Try 10 focused Series 99 questions on Professional Conduct, with explanations, then continue with the full Securities Prep practice test.
Series 99 Professional Conduct questions help you isolate one part of the FINRA outline before returning to a mixed practice test. The questions below are original Securities Prep practice items aligned to this topic and are not copied from any exam sponsor.
| Item | Detail |
|---|---|
| Exam | FINRA Series 99 |
| Official topic | Function 2 — Professional Conduct and Ethical Considerations |
| Blueprint weighting | 30% |
| Questions on this page | 10 |
An operations analyst confirms on September 9, 2025 that an external party had unauthorized access to certain customers’ nonpublic personal information (NPI). On September 10, 2025, the firm receives a written request from law enforcement stating: “Do not notify affected customers until September 23, 2025.”
Exhibit: WSP excerpt (Privacy incident notices)
Assume business days are Monday–Friday and there are no holidays. Which customer communication meets the WSP timing and content requirements?
Best answer: C
Explanation: The law-enforcement delay pushes notification to the next business day after September 23, and the email content must avoid full account numbers/SSNs by masking to last four digits.
A written law-enforcement delay overrides the normal 10-calendar-day notification timing. The WSP requires sending the notice on the next business day after the specified delay date and prohibits including full account numbers, SSNs, or credentials in an email notice. The communication that follows the delay timing and uses masked account information is the only compliant choice.
This scenario tests two constraints that must both be satisfied: timing after a law-enforcement delay and content limits for customer notices. Although the firm’s baseline requirement is to notify within 10 calendar days of the determination date, the WSP allows delaying notification when the firm receives a written law-enforcement request.
Apply the exhibit to the dates provided:
For content, the notice (especially by email) must not include full account numbers, SSNs, or login credentials; masking to the last four digits is acceptable. The best response is the one that sends on the required post-delay business day and uses masked identifiers rather than sensitive data.
A broker-dealer’s online Privacy Center lets a customer submit an opt-out from sharing nonpublic personal information (NPI) with nonaffiliated third parties. Which operational feature best matches the requirement to record, retain, and honor that opt-out preference?
Best answer: A
Explanation: Opt-out elections must be captured as an auditable record and systematically enforced in downstream disclosures/sharing processes.
To honor an opt-out, the firm needs a durable, auditable record of the customer’s election and a control that enforces it in any process that could share NPI. The best match is a time-stamped preference stored with the customer profile and used to suppress sharing through downstream systems and vendors.
Opt-out preferences are operationally effective only when they are captured as a persistent customer instruction and then applied wherever the firm could disclose or share NPI. That typically means maintaining a time-stamped preference record (including when/how it was obtained) and integrating it into data entitlements, marketing lists, and any vendor or affiliate file feeds covered by the opt-out. The record must be retained under the firm’s books-and-records controls so the firm can evidence the customer’s election and demonstrate that sharing was suppressed when required. A disclosure pop-up, a courtesy confirmation email, or a general supervisory attestation may support the program, but they do not, by themselves, create an enforceable, system-applied opt-out control.
A customer calls the operations desk stating they did not authorize an online liquidation and an outgoing wire that is currently in “pending release” status. The customer also asks to immediately update their email address and provide new bank wiring instructions. You see the wire request was entered less than an hour ago from a new device and there is also a same-day request to change the customer’s phone number.
Which action best aligns with durable escalation and customer-protection standards?
Best answer: A
Explanation: A hold plus prompt escalation preserves customer assets and routes a fraud/red-flag event to the appropriate supervisory and compliance functions.
This is a fraud/red-flag scenario involving potential account takeover and an unauthorized disbursement. The best operational response is to follow WSPs to protect assets (e.g., hold/restrict disbursements), preserve relevant records, and promptly route the issue to supervisory review and the compliance/AML function for investigation and any required reporting.
Operations should treat conflicting customer instructions plus unusual access/activity (new device, same-day changes to contact information, and a pending wire) as a red flag requiring immediate protective action and escalation. The durable standard is: stop potential loss first within firm procedures, then route to the right control owners.
A sound sequence is:
Processing new wiring instructions or delegating resolution to the rep risks further unauthorized movement and weakens record integrity and supervision.
An operations supervisor receives two access requests:
Which control approach best matches the key differentiator between restricting access to customer NPI versus restricting access to potential MNPI?
Best answer: C
Explanation: Customer NPI access is governed by need-to-know/least-privilege entitlements, while potential MNPI requires information barrier and controlled wall-crossing restrictions.
Customer personally identifiable information (NPI) should be accessible only on a need-to-know basis using least-privilege entitlements, masking, and auditable access. Potential MNPI tied to an underwriting requires information barrier controls, such as deal-room access restrictions and formal wall-crossing procedures. The decisive difference is privacy-based access control for NPI versus information-barrier-based restrictions for MNPI.
Operations controls restrict sensitive information in two distinct ways depending on what is being protected. For customer NPI (e.g., full SSNs), the operational control is a privacy/Reg S-P style approach: role-based access, least privilege, masking/unmasking only when required for the task, and audit trails to evidence appropriate access. For potential MNPI (e.g., an Investment Banking deal folder for an underwriting), the core control is an information barrier: separate systems/drive permissions for “deal rooms,” limited access to the deal team, and formal wall-crossing/approval when someone outside the barrier needs access.
The key takeaway is to match the restriction mechanism to the risk: privacy entitlements for customer data, and information barriers for MNPI.
An operations associate is reviewing the following account maintenance ticket.
Exhibit: Account maintenance ticket (snapshot)
Acct: 8KQ-1142 (Individual)
Age of account: 6 years
Request(s):
1) Change mailing address effective immediately
2) Add new bank instructions
3) Wire $48,500 today
Request channel: Email
From email: j.smith247@outlook.com (not on file)
Call-back number provided: (917) 555-0188 (not on file)
Last statement status: Returned mail (UAA) 10 days ago
Standing instructions: None on file
Based on the exhibit, which interpretation is best supported under a firm’s Regulation S-ID identity theft prevention program?
Best answer: A
Explanation: UAA mail followed by remote change requests and first-time wire instructions is an identity-theft red flag that should trigger heightened verification and escalation per the program.
Regulation S-ID programs require firms to identify and respond to “red flags” that suggest possible identity theft. The exhibit shows returned mail (UAA) followed shortly by email-initiated changes and a first-time wire request using contact information not on file. Operations should pause processing and follow program steps to verify the customer and escalate as required.
Regulation S-ID focuses on detecting and responding to patterns that indicate possible identity theft, especially when account maintenance activity is inconsistent with the customer’s established profile. Here, multiple red flags appear together: returned mail (UAA), a request submitted via an unrecognized email address, a new call-back number not on file, adding new bank instructions, and an urgent first-time wire.
Operations typically supports the firm’s identity theft prevention program by:
The key is responding to the red flags before releasing funds, rather than assuming the request is legitimate based on account age or doing only routine sanctions screening.
At 2:50 p.m. ET (wire cutoff is 3:00 p.m. ET), a registered rep forwards an email for an institutional LLC account requesting a $250,000 same-day wire. The email includes a scanned LOA to add a new third-party bank instruction and directs the wire to that new bank; the account has two authorized signers on file, and the wire request is not coming from an authenticated client channel. A back-office associate with entitlements to both update standing instructions and release wires is asked to “push it through before cutoff,” and the phone number in the email signature does not match the number on the account profile.
What is the single best action to satisfy supervisory controls and reduce operational risk?
Best answer: B
Explanation: Segregating maintenance from disbursements and using out-of-band verification prevents a single person from both changing instructions and moving funds based on an unauthenticated request.
The key control is segregation of duties between account maintenance and cash movement, with independent verification of a high-risk change. Because the request is unauthenticated and includes a new third-party bank instruction, the firm should verify using contact information from its records and require independent review before any disbursement.
Broker-dealers organize supervision and controls by separating incompatible functions (e.g., account instruction maintenance vs. cashiering/disbursements) and requiring independent verification/approval for higher-risk events. In this scenario, a late-day request combines two fraud-sensitive actions—adding a new third-party wire instruction and sending funds—delivered through a non-authenticated channel with a contact mismatch red flag. The best control response is to stop the disbursement, route the instruction change to the team supervised for account maintenance, perform out-of-band verification using a number already on file (not information provided in the request), and only then allow cashiering—under its own supervisory chain and dual controls—to release the wire. This reduces the chance that one compromised user, rep, or ops associate can both alter standing instructions and move customer funds.
A cashiering associate receives a same-day wire request from a retail customer to send $85,000 to a new third-party bank account. The request also includes a change to the customer’s phone number and email address. When the associate calls the new phone number to authenticate, the caller cannot answer basic out-of-wallet questions, and the customer’s prior number on file goes straight to voicemail.
Under Regulation S-ID, what is the most appropriate escalation step?
Best answer: D
Explanation: Reg S-ID requires responding to red flags by stopping the transaction and escalating per the firm’s program while independently verifying the customer’s identity.
This scenario presents multiple identity theft red flags (new contact info, high-risk disbursement, failed authentication). Regulation S-ID requires the firm to follow its written Identity Theft Prevention Program to respond appropriately, which typically includes stopping or holding the transaction, escalating to the designated supervisor/compliance contact, and independently verifying identity using reliable information not provided in the suspicious request.
Regulation S-ID requires broker-dealers to have an Identity Theft Prevention Program that detects, prevents, and mitigates identity theft in connection with covered accounts. Here, the combination of changed contact details, a high-dollar third-party wire request, and unsuccessful authentication are classic “red flags.” The operational response should follow the firm’s escalation path and controls designed to prevent unauthorized disbursements.
Appropriate escalation and response generally include:
The key control point is stopping the transaction and escalating, rather than relying on potentially compromised contact information.
In a broker-dealer’s privacy incident response program (Reg S-P / Reg S-ID concepts), which action best reflects proper escalation and evidence preservation when unauthorized access to customer nonpublic personal information (NPI) is suspected?
Best answer: B
Explanation: Prompt internal escalation and preserving tamper-resistant copies of access and system records helps contain the incident and supports investigation and reporting.
A suspected privacy breach should be escalated through the firm’s defined incident response channels and handled in a way that preserves evidence. Preserving tamper-resistant copies of relevant records (for example, authentication and access logs) supports containment, investigation, and any required notifications or filings without contaminating evidence.
Under Reg S-P safeguarding expectations (and related Reg S-ID governance for identity-theft risk), firms should follow written incident response procedures that quickly route suspected unauthorized access to the right control owners (typically information security, compliance, legal, and operations management). Evidence preservation focuses on capturing what happened without altering it.
Practical evidence to preserve commonly includes:
Actions that overwrite or destroy data (reboots, log purges, ad hoc “cleanup”) can compromise investigation and regulatory response.
A customer calls after seeing a trade on yesterday’s online activity that they did not authorize. Operations determines it was an internal keying error: an order for Customer A was mistakenly booked to Customer B’s account. The trade can be corrected through the firm’s normal trade correction process, and a corrected confirmation will be generated.
Which action should the operations professional NOT take when communicating and documenting this correction?
Best answer: B
Explanation: Firms must preserve the original records and maintain an auditable trail of the error, communications, and correction.
Operational errors should be corrected through controlled workflows while keeping a complete audit trail. Communications with customers and any vendors/contra parties should be timely and accurate, and the firm should retain records of what happened, who approved the fix, and how the customer impact was remediated. Deleting or overwriting the original evidence of the error breaks required books-and-records controls.
When a booking error places a trade in the wrong customer account, operations should (1) promptly communicate accurate information to the affected customer(s), (2) coordinate with any internal teams and external parties needed to complete the correction, and (3) document the event end-to-end. Documentation should preserve the original entry and all related communications, show the investigation and approvals, and evidence the corrective action (e.g., corrected confirms/adjustments) so the firm maintains an auditable trail. Destroying, deleting, or overwriting the original blotter/booking and communications to “clean up” the file is improper because it obscures what occurred and undermines record retention and supervision.
A clearing broker-dealer receives an email from a regular-way equity counterparty’s settlements mailbox stating a trade is in DK status and asking for the underlying customer’s full name and account number “to confirm the trade was authorized.” Your firm can resolve DKs using trade identifiers and affirmed settlement instructions, and customer-identifying data is treated as nonpublic personal information (NPI). You are the operations professional assigned the exception. What is the best next step?
Best answer: D
Explanation: Authenticate the requester and provide only the minimum information needed to resolve the settlement exception.
When a vendor or counterparty requests information, operations should apply need-to-know and least-privilege principles. First confirm the requester is legitimate (e.g., call-back using established contact information), then limit what you disclose to what is required to complete the operational task. For a DK, trade-level details and SSIs are typically sufficient without sharing customer NPI.
The control point here is confidentiality in external communications: counterparties should receive only what they need to resolve the specific issue, and access to customer-identifying information should be restricted. For a DK, the normal workflow is to authenticate the counterparty contact using firm-approved verification (such as a call-back to a known number or validated mailbox) and then provide the minimum data required (e.g., trade date, quantity, price, contra, account at DTC/clearing details, and agreed SSIs).
A practical sequence is:
Key takeaway: authenticate first, then disclose the minimum necessary information.
Use the Series 99 Practice Test page for the full Securities Prep route, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.
Use the Series 99 Cheat Sheet on SecuritiesMastery.com when you want a compact review before returning to the FINRA Series 99 Practice Test page.