed by settlement date. When a fail persists, it becomes an aged fail, and firms face specific operational obligations. The receiving firm must send a confirmation of the aged fail to the delivering party, restating the details of the undelivered transaction, and this confirmation must be repeated at prescribed intervals as the fail continues to age. Internally, aged fails require escalation: operations staff must report aging fails to designated supervisors or principals, and the firm must take action to resolve them, including buy-in or close-out procedures when the fail cannot be cured. The purpose of the confirmation and escalation regime is to prevent fails from lingering indefinitely and distorting the firm's stock record.

Memory hook:An aging fail demands repeat confirmations to the counterparty and escalation up the chain until it is cured.

Every trade for a customer requires a confirmation, and its content is prescribed: security name, number of shares or units, price, trade date, settlement date, commission, and the identity of the introducing and clearing firms. A critical disclosure is capacity: the firm must state whether it acted as agent, executing the order for a commission, or as principal, trading to its own account for a markup. This matters because principal trades carry markup rules and agent trades carry commission disclosure, and the customer is entitled to know which side the firm was on. Electronic delivery of confirmations is permitted, but only where the customer has affirmatively consented to receive documents electronically and the firm's system reasonably ensures the customer can access and retain them.

Memory hook:Confirmations reveal capacity: agent earns commission, principal earns markup; e-delivery needs consent.

A customer account statement is the periodic record a firm must send showing the account's current state: positions held, their valuation, cash balances, and account activity during the period, such as purchases, sales, dividends, and interest. Statements are sent at least monthly when there is activity in the account during the period, and at least quarterly when the account holds positions but no activity occurred. A performance report is different in purpose and content: it presents the account's rate of return over time, often comparing results against a benchmark, and is typically prepared for managed or fee-based accounts. The exam distinction is that the statement documents what the account holds and what happened, while the performance report measures how well the account did. A firm cannot substitute one for the other.

Memory hook:Statement shows what you hold and what happened; performance report shows how well it did.

Cost basis reporting requires brokers to report the customer's basis in securities sold on Form 1099-B, which goes to the customer and the IRS. The system distinguishes covered securities, generally those acquired after the cost basis reporting rules took effect, for which the broker must track and report basis, from non-covered securities acquired earlier, for which basis reporting is not required and the customer is responsible for their own records. When a customer sells part of a position, the broker must apply a default lot method unless the customer instructs otherwise. The default is first in, first out, meaning the oldest shares are treated as sold first, which often produces the largest gain. Customers may instead designate specific lots or use average cost for mutual funds.

Memory hook:1099-B reports basis for covered securities; no instruction means FIFO, oldest lots sold first.

Backup withholding is the IRS mechanism that requires a payer to withhold tax from reportable payments when the recipient fails to supply a correct taxpayer identification number, when the IRS notifies the payer that the recipient underreported interest or dividends, or when the recipient fails to certify they are not subject to backup withholding. The standard backup withholding rate is currently 24 percent, applied to interest, dividends, and other reportable payments. Nonresident withholding is a separate regime for nonresident aliens: payments of US-source dividends and interest to nonresident aliens are generally subject to withholding at a statutory rate, commonly 30 percent unless a treaty between the United States and the recipient's country reduces it. The customer must document treaty eligibility, typically through a withholding certificate.

Memory hook:Backup withholding is 24 percent for TIN failures; nonresident dividends face 30 percent unless a treaty cuts it.

The financial and operations principal, or FINOP, is the registered principal responsible for the accuracy of a broker-dealer's financial reporting. FINOP duties include preparing and signing the FOCUS report, the Financial and Operational Combined Uniform Single report that member firms file with FINRA to disclose their financial condition, computing net capital under Rule 15c3-1, and ensuring the general ledger reconciles to the financial statements. The FOCUS filing cycle depends on the firm's category: carrying and clearing firms file more frequently than introducing or sole proprietor firms, with the most frequent filers submitting monthly and annual parts, while smaller firms file quarterly and annually. FINOP review is what makes the numbers in the FOCUS reliable to regulators.

Memory hook:FINOP signs the FOCUS and computes net capital; filing frequency follows the firm's category.

Net capital under Rule 15c3-1 is the firm's own cushion against loss, computed by starting with net worth and then deducting haircuts: percentage reductions in the value of securities positions that reflect market and liquidity risk, plus deductions for illiquid assets such as unsecured receivables. The riskier the inventory, the bigger the deductions, so a firm can look profitable on the general ledger and still be capital-deficient. Firms that carry customer accounts or handle customer funds face higher minimum requirements than firms that do not. Rule 4311 completes the picture: when an introducing firm's customers are carried by another broker-dealer, the carrying agreement spells out who holds funds, who computes reserve requirements, and who bears financial responsibility.

Memory hook:Haircuts cut asset values; the carrying firm carries the capital burden.

SEC Rule 17a-3 says which records must be made: order tickets, trade memoranda, ledgers, and customer account records. Rule 17a-4 says how long they must be kept, generally three or six years depending on the record type, with the first two years in an easily accessible place. FINRA's 4510 series adds its own requirements on top. Posting timelines matter because many entries must be made by the close of business or within a set number of days after the event, so a record made late is a violation even if it is accurate. Electronic storage is permitted only if the system preserves records so they cannot be altered, maintains an audit trail, and allows prompt regulatory access. Falsifying records or destroying them early is prohibited.

Memory hook:17a-3 makes them, 17a-4 keeps them; two years close at hand.

Rule 2210 sorts communications by audience, and the audience drives the review. Retail communications, meaning written or electronic messages reaching more than 25 retail investors within 30 calendar days, must be approved by a registered principal before first use. Correspondence goes to 25 or fewer retail investors in that same window; it requires no pre-approval but remains subject to supervisory review, with the timing and intensity shaped by the firm's assessment of risk. Institutional communications are distributed exclusively to institutional investors, so they escape the retail pre-approval and filing requirements, but they must still be fair, balanced, and free of false or misleading statements, and the firm needs a reasonable basis to treat the audience as institutional.

Memory hook:Twenty-five retail readers in 30 days turns correspondence into retail communication.

Regulation S-P requires a broker-dealer to deliver an initial privacy notice when a customer relationship is established and annually thereafter for as long as the relationship continues. The notice describes the firm's policies and practices, the categories of information collected, and the categories of third parties with whom it may be shared. Customers then hold an opt-out right before the firm shares nonpublic personal information with nonaffiliated third parties, subject to exceptions such as processing requested transactions or sharing with service providers bound by confidentiality. The opt-out mechanism must be reasonable, and account numbers cannot be shared for marketing without express consent. Operations staff deliver the notices and must honor opt-out elections in downstream data handling.

Memory hook:Notice at opening, notice each year; opt-out stops nonaffiliated sharing.

Regulation S-ID applies to broker-dealers that offer covered accounts, meaning accounts with a reasonably foreseeable risk of identity theft, such as brokerage or margin accounts. The firm must maintain a written identity theft prevention program with reasonable policies to identify relevant red flags, detect them in day-to-day operations, and respond appropriately to mitigate harm. Red flags include consumer report alerts, suspicious documents, unusual account activity, and notice of identity theft from customers or law enforcement. The board or a designated committee must approve the initial program and oversee its training, vendor oversight, and periodic updates as risks evolve. Keep this separate from Reg S-P, which addresses privacy notices and information safeguards.

Memory hook:S-P protects privacy; S-ID spots identity theft red flags.

When customers hold shares in street name, the broker-dealer is the record owner and the customer is the beneficial owner. Issuers want to reach beneficial owners with proxy materials and corporate action notices, so each customer chooses a status. A non-objecting beneficial owner, or NOBO, permits the firm to release the customer's name, address, and security position to the issuer. An objecting beneficial owner, or OBO, blocks that release, keeping the identity confidential; the firm responds to issuer inquiries without identifying the customer. NOBO status lowers issuer solicitation costs because issuers can mail materials directly instead of paying the firm to forward them. The election belongs to the customer, never the firm.

Memory hook:OBO objects to disclosure; NOBO doesn't object, so the issuer gets the name.

FINRA Rule 2060 bars a member firm from using information obtained in a fiduciary capacity, for example while acting as trustee, custodian, or in another position of trust, for solicitation or for any purpose other than the purpose for which the information was received. Two doors open lawful use: consent from the person for whom the information was obtained, or compulsion by court order or authorized regulatory authority. The rule also restricts use of information obtained from another member firm, with a limited path for customer lists, and even then use for solicitation must respect customers who have objected. The theme is simple: information gathered because of a trusted role belongs to that role.

Memory hook:Fiduciary facts are for the fiduciary job only, no solicitation without consent.

Section 28(e) of the Exchange Act creates a safe harbor for advisers who pay commissions higher than pure execution cost in order to obtain brokerage and research services. Without it, paying up could breach fiduciary duty. To qualify, the adviser must determine in good faith that the commission is reasonable relative to the value of the brokerage and research received, considering the full range and quality of services and whether best execution was obtained overall. The safe harbor covers research and brokerage only, not office rent, equipment, travel, or entertainment. Mixed-use assets, such as a terminal providing both research and market data, require a reasonable, documented allocation between covered and uncovered uses.

Memory hook:28(e) buys research and brokerage, nothing else, and mixed use needs a split.

A broker-dealer cannot pay commissions or other transaction-based compensation to a person who is not appropriately registered for effecting or supervising securities transactions. The logic is that anyone earning pay that varies with securities transactions is presumed to be functioning in a registered capacity, soliciting business or effecting trades. Unregistered persons may still receive salaries, bonuses untied to securities transactions, and compensation for non-securities work, so the prohibition is not absolute. Operations staff often spot the violation in the payout system itself: if the amount moves when a trade settles, the recipient must be registered. Misclassifying someone as administrative while paying per-transaction bonuses is a classic enforcement fact pattern.

Memory hook:Pay tied to the trade means the payee must be registered.

When a firm outsources a function such as clearing, technology, or customer communications, it can outsource the work but never the accountability. Vendor due diligence runs in three phases. Selection: verify financial stability, regulatory history, references, and operational capacity before signing anything. Contract controls: put expectations in writing, including service levels, confidentiality and data-protection obligations, commitments to comply with applicable rules, audit rights, and termination provisions. Ongoing oversight: monitor performance against the contract, conduct periodic reviews, escalate problems, and reassess risk whenever the vendor or the scope of work changes. Regulators examine the entire chain, so a weak vendor becomes the firm's own finding.

Memory hook:Pick carefully, paper the deal, then keep watching; accountability stays home.

Customer information should move only on a need-to-know basis. Inside the firm, departments share nonpublic personal information only when the recipient needs it to perform the job: a cashiering clerk needs balances and settlement instructions; a marketing group does not. Outside the firm, sharing with nonaffiliated third parties is limited by Reg S-P, so the customer's opt-out must be honored, any claimed exception such as transaction processing or a confidentiality-bound service provider must genuinely fit, and account numbers cannot be shared for marketing without express consent. Firms enforce all of this through confidentiality agreements, information barriers, and access controls. Disclosures compelled by law, made with consent, or made to affiliates under proper notice remain permissible.

Memory hook:Need-to-know inside the walls; opt-out rules the outside.

Regulation S-P requires a written information security program built on three kinds of safeguards. Administrative safeguards cover people and policies: training, background checks, and a designated coordinator who oversees the program. Technical safeguards cover systems: encryption, access controls, firewalls, and secure transmission of customer data. Physical safeguards cover space and files: locks, restricted building and office access, and secure disposal of paper records. The program must be reasonably designed to protect customer records and information, guard against anticipated threats or hazards, and prevent unauthorized access that could harm customers. The board approves the program, and it must be tested and updated as risks change. A breach triggers notice obligations to affected customers.

Memory hook:People, systems, and locks; Reg S-P safeguards come in threes.

FINRA Rule 4513 requires firms to keep a file of written customer complaints. A complaint is a written expression of dissatisfaction; oral gripes do not trigger the record requirement, though well-run firms track them internally anyway. For each written complaint, the firm records the customer's name and address, the account number, the date the complaint was received, the name of the related registered person, and a description of the complaint, along with any action taken. The file must be maintained and available for regulatory inspection. Operations staff are often the first point of contact, so recognizing that a letter, email, or note is a complaint and routing it into the file is a core duty.

Memory hook:Written gripe, written record: name, account, date, description.

Rule 4530 requires firms to report specified events to FINRA within 30 calendar days of concluding they have notice, including settlements above the reporting threshold, arbitration awards, indictments and criminal charges, regulatory actions, and terminations for cause involving registered persons. Separately, firms file a quarterly statistical summary of customer complaints, capturing the number received and relevant categories. The 30-day clock starts when the firm has notice of the event, not when the matter is fully resolved or the file is closed. Operations and compliance must coordinate so nothing slips, because a missed report is itself a violation, entirely independent of how the underlying event turned out.

Memory hook:Thirty days to report the event; four times a year to count the complaints.

Escalation means moving a concern up the chain promptly, through the firm's defined procedures, to a supervisor, compliance, or AML staff, and in writing where possible. Red flags that demand action include unusual withdrawal patterns, sudden changes to beneficiaries or contact information, unexplained third parties added to accounts, and suspected exploitation of older or impaired customers. For specified adults, meaning customers 65 or older or 18 and older with an impaired capacity, FINRA's senior exploitation rule permits a firm to place a temporary hold on a disbursement while it investigates, and permits reporting to state adult protective services or regulators. The rule does not force a hold, but it protects the firm that takes one in good faith.

Memory hook:See the flag, raise the flag; a good-faith hold protects the vulnerable customer.

Rule 3110 requires every firm to have a supervisory system reasonably designed to achieve compliance with securities laws and FINRA rules, and to put that system in writing. Written supervisory procedures assign each area of the business a supervisor, describe how transactions are reviewed and principal approvals obtained, and set inspection schedules for offices of supervisory jurisdiction. Supervisors must be registered and the firm must have a reasonable basis for designating them, including giving them the time and training to do the job. The procedures must fit the firm's actual business; a generic manual copied from another firm fails the test. They must also be updated as products, business lines, or rules change, and reinforced through the annual compliance meeting.

Memory hook:Written, fitted, assigned, updated; that is a 3110 supervisory system.

Rule 3120 makes a firm test its own supervision. The firm must establish a supervisory control system that tests and verifies the adequacy of its written supervisory procedures, whether those procedures comply with applicable rules, and whether the firm actually follows them in practice. Testing and verification are conducted at least annually, and the firm must report to senior management at least annually, summarizing the testing results, any material amendments made to procedures, and the findings. Keep the division of labor straight: Rule 3110 is the daily supervision itself, while Rule 3120 is stepping back and checking that the supervision works as designed.

Memory hook:3110 does the job; 3120 checks the job.

Rule 3130 requires the chief executive officer to certify annually that the member has in place processes to establish, maintain, review, test, and modify written policies and supervisory procedures reasonably designed to achieve compliance with securities laws and FINRA rules. The certification is not a promise that nothing went wrong. It must be accompanied by a report from the chief compliance officer describing the compliance exceptions and material exceptions identified during the year and the firm's response, essentially where the system fell short. The CEO must also have at least one direct report who is a registered principal responsible for administering the firm's policies and procedures, so the certification rests on a real structure.

Memory hook:CEO certifies the process; CCO's report confesses the exceptions.

Rule 4370 requires each firm to create and maintain a business continuity plan reasonably designed to let the firm meet its obligations to customers and counterparties in an emergency or significant business disruption. The plan addresses data backup and recovery, mission-critical systems, communications with customers, employees, and regulators, alternate physical workspace, regulatory reporting, and how and when the firm resumes business or winds down if recovery is not possible. Firms must keep emergency contact information current with FINRA. On the customer side, the firm must be prepared to disclose the plan, providing a summary of how it will handle disruptions, and many firms include that summary in new account materials or post it publicly.

Memory hook:Plan for the disaster, tell the customer the plan exists.

Segregation of duties means no single person controls a transaction from start to finish: the person who initiates is not the same person who approves, settles, and reconciles. Departments are separated so that trading, cashiering, and recordkeeping functions check one another, and information barriers keep confidential material from flowing where it could be misused, such as between areas with conflicts. Entitlement policies govern system access: users receive only the access their job function requires, approvals are documented, access is reviewed periodically, and entitlements are revoked promptly when roles change or someone leaves the firm. The goal is simple: mistakes and misconduct become visible because a second set of eyes sits at every critical step.

Memory hook:Separate the duties, match the access, revoke it fast.