We Keep the PDF, So What's the Problem?
Meridian Research Partners stores final research reports as PDFs on a shared drive and deletes drafts, models, and analyst notes after 90 days "to keep the drive lean." Public appearance notes are kept only if the analyst remembers to save them. Responding to a FINRA request, Meridian produces 22 final reports but cannot produce the spreadsheet behind a $72 price target, the two prior drafts of a downgrade note, the panel notes from a March industry conference, or any Regulation AC certifications. Separately, two analysts use personal phones with disappearing-message apps for group chats with institutional clients because "clients prefer it." The COO asks whether any of this is a problem, given that "the final report is what clients actually see."
1. Which records must Meridian retain, for how long, and why is "we keep the final PDF" the wrong standard?
Read the worked answer
The final PDF is the output; the rule is about the evidence behind it.
- Reports and the work behind them. Research reports, the supporting analysis (models, backup data, valuation inputs), and the record of principal review must be preserved. The spreadsheet behind a published $72 target is the only way to test whether the target had a reasonable basis.
- Public appearances. Notes, scripts, or recordings, plus the date, venue, and subject, and the analyst's Regulation AC certification for the appearance.
- Certifications and reviews. Regulation AC certifications and evidence of supervisory approval.
- Communications. Business-related emails, texts, and chat messages with clients about covered companies, including the group chats - the medium does not change the status.
- Retention. Communications and research-related records generally must be kept for at least three years with the first two readily accessible, and certain books and records for longer. Deleting at 90 days fails both the retention period and the accessibility requirement.
- The trigger is the record type and its business purpose, not whether a client ever sees it.
2. What is the firm's exposure on the personal-phone, disappearing-message chats, and what must it do now?
Read the worked answer
This is off-channel business communication - a live supervisory failure, not a preference issue.
- Content on personal devices about firm business is a firm record. Disappearing-message settings mean the firm cannot retain, review, or produce it - undermining supervision and recordkeeping at once.
- If the firm has reason to believe the messages concern recommendations, price targets, or client orders, non-production to FINRA is a serious matter independent of what the messages said.
- Immediate steps: issue a firm-wide instruction to stop using personal devices and ephemeral apps for business; disable the apps or require migration to approved channels; collect and preserve whatever remains from the two analysts' devices with counsel involved; notify FINRA of the preservation issue and a remediation timeline rather than waiting to be asked; and impose heightened supervision on the two analysts.
- Going forward: approved-device-only policy, capture and archive of all business channels, periodic attestations, and testing that the archive actually captures what the policy promises.
3. The COO wants a one-page answer for the examiners. What is the defensible remediation plan, and what should the firm not say?
Read the worked answer
Say what happened, what is missing, and what changes - in that order.
- Acknowledge the gap precisely. Identify which required records are unavailable (the target model, two drafts, the panel notes, all Regulation AC certifications) and for what periods. Vagueness reads as concealment.
- Preserve what exists. Issue a litigation hold, suspend the 90-day deletion immediately, and image devices and drives before any cleanup.
- Rebuild retention. Adopt a schedule keyed to record type and retention period; capture drafts, models, review evidence, appearance files, and certifications at the point of creation rather than by analyst memory; assign an owner and test quarterly.
- Fix the control that failed. The 90-day deletion was a deliberate policy - name who approved it and change the approval authority for record destruction.
- Remediate supervision. Confirm principal review is documented, and pair the retention fix with the appearance and quiet-period controls so the same analysts are not simply generating better-documented violations.
Do not say: "the final report is what clients see," "the model is proprietary," or "the analysts' texts were personal." Each is an admission that the firm decided which records mattered after the request arrived.