Reporting, Disclosure, and Recordkeeping
What the domain tests
This domain tests periodic regulatory returns, ad hoc notifications, client disclosure, financial reporting, record retention, data integrity, audit trails and breach reporting.
Core rules and concepts
- Periodic returns must be accurate, complete and submitted by the deadline. A return is a regulatory representation, not an internal draft.
- Ad hoc notifications cover breaches, material errors, changes in control, systems failures and other specified events. Promptness matters; waiting for the annual audit is not acceptable.
- Client disclosure must be clear, fair and not misleading, and must be made at the right time and in a durable medium where required.
- Records must be retained for the prescribed period, which may run from the transaction date or from the end of the client relationship. Records include emails, instant messages and call recordings where relevant.
- Data integrity requires access controls, audit trails and protection against alteration.
Worked example
A firm discovers that a quarterly return overstated capital because a deduction was omitted. It should notify the regulator promptly, correct the return, explain the cause and remediate the control. It should not wait for the next scheduled return or assume the auditor will catch it.
Traps that cost marks
Assuming retention starts only at account closure; treating informal messages as outside the record; correcting a return without notifying; and disclosing to clients in a way that is misleading or untimely.