FINRA Series 6 — All Questions

A member recommends a bond to an institutional account. Customer-specific suitability under Rule 2111(b) is satisfied if the member reasonably believes the customer can evaluate investment risks independently and the customer:

• a.Signs a waiver of suitability protections that the customer's board of directors has approved
• b.Affirmatively indicates it is exercising independent judgment in evaluating recommendations✓
• c.Has held an account at the member for at least five consecutive years without a complaint
• d.Reports total assets above $50 million on the member's most recent account form

Rule 2111(b) sets two conditions for an institutional account: the member has a reasonable basis to believe the customer can evaluate investment risks independently, both in general and for the particular transactions, and the customer affirmatively indicates that it is exercising independent judgment in evaluating the member's recommendations. The $50 million threshold appears in the Rule 4512(c) definition of an institutional account, but it is not the second condition. Account tenure is not a test. The rule does not call for a blanket waiver of protections.FINRA Rule 2111(b)

A representative with no discretion and no control over a non-retail customer's account recommends a series of trades that, taken together, produce turnover and costs far beyond what the customer's profile supports. Can Rule 2111 quantitative suitability apply?

• a.No, because the rule tests each recommended transaction individually and never as a series
• b.Yes, but only if the trades were executed in a discretionary account approved by a principal
• c.Yes, because actual or de facto control is no longer an element of quantitative suitability✓
• d.No, because quantitative suitability applies only when the member has actual or de facto control

Rule 2111.05(c) asks whether a series of recommended transactions, even if suitable when viewed in isolation, is excessive and unsuitable for the customer when taken together in light of the customer's investment profile. FINRA removed the control element from the quantitative obligation effective June 30, 2020, so a representative without control can still be liable. The control requirement belongs to the earlier version of the rule. The rule expressly looks at a series of transactions, and it does not require a discretionary account.FINRA Rule 2111.05(c)

A representative tells a non-retail customer to keep holding a large position in a single stock rather than diversify. Does Rule 2111 reach that advice?

• a.No, because suitability covers only recommendations to buy, sell or exchange a security
• b.Yes, but only if the representative earns a commission on the position each period
• c.Yes, because a recommendation to hold is an investment strategy under the rule✓
• d.No, because advice to keep an existing position is market commentary, not a recommendation

Rule 2111.03 says the phrase investment strategy involving a security or securities is to be interpreted broadly and includes an explicit recommendation to hold a security. Advice to keep a concentrated position is therefore a recommendation that must meet the suitability obligations for a customer outside Reg BI. The rule is not limited to buy, sell or exchange recommendations, and the compensation the representative earns does not decide whether it is a recommendation.FINRA Rule 2111.03

A firm last inspected one of its offices of supervisory jurisdiction (OSJ) in March 2025. What does Rule 3110 require for 2026?

• a.No inspection until March 2028, because every branch is on the same three-year cycle
• b.An inspection in 2026 or 2027, since the firm may pick either year within a two-year window
• c.An inspection by March 2026, because the annual cycle runs from the date of the last inspection
• d.An OSJ inspection during calendar year 2026, since the annual requirement runs on a calendar-year basis✓

Rule 3110(c)(1)(A) requires the member to inspect every OSJ, and any branch office that supervises non-branch locations, at least annually, on a calendar-year basis. That means an inspection must take place in each calendar year, so 2026 needs one even though the last one was in March 2025. The rolling twelve-month reading is not what the rule says. The three-year cycle belongs to non-supervisory branch offices under (c)(1)(B), not to an OSJ. No two-year window exists.FINRA Rule 3110(c)(1)(A)

A firm plans to hire an experienced representative who starts next Monday. Under Rule 3110(e), when must the firm investigate the applicant's good character, business reputation, qualifications and experience?

• a.Within 30 days after the firm files the person's Form U4 with FINRA
• b.Before the person's first customer trade, though the U4 may be filed earlier
• c.Before it applies to register the person, and before the Form U4 is filed✓
• d.Within 60 days after the person's first day on the firm's payroll

Rule 3110(e) requires the member to ascertain by investigation the good character, business reputation, qualifications and experience of an applicant before the member applies to register that person with FINRA. Waiting until after the Form U4 is filed is too late. The 30-day period in the rule applies to verifying the accuracy of the Form U4, which is a separate step. A deadline tied to the first day of work or first trade does not match the rule.FINRA Rule 3110(e)

A firm files a new representative's Form U4 on June 1. By what date must it have verified the accuracy of the information in that Form U4 under Rule 3110(e)?

• a.July 31, because the limit is 60 calendar days from filing
• b.July 1, which is 30 calendar days after the form is filed✓
• c.June 15, because the limit is two weeks from filing
• d.September 1, because the limit is 90 calendar days from filing

Rule 3110(e) requires the member to verify the accuracy and completeness of the Form U4 no later than 30 calendar days after the form is filed. June 1 plus 30 calendar days is July 1. The 60-day figure is the separate period for reviewing the applicant's prior registration documents, so it is the right number for the wrong step. Neither 90 days nor two weeks appears in the rule.FINRA Rule 3110(e)

Under Rule 3120, the designated principal's annual report to senior management must detail which of the following?

• a.Every customer complaint received during the year, with the resolution reached for each one
• b.The supervisory controls, test results with significant exceptions, and amended procedures✓
• c.Each registered representative's total commissions for the year, ranked from highest to lowest
• d.The firm's net capital computation for each month of the prior year, with its FOCUS filings

Rule 3120(a) requires a report, at least annually, detailing the member's system of supervisory controls, a summary of the test results and significant identified exceptions, and any additional or amended supervisory procedures created in response. A tabulation of complaint reports made to FINRA is added only for larger firms under paragraph (b), and it covers reports made to FINRA rather than every complaint received. Net capital and representative compensation are not part of the report.FINRA Rule 3120(a)

A member reported $240 million in gross revenue for calendar year 2025. What must its 2026 Rule 3120 report to senior management include beyond the standard content?

• a.A CEO certification of its compliance processes in place of the principal's annual report
• b.Nothing more, because the added content applies only at $1 billion or more in gross revenue
• c.A tabulation of every complaint received, reported or not, plus an audit by an outside accountant
• d.A tabulation of its complaint and investigation reports to FINRA, plus a six-area compliance discussion✓

Rule 3120(b) applies to a member that reported $200 million or more in gross revenue in the preceding calendar year, so $240 million for 2025 triggers it for the 2026 report. The report must add a tabulation of the reports on customer complaints and internal investigations made to FINRA during the preceding year and a discussion of the firm's compliance efforts in six areas, including antifraud and sales practices, supervision and anti-money laundering. The $1 billion figure is not in the rule. The CEO certification is a separate Rule 3130 duty and does not replace the report.FINRA Rule 3120(b)

A member names a principal as its chief compliance officer under Rule 3130. How must the member identify that person to FINRA?

• a.Specifically, on Schedule A of Form BD, as one of its designated principals✓
• b.On its Form CRS, which must name the principal handling compliance
• c.In the annual audited report the firm files under SEC Rule 17a-5 each year
• d.On Form U5, filed when the principal accepts the compliance role at the firm

Rule 3130(a) requires each member to designate and specifically identify to FINRA, on Schedule A of Form BD, one or more principals to serve as chief compliance officer. Form U5 reports the end of a person's registration with a firm, not a new role. Form CRS is a customer disclosure document, and it does not name the compliance officer. The Rule 17a-5 annual report is a financial filing and is not where the designation is made.FINRA Rule 3130(a)

A member's CEO is about to sign the annual compliance certification under Rule 3130. Which statement must the CEO be able to make?

• a.That no complaint against the firm was reported to FINRA in the preceding year
• b.That the CEO met with the CCO within the preceding 12 months to discuss the processes✓
• c.That the chief compliance officer reviewed each representative's trades and found no violations
• d.That the CEO personally tested every written supervisory procedure during the preceding year

Rule 3130 requires the CEO to certify that the member has processes to establish, maintain, review, test and modify its compliance policies and written supervisory procedures, and that the CEO has conducted one or more meetings with the chief compliance officer in the preceding 12 months to discuss them. The certification does not require the CEO to test procedures personally. It does not promise that no violations occurred, and it says nothing about the absence of complaints.FINRA Rule 3130(b)-(c)

A Series 6 representative wants to open a brokerage account at another firm for her own trading in stocks. What does Rule 3210 require?

• a.Her employer's prior written consent, and written notice to the other firm✓
• b.Her employer's consent, with any notice to the other firm left to her discretion
• c.Written notice to her employer within 30 days after the account opens, and nothing more
• d.Approval only if the account is a margin account, since cash accounts are exempt

Rule 3210(a) bars an associated person from opening an account at another member or financial institution in which securities transactions can be effected and in which she has a beneficial interest, without the employer's prior written consent. Under paragraph (b) she must also notify the executing firm in writing of her association before the account is opened. Notice after the fact does not satisfy the rule. The notice to the other firm is not optional, and the rule covers cash accounts as well as margin accounts.FINRA Rule 3210(a)-(b)

A Series 6 representative wants to open an account at an unaffiliated broker-dealer that will be used only to buy and sell open-end mutual fund shares. Is the Rule 3210 consent-and-notice process required?

• a.No, because accounts limited to redeemable shares of registered investment companies are outside the rule✓
• b.Yes, because the rule covers every account in which she has a beneficial interest, whatever it holds
• c.No, but only if the account balance stays under $25,000 for as long as the account is open
• d.Yes, but only the notice to the other firm, since her employer's consent is not needed for funds

Rule 3210.03 provides that the rule does not apply to accounts in which transactions are limited to certain products, including redeemable securities of registered investment companies such as open-end mutual funds, as well as unit investment trusts, municipal fund securities and variable contracts. A fund-only account therefore needs neither the employer's consent nor the notice. The rule does not cover every account regardless of holdings, and the exclusion has no dollar threshold.FINRA Rule 3210, Supplementary Material .03

A representative tells a nervous customer, "Buy this fund, and if it ever falls below what you paid, I will make up the difference from my own pocket." Can the firm approve the promise in writing so that it becomes permissible?

• a.Yes, if the customer signs a document acknowledging that the promise is not binding
• b.Yes, if the representative's firm approves the promise in writing before the purchase
• c.No, since guaranteeing a customer against loss is prohibited, with no route for firm approval✓
• d.Yes, but only if the promise covers no more than the commissions the representative earned on that purchase

Rule 2150(b) states that no member or person associated with a member shall guarantee a customer against loss in connection with any securities transaction or in any securities account. The text has no exception for firm approval, a customer acknowledgment or a cap tied to commissions, so the promise is improper however it is documented and whoever would fund it.FINRA Rule 2150(b)

A representative and an unrelated customer agree to share in the customer's account. The customer contributes $80,000 and the representative $20,000, and both the firm and the customer have given prior written authorization. Which sharing arrangement satisfies Rule 2150(c)?

• a.The representative takes 20% of profits, and the customer bears losses
• b.Any split they agree on, since the customer's authorization is what controls
• c.The representative takes 20% and the customer 80% of profits and losses✓
• d.A 50/50 split of profits and losses, because both parties agreed in writing

Rule 2150(c) allows sharing in a customer's account only with the prior written authorization of the member and of the customer, and the sharing must be in direct proportion to the financial contributions made to the account. The representative's $20,000 is 20% of the $100,000 total, so the representative takes 20% of the profits and bears 20% of the losses. Only an immediate family account escapes the proportion requirement. A 50/50 split, a profits-only share and a freely chosen split all depart from direct proportion.FINRA Rule 2150(c)

A firm files a new representative's application for registration on March 3. By what date must the firm review the applicant's prior Form U5 under Rule 3110(e), or show FINRA it made reasonable efforts to do so?

• a.April 2, which is 30 days counted from the filing
• b.March 17, which is only 14 days after the filing
• c.June 1, which is 90 days measured from the filing
• d.May 2, which is 60 days after the filing date✓

Rule 3110(e) requires the member to review the applicant's prior registration documents, such as the Form U5, within 60 days of the filing date of the application for registration, or demonstrate to FINRA that it made reasonable efforts to do so. March 3 plus 60 days is May 2, counting 28 days to March 31, 30 more to April 30 and 2 more. The 30-day period is the separate Form U4 accuracy check, and neither 90 nor 14 days appears in the rule.FINRA Rule 3110(e)

Before a broker-dealer opens an account for an individual who is a U.S. person, the Customer Identification Program must obtain which minimum set of identifying information?

• a.Name, street address, taxpayer identification number, and stated annual household income
• b.Name, date of birth, residential or business street address, and taxpayer identification number✓
• c.Name, address, taxpayer identification number, and a copy of unexpired photo ID
• d.Name, date of birth, address, and the person's current occupation and employer name

31 CFR 1023.220(a)(2)(i)(A) requires, at a minimum and prior to opening the account, the name, the date of birth for an individual, an address and an identification number, which for a U.S. person is a taxpayer identification number. A photocopy of photo identification is one way to verify identity, but the CIP may verify through non-documentary methods, so a copy is not part of the minimum information. Occupation, employer and income are suitability or account-record items, not CIP minimums.31 CFR 1023.220(a)(2)(i)

A deployed service member has no residential or business street address. What may the broker-dealer's CIP accept as the address when it opens her account?

• a.The address of the firm's branch, which is allowed when the customer has no other address
• b.Any post office box she rents, since a box satisfies the address requirement for any individual customer
• c.No account can be opened until she gets a street address, because the address is mandatory
• d.An APO or FPO box number, or the street address of a next of kin or another contact individual✓

The CIP rule requires a residential or business street address for an individual. For an individual without one, it permits an Army Post Office or Fleet Post Office box number, or the residential or business street address of a next of kin or another contact individual. An ordinary post office box does not meet the rule, and the rule provides an alternative rather than barring the account. Using the firm's own address would not identify the customer.31 CFR 1023.220(a)(2)(i)(A)(3)

A customer opens a brokerage account by mail with the identifying information the CIP requires. When must the broker-dealer verify the customer's identity?

• a.Within 90 days after opening, the outer limit the rule sets for completing verification
• b.Before the account is opened in every case, since no activity is allowed until verification is complete
• c.Within 5 business days after the first deposit clears, using only a copy of a government photo identification
• d.Within a reasonable time before or after opening, using documents, non-documentary methods or both✓

31 CFR 1023.220(a)(2)(ii) requires the CIP to verify identity within a reasonable time before or after the customer's account is opened, and the procedures must say when the firm uses documents, non-documentary methods or a combination. The rule does not require verification before opening in every case, and it sets no five-business-day or 90-day deadline. It also does not limit verification to a photo identification copy.31 CFR 1023.220(a)(2)(ii)

On March 10, 2024, a firm opens an account and records the type, number and place of issuance of the driver's license it relied on to verify the customer. The account is closed on June 1, 2026. Until what date must the firm keep that description of the document?

• a.June 1, 2029, three years after the account was closed
• b.March 10, 2027, three years after the record was made
• c.June 1, 2031, five years after the account was closed
• d.March 10, 2029, five years after the record was made✓

31 CFR 1023.220(a)(3)(ii) splits the retention periods. The identifying information collected under the CIP is kept for five years after the account is closed, while the description of any document relied on, the methods and results of verification, and the resolution of discrepancies are kept for five years after the record is made. The document description was made on March 10, 2024, so it must be kept until March 10, 2029. June 1, 2031 is correct only for the identifying information. The three-year figures do not appear in the rule.31 CFR 1023.220(a)(3)(ii)

A limited liability company opens a brokerage account. Its owners hold 40%, 30%, 20% and 10%, and its chief executive officer is a salaried manager who owns nothing. How many individuals must the firm identify and verify as beneficial owners?

• a.Two: only the individuals who own 25% or more of the equity interests in the company
• b.One: only the individual who has significant responsibility to control the company
• c.Three: the two individuals owning 25% or more, and one individual with control, the CEO✓
• d.Four: every owner, since the rule requires all equity holders to be identified

31 CFR 1010.230(d) defines a beneficial owner as each individual who owns 25 percent or more of the equity interests, which here means the 40% and 30% owners, and a single individual with significant responsibility to control, manage or direct the entity, such as an executive officer. The salaried chief executive officer fills the control prong, so three individuals are identified. The 20% and 10% holders fall below the threshold. Identifying only the owners, or only the controller, leaves out one of the two prongs.31 CFR 1010.230(d)

For which new account is the broker-dealer required to identify and verify beneficial owners as a legal entity customer?

• a.An investment company registered with the SEC under the Investment Company Act
• b.A corporation with a class of securities registered under Section 12 of the Securities Exchange Act
• c.A bank regulated by a state bank regulator that is opening a brokerage account
• d.A privately held corporation created by a public filing with a Secretary of State office✓

31 CFR 1010.230(e)(1) covers a corporation, limited liability company or other entity created by the filing of a public document with a Secretary of State, so a privately held corporation is a legal entity customer. Paragraph (e)(2) excludes, among others, issuers of securities registered under Section 12 of the Exchange Act, SEC-registered investment companies, and banks regulated by a state bank regulator, so no beneficial owner need be identified for those customers.31 CFR 1010.230(e)(2)

A broker-dealer receives a FinCEN information request naming a suspect, and the request does not change the scope of the search. What must the firm search for?

• a.Current accounts, accounts held in the prior six months, and transactions in the prior 12 months, in each case
• b.Current accounts, accounts held in the prior 12 months, and transactions in the prior six months✓
• c.All accounts and all transactions of the suspect during the preceding five full years
• d.Current accounts only, since earlier accounts and transactions are outside the scope of the request

Unless the request says otherwise, 31 CFR 1010.520(b)(3)(i) requires the institution to search for any current account for the named suspect, any account maintained during the preceding twelve months, and transactions or funds transmittals conducted by or for the suspect during the preceding six months that are required to be recorded or are recorded and maintained electronically. The periods are not interchangeable. The search is not limited to current accounts, and the rule does not call for a five-year search.31 CFR 1010.520(b)(3)(i)

After a FinCEN request, a firm's search finds an account for a long-standing customer, and the representative wants to tell the customer about the request. Is that permitted?

• a.No, the firm may not disclose the FinCEN request except as needed to comply with it✓
• b.Yes, if the customer has been with the firm for several years and is in good standing
• c.Yes, once the firm has reported the matching account to FinCEN within the time stated
• d.Yes, but only after the firm notifies its own senior management in writing of the plan

31 CFR 1010.520(b)(3)(iv)(B) bars a financial institution from disclosing to any person, other than FinCEN or the requesting agency, the fact that FinCEN has requested or obtained information, except to the extent necessary to comply with the request. Reporting to FinCEN does not lift the bar, and neither does the length or quality of the customer relationship. Internal notice to senior management does not authorize a disclosure to the customer.31 CFR 1010.520(b)(3)(iv)(B)

A customer will carry $8,000 in currency and $4,000 in traveler's checks from the United States to Canada on one trip. What reporting duty applies to the transportation?

• a.A report is needed only if the customer is not a U.S. citizen or a resident of the United States
• b.A report is needed only for the currency, because traveler's checks are not monetary instruments
• c.A report is required, because the currency and monetary instruments together exceed $10,000 at one time✓
• d.No report is needed, because neither the currency nor the checks alone exceeds $10,000

31 CFR 1010.340(a) requires a report from each person who physically transports currency or other monetary instruments in an aggregate amount exceeding $10,000 at one time out of or into the United States. The two amounts are added together, so $12,000 is reportable even though neither part exceeds the threshold. Traveler's checks are monetary instruments, and the duty applies to any person who carries the funds, not only to non-residents.31 CFR 1010.340(a)

A broker-dealer maintains a U.S. correspondent account for a foreign bank whose shares are not publicly traded. Absent an exception, what records must it keep in the United States?

• a.The identity of the foreign bank's regulator, with each branch's physical address abroad
• b.A copy of the foreign bank's license, with a list of each customer served by the account
• c.The identity of the bank's owners, and the name and U.S. address of an agent for legal process✓
• d.The foreign bank's tax returns for the last five years, together with its audited financial statements

31 CFR 1010.630(a)(2)(i) requires a covered financial institution with a correspondent account for a foreign bank to maintain records in the United States identifying the owners of each such bank whose shares are not publicly traded, and the name and street address of a person residing in the United States who is authorized, and has agreed, to accept service of legal process for records about the account. An exception exists where the bank has a Form FR Y-7 on file with the Federal Reserve. The rule does not call for tax returns, customer lists or regulator details.31 CFR 1010.630(a)(2)

A private banking account at a broker-dealer is owned by a senior foreign political figure. What additional step does the due diligence program require for that account?

• a.Written approval from the foreign government that the figure represents, before any deposit
• b.A quarterly report to the SEC listing every deposit to the account, with the source of each
• c.Closing the account within 30 days, as no firm may serve a foreign political figure
• d.Enhanced scrutiny to detect transactions that may involve proceeds of foreign corruption✓

31 CFR 1010.620(c)(1) requires the due diligence program, for a private banking account whose nominal or beneficial owner is a senior foreign political figure, to include enhanced scrutiny reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption. The rule does not ban such accounts, and it does not require quarterly reports to the SEC or foreign government approval.31 CFR 1010.620(c)

On March 12, 2026, a broker-dealer becomes aware that an intruder accessed sensitive customer information, and no delay has been authorized by the Attorney General. By what date must affected individuals be notified at the latest?

• a.April 11, 2026, which is 30 days after the firm became aware✓
• b.April 26, 2026, which is 45 days after the firm became aware of the access
• c.March 15, 2026, which is 72 hours after the firm became aware of the access
• d.May 11, 2026, which is 60 days after the firm became aware of the access

17 CFR 248.30(a)(4)(iii) requires notice as soon as practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. March 12 plus 30 days is April 11. The 72-hour figure is the period in which a service provider must notify the firm, a different duty. Neither 45 nor 60 days applies, and the Attorney General delay does not apply on these facts.17 CFR 248.30(a)(4)(iii)

A broker-dealer's cloud vendor discovers a breach of the system that holds the broker-dealer's customer data. Under Regulation S-P, the firm's vendor oversight policies must be designed to require the vendor to notify the firm within what time?

• a.As soon as possible, and no later than 72 hours after becoming aware of the breach✓
• b.Within 24 hours after the vendor first suspects any unauthorized activity in its systems
• c.Within 10 business days after the vendor completes its own internal investigation
• d.Within 30 days after becoming aware of the breach, matching the firm's own notice period

17 CFR 248.30(a)(5)(i)(B) requires service provider oversight policies reasonably designed to ensure that the provider notifies the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the provider maintains. The firm's own notice to affected individuals has the separate 30-day outer limit. No 24-hour or 10-business-day standard appears, and the clock does not wait for the vendor's investigation to finish.17 CFR 248.30(a)(5)(i)(B)

A broker-dealer's contract says its vendor will send breach notices to affected customers on the firm's behalf. The vendor fails to send them. Who remains responsible under Regulation S-P?

• a.The vendor alone, because the written agreement transferred the notice duty to the vendor
• b.Both parties equally, so the broker-dealer owes only half of any customer's remedy
• c.Neither party, because the notice duty ends once a written agreement exists for it
• d.The broker-dealer, because the duty to ensure that affected individuals are notified rests with it✓

17 CFR 248.30(a)(5)(ii) permits a written agreement under which a service provider notifies affected individuals for the institution, but paragraph (a)(5)(iii) provides that, despite the use of a service provider, the obligation to ensure that affected individuals are notified rests with the covered institution. The contract allocates the task, not the responsibility, and no rule splits the duty or ends it on signing.17 CFR 248.30(a)(5)(ii)-(iii)

After an incident, a broker-dealer cannot tell which customers' sensitive information was actually accessed in the affected system. What does Regulation S-P require about notice?

• a.Notice only to customers whose accounts were open during the period of the incident
• b.Notice only to the customers with the largest balances, since they face the greatest harm
• c.Notice to everyone whose sensitive information is in that system, save those found unaffected✓
• d.No notice, because notice is required only when specific affected individuals can be identified

17 CFR 248.30(a)(4)(ii) provides that if the firm cannot identify which individuals' sensitive information was accessed or used without authorization, it must notify all individuals whose sensitive customer information resides in the affected customer information system, though it need not notify an individual it reasonably determines was not affected. Inability to identify victims does not excuse notice, and the rule does not use account-open dates or balances as filters.17 CFR 248.30(a)(4)(ii)

Which of the following must a Regulation S-P breach notice to an affected individual include?

• a.A copy of the firm's incident report and its cost estimate for repairing the intrusion
• b.An incident description, the information involved, contact details and fraud alert guidance✓
• c.A complete list of the individual's records that were accessed, with the account numbers involved
• d.An offer of at least two years of free credit monitoring for every individual affected by the incident

17 CFR 248.30(a)(4)(iv) requires the notice to describe the incident in general terms and the type of sensitive information involved, to give the date or date range if reasonably determinable, to provide contact information, to recommend reviewing account statements, and to explain fraud alerts, credit reports and where to find Federal Trade Commission guidance. The rule does not require credit monitoring, an itemized list of the records involved, or the firm's internal report and costs.17 CFR 248.30(a)(4)(iv)

A small broker-dealer organized as a partnership has no board of directors. It adopts a written Identity Theft Prevention Program under Regulation S-ID. Who may give the required approval of the initial program?

• a.Any registered representative, since the program only affects customer accounts
• b.No approval is needed, because only firms with a board are required to adopt a program
• c.FINRA, which must approve each firm's initial program before the firm may use it
• d.A designated employee at the level of senior management, who stands in for the board✓

17 CFR 248.201(e)(1) requires approval of the initial written program from the board of directors or an appropriate committee of the board. Under paragraph (b)(2), for a financial institution without a board, the term board of directors means a designated employee at the level of senior management. The approval requirement does not disappear for firms without a board, and it is not delegated to a representative or to FINRA.17 CFR 248.201(e)(1)

When a broker-dealer periodically decides whether it offers or maintains covered accounts under Regulation S-ID, which factors must its risk assessment consider?

• a.The average account balance, the age of its customers, and the share held in retirement plans
• b.Its methods of opening accounts, its methods of access, and its previous experience with identity theft✓
• c.The number of SARs filed last year, its net capital position, and whether it self-clears
• d.The number of its representatives, the states it operates in, and its annual gross revenue

17 CFR 248.201(c) requires a financial institution to periodically determine whether it offers or maintains covered accounts, and, as part of that determination, to conduct a risk assessment of accounts described in paragraph (b)(3)(ii) that considers the methods it provides to open its accounts, the methods it provides to access its accounts, and its previous experiences with identity theft. Firm size, balances and customer demographics are not the listed factors, and SAR counts or net capital play no part in the assessment.17 CFR 248.201(c)

A company officer adopts a written Rule 10b5-1 trading plan on Monday, January 5, 2026. The issuer files its Form 10-Q for the first quarter on Friday, May 8, 2026, and two business days after that is May 12. When may trading under the plan begin?

• a.After 90 days, because ninety days is the full cooling-off period for an officer
• b.After May 12, because the cooling-off ends two business days after the Form 10-Q
• c.After 30 days, because that cooling-off period applies to every plan adopter
• d.Only after 120 days, since the later-of period is capped at 120 days✓

For a director or officer, Rule 10b5-1(c)(1)(ii)(B)(1) sets a cooling-off period equal to the later of 90 days after adoption or two business days after the issuer discloses results for the quarter in which the plan was adopted, with a maximum of 120 days after adoption. Here 90 days ends April 5 and the second business day after the Form 10-Q is May 12, which is 127 days after adoption, so the 120-day cap controls and the period ends May 5. The 90-day figure is only the floor, and the 30-day period applies to persons who are neither the issuer nor a director or officer.17 CFR 240.10b5-1(c)(1)(ii)(B)(1)

A registered representative learns of a pending merger from his brother, an employee of the target, and buys target shares. The brothers have no agreement to keep confidences and no history of sharing them. How does Rule 10b5-2 treat the duty?

• a.No duty exists, because without an agreement or a history of sharing confidences the rule does not reach relatives who owe the issuer no duty
• b.A duty exists and cannot be rebutted, because the rule treats every tip received from a sibling as confidential by its own terms
• c.A duty exists only when the brother is an officer or a director of the target company, not an ordinary employee
• d.A duty is presumed from the sibling tie, but he may show he neither knew nor should have known confidentiality was expected✓

Rule 10b5-2(b)(3) provides that a duty of trust or confidence exists whenever a person receives material nonpublic information from a spouse, parent, child, or sibling, but the recipient may show that no duty existed by establishing that he neither knew nor reasonably should have known the source expected confidentiality, because of the parties' history, pattern, or practice of sharing confidences and because there was no agreement to keep the information confidential. The family tie raises the presumption, and the facts given are the ones that support rebuttal. The rule does not require the source to be an officer or director, and it does not bar rebuttal.17 CFR 240.10b5-2(b)(3)

A broker-dealer employee learns from a friend at the bidder's investment bank that the bidder has taken substantial steps toward a tender offer for ABC, though nothing has been announced. The employee buys ABC shares. Under Rule 14e-3, what is the result?

• a.Prohibited, since substantial steps were taken and no breach of duty need be shown✓
• b.The purchase is permitted, because no tender offer has yet been formally commenced or announced
• c.The purchase is permitted, because the rule reaches only the bidder and its own officers and directors
• d.The purchase is permitted, because the employee owes no fiduciary duty to ABC or its shareholders

Rule 14e-3(a) applies once a person has taken a substantial step or steps to commence a tender offer, not only once the offer has formally commenced. It bars anyone who knows or has reason to know that material nonpublic information about the offer came, directly or indirectly, from the offering person, the target, or persons acting for either, from buying or selling the target's securities unless the information and its source are publicly disclosed first. The rule does not depend on a fiduciary duty to the target's shareholders, and it reaches tippees as well as the bidder's own people.17 CFR 240.14e-3(a)

A registered representative trading on material nonpublic information earns $150,000. The SEC sues the employer as a controlling person and shows it knowingly failed to maintain its required insider-trading policies, which substantially contributed to the violation. What is the maximum civil penalty on the employer?

• a.$450,000, because the cap is three times the profit gained, as it is for the trader
• b.$1,450,000, because the cap is three times the profit plus a $1,000,000 minimum
• c.$150,000, because the penalty is limited to the profit the trader gained
• d.$1,000,000, because the cap is the greater of $1,000,000 or three times the profit✓

Under Exchange Act Section 21A (15 U.S.C. 78u-1(a)(3)), the penalty on a controlling person may not exceed the greater of $1,000,000 or three times the profit gained or loss avoided. Three times $150,000 is $450,000, which is less than $1,000,000, so $1,000,000 is the cap. Three times the profit is the cap for the person who traded, not for the controlling person. The profit itself is the measure of disgorgement, not the ceiling on the penalty, and the two figures are alternatives that are not added together.15 U.S.C. 78u-1(a)(3)

A firm recommends a penny stock to a new customer whose transaction is not exempt. On Thursday, October 15, 2026, it sends the penny stock risk disclosure document, and the customer returns the signed acknowledgment that same day. What is the earliest day the firm may effect the purchase?

• a.Monday, October 19, since two business days must pass after the document is sent✓
• b.Thursday, October 15, because the signed acknowledgment has already been received
• c.Tuesday, October 20, because the rule requires more than two business days to pass
• d.Friday, October 16, because one business day after sending satisfies the waiting rule

Rule 15g-2(a) requires the broker-dealer to furnish the Schedule 15G disclosure document and obtain a signed and dated acknowledgment before a non-exempt penny stock transaction. Rule 15g-2(b) adds that, whatever form the acknowledgment takes, the transaction is unlawful if effected less than two business days after the document is sent. Counting from Thursday, Friday is the first business day and Monday is the second, so Monday is the earliest day. A prompt acknowledgment does not shorten the wait, and the rule does not require more than two business days.17 CFR 240.15g-2(b)

A firm recommends a penny stock. For which customer is the transaction exempt from the Rule 15g-9 account approval and written agreement requirements as an established customer?

• a.A customer who deposited funds into the account 14 months ago and has not placed any trade since✓
• b.A customer who made three penny stock purchases on separate days, all in the same issuer
• c.A customer who signed the penny stock risk acknowledgment last week and has not yet traded
• d.A customer who opened the account nine months ago with a $100,000 deposit and no trades

Rule 15g-9(c)(3) exempts transactions with an established customer, and Rule 15g-9(d)(2) defines that as a person whose account has effected a securities transaction or received a deposit of funds or securities more than one year previously, or who has made three penny stock purchases on separate days involving different issuers. A deposit made 14 months ago meets the one-year test. Nine months is too recent, three purchases in a single issuer do not meet the different-issuers condition, and signing an acknowledgment is a separate disclosure step that creates no established-customer status.17 CFR 240.15g-9(d)(2)

A customer bought a penny stock through a firm in a non-exempt transaction in January and still holds it on the last trading day of March. By what date must the firm send the customer the monthly statement for March under Rule 15g-6?

• a.June 10, which is ten days after the end of the quarter
• b.April 30, which is the end of the month that follows
• c.April 10, which is ten days after the month ends✓
• d.April 1, which is the day after the month ends

Rule 15g-6(a) requires a broker-dealer that has effected a non-exempt sale of a penny stock to send a written statement, within ten days following the end of each calendar month in which the security is held for the customer's account. Ten days after March 31 is April 10. The quarterly option in Rule 15g-6(b)(1) is available only after six consecutive months with no penny stock transactions for the customer, which is not the case here, and the rule sets no end-of-following-month or next-day deadline.17 CFR 240.15g-6(a)

A firm tells a customer in writing, before her first purchase, that her monthly mutual fund investment plan will be reported by periodic statement instead of an immediate confirmation of each purchase. When must the firm send each statement?

• a.Within five business days after the end of each monthly period in the plan
• b.Within five business days after the end of each quarterly period✓
• c.By the settlement date of each monthly purchase in the plan
• d.Within ten business days after the end of each calendar year

Rule 10b-10(b) lets a firm replace immediate confirmations for periodic plan and investment company plan transactions with a statement sent within five business days after each quarter, if the customer received prior written notice. A monthly schedule applies to money market fund transactions, not to periodic plans, so it is the wrong cadence here. Settlement-date confirmations are the ordinary rule that the alternative replaces, and an annual statement is not an option under the rule.17 CFR 240.10b-10(b)

Assuming the customer received prior written notice, which transaction may be reported on a periodic statement in place of an immediate confirmation?

• a.A redemption of shares in a stable-NAV money market fund that deducts no sales load✓
• b.A redemption of money market fund shares that carries a contingent deferred sales charge
• c.A one-time lump-sum purchase of a no-load growth fund made on a single day
• d.A purchase of exchange-traded fund shares placed on the firm's website as a market order

Rule 10b-10(b)(1) allows periodic reporting for periodic or investment company plan transactions and for a money market fund that tries to hold a stable NAV, provided no sales load is deducted on purchase or redemption. A deferred sales charge is a sales load, so that fund does not qualify. A single lump-sum purchase is neither a plan transaction nor a money market fund transaction, and an ETF trade is an ordinary secondary market trade that needs a confirmation.17 CFR 240.10b-10(b)(1)

A customer writes to her broker-dealer asking for the time of execution of a purchase that was effected 45 days before the firm received her letter. How soon must the firm provide the information?

• a.Within 10 business days of the firm receiving the request
• b.Within 5 business days of the firm receiving the request
• c.Within 30 calendar days of the firm receiving the request
• d.Within 15 business days of receiving the request✓

Rule 10b-10(c) requires requested confirmation information within 5 business days, but when the transaction was effected more than 30 days before the request, the period is 15 business days. This trade is 45 days old, so 15 business days applies. The 5-day period covers newer trades, and neither a 10-business-day nor a 30-calendar-day deadline appears in the rule.17 CFR 240.10b-10(c)

A confirmation for a customer's market order in a listed stock does not show the time of execution. Is that permitted?

• a.No, because the time of execution is mandatory for listed securities
• b.Yes, but only when the firm acted as agent rather than as principal
• c.Yes, if it states that the time will be furnished upon written request✓
• d.Yes, provided the next quarterly account statement shows the time

Rule 10b-10(a)(1) requires the date and time of the transaction, or the fact that the time will be furnished on written request. The confirmation may therefore leave the time off if it says so. The time is not mandatory for listed securities, the exception does not depend on agency or principal capacity, and nothing in the rule lets the account statement substitute for the notice on the confirmation.17 CFR 240.10b-10(a)(1)

A firm that makes a market in a stock sells 200 shares from its own inventory to a customer. What must the confirmation disclose about the firm's role?

• a.That it acted as agent, because an inventory sale by a market maker is an agency trade
• b.Only that it acted as principal, since market-maker status appears on Form CRS
• c.That it acted as principal and that it is a market maker in that security✓
• d.Nothing about its role, since the account agreement and website cover it

Rule 10b-10(a)(2) requires the confirmation to state whether the firm acted as agent or principal, and a firm trading as principal must also say whether it is a market maker in the security. A sale from inventory is a principal trade, not an agency trade. Form CRS describes the firm's relationship with retail investors and does not replace the confirmation, and the account agreement cannot substitute for the required disclosure.17 CFR 240.10b-10(a)(2)

On an agency trade, which customer's confirmation need not show the dollar amount of the firm's remuneration?

• a.A customer whose purchase totaled less than $5,000 in principal amount
• b.A customer whose written agreement sets an annual fee not tied to each transaction✓
• c.A customer who entered the order through the firm's website rather than by telephone
• d.A customer whose order was for an odd lot rather than a round lot

Rule 10b-10(a)(2)(i)(B) requires the confirmation to show the amount of remuneration the firm receives from the customer unless that remuneration is determined under a written agreement other than on a transaction basis, such as an asset-based annual fee. The order entry channel, an odd-lot size and a small trade value do not remove the disclosure; an odd-lot differential has its own disclosure rule.17 CFR 240.10b-10(a)(2)(i)(B)

A firm routes a customer's market order in an NMS stock to a wholesaler that pays the firm for order flow. What must the confirmation say about the payment?

• a.That payment for order flow is received; source and nature come on written request✓
• b.Nothing, because routing payments are disclosed only in the firm's quarterly Rule 606 reports
• c.The dollar amount of the payment per share, printed on the face of the confirmation itself
• d.That the order was routed for a rebate, but only if the customer asked before execution

For an agency order in an NMS stock, Rule 10b-10(a)(2)(i)(C) requires the confirmation to state whether payment for order flow is received and that the source and nature of the compensation will be furnished on written request. The dollar amount does not have to be printed. Rule 606 reports are a separate disclosure that does not replace the confirmation, and the statement is not conditioned on the customer asking in advance.17 CFR 240.10b-10(a)(2)(i)(C)

A firm that is not a market maker receives a customer order to buy 500 shares at the market. It buys 500 shares at $40.00 in the market and sells them to the customer at $40.20. Besides the price, what must the confirmation show for this riskless principal trade?

• a.The $0.20 difference between its price and its own contemporaneous purchase price✓
• b.The markup expressed only as a percentage of the prevailing market price, about 0.5%
• c.The best bid and offer quoted at the time the firm received the order
• d.Nothing beyond the $40.20 price, since a riskless trade is treated as an agency trade

Under Rule 10b-10(a)(2)(ii)(A), a non-market-maker that buys elsewhere to offset a contemporaneous customer purchase must disclose the difference between the customer's price and its own purchase price. Here that is $40.20 minus $40.00, or $0.20. The trade is still a principal trade, a percentage-only markup is not what this paragraph calls for, and the quoted market at order receipt is not a required confirmation item.17 CFR 240.10b-10(a)(2)(ii)(A)

A broker-dealer introduces accounts to a carrying firm that is not a member of SIPC. What must the confirmations for those customers say?

• a.That the carrying firm is not a member of SIPC, if that is the case✓
• b.Nothing, since SIPC status is disclosed only at account opening
• c.That customer assets are insured by the FDIC instead of SIPC
• d.That SIPC protection is limited to $500,000 per customer account

Rule 10b-10(a)(8) requires the confirmation to state that the broker-dealer, or the firm clearing or carrying the account, is not a SIPC member, when that is the case. The requirement is not limited to account opening. FDIC insurance does not cover securities accounts, and the rule does not call for a description of SIPC coverage limits.17 CFR 240.10b-10(a)(8)

Under Rule 10b-10, when must a broker-dealer give or send a customer the written confirmation of a transaction?

• a.Within 24 hours after execution of the order
• b.By the end of the month of the trade
• c.Within five business days of trade date
• d.At or before completion of the transaction✓

Rule 10b-10(a) requires the notification to be given or sent at or before completion of the transaction, with completion defined by Rule 15c1-1. The five-business-day period belongs to periodic reporting and information requests, not to ordinary confirmations. A 24-hour or month-end deadline is not in the rule.17 CFR 240.10b-10(a)