Complaints, Investigations, and Enforcement
Handling complaints
A complaint is any expression of dissatisfaction, whether oral or written. The firm must have a documented complaint-handling process with defined timelines, a designated handler, and a record of the outcome. The supervisor should ensure the client receives a clear response and that the complaint is analyzed for root causes. A common trap is a representative who resolves a complaint informally without recording it; the record is the control.
Investigations
When a potential violation is identified, the firm should open an investigation that is independent of the business unit involved, preserves evidence, and gives the subject an opportunity to respond. The supervisor's role is to escalate and cooperate, not to investigate their own conduct. Conflicts in the investigation must be managed, for example by assigning a different supervisor.
Enforcement
Regulatory enforcement can result in sanctions, conditions on registration, suspension, or expulsion. Firms must report certain events to the regulator, including disciplinary action against a representative and regulatory investigations. The exam often tests whether a firm may settle a client complaint confidentially; confidentiality clauses cannot prevent reporting to the regulator.
Traps to expect
Watch for questions about the limitation period for complaints and about whether a client must exhaust the firm's process before going to an ombudsman. Also watch for a supervisor who disciplines a representative without documenting the basis.
Worked rule of thumb
Apply the "three-record test" to every complaint: record the complaint, record the investigation and findings, and record the client communication. If any record is missing, the handling is deficient.
Recordkeeping, Reporting, and Technology Controls
What must be kept and for how long
Records must be accurate, complete, and retrievable for the required retention period. Core records include account applications, KYC and suitability documentation, order tickets, trade confirmations, statements, complaint files, supervisory reviews, and communications. The retention clock generally runs from the date of the record or the end of the relationship, whichever is later, and certain records must be kept longer. A common trap is treating emails as informal and exempt; client communications are records.
Reporting obligations
Firms must file financial reports, regulatory notices, and event-driven reports within prescribed deadlines. Late or inaccurate reporting is itself a violation. The supervisor should know which events trigger a report and who is responsible for filing.
Technology controls
Electronic records must be stored in a way that prevents alteration, supports retrieval, and preserves metadata where required. Access controls, audit trails, and backup and recovery plans are expected. Social media and messaging apps raise particular issues: off-channel communications that are not captured are a recordkeeping failure, even if the content is benign.
Traps to expect
A question may present a representative who uses a personal phone for client texts. The issue is not the device but whether the communication is captured and retained. Another trap is assuming a vendor's certification satisfies the firm's obligation; the firm remains responsible.
Worked rule of thumb
Apply the "retrieve and explain" test: could the firm produce this record within the required time and explain its context? If not, the control has failed.