SEC Phase 1 cheat sheet

Regulation is a binding legal instrument adopted by a designated authority; non-compliance exposes the firm and individuals to enforcement action, fines, censure, or prohibition.

Primary sources of regulation in securities markets: statute (e.g., securities act), delegated regulations, and regulator-issued rules; statute prevails over delegated regulation where they conflict.

Regulatory scope typically covers registration/licensing, capital adequacy, conduct of business, recordkeeping, market abuse, and reporting to the regulator.

A regulated firm must obtain authorization before conducting regulated activity; performing a regulated activity without authorization is a criminal or administrative offence.

Regulators derive powers from statute: investigation, information requests, inspection, disciplinary sanction, and referral for prosecution.

Approved persons/registered representatives must be fit and proper: competence, honesty, financial soundness, and no disqualifying disciplinary history.

Territorial reach: regulation applies to activities performed within the jurisdiction and may extend extraterritorially to firms marketing to or from that jurisdiction.

Breach reporting duties: material breaches, fraud, and client-money shortfalls must be escalated internally and reported to the regulator within prescribed timeframes.

Rule hierarchy: statute > regulation > regulator rulebook > exchange/self-regulatory rules > internal policy; a lower level cannot contradict a higher one.

Know-your-client rule: collect and verify identity, investment objectives, risk tolerance, financial position, and beneficial ownership before onboarding.

Suitability rule: a recommendation must be suitable for the client's stated objectives, risk profile, and financial circumstances; record the basis for the recommendation.

Best execution: take all reasonable steps to obtain the best available result for clients considering price, cost, speed, likelihood of execution and settlement, size, and nature of the order.

Client order handling: execute client orders promptly and fairly; client orders take precedence over proprietary orders; disclose and manage conflicts.

Client asset rules: segregate client money and assets from firm assets, reconcile regularly, and hold in designated accounts/registries.

Recordkeeping: retain order, trade, communication, and suitability records for the prescribed retention period (commonly 5-7 years) and produce on request.

Market conduct rules: prohibitions on insider dealing, market manipulation, false or misleading statements, and improper disclosure of inside information.

Core conduct principles: integrity, due skill care and diligence, fair treatment of clients, management of conflicts, market integrity, and compliance with the law.

Integrity principle: a person must be honest and observe standards of market conduct; it applies to conduct both inside and outside the workplace where relevant to fitness.

Conflicts of interest: identify, prevent, or manage; disclose material conflicts that cannot be managed; maintain an independence policy and conflicts register.

Personal account dealing: pre-clearance required, no dealing ahead of client orders, no short-term trading for profit, and periodic disclosure of holdings.

Gifts and entertainment: register and threshold limits; gifts must not be intended to influence conduct; regulator notification above prescribed values.

Inside information: do not deal, tip, or encourage others to deal; apply restricted lists, information barriers, and wall-crossing procedures.

Whistleblowing: firms must provide protected channels for reporting breaches; retaliation against a good-faith reporter is prohibited.

Fitness and propriety: disciplinary history, criminal records, and regulatory references must be assessed and disclosed to the regulator.

Guidance/guidelines are not binding law but set out the regulator's expected standard; departing from them requires documented rationale and equivalent alternative measures.

Policy hierarchy: board-approved policy > business-unit procedures > desk-level operating instructions; each must map to the underlying rule requirement.

Policy lifecycle: risk assessment, drafting, approval, communication and training, monitoring and testing, review at least annually or on regulatory change.

Three lines of defence: business unit owns risk, compliance/risk functions oversee, internal audit provides independent assurance.

Compliance monitoring programme: risk-based plan, testing of controls, findings logged, remediation tracked with owners and deadlines, reported to the board.

Outsourcing policy: due diligence on the provider, written agreement, regulatory notification where required, exit plan, and retained accountability for outsourced functions.

Training and competence: role-appropriate training at induction and annually, records retained, competence assessed before staff perform regulated activity.

Breach and incident management: log, assess impact, remediate, report internally and to the regulator where required, and feed lessons into policy revision.