Business Rules - SEC Compliance for Fintech Builders

> Legal/financial note: This section is descriptive and informational. > It does not constitute personalized financial advice, an investment recommendation, or legal advice. > Always consult a qualified professional (compliance officer, financial-markets counsel) before making operational decisions. > Governing reference: SEC Regulation Best Interest (2019); Investment Advisers Act of 1940 (15 U.S.C. § 80b); 17 CFR.

This document lists the invariant business rules of the SEC compliance domain from the perspective of a fintech platform builder. Each rule describes the compliance process (record creation, retention, reporting, audit), not an investment recommendation. Identified with BR-NNN codes.

---

BR-001 - Automatic creation of books and records

Code: BR-001 Name: Every transaction generates the records required by Rule 17a-3 Description: In the SEC domain, broker-dealer platforms must automatically generate all required record types as transactions are processed (blotters, ledgers, order memoranda), with immutable timestamps and identifiers. Motivation: Ensure completeness of the prescribed books and records. Priority: CRITICAL Actors: Order Management System, Compliance Officer Traceability: 17 CFR § 240.17a-3; glossary "Rule 17a-3", "Books and Records".

---

BR-002 - WORM retention of records

Code: BR-002 Name: Electronic records are retained on WORM media for the prescribed period Description: The process requires records created under 17a-3 to be stored on WORM (Write Once Read Many) media, non-deletable and non-rewritable for the minimum retention period (generally six years). Motivation: Protect the integrity and immutability of regulated records. Priority: CRITICAL Actors: Storage System, Compliance Officer Traceability: 17 CFR § 240.17a-4(f); glossary "WORM", "Object Lock WORM".

---

BR-003 - Immutable audit log on every record access

Code: BR-003 Name: Every read/write/export of a record generates an immutable audit entry Description: The domain requires a tamper-evident, append-only audit log recording every event on regulated records with actor identity, timestamp, and outcome, retained on WORM media. Motivation: Enable reconstruction and examination verification. Priority: HIGH Actors: Audit Logging System, SEC/FINRA Examiner Traceability: 17 CFR § 240.17a-4(f)(2)(ii); glossary "Immutable Audit Log".

---

BR-004 - Timely access for examiners

Code: BR-004 Name: Records are producible to examiners within prescribed deadlines Description: The process provides a portal or export feature producing non-deletable, non-rewritable copies of records on SEC/FINRA examiner request, with complete access audit logging. Motivation: Ensure accessibility and reproducibility during examinations. Priority: HIGH Actors: Examiner Portal, SEC/FINRA Examiner Traceability: 17 CFR § 240.17a-4(f)(3)(vii); glossary "Examiner Portal".

---

BR-005 - Undertaking letter for third-party storage

Code: BR-005 Name: Third-party storage requires a valid undertaking letter Description: In the domain, using a third-party storage service for regulated records is non-compliant without an undertaking letter binding the vendor to WORM requirements and examinations. Motivation: Contractually extend WORM obligations down the supply chain. Priority: MEDIUM Actors: Compliance Officer, Storage Vendor Traceability: 17 CFR § 240.17a-4(f)(3)(vii); glossary "Third-Party Undertaking Letter".

---

BR-006 - SAR/CTR reporting workflow (AML)

Code: BR-006 Name: Suspicious activity and cash thresholds trigger reporting workflows Description: The process requires monitoring systems and workflows for filing SARs (within 30 days of detection) and CTRs (for cash transactions >USD 10,000), with five-year retention. Motivation: Comply with the Bank Secrecy Act and AML obligations. Priority: HIGH Actors: Compliance Officer, FinCEN Traceability: 31 CFR § 1020.320 (SAR); 31 CFR § 1010.311 (CTR); glossary "SAR", "Currency Transaction Report (CTR)".

---

BR-007 - Information barrier against MNPI leakage

Code: BR-007 Name: The flow of MNPI between restricted and public sides is prevented Description: The domain requires information barrier (Chinese wall) controls at the data level preventing the flow of material non-public information, logging crossing requests and generating compliance reports. Motivation: Prevent insider trading under Rule 10b-5. Priority: CRITICAL Actors: Compliance Officer, RBAC System Traceability: 17 CFR § 240.10b-5; glossary "Information Barrier (Chinese Wall)", "Material Non-Public Information (MNPI)".

---

BR-008 - Pre-order controls for short sales

Code: BR-008 Name: Short orders comply with Regulation SHO controls Description: In the domain, OMS systems must implement Regulation SHO controls (locate, short/long marking, threshold-security monitoring) as a pre-order gate. The description is a process, not a trading recommendation. Motivation: Comply with Regulation SHO on short sales. Priority: HIGH Actors: Order Management System, Compliance Officer Traceability: 17 CFR §§ 242.200–204; glossary "Regulation SHO", "Short Sale".