- For recordkeeping purposes, which of the following is considered a 'customer complaint' that must be retained by the firm?
Answer: Any written grievance from a customer involving the activities of the firm or its associated persons.
A customer complaint is defined by FINRA as any written grievance by a customer or a person acting on behalf of a customer involving the activities of the member firm or its associated persons in connection with the solicitation or execution of any transaction or the disposition of securities or funds of that customer. An email or letter would meet this definition.
- A written customer complaint must be kept on file at a broker-dealer for a minimum of:
Answer: four years.
FINRA rules specify a four-year retention period for written customer complaints. This is a specific timeframe that differs from the more common three-year and six-year record categories.
- A firm identifies missing order tickets; how does a broker-dealer ensure compliance with record retention policies and remediation?
Answer: Escalate to compliance, reconstruct with reliable sources, document gaps, enhance controls, and retain remediation evidence
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, identifying missing order tickets highlights how remediation must maintain compliance. The correct choice, A, accurately reflects SEC requirements for reconstruction and documentation. A common distractor, C, fails because customer copies are not official records. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- Which of the following is an acceptable method for a broker-dealer to deliver its annual privacy notice to an existing customer who has agreed to electronic delivery?
Answer: An email to the customer that includes a clear link to the privacy policy.
For customers who have consented to electronic delivery, sending an email with a conspicuous link to the firm's privacy policy is an acceptable method of delivery under Regulation S-P. The other methods are not considered adequate forms of delivery for this required notice.
- Under Regulation S-P, a 'consumer' is an individual who obtains a financial product or service from a firm. A privacy notice must be provided to a consumer:
Answer: before the firm shares their nonpublic personal information with nonaffiliated third parties.
A firm's obligation to a 'consumer' (someone without an ongoing relationship) is different from its obligation to a 'customer.' For a consumer, the firm must provide a privacy notice and an opportunity to opt out before sharing NPI with nonaffiliated third parties. If the firm does not share the information, no notice is required for a consumer.
- A customer who is traveling internationally for an extended period asks their registered representative to hold all account-related mail. For the firm to do this, the customer must:
Answer: make the request in writing.
FINRA rules permit a firm to hold mail for a customer, but only if the customer provides written instructions. The rule also requires the firm to inform the customer of any alternative methods of communication and to ensure that the hold is for a valid reason and appropriate duration (typically not to exceed three consecutive months if the customer will not be receiving important notifications).
- After a phishing alert, what practices help prevent data breaches in customer financial records and support AML monitoring?
Answer: Use least-privilege access, MFA, encryption, and audit logs while preserving records for SAR decisioning
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, responding to a phishing alert highlights how security measures support AML and prevent breaches. The correct choice, B, accurately reflects best practices for access controls, encryption, and record preservation under SEC and FINRA rules. A common distractor, C, fails because it risks unencrypted transmission, violating privacy safeguards. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Integrating cybersecurity training enhances compliance.
- A firm's privacy program is tested; which of the following is a requirement under Regulation S-P's safeguards rule?
Answer: Implement written policies and procedures reasonably designed to protect customer records and information
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, testing a privacy program highlights how safeguards must be reasonably designed. The correct choice, A, accurately reflects Regulation S-P's safeguards rule. A common distractor, B, fails because it imposes an impossible guarantee. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Written procedures are foundational.
- During onboarding, what practices help prevent data breaches in customer financial records while supporting CIP and CDD documentation?
Answer: Use secure portals, encrypt stored IDs, restrict access, and retain CIP/CDD records per retention schedules
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, onboarding customers highlights how secure practices support CIP/CDD while preventing breaches. The correct choice, B, accurately reflects secure storage and retention under AML and privacy rules. A common distractor, C, fails because shared spreadsheets risk unauthorized access. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- All of the following items are required to be included on a customer's trade confirmation EXCEPT:
Answer: the name of the contra-party to the trade.
A trade confirmation must disclose key details of the transaction, including the firm's capacity, dates, and security details. However, the identity of the contra-party (the other buyer or seller in the transaction) is generally not required to be disclosed on the confirmation.
- During branch inspections, what practices help prevent data breaches in customer financial records and support customer protection controls?
Answer: Enforce clean-desk, locked storage, secure printing, and role-based access to customer account systems
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, conducting branch inspections highlights how physical and access controls protect records. The correct choice, B, accurately reflects safeguards for customer protection. A common distractor, A, fails because unlocked storage risks breaches. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Clean-desk policies reinforce security.
- A customer receives a trade confirmation that incorrectly states the number of shares purchased. The first action the registered representative should take is to:
Answer: bring the error to the attention of a principal or supervisor.
Any error found on a trade confirmation or account statement must be reported to a supervisor or principal immediately. The principal will then direct the appropriate steps for correcting the trade record and issuing a corrected confirmation.
- A firm experiences a system outage; how does a broker-dealer ensure compliance with record retention policies and business continuity?
Answer: Maintain redundant archiving, validated backups, and documented procedures to preserve and promptly retrieve required records
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, a system outage highlights how business continuity supports record preservation. The correct choice, A, accurately reflects SEC requirements for backups and retrieval. A common distractor, D, fails because deleting records violates retention rules. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- During an SEC exam, how does a broker-dealer ensure compliance with record retention policies and privacy safeguards?
Answer: Maintain WORM-format records with indexed retrieval, retention schedules, and supervisory reviews, plus secure access controls
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, ensuring compliance during an SEC exam highlights how broker-dealers must maintain proper record formats and access controls. The correct choice, B, accurately reflects SEC Rule 17a-4 requirements for WORM-format records, indexing, retention, and security. A common distractor, A, fails because it misinterprets retention periods by suggesting indefinite storage without regulatory schedules. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Additionally, regular training on these rules can help prevent compliance failures.
- Within how many days of opening a new account must a firm send the customer a copy of the account record for verification?
Answer: 30 days
FINRA Rule 4512 requires that within 30 days of opening an account, a member firm must furnish to each customer a copy of the account record. The rule also requires periodic updating of this information at least every 36 months.
- A firm uses a call center; which of the following is a requirement under Regulation S-P for limiting NPI exposure?
Answer: Limit access to NPI to those with a business need and apply controls to protect against unauthorized disclosure
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, using a call center highlights how NPI access must be limited. The correct choice, A, accurately reflects Regulation S-P's access controls. A common distractor, D, fails because affiliate sharing may still require notices. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- A firm shares NPI with a service provider; which of the following is a requirement under Regulation S-P?
Answer: Provide an initial and annual privacy notice describing NPI sharing and customers' opt-out rights, if applicable
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, sharing NPI with a service provider highlights how privacy notices and opt-out rights must be provided. The correct choice, A, accurately reflects Regulation S-P's notice requirements for initial and annual disclosures. A common distractor, D, fails because it misinterprets consent rules, as consent is not required for initial collection but for certain sharing. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- A firm revises its privacy notice; which of the following is a requirement under Regulation S-P for notice delivery?
Answer: Deliver an initial privacy notice at account opening and annual notices as required, describing NPI practices
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, revising a privacy notice highlights how delivery must occur at specific times. The correct choice, A, accurately reflects Regulation S-P's notice delivery rules. A common distractor, B, fails because it ties notices to AML triggers incorrectly. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts.
- After an email compromise, what practices help prevent data breaches in customer financial records and preserve required books and records?
Answer: Implement DLP, secure journaling/archiving, incident logging, and access reviews while retaining communications as required
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, handling an email compromise highlights how data loss prevention and archiving preserve records. The correct choice, B, accurately reflects SEC and FINRA requirements for secure retention. A common distractor, A, fails because purging archives violates retention rules. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Incident response plans are crucial.
- A broker-dealer receives a FINRA request; how does a broker-dealer ensure compliance with record retention policies and retrieval?
Answer: Maintain indexed records in an easily accessible place for required periods, with prompt production capability
This question tests the application of recordkeeping and privacy requirements in the securities industry. Recordkeeping ensures accurate documentation and compliance, while privacy rules like Regulation S-P protect customer information. In this scenario, responding to a FINRA request highlights how records must be maintained for prompt retrieval. The correct choice, A, accurately reflects SEC Rule 17a-4's accessibility and retention requirements. A common distractor, B, fails because it limits production, violating regulatory obligations. To improve understanding, focus on key regulatory requirements and their practical applications, ensuring clarity between similar concepts. Indexing systems aid compliance.
