Record retention

There are many records that must be kept, and those records have to be kept for different amounts of time. For all of these, the first 2 years the record must be kept in an “easily accessible location”. Records can be kept on paper, on micrographic media (microfilm or microfiche), or electronically. Electronic records must be kept either in a format that can’t be rewritten or erased, or in a system that keeps a complete time-stamped audit trail of every change, so the original record can always be re-created.

Most brokerage records default to a 3-year retention period; the sections below cover the shorter exception lists (4, 5, 6 years, and lifetime) first since they’re easier to memorize, before the three-year default. (One exception to the default: a record that FINRA’s own rules require, with no period stated in any FINRA or SEC rule, is kept 6 years under FINRA Rule 4511(b).)

Four year records

Complaints. Customer complaints are held for 4 years under FINRA Rule 4513. If the question specifically asks for MSRB complaints, MSRB complaints (per MSRB Rule G-9) are held for 6 years, but if it doesn’t specifically say MSRB, then the answer is the complaint is held for 4 years. How firms handle and report complaints is covered at the end of this chapter.

Five year records

These are primarily verification documents. Verifying the money, and verifying the client.

All FINCEN documents, CTRs, SARs, are held for 5 years. These can be thought of as verifying that the money is clean.

Customer identification records are also held for 5 years: the identifying information a customer provides (name, date of birth, address, and ID number) for 5 years after the account is closed, and the record of how their identity was verified, such as a description of their driver’s license, for 5 years after that record is made. These can be thought of as verifying that the person is clean, and not some person on the Specially Designated Nationals (SDNs) or some other blocked person.

Six year records

Blotters, ledgers, and stock and customer account records are kept for 6 years, the first 2 in an easily accessible place (SEC Rule 17a-4(a)).

Definitions

Blotter

The original book of entry containing an itemized daily record of all purchases and sales of securities, all receipts and deliveries of securities, and all receipts and disbursements of cash.

Ledger

An accounting book; another type of original book of entry.

Records

Stock records and customer account records; together with blotters and ledgers, these are the “seriously important documents” in this category.

Lifetime records

These are the birth certificate documents. These are the documents that without, the company basically doesn’t exist.

The easiest of these is the corporate charter or partnership agreement, which establishes a firm’s legal existence and is kept for the life of the firm (Goldman Sachs, for example, still holds the charter under which it was formed over 150 years ago). This same logic applies to partnership agreements and articles of incorporation.

All amendments to filing documents must also be kept for the lifetime of the firm.

All board meeting minutes are also kept for the lifetime of the firm.

Three-year records

Most records are actually kept for three years. The reason they are the last on the list, is because it is generally a lot easier to memorize the 4, 5, 6, and lifetime records, and then think “if it isn’t one of them, go with 3 years”.

Most brokerage records, as stated, are 3 years. Listing all the different ones, would itself, fill most of a book, which is why you should memorize the others, and if it isn’t one of them, go with 3 years.

The most common 3-year documents would include;

Trade confirmations, communications, U-4 and U-5, order tickets, notices, monthly trial balances, net capital computations, fingerprint cards, records of lost/stolen/missing/counterfeit securities, compensation records, among many others.

To be clear, the U-4 can be a little tricky, as it is actually kept for as long as the associated person is at the firm, and then 3 years after departure. The U-5, being created only at departure, would therefore only be kept for 3 years, but the U-4, if you work for the same company for 10 years and then move to another one, or retire, that company would have kept your U-4 for a total of 13 years, the 10 you worked for them, and then the 3 years required after you left.

Lost, stolen, missing, and counterfeit securities (SIC)

We always have to be careful of lost and stolen securities. Although it doesn’t happen as much as it looks like it does in TV and movies, but it has and could happen. The Securities Information Center (SIC) was established to help identify, intercept, and prevent serious problems with lost and/or stolen securities.

Under SEC Rule 17f-1, every reporting institution must check with and report to the SIC. Reporting institutions include every national securities exchange and its members, registered securities associations, brokers, dealers, municipal and government securities dealers, registered transfer agents, registered clearing agencies and their participants, members of the Federal Reserve System, and FDIC-insured banks: in practice, almost everyone involved in the industry.

It may seem obvious what the difference between something that is “lost” and something that is “stolen”, and in reality, it clearly is, but in test world, they can be less obvious. Effectively, if you’ve reorganized the office, had a new filing system, something like that and can’t find a certificate, that is implying lost. If the office was broken into, and you can’t find a certificate, that implies it was stolen.

• If the institution believes theft or criminal activity was involved, it must report to the SIC and the issuer’s transfer agent within 1 business day of the discovery, and promptly report to the FBI.
• If the institution finds that securities are missing, lost, or some other way can’t be found, but no criminal activity is suspected, the firm has 2 business days to try to locate the securities. If they can’t be found in 2 days, they have 1 business day to report it to SIC and the transfer agent of the issuer of the security.
• If securities are lost in transit to a customer, transfer agent, bank, broker, or dealer, the delivering institution must report them by the later of 2 business days after notice of non-receipt, or as soon after that as the certificate numbers can be ascertained. For a shipment of retired certificates between unaffiliated institutions where the delivering firm gets no notice of receipt or non-receipt, it must find out what happened, and if the certificates aren’t recovered, report them within a reasonable time, and no later than 20 business days after shipment.
• Securities found lost or missing in a securities count or verification must be reported by the later of 10 business days after the count is completed, or as soon after the count as the certificate numbers can be ascertained.
• Every institution must report the discovery of counterfeit securities to the SIC, the issuer’s transfer agent, and the FBI within 1 business day.
• If a previously reported lost/missing/stolen security is recovered, must report it to the SIC, and the transfer agent of the issuer. If it was originally reported stolen, the firm must also notify the FBI the securities have been recovered.

Inquiries to SIC

There are times when we need to actually check securities, as part of the interception of the lost/missing/stolen securities; maybe someone stole them, and are trying to give them to us to sell. Firms must inquire to the SIC, about every security that comes into their possession, with the exception of the following

• The certificates are received directly from the issuer or issuing agent at issuance
• The certificates are received from another reporting institution or from a Federal Reserve Bank or Branch
• The certificates are received from the customer, and are registered in the name of the customer or were previously sold to the customer as verified by internal records of the firm.
• The certificates are part of a transaction with an aggregate face amount of $10k or less for bonds, or $10k or less market value for stocks, or
• The certificates are received directly from a drop which is affiliated with the reporting institution for purposes of receiving/delivering certificates on behalf of the reporting institution

That is a lot of effective negatives, and any one of them is enough: a transaction of $10k or less needs no inquiry, whoever delivers the certificates. When no other exception applies, the most common examples where they may try and trick you up, would be if the certificates are delivered by a customer, but are registered in street name, not in the customer’s name. SIC would need to be inquired. Similarly, if securities are delivered by someone who is not currently a customer of the firm, the firm must inquire to SIC.

Customer complaints

A customer complaint is any grievance by a customer, or someone authorized to act for the customer, about the firm or an associated person in connection with soliciting or executing a transaction, or handling the customer’s funds or securities (FINRA Rule 4513). Written includes electronic: an email or a text is a written complaint.

Every firm’s written supervisory procedures must include procedures to capture, acknowledge, and respond to all written customer complaints (FINRA Rule 3110(b)(5)). Reviewing correspondence is one way a firm captures them.

Each office of supervisory jurisdiction keeps a separate file of the written complaints that relate to it, including complaints about activity supervised from that office, along with any action the firm took. The firm can instead keep them elsewhere and make them promptly available at the OSJ when FINRA asks. Either way, they are kept 4 years (FINRA Rule 4513). An MSRB firm keeps an electronic log of every written complaint about municipal securities, coded by product and problem, for 6 years (MSRB Rules G-8 and G-9).

Complaints are also reported to FINRA under FINRA Rule 4530:

• Quarterly: statistical and summary information on all written customer complaints, by the 15th day of the month after the end of each calendar quarter.
• Within 30 calendar days: a written complaint that alleges theft or misappropriation of funds or securities, or forgery. It is reported on its own and also counted in the quarterly statistics.
• Within 30 calendar days: other events, such as a regulator finding that the firm or one of its people violated securities rules, a settlement or award over $15,000 involving an associated person ($25,000 when the firm is the party), or a firm disciplining an associated person with a fine or withheld pay over $2,500, a suspension, or a termination. So does the firm’s own conclusion that it or one of its people violated securities rules.

Example: Two complaints in one quarter

On May 4, a branch receives two customer emails. One complains that monthly statements keep arriving late. The other says the customer’s signature on a withdrawal form was forged. The branch logs both and acknowledges both. The forgery complaint must be reported to FINRA by June 3, within 30 calendar days. Both complaints appear in the second-quarter statistics, due July 15, and both stay in the complaint file of the OSJ that supervises the branch for 4 years.

For municipal securities, an MSRB firm must also tell each of its municipal securities customers in writing, once every calendar year, that it is registered with the SEC and the MSRB, and that an MSRB brochure describing investor protections and how to file a complaint is available on msrb.org (MSRB Rule G-10).