Books and Records Practice Questions for the SIE

Answer: Six years, with the first two years in an easily accessible place

SEC Rules 17a-3 and 17a-4 sort broker-dealer records into retention tiers, and the SIE tests the tiers rather than the subsection details. The 6-year bucket holds the firm's foundational operating records: blotters (the daily records of purchases and sales), the general ledger, and customer account records (kept six years after the account closes). Within any 6-year record, the first two years must be kept in an easily accessible place. Choice B swaps in the 3-year catch-all bucket, which covers most everything else — confirmations, order tickets, trial balances, and communications including email. Choice C borrows the 4-year period that FINRA Rule 4513 assigns to customer complaint records. Choice D reaches for the lifetime bucket, which is reserved for organizational documents such as articles of incorporation, minute books, stock certificate books, and Form BD. A workable mental picture is a pyramid: Lifetime at the top, then 6, then 4, then 3.

The Trap: Swapping the 3-year and 6-year retention buckets

• Four years: Misconception: importing the 4-year customer complaint period from FINRA Rule 4513 into an unrelated record category.
• Three years, with the first two years in an easily accessible place: Misconception: 3-year vs 6-year buckets swapped — assigning the catch-all 3-year period to records that actually belong in the 6-year tier.
• The life of the firm and any successor firm: Misconception: over-extending the lifetime bucket, which is reserved for organizational documents, to ordinary operating records.

Verified against: misconception pair '3-year vs 6-year record buckets swapped'; teaching angle 'Retention pyramid graphic'; SEC Rules 17a-3 and 17a-4

Answer: Four years

FINRA Rule 4513 requires each office of supervisory jurisdiction to keep records of written customer complaints for four years. Four years is worth memorizing precisely because it is an oddity: it is essentially the complaint-only tier, sitting between the 3-year catch-all and the 6-year operating records. Choice B drops complaints into the 3-year bucket, which holds confirmations, order tickets, trial balances, and communications such as email. Choice C promotes them to the 6-year bucket of blotters, general ledger, and customer account records. Choice D reflects an intuition that because complaints are serious they must be permanent; permanent (life-of-the-firm) retention is reserved for organizational documents such as articles of incorporation, minute books, stock certificate books, and Form BD. Note that a 'complaint' for these purposes is a written grievance from a customer concerning the firm or its associated persons — and an allegation of unauthorized trading like this one would also raise supervisory and reporting questions well beyond recordkeeping.

The Trap: Believing customer complaint records are retained indefinitely (or defaulting them to the 3- or 6-year bucket)

• Six years: Misconception: 4-year vs 6-year confusion — promoting complaints into the blotter/ledger/account-record tier.
• The life of the firm, because complaint records may never be destroyed: Misconception: 'complaints are kept forever' — students assume the seriousness of a complaint implies permanent retention, and conflate it with the lifetime organizational-document bucket.
• Three years: Misconception: defaulting complaints into the 3-year catch-all bucket that covers confirmations, order tickets, and communications.

Verified against: misconception pair 'complaints kept forever (4 years)'; FINRA Rule 4513

Answer: The firm's articles of incorporation and minute books

The lifetime bucket is narrow and it is about the firm's identity rather than its activity: articles of incorporation or partnership agreements, minute books, stock certificate books, and Form BD must survive as long as the enterprise (and any successor) does. Everything else is on a clock. Choice B belongs to the 3-year catch-all, which is the largest bucket by volume — confirmations, order tickets, trial balances, and communications including email; Forms U4 and U5 and fingerprint cards are likewise kept three years after termination. Choice C sits in the 6-year bucket alongside blotters and the general ledger; the customer account record clock runs six years from account closing, not from account opening. Choice D is the 4-year complaint tier. If you can place two or three flagship examples in each of the four tiers — Lifetime, 6, 4, 3 — you will handle nearly every retention question the exam asks without memorizing the rule subsections.

The Trap: Failing to distinguish the lifetime organizational-document bucket from the 3-, 4-, and 6-year operating buckets

• Business-related email correspondence with customers: Misconception: 3-year bucket misplaced — communications, including email, fall in the 3-year catch-all, not the lifetime tier.
• Records of written customer complaints: Misconception: 'complaints kept forever' — complaint records carry a 4-year period under FINRA Rule 4513.
• Customer account records: Misconception: 6-year bucket misplaced — customer account records are kept six years after the account is closed, not permanently.

Verified against: teaching angle 'Retention pyramid: Lifetime / 6 / 4 / 3 with two or three flagship examples per tier'; SEC Rules 17a-3 and 17a-4; FINRA Rule 4513

Answer: 36 months

SEC Rule 17a-3 pairs two clocks for the customer account record. First, the firm furnishes the account record to the customer within 30 days of opening. Second, at least every 36 months, the firm sends the account record back to the customer so its information — name, address, and the investment-profile details the firm relies on — can be verified and corrected. The point is practical: a suitability analysis or a Regulation Best Interest recommendation rests on customer information, and stale information produces bad recommendations. Section 3 is dense with similar-looking periods, and each distractor here is one of them: 12 months is the privacy notice cadence under Regulation S-P; 24 months is the period during which 6-year records must stay readily accessible; and 60 months is how long customer identification program records are kept after an account closes. Match each number to its own obligation rather than trusting a general sense of 'a few years.'

The Trap: Confusing the 36-month account-record re-verification cycle with adjacent periods (annual privacy notice, 2-year accessibility, 5-year CIP retention)

• 60 months: Misconception: importing the five-year customer identification program retention period (records kept five years after the account closes) into the re-verification cycle.
• 12 months: Misconception: importing the annual cadence of the Regulation S-P privacy notice into the account-record requirement.
• 24 months: Misconception: borrowing the two-year 'readily accessible' period from the retention rules, which describes how records are stored, not when they are re-verified.

Verified against: adjacent periods from Cluster 10 (CIP 5-year retention) and Cluster 11 (2-year accessibility); SEC Rule 17a-3

Answer: At least once each calendar quarter, and monthly for any month in which there is activity in the account

FINRA's customer account statement rule (Rule 2231) sets the floor at once every calendar quarter. On top of that floor, a statement is sent for any month in which there is activity in the account — so an actively traded account effectively receives monthly statements while a dormant account may receive only four per year. Choice B is the classic trap: because most retail investors do in fact receive monthly statements, students promote industry practice to a rule. The regulatory minimum is quarterly. Choice C confuses the statement cadence with the annual privacy notice under Regulation S-P. Choice D misreads the obligation as reactive; the firm must send statements without being asked. Keep the contrast clean: a confirmation is per-trade and due by settlement, while a statement is periodic and due at least quarterly. (Accounts holding penny stocks are subject to a monthly statement requirement.)

The Trap: Statements 'always monthly' — missing that quarterly is the floor and monthly is activity-driven

• At least once each calendar year: Misconception: importing the annual cadence of the Regulation S-P privacy notice into the statement rule, understating the required frequency.
• Monthly in every month, without exception: Misconception: statements are 'always monthly.' Students generalize from the common industry practice of monthly statements to a rule that actually sets a quarterly minimum.
• Only when the customer submits a written request for one: Misconception: treating the periodic statement as an on-request document rather than an affirmative, automatic delivery obligation.

Verified against: monthly in any month with activity'; misconception pair 'Statements always monthly (quarterly minimum)'; FINRA Rule 2231

Answer: At or before completion of the transaction — that is, no later than settlement date

SEC Rule 10b-10 requires the confirmation to be given or sent at or before completion of the transaction. For a regular-way trade, completion means settlement — and regular-way settlement for corporate securities is now T+1, one business day after the trade date. So the practical answer is 'by settlement, at the latest.' Choice B states a stricter deadline than the rule imposes: firms may confirm on trade date, but they are not required to. Choice C is the retired T+3-era 'three days' reflex; U.S. settlement moved to T+1 in May 2024, and older study materials showing T+2 or T+3 are out of date. Choice D confuses two different documents: a confirmation is per-trade and arrives by settlement, while an account statement is periodic. The confirmation itself must disclose key facts including the firm's capacity (agent or principal) and, for agency trades, the commission charged.

The Trap: Confirmation deadline — believing it is trade date or a fixed 'within 3 days' window rather than completion of the transaction (settlement)

• No later than the close of business on the trade date: Misconception: confirmation deadline is trade date. Sending on trade date is permitted but is not the requirement — the rule's outer limit is completion of the transaction.
• With the customer's next quarterly account statement: Misconception: confirmation vs account statement — collapsing the per-trade document into the periodic one.
• Within three business days after the trade date: Misconception: the legacy 'within 3 days' framing, a holdover from the retired T+3 settlement cycle, restated as a fixed confirmation window.

Verified against: misconception pair 'Confirmation deadline: settlement date, not trade date, not within 3 days'; SEC Rule 10b-10

Answer: Obtain the customer's written instructions specifying the period for which mail is to be held, and have the firm hold the mail subject to its required safeguards

FINRA Rule 3150 permits a member firm to hold a customer's mail for a specified period if the customer gives written instructions that include the time period involved. The firm must also satisfy safeguards: it verifies the instructions, informs the customer of alternate means to access account information, and takes reasonable steps to confirm the instructions remain valid — and it cannot let a hold become a way to conceal activity from the customer. So the answer is not 'no,' it is 'yes, in writing.' Choice B fails on form: an oral request, however carefully documented by the representative, is not the customer's written instruction. Choice C overstates the rule into a flat prohibition. Choice D is the dangerous one. Routing a customer's mail to a representative's own address severs the customer's independent view of her account and is a classic mechanism for hiding unauthorized trading — which is why confirmations and statements are required to reach the customer in the first place. Holding mail is a firm function performed under the firm's controls, not a personal accommodation by the representative.

The Trap: Accepting oral instructions to hold customer mail, or believing mail holding is flatly prohibited

• Hold the mail as requested, since the representative documented the phone call in the customer's file and an oral instruction is sufficient for a temporary hold: Misconception: oral instructions suffice. The rule requires written instructions from the customer; a documented phone call does not substitute.
• Refuse the request, because firms are prohibited from holding customer mail under any circumstances: Misconception: treating mail holding as flatly prohibited by confusing it with genuinely prohibited conduct such as diverting customer mail.
• Have the mail redirected to the representative's own address so that it can be handed to the customer when she returns: Misconception: conflating a permissible firm-level hold with routing customer mail to a representative's address — a serious red flag for concealment of account activity.

Verified against: FINRA Rule 3150

Answer: The firm must first provide a privacy notice and give the customer a reasonable opportunity to opt out of the sharing

Regulation S-P — the SEC's customer-privacy rule — makes the United States an opt-OUT jurisdiction: before a firm shares a consumer's nonpublic personal information with nonaffiliated third parties, it must deliver a clear privacy notice and give a reasonable opportunity (commonly about 30 days) to opt out. Option B is the opt-in trap — an intuition borrowed from regimes like the GDPR that Reg S-P does not impose. Option C reverses the affiliate rule: the opt-out right applies to NON-affiliated third parties, while sharing with affiliates and service providers is covered by exceptions. Option D understates the notice obligation — privacy notices are due at account opening and annually thereafter, and notice alone never replaces the opt-out opportunity. Source: SEC Regulation S-P.

The Trap: opt-in-vs-opt-out (GDPR-style opt-in imported into the U.S. opt-out regime)

• No action is required, because the opt-out right applies only to information shared with the firm's own affiliates: Affiliate/nonaffiliate swap: the opt-out right protects against sharing with NON-affiliated third parties. Sharing with affiliates and with service providers falls under exceptions to the opt-out requirement.
• The firm must first obtain the customer's affirmative written opt-in consent to the sharing: Opt-in trap: students import GDPR-style opt-in intuition. The U.S. regime under Reg S-P is opt-OUT — the customer must act to block the sharing; affirmative consent is not required.
• No action is required beyond the privacy notice delivered at account opening, which covers all future sharing: Notice-frequency trap: privacy notices are required initially AND annually, and delivering a notice does not substitute for giving the customer the opt-out opportunity before nonaffiliate sharing.

Verified against: SEC Regulation S-P (customer privacy notice and opt-out requirement)

Answer: Notify each affected individual as soon as practicable, and in any event no later than 30 days after becoming aware of the incident, unless the firm determines the information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience

This tests the amended Regulation S-P provisions, whose compliance dates have now all passed (larger firms in December 2025, smaller firms in June 2026), so this is current law — but note that many older study materials predate it and describe Regulation S-P as privacy notices and opt-outs only. The amendments require firms to maintain a written incident response program and, where sensitive customer information was or is reasonably likely to have been accessed or used without authorization, to notify affected individuals as soon as practicable and no later than 30 days after becoming aware of the incident. Notice may be excused only by a determination that the information has not been and is not reasonably likely to be used in a way causing substantial harm or inconvenience — a finding the firm must actually make, not a default. Choice B imports a 72-hour clock from a different privacy regime. Choice C mistakes a routine annual disclosure for an urgent one. Choice D inverts the standard: the duty is triggered by reasonably likely misuse, so a firm may not sit back and wait for victims to surface.

The Trap: Misstating the customer breach-notification deadline (72 hours / annual notice) or waiting until harm actually materializes

• Describe the incident in the firm's next annual privacy notice to customers: Misconception: notice-frequency confusion — folding an urgent breach notification into the routine annual privacy notice cycle.
• Notify affected individuals within 72 hours of discovering the incident: Misconception: importing a European-style 72-hour breach clock, the same non-U.S. intuition that produces the opt-in error elsewhere in Regulation S-P.
• Notify only those customers who later report identity theft or unauthorized activity in their accounts: Misconception: waiting for harm to materialize. The trigger is that information was, or is reasonably likely to have been, accessed or used without authorization — not that damage has been proven.

Verified against: smaller firms June 3, 2026)'; current-fact warning 'Reg S-P amendments are now fully live'; Regulation S-P as amended

Answer: Be given notice and a reasonable opportunity to opt out of the sharing

Regulation S-P is an opt-out regime: a broker-dealer may share a customer's nonpublic personal information with a non-affiliated third party as long as it has first delivered a notice describing the sharing and has given the customer a reasonable opportunity to opt out. The customer must act to stop the sharing; silence permits it. A useful hook is that the United States is an opt-OUT country. Choice B is the single most common error, imported from privacy regimes that require affirmative consent. Choice C overcorrects in the other direction — the sharing is regulated, just not by consent. Choice D reverses the rule's target: the opt-out right exists precisely because the recipient is NOT an affiliate; sharing among affiliates is treated far more permissively. Note also that certain sharing is excepted from the opt-out entirely, such as disclosures to service providers performing services for the firm and disclosures made in response to legal or regulatory requests.

The Trap: Opt-out vs opt-in — importing GDPR-style affirmative-consent intuition into the U.S. regime

• Take no action, because federal privacy rules place no limits on a broker-dealer's sharing of customer information: Misconception: assuming the absence of an opt-in requirement means the absence of any restriction. Notice plus an opt-out opportunity is mandatory.
• Be given an opportunity to opt out only if the third party is an affiliate of the broker-dealer: Misconception: affiliate vs non-affiliated third party — the opt-out right attaches to sharing with NON-affiliated third parties, so this choice reverses the rule's scope.
• Sign a written authorization affirmatively opting in to the sharing before any information is disclosed: Misconception: opt-out vs opt-in — students import European-style affirmative-consent intuition. U.S. law places the burden on the customer to say no, not on the firm to obtain a yes.

Verified against: misconception pairs 'Opt-out vs opt-in' and 'Sharing with affiliates vs non-affiliated third parties'; Regulation S-P