Securities rules look like a pile of numbers. They are easier to hold if you keep asking two questions: which body wrote this, and what does it oblige someone to do? Congress writes statutes, the Commission writes regulations under them, the industry's own organization writes rules its members must follow, and each state writes its own act on top. This guide reads those instruments directly. Orientation for study, not investment advice, and not affiliated with any exam body.
Each chapter opens with the short version. Tap one to read the detail.
What a firm owes you at the moment it fills an order
~2 min
Order handling is governed by what the firm must disclose and record, not by the order types themselves. A confirmation must reach you in writing at or before completion, and it must say whether the firm acted as agent or principal. Short sales carry their own machinery: a locate before the sale, and a forced close-out when delivery keeps failing.
Order types are market convention; the regulated part is the firm's duty around them. The confirmation rule requires a broker-dealer to give the customer specified information in writing at or before completion of a transaction. The item you are most likely to miss is capacity. As agent, the firm arranges your trade with someone else and charges a commission. As principal, it sells you something from its own inventory. Both are lawful, and the disclosure is what lets you tell them apart.
Records sit behind the disclosure. The books-and-records rule requires a memorandum of each order showing, among other things, the time it was entered, which is what makes a later reconstruction possible. Suppose your customer disputes the price they got. The time-stamped ticket and the confirmation are the two documents that answer it.
Short selling has the most machinery. Before a short sale, the broker-dealer must have borrowed the security, arranged to borrow it, or have reasonable grounds to believe it can be borrowed by the delivery date, and must document that. If a fail-to-deliver position persists at a clearing agency for thirteen consecutive settlement days, the participant must close it out by buying like securities. The misconception is that a short sale is just a bet placed in reverse. The borrow requirement is what stops it being a promise the seller cannot keep.
A newer duty governs how orders reach the market at all. A firm with market access must maintain risk-management controls, and the rule defines that access as trading through membership or a subscription, not as any particular technology.
Rule: for any trading question, ask what the firm had to disclose, what it had to record, and — if the sale was short — whether it could actually deliver.
Two accounts, and the credit rule that separates them
~2 min
A cash account permits a purchase when the funds are there or the firm accepts an order in good faith. A margin account is where everything else is recorded, because the customer is borrowing. The credit regulation sets the initial requirement; the exchanges and the firm set maintenance levels, which is why a call can arrive without the rule changing.
The account types are a credit distinction. In a cash account, a firm may buy for or sell to a customer when there are sufficient funds, or when it accepts the order in good faith. The margin account is defined residually: all transactions not specifically authorized for another account are recorded there. That residual definition is the tell. Margin is less a product your customer opts into than the account that holds borrowing.
The federal credit rule fixes the initial requirement and the list of what may be margined at all; exempted securities are treated differently from ordinary equities. Maintenance requirements come from the exchanges and the firm's own house policy. So your customer can meet the initial requirement, watch the position fall, and still receive a maintenance call without any rule changing. An ordinary decline can breach maintenance while the original purchase stays fully compliant.
Opening the account has its own federal layer. A broker-dealer must run a customer identification program, verifying identity and collecting a taxpayer identification number. For a legal-entity customer, it must identify the beneficial owners: each individual holding twenty-five percent or more of the equity, plus one individual with significant responsibility to control or manage the entity.
Registration forms such as joint tenancy, custodial accounts for a minor, trusts and estates belong to state property and probate law, not federal rules, so their mechanics are not stated here. Retirement account limits move annually; treat any figure you memorize as this year's, not the rule.
Rule: ask whether the customer is paying or borrowing, then whether the requirement you are being asked about is the initial federal one or a maintenance level someone else set.
One antifraud rule, and the reporting regime beside it
~2 min
The general antifraud rule reaches any device or scheme to defraud in connection with a purchase or sale, and it bars both an untrue statement of a material fact and an omission. Insider trading is framed as trading on the basis of material nonpublic information. The money-laundering duties are a separate regime in a different title of the code.
Most prohibited-practice questions you meet resolve to one rule. It makes it unlawful to employ any device, scheme or artifice to defraud. It also bars an untrue statement of a material fact or the omission of a material fact needed to make what was said not misleading, the half people forget. Silence can be the violation. That single sentence is why so many different frauds share one citation.
Insider trading is built on top of it. The rule frames the prohibition as trading "on the basis of" material nonpublic information. A companion rule extends the same logic to tender offers, where a substantial step toward an offer triggers duties in anyone who learns of it. The misconception is that the information must be stolen. What matters is the duty attaching to the person who has it.
Customer property has its own protection. The customer-protection rule obliges a firm to obtain and keep possession or control of fully paid customer securities. That requirement is behind every question about commingling a firm's assets with a customer's.
Anti-money-laundering duties live in a different title of the code, which is why they feel like a separate subject: a report for cash transactions above ten thousand dollars, suspicious-activity reporting the customer is not told about, sanctions screening, and the beneficial-ownership identification from the accounts chapter. Suppose your customer breaks a large cash deposit into smaller ones to stay under the reporting line. The structuring is itself the offense.
Rule: name the instrument before the label. Fraud and insider trading come from the securities antifraud rule; the reporting duties come from the bank-secrecy regime.
Registration is a status with conditions attached
~2 min
Registration attaches to the individual, not only the firm, and it is applied for on a uniform form that also carries disclosure. Statutory disqualification is defined by statute rather than by the industry body. Continuing education has a regulatory element the individual owes and a firm element the employer designs.
If you do the work as an associated person, you must register, through a uniform form filed on the industry's registration system. That form does double duty. It registers you and it discloses your history, so a criminal, regulatory or customer-complaint event becomes part of a public record. When you leave, the firm files a termination notice, which is why leaving does not erase what was disclosed.
The misconception is that statutory disqualification is an industry judgment about character. It is not: the term is defined in the securities statute, and the rulebook simply points at that definition. So the question is never whether a firm considers someone unsuitable. It is whether the statute's list captures the event.
Continuing education splits in two, and the split is the exam point. The regulatory element is prescribed centrally and owed by you, the registered individual. The firm element is designed by your employer for its own people and business. One is a syllabus you are given; the other is a syllabus your firm writes.
The rulebook also separates registration requirements from registration categories: who must register, and which representative or principal category they hold. A principal supervises; a representative deals with customers. Suppose you are promoted to supervise a desk you previously traded on. The work changed category, so your registration must too.
Gift limits, contribution thresholds and outside-activity notice periods are numbers that move. Learn which rule governs each, and check the current figure rather than memorizing one.
Rule: separate the person from the firm, and the requirement from the category. Most conduct questions are asking which of those four things changed.
Which act does what, and why the answer is usually the 1934 one
~2 min
The 1933 Act governs new issues and disclosure at sale; the 1934 Act created the Commission and governs everything continuing — reporting, proxies, ownership, and the antifraud reach. Insiders surrender short-swing profits to the issuer. The fund and adviser definitions live in the 1940 Acts, not in either of the first two.
The framework is easier to hold as a timeline than as a list. The 1933 Act covers the moment securities are sold to the public: registration, the prospectus, and liability for a defective registration statement. The 1934 Act covers everything afterwards, and it built the machinery. It created the Commission, registered the exchanges and the industry's self-regulatory organizations, and set the continuing obligations of a public company.
You will meet those continuing obligations repeatedly. Periodic reports keep the market informed. The proxy rules govern how a company solicits votes. Ownership reporting obliges large holders and insiders to say what they hold. And the short-swing provision recovers for the issuer any profit an insider makes buying and selling within a period of less than six months. It is a strict rule that does not ask whether the insider actually misused anything.
The definition of a security lives here too, as a long enumerated list that includes the investment contract. That catch-all is why arrangements nobody called a security have been treated as one. Consider a company that sells stakes in a venture it will operate and profit from on the buyers' behalf. No share certificate is involved, and the investment-contract clause can still reach it.
The most common wrong answer puts funds and advisers in the wrong statute. Investment companies and investment advisers are creatures of the two 1940 Acts, which define the fund categories: the face-amount certificate company, the unit investment trust, and the management company. The 1934 Act only cross-references them.
Rule: place the question on the timeline. Selling something new is the 1933 Act; being a public company, an exchange or a broker-dealer afterwards is the 1934 Act; being a fund or an adviser is 1940.
Fifty acts that rhyme, and one model behind them
~2 min
State securities law is enforced by an Administrator with rulemaking, investigative and order powers. Registration at state level runs by coordination, qualification, or notice filing. The buyer's remedy is rescission — the consideration paid plus interest, less income received — which is why state law bites even where federal law also applies.
There is no single state securities law. There is a model act, revised over decades, and each state enacts its own version. The concepts transfer; the section numbers and thresholds do not. So study the mechanics, then check the state that actually governs.
The model's central figure is the Administrator, who makes rules, investigates, and issues orders, including summary ones. Its investigative powers include compelling testimony under oath and issuing subpoenas, so a state inquiry can move before any federal case exists.
Registration of securities runs three ways. Coordination rides on a concurrent federal registration. Qualification is the standalone route, used when there is no federal filing. Notice filing is the thin route for securities federal law has already made covered, where the state's role shrinks to notice and fees.
The misconception is that federal registration ends the matter. Even a federally covered security still meets a notice filing and fees, and state antifraud authority survives regardless. Exemptions come in the same two flavors as federal law. Memorize one by its shape: the isolated nonissuer transaction, exempt whether or not a broker-dealer was involved. The category follows the transaction's character, not who executed it.
The remedy gives the act its teeth. A buyer may recover the consideration paid, plus interest at the state's legal rate, costs and reasonable attorney's fees, less any income already received. Tender requires only notice of willingness to exchange the security back. Suppose an unregistered agent sold your customer stock: the customer can unwind the purchase, not merely sue for the loss.
Rule: learn the model's structure, then say which state's enacted version governs before you state a number.
Advice for compensation, and the duties that follow it
~2 min
An adviser is someone who, for compensation, is in the business of advising about securities — all three parts must be present. Registered advisers must deliver a brochure describing their business and conflicts. Holding client assets triggers the custody rule, which treats inadequate safekeeping as itself a fraudulent practice.
The definition is a three-part test, and you lose marks by dropping one: advice about securities, as a business, for compensation. Take any part away and the person is something else: a friend with opinions, an occasional favor, an unpaid commentator. The exclusions follow the same logic; professionals whose advice is incidental to another practice are outside it.
The misconception is that the pay method settles it, so a fee makes an adviser and a commission makes a broker. Compensation is only one of the three parts. What matters is receiving it for advice given as a business.
The relationship's paperwork is the brochure. A registered adviser must deliver a brochure, plus supplements covering the individuals who advise the client, with the information the form requires. It discloses the business and its conflicts, so the client can judge the advice's incentives as well as its content.
Custody is where the rules turn severe. If an adviser has custody of client funds or securities, failing to arrange proper safekeeping is itself a fraudulent, deceptive or manipulative practice. The violation is the arrangement, not any loss. So you answer custody questions by what protections were in place, not by whether the client was harmed.
Advisers also owe a code of ethics, with records of violations and written acknowledgments. Consider a firm whose staff trade personally in securities they recommend: the code and its records make the conflict visible.
Federal versus state registration turns on size and place of business, and that line has moved more than once. Treat any threshold you learn as current, not permanent.
Rule: test the definition in three parts, then ask what the adviser holds. Advice alone brings disclosure duties; holding assets brings custody duties.
Audience decides the category; supervision decides who checks
~2 min
Communications are sorted by how many retail investors receive them in a thirty-day window: more than twenty-five is a retail communication, twenty-five or fewer is correspondence, and institutional-only is its own category. Supervision is a written system with designated offices, and an office becomes a supervisory jurisdiction by the functions performed there.
The categories are an audience count, not a judgment about tone. A retail communication is a written communication distributed or made available to more than twenty-five retail investors within any thirty calendar-day period. Correspondence is the same thing to twenty-five or fewer. An institutional communication goes only to institutional investors and excludes a firm's internal messages. The misconception is that you classify a piece by what it says. The same words move category when the distribution list grows. Suppose your letter goes to twenty clients, and then a colleague forwards it to forty more. The category changed, and with it the approval and filing duties.
Supervision is the other half. A firm must have a written supervisory system, and the rulebook defines an office of supervisory jurisdiction by what happens there: order execution or market making, structuring offerings, or holding custody of customer funds or securities, among other functions. So a small office can be a supervisory jurisdiction and a large one need not be. The test is function, not headcount.
The system is maintained, not merely written. Offices are inspected on a cycle, and you, as a registered person, attend an annual compliance interview or meeting about matters relevant to your own activities. People generalize that detail away: the meeting is supposed to be about what you actually do.
Records are the third leg, and their retention periods are set federally, not by the industry rulebook. So this chapter's three subjects come from two different rule-makers.
Rule: count the audience to classify a communication; describe the function to classify an office.
Who decides, who hears an appeal, and what the forum cannot give you
~2 min
Industry discipline runs through a code of procedure: a complaint, a hearing panel, and an appeal to the national adjudicatory body. Most matters settle instead, through a consent letter that avoids a hearing. Arbitration is a separate forum for customer disputes, and neither forum can restore a loss that came from the market itself.
Discipline has a shape worth memorizing. A department brings a complaint, a hearing panel hears it, and its decision may be appealed to the national adjudicatory council, with the Commission and then the courts beyond that. Know the ladder and you can answer a whole family of questions about who reviews whom.
Most cases never reach a panel. The code provides for acceptance, waiver and consent: a settlement in which the respondent consents to findings and a sanction without a hearing. A separate minor-violation route handles small matters. The misconception is that a settlement means the matter was weak. It usually means both sides preferred certainty.
Sanctions are the industry's own: censure, fines, suspension, and a bar from association. Note what is missing. A self-regulatory organization cannot imprison anyone. Criminal exposure comes from prosecutors under the securities statute and the general criminal law, and civil remedies such as injunctions and disgorgement come from the Commission in court. Consider a fraud that ends three ways at once: a bar from the industry, a civil action, and a criminal case, each in its own forum.
Customer disputes go to arbitration, a separate forum with its own code, where awards are binding and the grounds for vacating one are narrow. Mediation runs alongside it and is voluntary.
And the honest limit: no forum restores a loss caused by the market moving against you. Recourse exists for misconduct, not for risk.
Rule: identify the forum first — industry discipline, arbitration, civil court, criminal court — because each has its own decider and its own remedy.
Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.