Recordkeeping, Reporting and Privacy Requirements
Recordkeeping, reporting, and privacy
This domain tests the records a firm must create, how long it keeps them, what it files, and how it protects customer information. Under SEC Rules 17a-3 and 17a-4, firms must make and preserve books and records: blotters, ledgers, order tickets, confirmations, account records, and communications. Core books and records are generally kept six years, with the first two years easily accessible; correspondence and communications are typically retained three years; customer complaint records are kept four years under FINRA Rule 4513. Electronic records must be preserved in a compliant, retrievable format.
Reporting obligations include FOCUS reports, annual audited financial statements under Rule 17a-5, early-warning notices under Rule 17a-11, Form U4 and U5 filings, and suspicious activity reports. Privacy obligations arise under Regulation S-P-notice, opt-out for sharing with nonaffiliated third parties, safeguards, and disposal-and Regulation S-ID, which requires an identity theft prevention program. NYSE Rule 440 reinforces the books-and-records duty.
Traps
The most common error is mixing retention periods-core books and records generally live longer than communications, and complaints have their own four-year rule. Another trap is assuming a privacy notice is optional for existing customers; annual notices and safeguards apply. Suspicious activity report confidentiality is strict: the firm cannot tell the customer a report was filed.
Rule of thumb
Use a "6-2-3-4" memory aid: six years for core books, first two easily accessible; three years for communications; four years for complaints.
Worked example: A customer emails a complaint alleging unauthorized trading. The firm must route it to the complaint system, retain the email and complaint record for four years, and preserve related communications for three years-without disclosing any suspicious activity report filing.