Dealer Member Rules and Operations: Conduct, Books and Records
The rulebook in practice
Dealer Member rules govern how a firm conducts business: account opening, order handling, trade reporting, recordkeeping, supervision, and conflicts of interest. Candidates should know the core obligations: know-your-client and suitability, know-your-product, client complaint handling, and the requirement to maintain books and records sufficient to demonstrate compliance. Rules also address the handling of client orders, best execution considerations, and the prohibition on unauthorized trading.
Supervision and registration
Firms must supervise registered representatives and maintain a supervisory structure with designated supervisors. Registration categories (dealing representative, portfolio manager, chief compliance officer, chief financial officer) carry defined responsibilities. The CFO is accountable for financial reporting integrity and for the firm's capital and financial compliance. Understand the distinction between the firm's obligations and the individual registrant's obligations; both can be disciplined.
Operational controls
Operational rules cover trade confirmation and settlement, client statements, and the safeguarding of client assets. Firms must reconcile client accounts and maintain segregation. Business continuity and outsourcing arrangements are also within scope, because a failure in either can disrupt client service.
Traps
Questions often test whether a particular act requires firm approval, client consent, or both. Another frequent trap is conflating the supervisory obligation with the compliance department's role: supervision is a line-management duty, not solely a compliance function. Watch for questions on record retention periods and on whether a complaint must be escalated formally.
Worked rule of thumb
A representative executes a trade in a client account without instructions. This is unauthorized trading, a serious rule breach regardless of outcome. The firm must document the incident, review supervision, and consider client remediation. The rule of thumb: if the client did not authorize the specific transaction, supervisory escalation is mandatory even if the trade made money.
Key points
- KYC, suitability, and know-your-product are foundational conduct obligations.
- Books and records must demonstrate compliance, not merely exist.
- The CFO is accountable for financial reporting and capital compliance.
- Supervision is a line-management duty shared with compliance.
- Unauthorized trading is a breach even when profitable.
- Record retention and complaint escalation follow prescribed rules.
Risk Management: Identifying, Measuring and Mitigating Exposure
The risk taxonomy
A dealer faces market risk, credit risk, liquidity risk, operational risk, and conduct or reputational risk. Market risk splits into directional, volatility, and basis risk; credit risk includes counterparty and settlement exposure; liquidity risk covers both funding and market liquidity. Candidates must be able to map a scenario to the correct risk category and to the control that mitigates it.
Measurement and limits
Firms measure market risk with value-at-risk, stress testing, and scenario analysis. VaR has known limitations: it says nothing about losses beyond the confidence threshold and can understate tail risk. Stress tests complement VaR by modelling severe but plausible events. Risk limits are set at the desk, product, and firm level, and breaches must be escalated. Credit risk is managed through collateral, margin, netting, and counterparty limits.
Liquidity and contingency planning
Liquidity risk management requires holding sufficient liquid assets and maintaining a contingency funding plan. The interaction between margin calls and liquidity is critical: a sudden margin call can consume liquid assets quickly. Operational risk covers process failures, systems, fraud, and outsourcing; controls include segregation of duties, reconciliation, and business continuity planning.
Traps
Expect questions that confuse VaR with maximum possible loss, or that assume diversification eliminates risk rather than reducing it. Another trap: treating stress testing as redundant with VaR. Also watch for questions on who owns risk limits (the business line proposes, independent risk approves and monitors).
Worked rule of thumb
A portfolio has a one-day 99% VaR of $2 million. This means that on 99% of days, losses should not exceed $2 million; it does not cap losses at $2 million. A stress scenario should model a far larger loss, perhaps $8 million, to test whether the firm's capital and liquidity can absorb it. Always pair a VaR figure with a stress estimate in analysis.
Key points
- Know the five core risk categories and their controls.
- VaR does not bound maximum loss; stress testing covers tails.
- Risk limits exist at desk, product, and firm level with escalation rules.
- Collateral, margin, and netting mitigate credit exposure.
- Margin calls can rapidly consume liquidity; plan for contingency funding.
- Independent risk functions approve and monitor limits.
Internal Controls and Ethics: Tone, Testing and Trust
The control framework
Internal controls are the processes that provide reasonable assurance of reliable reporting, effective operations, and compliance. The COSO framework identifies five components: control environment, risk assessment, control activities, information and communication, and monitoring. Candidates should know the difference between preventive controls (approvals, segregation of duties) and detective controls (reconciliations, reviews), and understand that no control system provides absolute assurance.
Ethics and conflicts
Ethical conduct underpins market integrity. Core duties include acting honestly and in good faith, avoiding conflicts of interest or managing them through disclosure and avoidance, protecting client confidentiality, and refusing to participate in manipulative or deceptive practices. The CFO sets the tone at the top: financial reporting integrity, whistleblower protection, and a culture where escalation is safe. Gifts, outside business activities, and personal trading require disclosure and approval.
Testing and remediation
Controls must be tested, not merely documented. Deficiencies are classified by severity, and material weaknesses require disclosure and remediation. Internal audit provides independent assurance. Segregation of duties is a key preventive control: the person who initiates a transaction should not also approve and reconcile it.
Traps
Questions often present a scenario where a control exists on paper but is not operating, testing whether the candidate recognises an operating deficiency versus a design deficiency. Another trap: assuming disclosure alone resolves a conflict when avoidance is required. Watch for questions on whether a small firm can rely on compensating controls.
Worked rule of thumb
A single employee both executes trades and reconciles the brokerage statements. This is a segregation-of-duties failure. The fix is to separate initiation from reconciliation, or, in a small firm, add an independent review by the CFO or an external party. Rule of thumb: if one person could commit and conceal an error or fraud, the control is inadequate regardless of documentation.
Key points
- COSO's five components frame internal control assessment.
- Preventive controls stop errors; detective controls find them.
- Controls must be tested for operating effectiveness, not just designed.
- Conflicts require avoidance or managed disclosure, not silence.
- Segregation of duties separates initiation, approval, and reconciliation.
- Tone at the top and safe escalation channels are CFO responsibilities.