Compliance & Account Protection

The exam loves to test the trigger: Reg BI attaches only to a recommendation to a retail customer, never to self-directed or unsolicited orders, and never to institutional accounts. Watch for the classic “without placing the firm’s interest ahead of the customer’s” phrasing, and know that a recommendation to roll over a 401(k) or select an account type counts. A favorite trap pairs the four obligations — disclosure, care, conflict-of-interest, compliance — and asks which one absorbs suitability; the answer is always Care.

Distinguish the related ideas. Churning is the quantitative limb of the care obligation gone wrong (excessive trading plus broker control), so a churning fact pattern can be reframed as a Care violation. Don’t confuse Reg BI with the adviser fiduciary standard or with CIP/account-opening, which is identity-driven and not recommendation-based. A memory hook: “BI = Best Interest, Brokers Included” — it lifted broker-dealers above the old suitability bar (FINRA Rule 2111).

A favorite question asks who owns the rules: AML lives under the Bank Secrecy Act and USA PATRIOT Act, with regulations written by FinCEN (a Treasury bureau), while sanctions screening runs against the OFAC/SDN list — a parallel Treasury duty (OFAC, not FinCEN, administers the blocked-persons list). The pillar question wants the four program elements, but the deeper trap is confusing the program with the filings it produces.

AML is the umbrella; a CTR (cash over $10,000 in a day) and a SAR (suspicious activity of $5,000+, filed within ~30 days, and the customer is never tipped off) are the outputs. Don’t mix it with CIP, which only collects and verifies identity at account opening, or Reg S-P, which is privacy — not laundering. And know that structuring — splitting deposits under the threshold to dodge a report — is itself a federal crime, even when no single transaction breaches the limit.

The classic item hands you a scenario and asks which form, if any, fires — so train on the two triggers as a fork. If the fact pattern says “cash,” “currency,” or names a dollar figure crossing $10,000 in one business day, the answer is the CTR (FinCEN Form 112) and intent is irrelevant. If it instead describes behavior — a customer splitting deposits, refusing to give a TIN, or moving money with no apparent business purpose at the $5,000 level — the answer is the SAR (FinCEN Form 111). A near-miss trap: structuring multiple deposits at, say, $9,500 still triggers a SAR even though no single CTR threshold was hit.

Don’t confuse this with AML (the whole program these filings live inside) or CIP (identity-gathering at account opening). The favorite wrong answer is “tell the customer” or “freeze the account” — neither happens; SAR confidentiality is absolute. Memory hook: CTR = Cash + Counting dollars; SAR = Suspicion + Silence.

The classic SIE item drops a dollar figure on you: a customer holds $600,000 in securities and $300,000 in cash at a failed firm — how much is protected? The answer is $500,000, because the cash sub-limit is carved inside the ceiling, not added on top. Cash counts first up to $250,000, leaving only $250,000 of the ceiling for securities — so $250,000 cash + $250,000 securities, with the customer a general creditor for the $400,000 shortfall (don’t mistake this for $550,000 by stacking cash on top). The other “tell” invites you to add IRA, joint, and individual balances together — don’t; each separate capacity gets its own full coverage.

Distinguish the neighbors by what they protect. SIPC restores custody when the firm fails; Reg S-P guards customer privacy, AML detects illicit money, and margin rules govern borrowing — none address insolvency. Memory hook: SIPC = Safety If Pieces (of the firm) Collapse, never a promise your stocks won’t fall.

The exam tests Reg S-P as a timing-and-trigger question: it hands you a scenario and asks when a notice is required or whether the customer gets an opt-out. The “tell” is the recipient — sharing with a nonaffiliated third party is the only path that triggers the opt-out, while affiliates and account-servicing vendors are exempt. A newer wrinkle: the SEC’s 2024 amendments add a breach-notification rule requiring firms to notify affected individuals as soon as practicable, and no later than 30 days after becoming aware of a breach (phased compliance — larger firms by Dec 3, 2025, smaller firms by June 3, 2026; older question banks omit this entirely).

Don’t confuse Reg S-P with its neighbors. CIP/account-opening collects identity data going in; Reg S-P controls that data going out. AML screens for criminal money flows; Reg S-P protects honest customers’ privacy. SIPC restores missing assets when a firm fails, not when data leaks. Memory hook: S-P = “Stay Private.” When the question says “outside the firm’s corporate family,” reach for the opt-out.

The exam loves the time-zone trap: a question gives a rep in New York dialing a prospect in California and asks the latest legal call time — the answer keys on the prospect’s clock, so a 9 p.m. Pacific call is fine even though it’s midnight for the caller. The other classic tell is the exception list — expect a fact pattern testing whether an established business relationship, a personal relationship, or prior express written permission lets you call a registry-listed number. Watch the permanence split: a firm-specific Do-Not-Call request must be honored long-term (the TCPA standard is at least five years), while national-registry entries no longer expire at all.

Don’t confuse this with the related account rules: CIP governs opening an account, Reg S-P governs sharing a customer’s data (with an opt-out), and a complaint must be written to be reportable. Telemarketing is the one scoped to prospecting cold calls before any relationship exists. Memory hook: “8-to-9, their time.”

Exam items hinge on the “written” trigger: a stem describing an angry phone call asks whether it’s a reportable complaint — the answer is no, only a written grievance counts (letters, email, text, or other electronic messages; an oral gripe falls outside Rule 4513). Watch the rep’s duty: the right move is always forward it to a principal, never handle it solo. The classic trap answer is a rep who settles privately or pays the customer off without the firm’s knowledge — that itself violates Rule 2010, and the same logic applies to falsifying records to bury unauthorized trading.

Don’t confuse the quarterly Rule 4530(d) statistical summary of written complaints with the prompt reporting (within 30 calendar days) under Rule 4530(a) that serious matters like theft, forgery, or misappropriation trigger. Also separate this from related conduct rules: guaranteeing against loss and improper profit-sharing (Rule 2150) generate complaints but are flat prohibitions, while agency-vs-principal issues turn on capacity disclosure, not complaint mechanics. Memory hook: “if it isn’t written, it isn’t a complaint” — and one you can’t make disappear by quietly paying it off.