Communications, recordkeeping, and privacy

FINRA Rule 2210 — the framework for everything a BD says publicly

One rule governs it all: FINRA Rule 2210 (Communications with the Public) is the master framework for how broker-dealers and their agents may communicate with customers and prospects. Every communication — every one — lands in one of three categories, each carrying its own supervisory, recordkeeping, and filing requirements.

And here's the principle that decides every borderline question: the categories are defined by audience and volume, never by medium. A single tweet, a one-on-one email, and a televised commercial may each fall into different categories depending on who sees the communication and how widely it travels. Ask "who and how many," not "what platform."

Approval, filing, and recordkeeping

Each 2210 category triggers its own approval and filing obligations — and the exam's favorite move is handing you a fact pattern and asking which requirement it trips. Here's the map:

Approval requirements:

• Retail communication — principal approval required before first use in most cases. Limited exceptions for previously-filed templates and certain research reports.
• Institutional communication — principal approval not required, but the firm must establish and enforce written supervisory procedures and conduct sample reviews.
• Correspondence — principal approval not required at the individual-message level. The firm must instead establish supervisory procedures for review of a representative sample.

Filing with FINRA — two clocks, same length, opposite directions:

• Pre-use filing within 10 business days before first use: retail communications about closed-end funds during the offering period, security futures, and certain BD performance rankings
• Post-use filing within 10 business days of first use: most other retail communications about registered investment companies, public DPP offerings, and similar products
• No filing for institutional communications, correspondence, or retail communications that fall within enumerated exemptions

And the floor under all of it — content standards that apply to every category:

• No false or misleading statements
• No predictions or projections of investment performance (limited exceptions)
• Fair and balanced presentation of risks and benefits
• Required disclosures included when relevant (e.g., past performance disclosures, fee disclosures)

SEC Marketing Rule — Testimonials and Endorsements

For decades, adviser testimonials were flatly banned. The SEC's revised Marketing Rule (effective November 2022) changed the deal: more is allowed, and everything allowed comes with disclosure strings. The key changes:

• Testimonials now permitted (previously banned) — with required disclosures about whether the person was compensated, any material conflicts, and that past experience may not be representative
• Endorsements permitted — with similar disclosures
• Performance advertising rules modernized:
  • Gross and net performance must be shown with equal prominence
  • Performance must include at least 1-, 5-, and 10-year periods (or since inception if less)
  • Hypothetical performance is permitted but only with extensive disclosures about methodology and limitations
• Social media: Advisers must supervise and archive social media content. An adviser's social media post is advertising and must comply with all marketing rules.

Social media, email, and digital messaging

Nothing new under the sun: electronic communications run through the same Rule 2210 categorization as everything else — the medium does not change the category, the audience and volume do. What changes is the operational burden: the firm has to capture and retain every business-related electronic message, wherever it happens.

Social media:

• Static content (profile information, biographical posts, advertising-style content) is typically retail communication and requires pre-use principal approval
• Interactive content (live tweets, comments, real-time replies) is typically treated as correspondence subject to supervisory review
• The firm must archive all business-related social media communications and have the ability to retrieve them on demand
• Personal social media accounts are out of scope unless they are used for business communications, in which case the firm's policies apply

Email and digital messaging:

• All business-related electronic communications must be captured and retained under SEC Rules 17a-3 and 17a-4 (covered below)
• The firm is responsible for adopting and enforcing acceptable-use policies, including prohibitions on conducting business through personal email or unmonitored messaging apps
• "Off-channel" communications — business conducted through unmonitored channels — have been a major recent enforcement area, with billions in fines across the industry. If the firm can't archive it, the business can't happen there.

Website communications:

• The firm's public website is retail communication, fully subject to pre-use approval, filing where required, and the 2210 content standards
• Linked content that the firm endorses, controls, or systematically references becomes the firm's responsibility under FINRA's "entanglement" and "adoption" doctrines

Books and records — SEC Rules 17a-3 and 17a-4

Two rules, one division of labor: SEC Rule 17a-3 says what a broker-dealer must make; SEC Rule 17a-4 says how it must be preserved. Together they're the backbone of the BD recordkeeping regime — and FINRA examinations begin and end with the records they require.

Rule 17a-3 — records that must be made:

• Blotters (records of original entry) showing all purchases and sales of securities, receipts and deliveries of securities, receipts and disbursements of cash
• Ledgers showing all customer assets, liabilities, capital, income, and expense accounts
• Securities records showing each security long or short with its location
• Order tickets capturing every order received
• Confirmations and account statements sent to customers
• Customer account records (the 4512 information)

Rule 17a-4 — the retention trio, straight to memory:

• Lifetime of the firm plus 2 years — partnership articles, corporate charters, minute books, stock certificate books
• 6 years, with the first 2 years easily accessible — customer account records, blotters, ledgers, securities records, customer correspondence
• 3 years, with the first 2 years easily accessible — most other records including order tickets, trade confirmations, communications with the public (Rule 2210 records), trial balances, and customer complaints

Storage media requirements:

• Electronic storage must use a non-rewritable, non-erasable format (WORM — Write Once, Read Many), or any electronic system that meets the SEC's audit-trail requirements
• Records must be readily producible to examiners on demand
• An independent third-party access undertaking is required if records are maintained electronically

Regulation S-P — customer privacy

What the firm knows about its customers is regulated too. SEC Regulation S-P governs how broker-dealers and investment advisers may collect, use, and share customer nonpublic personal information — with state law (USA §403 and the NASAA Investment Adviser Information and Security Privacy Rule) imposing parallel obligations for state-registered firms.

The notice cadence — initial and annual:

• An initial privacy notice must be delivered to each customer not later than the establishment of the customer relationship
• An annual privacy notice must be delivered while the customer relationship continues, unless the firm has not changed its disclosed sharing practices and shares only within permitted exceptions
• Notices must describe what information is collected, how it is used, with whom it is shared, and how it is protected

The opt-out right — and its precise edges:

• Customers have the right to opt out of sharing their nonpublic personal information with nonaffiliated third parties (with limited exceptions for service providers and joint marketing arrangements)
• The opt-out notice must be clear, conspicuous, and provide a reasonable means to exercise the right
• A reasonable period (typically 30 days) must be provided before any nonexempt sharing begins

The Safeguards Rule:

• Firms must adopt written policies and procedures reasonably designed to protect customer records and information
• The Safeguards Rule covers administrative, technical, and physical safeguards
• The 2024 amendments require written incident response programs and notification of affected individuals within 30 days of a covered breach