On May 6, 1939, three years after the SEC was created and seven years after the crash, the Commission adopted what would become SEC Rule 17a-4: the books-and-records rule that tells every broker-dealer in America how long to keep every piece of paper that passes through the business. The original rule assumed paper. Literal paper. Boxes of it. Whole floors of buildings in lower Manhattan devoted to boxes of it.
Electronic recordkeeping provisions were finally added piecemeal starting in 1997, and the fight over what counts as "write-once-read-many" storage stretched out for more than a decade after that. The rule you will be tested on is still the 1939 framework, layered with eighty-plus years of retention tiers, regulatory notices, and one very important amendment from May 2024 that has a compliance deadline about two months from today.
Section 1: SEC Rules 17a-3 and 17a-4
These two rules work as a pair. Rule 17a-3 says what records a broker-dealer must make. Rule 17a-4 says how long the firm must keep them. Together they create the multi-tier retention framework the Series 63 tests.
SEC Rule 17a-4 dates to 1939. It was written for a world where records meant correspondence, carbon copies, order tickets in triplicate, and bound ledgers. Electronic storage provisions were added starting in 1997, and the SEC's fight with vendors over "write-once-read-many" (WORM) storage consumed most of the decade that followed. The framework you are memorizing today is the 1939 architecture with eighty years of retention tiers bolted on.
The Mental Model
A broker-dealer runs on three kinds of paperwork:
- Firm-level operating records (blotters, ledgers, position books)
- Customer-level transaction records (order tickets, confirmations, statements)
- Legal and corporate records (articles of incorporation, partnership agreements, Form BD)
Each category has its own retention period.
SEC Rule 17a-4 Retention Tiers
| Retention | Records (by 17a-3 citation) |
|---|---|
| 6 years, first 2 accessible | Blotters, general ledgers, customer ledgers, securities position records, office personnel lists, compliance principal lists |
| 3 years, first 2 accessible | Order tickets, trade confirmations, customer account records (general), communications and emails, cancelled checks, bank statements, agreements, options records, advertisements, customer complaints |
| 6 years after account close | Retail customer account records and Regulation Best Interest records |
| Life of enterprise + 3 years | Articles of incorporation, partnership articles, charter, minute books, Form BD, Form BDW, Form SBSE |
Test tip: Most prep providers teach 17a-4 as a single "3 years, first 2 accessible" number. That is wrong as a blanket statement. The foundational firm books (blotters, ledgers, position records) live 6 years. Transaction paperwork lives 3 years. Corporate organizational documents live forever. Read the question carefully.
The memory hook: blotters and ledgers are foundational books, and they get the longer retention (6 years). Transaction paperwork is high-volume and gets the shorter period (3 years). Corporate organizational documents live as long as the firm does. Both the 6-year and 3-year categories require the first 2 years to be kept in an "easily accessible place," which means the firm must be able to produce them quickly on request.
Section 2: FINRA Rule 2210 Communications with the Public
This is the most heavily tested rule in Chapter 4. One specific number (25 retail investors in 30 days) runs through half the questions in this chapter.
The Three Categories of Communication
| Category | Definition |
|---|---|
| Correspondence | Written communication distributed to 25 or fewer retail investors in any 30 calendar-day period |
| Retail communication | Written communication distributed to more than 25 retail investors in any 30 calendar-day period |
| Institutional communication | Written communication distributed only to institutional investors |
Correspondence caps at 25 retail investors in 30 days. The 26th reader upgrades the entire communication to retail communication, which requires principal approval before it goes out. (The 26th reader is, from FINRA's perspective, the reader who turned a casual note into a compliance event.)
Retail vs. Institutional Investor
A retail investor is any person other than an institutional investor, regardless of whether the person has an account with a member firm. An institutional investor, cross-referencing FINRA Rule 4512(c), is:
- A bank, savings and loan, insurance company, registered investment company, or registered investment adviser
- Any other entity (natural person, corporation, partnership, trust) with total assets of at least $50 million
- A governmental entity
- A qualified employee benefit plan with 100 or more participants
- A person acting on behalf of any of the above
Approval and Supervision [Rule 2210(b)]
| Category | Pre-use approval required? |
|---|---|
| Retail communications | Yes: principal approval before earlier of use or filing with FINRA |
| Correspondence | No principal pre-approval; supervised under FINRA Rule 3110 |
| Institutional communications | No pre-use approval; written procedures required |
Filing Requirements [Rule 2210(c)]
- New member first-year pre-filing: New FINRA members must file retail communications at least 10 business days before first use for public media (TV, radio, newspaper, magazine).
- Pre-use filing (10 business days before): Custom-created mutual fund performance rankings; security futures communications.
- Post-use filing (within 10 business days of first use): Retail communications about registered investment companies, public direct participation programs (DPPs), CMOs, and derivatives or structured securities.
Content standards under Rule 2210(d) are straightforward: communications must be based on principles of fair dealing and good faith, must be fair and balanced, and may not omit material facts. Performance predictions are prohibited, with narrow exceptions for certain fund materials.
Under SEC Rule 17a-4(b)(4), communications (including advertisements and sales literature) are retained for 3 years, first 2 in an easily accessible place.
Section 3: FINRA Rule 4512 Customer Account Information
Rule 4512 works in tandem with Rule 2210. It defines what "institutional" means (which Rule 2210 incorporates) and sets the retention period for customer account records.
Required Information for Every Account [Rule 4512(a)(1)]
- Customer name and residence
- Whether the customer is of legal age
- Name(s) of the associated person(s) responsible for the account
- Signature of the partner, officer, or manager accepting the account
- For non-institutional discretionary accounts: customer's written approval and principal's written acceptance
- For corporations, partnerships, or other entities: names of persons authorized to transact
- Name and contact information of the trusted contact person, age 18 or older (added by the 2019 amendment)
For non-institutional accounts, the firm must also obtain the customer's tax identification number, occupation and employer, and whether the customer is associated with another member firm.
Trusted Contact Person
The trusted contact provision was added to Rule 4512 in May 2019 as FINRA's operational partner to the NASAA Vulnerable Adults Model Act (see Chapter 3, Section 4). The requirement is not to have a trusted contact person. The requirement is to ask. Members must disclose in writing that they may contact this person to address financial exploitation concerns or to confirm the customer's health or identity of a legal guardian. The customer can decline, and the account can still be opened.
The trusted contact must be age 18 or older. The absence of a trusted contact does NOT prevent account opening. The member must make "reasonable efforts to obtain" the information but cannot refuse service if the customer declines.
Institutional Account Definition [Rule 4512(c)]
An institutional account is an account belonging to a bank, savings and loan, insurance company, registered investment company, or registered investment adviser, or to any other entity (natural person, corporation, partnership, trust) with total assets of at least $50 million. Under $50 million in assets is retail. Exactly $50 million or more is institutional.
The 6-Year Retention Rule
Members must preserve a record of any customer account information that is subsequently updated for at least six years after the date the information is updated. Members must preserve the last update (or the original information if no update is made) for at least six years after the account is closed.
Translation: 6 years after each update, or 6 years after account closure. This is the Rule 4512 number that gets tested. Do not confuse it with the SEC 17a-4 tiers in Section 1.
Section 4: FINRA Rule 2360 Options
Options accounts have their own paperwork layered on top of the regular account rules. The exam tests the sequence of steps and the specific day counts.
The Required Sequence
- Perform customer due diligence (investment objectives, employment, income, net worth, liquid net worth, marital status, dependents, age, investment experience)
- Deliver the Options Disclosure Document (ODD)
- Obtain written account approval from a qualified principal
- Obtain a signed options agreement from the customer within 15 days
ODD Delivery and Account Approval
Rule 2360(b)(11)(A)(i) requires the ODD (the Characteristics and Risks of Standardized Options booklet published by the Options Clearing Corporation) to be delivered at or before the time the customer's account is approved for options trading. Not after. Approval itself is in writing from a branch manager, Registered Options Principal (ROP), or Limited Principal. If the branch manager lacks the proper registration, the account must be submitted to an ROP within 10 business days.
The 15-Day Options Agreement Rule
The Options Disclosure Document must be delivered at or before account approval. The signed options agreement must be obtained within 15 days after account approval. Two different documents, two different moments in the sequence.
For any recommendation, the member must have reasonable grounds that the transaction is "not unsuitable." For opening transactions, the member must have a reasonable basis to believe the customer has sufficient knowledge, experience, and financial capacity to understand and bear the risks. Options position reporting is triggered at 200 or more contracts on the same side of the market covering the same underlying security or index.
Section 5: FINRA Rule 4210 and Regulation T
Margin is lending. The federal rule that sets initial margin is Regulation T, issued by the Federal Reserve Board under SEA §7. FINRA Rule 4210 sets maintenance margin and adds FINRA-specific minimums.
Reg T Initial Margin
Reg T requires an initial deposit of 50% of the purchase price for long equity securities. A customer buying $10,000 of stock on margin must put up $5,000 of their own money. The firm lends the other $5,000.
Minimum Equity and Maintenance Margin
| Requirement | Amount |
|---|---|
| Reg T initial margin (long equity) | 50% of purchase price |
| Minimum equity, standard margin account | $2,000 |
| Maintenance, long positions | 25% of current market value |
| Maintenance, short stocks at $5 or above | $5/share or 30% of CMV, whichever greater |
| Pattern Day Trader minimum equity | $25,000 |
Pattern Day Trader [Rule 4210(f)(8)]
A Pattern Day Trader is a customer who executes four or more day trades within five business days, and whose day trades represent more than 6% of total trading activity during the same 5-day window. Both conditions must be met. A Pattern Day Trader must maintain at least $25,000 in equity at the start of any day the customer day trades. If equity falls below $25,000, day trading is restricted until equity is restored.
Test tip: $2,000 is the minimum equity for a standard margin account. $25,000 is the minimum for a Pattern Day Trader. If the fact pattern mentions day trading frequency (4 trades in 5 days, 6% of activity), the answer is $25,000.
Section 6: Regulation S-P (2024 Amendments)
On May 15, 2024, the SEC adopted amendments to Regulation S-P creating a federal minimum standard for customer data breach notification. The structure mirrors the 72-hour notification window already established in the European Union's General Data Protection Regulation. The larger firm compliance deadline has already passed (December 3, 2025). The smaller firm deadline is June 3, 2026. As of the date of this chapter, that deadline is roughly eight weeks away, which is one of the most time-sensitive facts on the current Series 63.
Who Is Covered
Regulation S-P applies to "covered institutions":
- Broker-dealers (including funding portals)
- Registered investment companies
- Registered investment advisers
- Transfer agents
What the 2024 Amendments Require
Incident response program. Every covered institution must develop and maintain written policies and procedures for an incident response program reasonably designed to detect unauthorized access to customer information, respond to the incident, and recover to normal operations. The program must also assess the nature and scope of any incident, contain and control it, and oversee service providers through due diligence and monitoring.
Customer notification (the 30-day rule). A covered institution must notify affected individuals as soon as practicable but not later than 30 days after becoming aware that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. The notice must describe the incident, the data that was breached, and how affected individuals can respond to protect themselves. Notification is not required if the institution determines that the information has not been and is not reasonably likely to be used in a manner resulting in substantial harm or inconvenience.
Service provider notification (the 72-hour rule). Service providers must notify the institution as soon as possible, not later than 72 hours after discovery. The institution's own 30-day customer clock starts when the institution becomes aware, which in practice means when the service provider notifies them.
- 30 days: Customer notification after incident discovery
- 72 hours: Service provider notification to institution
- December 3, 2025: Larger entity compliance (already in effect)
- June 3, 2026: Smaller entity compliance deadline
Section 7: USA §403 Filing of Sales and Advertising Literature
This is the state-law counterpart to FINRA Rule 2210. USA §403 gives the state Administrator authority to require filing of sales and advertising literature, including prospectuses, pamphlets, circulars, form letters, advertisements, sales literature, and other advertising communications addressed or intended for distribution to prospective investors, including clients or prospective clients of an investment adviser.
Key Points for the Exam
- The Administrator's authority under §403 is permissive: the Administrator may require filing, but it is not automatic. Filing is required only if the Administrator has adopted a rule or issued an order requiring it.
- §403 applies to both BD sales literature and IA advertising communications.
- Federal covered securities and federal covered advisers are generally exempt from state filing requirements under NSMIA (1996) and Dodd-Frank (2010) preemption. For those, FINRA Rule 2210 and SEC rules control, not USA §403.
- For state-registered IAs and non-covered securities, state filing under §403 remains available as an Administrator tool.
USA §403 is less commonly tested than FINRA Rule 2210, but it can show up as the "state law" counterpart to the federal communications framework. If a question asks what authority a state Administrator has over advertising literature, §403 is the answer.
Section 8: Thresholds, Traps, and Memory Tactics
Quantitative Thresholds for Chapter 4
| Threshold | What it governs |
|---|---|
| 25 retail / 30 days | Correspondence vs. retail communication line (FINRA 2210) |
| $50 million | Institutional account asset threshold (FINRA 4512(c)) |
| 100 participants | Qualified employee benefit plan = institutional investor |
| 18 years old | Minimum age for trusted contact person |
| 6 years | Customer account info retention after update or closure (FINRA 4512) |
| 6 years / first 2 accessible | Blotters, ledgers, position records (SEC 17a-4) |
| 3 years / first 2 accessible | Order tickets, confirmations, communications (SEC 17a-4) |
| Life of enterprise + 3 years | Articles of incorporation, Form BD (SEC 17a-4) |
| 10 business days before use | New member pre-filing (FINRA 2210(c)) |
| 15 days | Written options agreement after account approval (FINRA 2360) |
| 200 contracts | Options position reporting threshold |
| 50% | Reg T initial margin on long equity |
| $2,000 | Standard margin account minimum equity |
| 25% | Long position maintenance margin |
| 30% | Short stock ($5+) maintenance margin |
| $25,000 | Pattern Day Trader minimum equity |
| 30 days / 72 hours | Reg S-P customer / service provider breach notification |
| June 3, 2026 | Reg S-P smaller-entity compliance deadline |
Common Traps
Trap 1: 25/30 direction. "25 or fewer" is correspondence. "More than 25" is retail communication. Exactly 25 is still correspondence.
Trap 2: Institutional investors do not count. A communication sent to 20 retail and 10 institutional investors is correspondence. The 25-threshold counts only retail.
Trap 3: 17a-4 oversimplification. Blotters and general ledgers are 6-year records, not 3-year. If the question asks about blotters specifically, the answer is 6.
Trap 4: Rule 4512 vs. 17a-4. Rule 4512 customer account information is 6 years after update or closure. General records under 17a-4 run on the different tiered framework. When the question references Rule 4512 specifically, use the 6-year answer.
Trap 5: ODD vs. options agreement. ODD at or before approval. Signed agreement within 15 days after approval. Two documents, two moments.
Trap 6: $2,000 vs. $25,000. Standard margin vs. Pattern Day Trader. Two different floors.
Trap 7: Reg T vs. FINRA 4210. Reg T is initial margin (50%). FINRA 4210 is maintenance (25% long, 30% short).
Trap 8: Institutional account = $50 million. Not $25M, not $100M. This same number also defines institutional investor for Rule 2210.
Trap 9: Trusted contact age is 18, not 21. Same as voting age. The firm has to ask. The customer can decline.
Trap 10: 30 days vs. 72 hours on Reg S-P. Customer notification is 30 days. Service-provider-to-institution notification is 72 hours. Different clocks.
Memory Tactics
- 25 in 30. FINRA 2210 correspondence threshold.
- 50 = institutional. $50 million under Rule 4512(c).
- ODD before, agreement after. Options sequence.
- 2 grand to open, 25 grand to day trade. Rule 4210 minimums.
- 25% long, 30% short. Maintenance margin.
- 50% Reg T, 25% maintenance. Initial vs. maintenance.
- 30 and 72. Reg S-P customer and service provider clocks.
- Blotters and ledgers live 6 years. 17a-4 long tier.
Chapter 4 is dense with specific numbers. If one of those numbers is still fuzzy, come back before attempting Chapter 5. Domain 5 (Securities and Issuers) shifts away from numbers and toward the distinction between exempt securities and exempt transactions.