Which Reg BI Duties Apply to Your Reps, and Which Apply to the Firm

One of your reps recommends a rollover on a Tuesday afternoon and writes 3 lines about it in the CRM. 7 months later an examiner asks for the written policies that were supposed to govern that recommendation, and the request does not go to the rep. It goes to your firm, in writing, with a deadline. Those 3 lines in the CRM were never what the request was for.

That mismatch is a duty-allocation problem that starts with the way the rule is taught. That rule is usually presented as 4 obligations in 1 list, which invites the assumption that all 4 apply to whoever made the recommendation. Its own words split those 4 obligations 2 and 2. Firms in banking and finance that miss the split train supervisors on a duty Reg BI never gave them.

Why All 4 Obligations Get Taught Together

Reg BI arrived with 4 named obligations, and compliance decks reproduce that structure because the rule does. Trouble starts when that structure is read as 4 duties owed by the same person. A rep in that training hears 4 things they are personally responsible for, 2 of them written for the firm, and nobody in the room notices the swap. The difference between the 2 halves is 1 phrase.

That phrase is worth quoting in full, because it does all of the work. 2 of the obligations name a natural person and 2 of them do not, and the difference decides who an examiner writes to.

The 2 Obligations That Apply to a Rep as an Individual

The 2 obligations that apply to an individual are both about the moment of the recommendation. The scope paragraph at 240.15l-1(a)(1) defines that moment, and it reaches a broker, a dealer, or a natural person associated with one making a recommendation to a retail customer. That is the only place the rule describes whom it governs, and it names the individual there, as do the 2 obligations that follow.

Both are written the same way:

• The Disclosure obligation at (a)(2)(i) applies to the broker, dealer, or natural person who is an associated person, and requires full and fair disclosure in writing before or at the time of the recommendation.
• The Care obligation at (a)(2)(ii) applies to the same 3 parties, and requires reasonable diligence, care, and skill in making the recommendation.

Read those 2 together and the individual duty is specific and bounded. Your rep owes the customer a disclosure and a standard of care at a particular moment, and both are judged on what happened at that moment. Neither of them asks for a policy, a procedure, or a retained record. Those 3 requirements appear 2 paragraphs later, addressed to a different party.

The 2 Obligations That Belong to the Firm Alone

The 2 remaining obligations change subject, and the change is visible in the first 5 words of each. Where Disclosure and Care name a natural person, the Conflict of Interest obligation at (a)(2)(iii) opens with the broker or dealer, and the Compliance obligation at (a)(2)(iv) opens the same way. The firm-level pair reads differently:

• The Conflict of Interest obligation at (a)(2)(iii) requires the broker or dealer to establish, maintain, and enforce written policies and procedures reasonably designed to identify and then disclose or eliminate conflicts of interest.
• The Compliance obligation at (a)(2)(iv) requires the broker or dealer to establish, maintain, and enforce written policies and procedures reasonably designed to achieve compliance with Regulation Best Interest.

Both of those are firm duties in the ordinary sense, since a natural person cannot establish and enforce a firm's written policies. That is why an examiner asking about conflicts writes to the firm. Your supervisors do the work inside those procedures, and the duty to have them belongs to the entity.

That allocation changes your training material in 1 specific way. A rep taught from that material that Reg BI requires them to document their reasoning has been taught something the rule does not say. Correcting that early is worth the effort, because the documentation duty that does exist is enforceable against the firm.

The 4 Reg BI Obligations, Side by Side

Set out in a table, the split stops being a matter of interpretation. The third column is the one to read closely, because it is quoted from the rule and not summarized.

That last column is where the documentation effort belongs. Nothing in it is a document a rep keeps, and the 2 rows that ask for written policies and procedures both name the firm. Your written supervisory procedures therefore answer 2 of these 4 rows, and the other 2 are answered by what your reps did on the day.

Where the Supervisory Documentation Duty Comes From

The duty exists, and it comes from FINRA's supervision rules, which are addressed to the member. A member is a firm, so the duty is the firm's. Those rules are why a written supervisory procedures manual exists at all, and reading them beside Reg BI shows a consistent allocation.

What FINRA Rule 3110 Asks a Firm to Write Down

The supervision rule builds the requirement in stages:

• 3110(a) requires each member to establish and maintain a system to supervise the activities of each associated person, and states that final responsibility for proper supervision rests with the member.
• 3110(b)(1) requires each member to establish, maintain, and enforce written procedures to supervise the types of business in which it engages and the activities of its associated persons.
• 3110(b)(4) requires those procedures to include the review of incoming and outgoing written and electronic correspondence and internal communications relating to the member's investment banking or securities business.

That first item settles the question on its own. The item says final responsibility for proper supervision rests with the member, in those words, so the firm owns the system and owns the writing. Your supervisors operate inside that system, and the duty to have it is the firm's.

Testing and Certification Above the Procedures

2 further rules ask a firm to check its own work. The first of those rules is 3120(a), under which each member identifies principals to FINRA who maintain supervisory control procedures that test and verify its own. The annual certification in 3130(b) then puts the chief executive officer's name against those processes.

Both of those rules describe documents in the end. A test performed and never recorded cannot be verified a year later, and an annual certification is a statement about processes somebody has to produce.

What Audit Trail Software Has to Preserve Under 240.17a-4

The records half comes from the Exchange Act rules, and it is where audit trail software earns its place. 2 sections divide the job, since 240.17a-3 names the records a firm keeps current and 240.17a-4 sets how long each is preserved. The paragraph that decides whether a product is adequate is 240.17a-4(f).

Under 240.17a-4(b) a firm subject to 240.17a-3 preserves the listed records for not less than 3 years, the first 2 in an easily accessible place. Communications are inside that set, because (b)(4) covers originals received and copies sent, including approvals and inter-office memoranda. The correspondence review in 3110(b)(4) therefore produces records 240.17a-4(b)(4) requires you to keep.

The 4 Things a Time-Stamped Audit Trail Has to Show

Electronic recordkeeping has its own paragraph, and it is the paragraph that names an audit trail. Under 240.17a-4(f)(2)(i)(A), an electronic recordkeeping system may preserve a record for the duration of its retention period in a manner that maintains a complete time-stamped audit trail. The rule then sets out what the trail includes:

1. All modifications to and deletions of the record or any part of it.
2. The date and time of actions that create, modify, or delete the record.
3. Where applicable, the identity of the individual creating, modifying, or deleting the record.
4. Any other information needed to maintain an audit trail of the record.

Those 4 items are a specification, and they are the test any audit trail software has to pass. A system that stores the current version of a procedure and overwrites the previous one fails item 1 on its own. Check your repository against the 4 before an examination request arrives.

Which of These Records You Can Produce This Week

The question an examination asks is a narrow one, and it comes in 3 parts. Somebody will ask for the written policies behind a recommendation, the supervisory procedures that governed its review, and the records showing both existed on the day. Reg BI decides which belong to the firm, 3110 decides what has to be written, and 240.17a-4 decides how long you keep it.

Those 3 parts turn into 4 things to check before the next examination request:

1. Pull your written supervisory procedures and confirm they name the conflicts process required by 240.15l-1(a)(2)(iii).
2. Separate what your reps owe from what your firm owes in the training deck, so a supervisor is never taught a duty the rule gave the firm.
3. Check that correspondence review under 3110(b)(4) produces a record you can retrieve, since 240.17a-4(b)(4) requires you to keep it.
4. Test your repository against the 4 audit-trail items in 240.17a-4(f)(2)(i)(A), and replace anything that overwrites history.

Step 1 and step 4 are both document problems, and that is where KC Docs fits. It holds written supervisory procedures with version history, attestation and export, so the version in force on a given date is retrievable beside the record of who acknowledged it. Our guidance on compliance training and on employee documentation covers the rest of that program.

Your reps will keep owing disclosure and care at the moment of a recommendation. Your firm will keep owing the written policies, the supervisory procedures, and the audit trail behind them. Knowing which duty is whose before an examiner asks is what makes both answers available on the day.

Frequently Asked Questions

1. What is an audit trail under SEC recordkeeping rules?

It is the record of changes to a preserved record. Under 17 CFR 240.17a-4(f)(2)(i)(A), an electronic recordkeeping system may preserve a record for the duration of its retention period in a manner that maintains a complete time-stamped audit trail, and the rule specifies that the trail includes all modifications and deletions, the date and time of actions that create, modify, or delete the record, and where applicable the identity of the individual responsible.

2. Does Reg BI require a registered representative to document anything?

No. Regulation Best Interest names 4 obligations at 17 CFR 240.15l-1(a)(2), and the 2 that require written policies and procedures are addressed to the broker or dealer. The Disclosure obligation requires disclosure in writing to the customer, which is a document delivered rather than a document retained by the rep.

3. Which Reg BI obligations apply to a natural person?

Disclosure at (a)(2)(i) and Care at (a)(2)(ii). Each is framed as a duty of the broker, dealer, or natural person who is an associated person of a broker or dealer. Conflict of Interest at (a)(2)(iii) and Compliance at (a)(2)(iv) are each framed as duties of the broker or dealer.

4. Where does the written supervisory procedures requirement come from?

FINRA Rule 3110. Rule 3110(a) requires each member to establish and maintain a supervisory system and states that final responsibility for proper supervision rests with the member, and 3110(b)(1) requires written procedures to supervise the types of business the member engages in and the activities of its associated persons.

5. How long does a broker-dealer have to keep these records?

17 CFR 240.17a-4(b) sets a period of not less than 3 years for the records it lists, with the first 2 years in an easily accessible place. Paragraph (b)(4) covers originals of all communications received and copies of all communications sent, including any approvals of them and inter-office memoranda.

References

1. 17 CFR 240.15l-1, Regulation best interest, Electronic Code of Federal Regulations, current text.
2. FINRA Rule 3110, Supervision, FINRA Manual.
3. FINRA Rule 3120, Supervisory Control System, FINRA Manual.
4. FINRA Rule 3130, Annual Certification of Compliance and Supervisory Processes, FINRA Manual.
5. 17 CFR 240.17a-3, Records to be made by certain exchange members, brokers and dealers, Electronic Code of Federal Regulations, current text.
6. 17 CFR 240.17a-4, Records to be preserved by certain exchange members, brokers and dealers, Electronic Code of Federal Regulations, current text.