Glossary

> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

Annual Report (Form 10-K)

A Form 10-K is a comprehensive annual report that a public company must file with the SEC within 60 to 90 days of its fiscal year end, depending on filer status. The form contains audited financial statements, management discussion and analysis, risk factors, and corporate governance disclosures. Software builders constructing SEC EDGAR integration pipelines must handle the Form 10-K's XBRL-tagged financial data, large file sizes, and nested exhibit attachments. (Securities Exchange Act of 1934, § 13(a); 17 CFR § 240.13a-1)

Books and Records

Books and records under SEC Rule 17a-3 and Rule 17a-4 are the trade blotters, memoranda, correspondence, and ledgers that broker-dealers must create and retain. The term encompasses order records, trade confirmations, account statements, and all communications related to securities transactions. Systems must capture records at the point of origination, stamp them with a tamper-evident timestamp, and route them to compliant storage without modification. (17 CFR § 240.17a-3, 17 CFR § 240.17a-4)

Broker-Dealer

A broker-dealer is any person or firm engaged in the business of buying and selling securities for customers (broker) or for its own account (dealer), or both. Broker-dealers registered with the SEC under the Securities Exchange Act of 1934 are subject to Rule 17a-3 and Rule 17a-4 books-and-records requirements. Software platforms serving broker-dealers must implement compliant record creation, retention, and reproduction capabilities. (Securities Exchange Act of 1934, § 15; 17 CFR § 240.17a-3)

CFTC (Commodity Futures Trading Commission)

The CFTC is the US federal agency that regulates commodity futures, options, and swaps markets. It enforces rules on derivatives records retention that parallel SEC requirements and has issued its own WORM and electronic records rules. Builders of platforms supporting both securities and derivatives must implement dual-compliance retention logic covering both SEC Rule 17a-4 and CFTC Part 1.31. (17 CFR Part 1.31)

EDGAR (Electronic Data Gathering, Analysis, and Retrieval)

EDGAR is the SEC's public filing system through which companies submit registration statements, periodic reports, proxy statements, and current reports. The EDGAR EFTS full-text search API and EDGAR viewer API allow builders to retrieve filings programmatically. All EDGAR submissions must include XBRL-tagged financial data for structured consumption. (Securities Exchange Act of 1934, § 12; 17 CFR § 232.405)

Electronic Storage Media

Electronic storage media under Rule 17a-4 means any digital medium on which records can be written. The rule permits records to be stored on micrographic media, electronic storage media, or other digital media, provided the medium satisfies the WORM requirement. Cloud object storage configured with Object Lock in Compliance Mode satisfies this requirement. (17 CFR § 240.17a-4(b)(4), (f))

Exchange Act

The Securities Exchange Act of 1934 (Exchange Act) regulates the trading of securities after their initial issuance, governs broker-dealers, exchanges, and reporting companies, and established the SEC. Key sections relevant to software builders include § 13 (reporting obligations), § 15 (broker-dealer registration), and § 17 (record-keeping requirements). (15 U.S.C. § 78a et seq.)

FINRA (Financial Industry Regulatory Authority)

FINRA is the self-regulatory organisation that oversees registered broker-dealers in the United States. FINRA Rules 4370 (Business Continuity Plans), 4511 (Books and Records), and 4512 (Customer Account Information) supplement SEC Rule 17a-3/17a-4 and impose additional record-creation and retention obligations. Software platforms for broker-dealers must comply with both SEC and FINRA rules.

FINRA Rule 4511

FINRA Rule 4511 requires members to preserve books and records as required by SEC Rules 17a-3 and 17a-4, and provides supplemental requirements for digital records. It mandates that member records be maintained in a manner that is accessible and reproducible by FINRA examiners within stipulated response times. Builders must implement an examiner portal or export capability that produces WORM-compliant record copies on demand.

Form 4

A Form 4 is a Statement of Changes in Beneficial Ownership that corporate insiders (directors, officers, and 10%+ shareholders) must file with the SEC within two business days of a securities transaction. EDGAR receives Form 4 filings and makes them publicly accessible. Builders of insider-trading monitoring or corporate governance platforms must integrate Form 4 parsing into their data pipelines. (Securities Exchange Act of 1934, § 16(a); 17 CFR § 240.16a-3)

Form 8-K

A Form 8-K is a current report that a public company must file with the SEC within four business days of a material corporate event, such as a change in executive leadership, an acquisition, a bankruptcy filing, or a material restatement. EDGAR integration pipelines must subscribe to 8-K feeds to support event-driven analytics. (Securities Exchange Act of 1934, § 13(a); 17 CFR § 240.13a-11)

Immutable Audit Log

An immutable audit log is a tamper-evident, append-only record of all system events affecting regulated data. For SEC-regulated systems, immutable audit logs must record every read, write, deletion attempt, and export of a book-or-record, together with the actor identity, timestamp, and outcome. The log must be stored on WORM-compliant media and retained for a period that meets or exceeds the applicable record retention schedule. (17 CFR § 240.17a-4(f)(2)(ii))

Investment Adviser

An investment adviser is a person or firm that provides investment advice about securities for compensation. Investment advisers registered with the SEC under the Investment Advisers Act of 1940 are subject to Rule 204-2, which imposes books-and-records requirements paralleling those of Rule 17a-4. Software platforms serving registered investment advisers must implement compliant record creation and retention. (15 U.S.C. § 80b-4; 17 CFR § 275.204-2)

Lexicon XBRL

XBRL (eXtensible Business Reporting Language) is the structured data format mandated by the SEC for financial statement tagging in periodic reports. XBRL uses a taxonomy of standardised elements to tag each line item in a financial statement. Builders consuming EDGAR filings must parse XBRL instance documents and context/label linkbases to extract structured financial data.

Material Non-Public Information (MNPI)

MNPI is information that is both material (likely to affect a reasonable investor's decision) and non-public (not yet disclosed to the market). Trading on MNPI constitutes insider trading under SEC Rule 10b-5. Builders constructing compliance systems must implement information-barrier controls (Chinese walls) that prevent MNPI from flowing from restricted to public-side users in the same application. (Securities Exchange Act of 1934, § 10(b); 17 CFR § 240.10b-5)

Order Management System (OMS)

An OMS is a software platform for managing the lifecycle of securities orders - creation, routing, matching, execution, and reporting. OMS platforms are among the principal systems subject to SEC Rule 17a-3 order records requirements. Builders must ensure that all order state transitions (new, partial fill, cancelled, rejected) are recorded with microsecond timestamps and immutable identifiers. (17 CFR § 240.17a-3(a)(6))

Regulation SCI (Systems Compliance and Integrity)

Regulation SCI (17 CFR Part 242, Subpart D) requires SCI entities - exchanges, alternative trading systems, plan processors, and certain clearing agencies - to implement, maintain, and test systems that have adequate capacity, integrity, resiliency, availability, and security. Builders must implement capacity monitoring dashboards, automated failover testing procedures, and SCI event reporting pipelines to the SEC within one to 24 hours. (17 CFR §§ 242.1000–1007)

Regulation NMS (National Market System)

Regulation NMS (17 CFR Part 242) governs the structure of US equity markets, including order protection (Trade-Through Rule), access to quotes, sub-penny pricing, and market data. Builders of trading systems must implement best-execution logic that routes orders to the national best bid and offer and prevents locked or crossed market conditions. (17 CFR §§ 242.600–612)

Rule 10b-5

Rule 10b-5 is the SEC's anti-fraud rule under Section 10(b) of the Exchange Act. It prohibits any person from using any manipulative or deceptive device in connection with the purchase or sale of a security. Builders of trading platforms must implement controls that detect and block potential manipulation patterns (layering, spoofing, wash trading) and log all flagged events for compliance review. (17 CFR § 240.10b-5)

Rule 17a-3

Rule 17a-3 prescribes the types of records that broker-dealers must create and maintain: trade blotters, ledgers of securities owned and owed, ledgers of customers' accounts, memoranda of orders, and more. Software platforms for broker-dealers must generate all required record types automatically as transactions are processed, without requiring manual data entry. (17 CFR § 240.17a-3)

Rule 17a-4

Rule 17a-4 prescribes how long broker-dealers must retain the records created under Rule 17a-3. The general rule is six years from the end of the fiscal year in which the record was created. Some records - including partnership agreements, articles of incorporation, and certain customer records - must be retained for the life of the enterprise plus three years. Records must be stored on WORM media and must be accessible for examination. (17 CFR § 240.17a-4)

SAR (Suspicious Activity Report)

A SAR is a report that financial institutions must file with FinCEN when they detect activity suggesting money laundering, fraud, or other financial crimes. The Bank Secrecy Act and AML regulations require SARs to be filed within 30 days of detection (60 days if the subject cannot be identified). Builders must implement SAR workflow systems that track case creation, escalation, reviewer assignment, filing status, and 5-year retention of filed SARs. (31 CFR § 1020.320)

SCI Entity

An SCI entity is a national securities exchange, alternative trading system (ATS) with significant market share, registered clearing agency, or plan processor that is subject to Regulation SCI. SCI entities must adopt written policies for systems compliance, report SCI events to the SEC, conduct annual reviews, and maintain business continuity plans. Builders of trading infrastructure must determine whether their platform meets the SCI entity threshold. (17 CFR § 242.1000)

SCI Event

An SCI event is any systems disruption, intrusion, or material weakness affecting a critical SCI system. Broker-dealers and SCI entities must report SCI events to the SEC within one hour of detection for critical events and within 24 hours for other SCI events. Builders must implement automated SCI event detection pipelines that classify events, generate regulatory notification payloads, and submit them to the SEC via the EDGAR electronic reporting system. (17 CFR § 242.1002)

Securities Act

The Securities Act of 1933 (Securities Act) governs the initial offering and sale of securities to the public, requiring that registration statements and prospectuses be filed with the SEC before securities may be sold. Builders of issuance platforms, transfer agent systems, and cap-table management software must implement compliant registration workflow and prospectus distribution capabilities. (15 U.S.C. § 77a et seq.)

Short Sale

A short sale is the sale of a security that the seller does not own, borrowed from a third party with the intention of repurchasing it later at a lower price. Short sales are subject to Regulation SHO (17 CFR §§ 242.200–204), which imposes locate requirements, close-out obligations, and marking rules. Builders of order management systems must implement Regulation SHO checks as a pre-order gate.

SIFMA Guidelines

SIFMA (Securities Industry and Financial Markets Association) publishes model notices, guidance letters, and best-practice recommendations on electronic records retention, cloud storage, and third-party vendor management for broker-dealers. While not legally binding, SIFMA guidance provides the practical implementation baseline that FINRA examiners reference when assessing Rule 17a-4 compliance. Builders should consult SIFMA's guidance on cloud-hosted WORM storage prior to choosing an object storage configuration.

Transfer Agent

A transfer agent is an entity that records changes in securities ownership, cancels and issues certificates, processes investor mailings, and handles lost or destroyed securities. Transfer agents registered with the SEC under Section 17A of the Exchange Act are subject to Rule 17Ad-19 (lost securities procedures) and Rule 17Ad-7 (records retention). Builders constructing transfer agent platforms must implement both broker-dealer and transfer agent record-keeping requirements.

WORM (Write Once Read Many)

WORM is a data storage paradigm in which, once written, data cannot be modified or deleted for a prescribed minimum retention period. SEC Rule 17a-4(f) requires that electronic records of broker-dealers be stored on WORM-compliant media. Acceptable implementations include purpose-built optical WORM media, certified third-party WORM storage services (with a third-party undertaking letter on file), and cloud object storage in Object Lock Compliance Mode with governance locks disabled. (17 CFR § 240.17a-4(f)(2))

WORM Object Lock

WORM Object Lock is a cloud object storage feature (available in Amazon S3, Azure Blob Storage, and Google Cloud Storage) that prevents object deletion or overwrite during a specified retention period. In Compliance Mode, not even the bucket owner can delete a locked object before the lock expires. This satisfies Rule 17a-4's WORM requirement when combined with an appropriate third-party undertaking letter from the cloud provider. (17 CFR § 240.17a-4(f)(3)(vii))

XBRL (eXtensible Business Reporting Language)

XBRL is an XML-based language for electronic communication of business and financial reporting data. The SEC mandates XBRL tagging for financial statements filed in annual and quarterly reports (Forms 10-K and 10-Q). XBRL instance documents, taxonomy schemas, calculation linkbases, and label linkbases must all be validated against the US-GAAP taxonomy before submission. Builders of EDGAR filing tools must integrate an XBRL validator into their submission pipeline. (17 CFR § 232.405; SEC Release 33-9002)

Zero-Knowledge Proof in Financial Compliance

A zero-knowledge proof (ZKP) is a cryptographic method by which one party can prove to another that a statement is true without revealing any additional information. In financial compliance contexts, ZKPs are an emerging technique for proving transaction aggregates or account balance thresholds to regulators without exposing the underlying customer data. While not yet mandated by SEC rules, ZKP-based regulatory reporting is an active area of innovation in compliant fintech architecture.

Alternative Trading System (ATS)

An alternative trading system is a non-exchange trading venue that matches buyers and sellers of securities. ATSs with significant market share thresholds are classified as SCI entities under Regulation SCI and must comply with systems compliance and integrity requirements. Builders of dark pool or crossing-network platforms must implement SCI event detection, SEC reporting pipelines, and business continuity plans. (17 CFR § 242.301; 17 CFR § 242.1000)

Bank Secrecy Act (BSA)

The Bank Secrecy Act (31 U.S.C. § 5311 et seq.) is the primary US federal anti-money laundering statute. It requires financial institutions to maintain records, file Currency Transaction Reports (CTRs) for cash transactions exceeding USD 10,000, and file Suspicious Activity Reports (SARs) when suspicious patterns are detected. Builders of payment and trading platforms must implement BSA-compliant transaction monitoring, case management, and regulatory reporting workflows.

Customer Identification Program (CIP)

A CIP is the identity-verification program that financial institutions must establish under the USA PATRIOT Act and implementing regulations. CIP requires collecting and verifying the name, date of birth, address, and identification number of each customer prior to account opening. Builders must integrate document verification APIs, PEP/sanctions screening, and KYC orchestration workflows that record verification evidence for a minimum of five years. (31 CFR § 1020.220)

Currency Transaction Report (CTR)

A CTR is a report that US financial institutions must file with FinCEN whenever a customer conducts a cash transaction exceeding USD 10,000 in a single business day. Builders of payment platforms must implement CTR detection logic that aggregates same-day cash transactions per customer, generates the BSA-compliant FinCEN Form 112 payload, and submits it electronically within 15 days. (31 CFR § 1010.311)

Examiner Portal

An examiner portal is a secure, read-only interface that allows SEC and FINRA examiners to retrieve regulated records on demand during an examination. Under Rule 17a-4(f)(3)(vii), broker-dealers must provide prompt access to records and must be able to produce non-erasable, non-rewritable copies within the timeframes mandated by examiners. Builders must implement examiner-accessible views with comprehensive audit logging of all examiner access events.

Information Barrier (Chinese Wall)

An information barrier (commonly called a Chinese wall) is a set of policies, procedures, and technical controls that prevent MNPI from flowing between restricted-side (investment banking) and public-side (trading) personnel at the same firm. Software implementations must enforce role-based access controls at the data layer, log all barrier crossing requests, and generate compliance reports of any potential leakage events. (Securities Exchange Act of 1934, § 10(b); 17 CFR § 240.10b-5)

An LEI is a 20-character alphanumeric code assigned to legal entities engaging in financial transactions, managed by the Global LEI Foundation (GLEIF). US regulations and FINRA rules require LEIs in transaction reporting for certain counterparty types. Builders of trade reporting systems must integrate LEI validation against the GLEIF API, detect expired or lapsed LEIs before accepting counterparty registration, and maintain a LEI cache with TTL-based refresh. (17 CFR § 240.13h-1; GLEIF Technical Specification)

Regulation SHO

Regulation SHO (17 CFR §§ 242.200–204) governs short selling in US equity markets. It requires broker-dealers to locate borrowable shares before executing a short sale (locate requirement), to mark orders as "short" or "long", and to close out fail-to-deliver positions within prescribed timeframes. Builders of order management systems must implement Regulation SHO pre-order locate checks, short-marking logic, and threshold securities monitoring. (17 CFR § 242.200)

Third-Party Undertaking Letter

A third-party undertaking letter is a written agreement between a broker-dealer and a third-party storage provider (including cloud vendors) that contractually binds the provider to comply with Rule 17a-4 WORM requirements and to submit to SEC and FINRA examinations on request. Without a valid undertaking letter on file, use of a third-party storage service for regulated records is non-compliant. Builders integrating cloud storage must obtain and retain the current undertaking letter from their cloud provider. (17 CFR § 240.17a-4(f)(3)(vii))