The Nimbus Cloud: Retention, Vendor Undertakings, and Order Tickets
Ridgeline Securities, a government securities broker-dealer, keeps all order tickets, blotters and customer account records in a cloud system operated by Nimbus Data. The contract gives Ridgeline 90 days of online access; after that, Nimbus retrieves records only on a paid support ticket and refuses to sign any undertaking with regulators. Ridgeline keeps no local copies. The desk's emails and chat messages with institutional customers auto-delete after 60 days. Supervisory review of the desk consists of a monthly signature on a summary report; the underlying trade reviews were never created or retained. A customer complaint about a Treasury markup was resolved and the file then discarded.
1. Identify the recordkeeping deficiencies and the retention period for each category.
Read the worked answer
Three separate problems. (1) Records the firm is required to make under Rule 17a-3 must be preserved for six years under Rule 17a-4(a), the first two years in an easily accessible place; a 90-day access window falls far short, and a paid-ticket retrieval process is not 'easily accessible.' (2) Communications with customers relating to the firm's business must be kept three years, the first two easily accessible, under 17a-4(b)(4); a 60-day auto-delete destroys them systematically. (3) A resolved complaint file is a business record and must be retained, not discarded once the matter closes.
The supervisory point compounds the records point: a monthly signature is not evidence of review if no underlying review was performed or documented. An examiner will not accept a summary that cannot be tied to specific trades, prices and accounts.
2. Does the Nimbus arrangement satisfy the electronic records requirements? What must Ridgeline obtain or change?
Read the worked answer
No. Electronic records must be preserved in a non-rewriteable, non-erasable format or under the audit-trail alternative, with a verification process, per Rule 17a-4(f). Where an outside vendor holds the records, the firm must obtain from that vendor a written undertaking, filed with the examining authority, that records will be produced promptly on request and that the vendor will notify the firm before any change that would impair production.
Nimbus will not sign, so the arrangement fails. The firm is the party legally responsible for production; 'the vendor would not cooperate' is not a defense and will not mitigate an enforcement referral. The practical answer is to move to a compliant provider or maintain a compliant duplicate internally, and to document the retrieval process end to end.
3. What must an order ticket for a customer's Treasury trade show, and what must the supervisory file show about it?
Read the worked answer
The ticket must identify the security, the face amount, whether the order is a buy or a sell, the price (Treasuries quote in points and 32nds, so the ticket must show the convention used and the resulting decimal), the account, the date and time the order was received, and who executed it. Critically, it must show whether the firm acted as principal or agent, because that determines whether a markup or markdown must be disclosed to the customer.
For a principal trade the price must be supportable against contemporaneous market levels, and the supervisory file should show that a principal with authority reviewed the execution for fairness and for allocation among customer accounts. A signature on a monthly summary proves none of this.