Securities Regulators and Self-Regulatory Organizations

5 minutes 5 Questions

In the Certified Fraud Examiner (CFE) curriculum, securities fraud is examined against the backdrop of a layered regulatory system composed of government securities regulators and self-regulatory organizations (SROs). Understanding this structure helps fraud examiners know who investigates misconduct, who sets the rules, and where to report or coordinate during an investigation. Securities regulators are government agencies with statutory authority to oversee securities markets, issuers, and market participants. In the United States, the primary regulator is the Securities and Exchange Commission (SEC), created by the Securities Exchange Act of 1934. The SEC enforces federal securities laws, requires public companies to file accurate disclosures (such as Forms 10-K and 10-Q), registers broker-dealers and investment advisers, and brings civil enforcement actions for violations such as insider trading, market manipulation, accounting fraud, and Ponzi schemes. The Commodity Futures Trading Commission (CFTC) regulates futures, options, and swaps markets. At the state level, securities administrators enforce 'blue sky' laws, often coordinated through the North American Securities Administrators Association (NASAA). Internationally, bodies such as the UK's Financial Conduct Authority and Canada's provincial commissions perform comparable roles, with the International Organization of Securities Commissions (IOSCO) promoting global cooperation. Self-regulatory organizations are private, non-governmental entities granted authority by law or regulators to supervise their own members. They create and enforce rules, conduct examinations, impose discipline, and refer serious cases to government authorities. Key U.S. SROs include the Financial Industry Regulatory Authority (FINRA), which oversees broker-dealers and registered representatives, administers licensing exams, operates arbitration forums, and runs BrokerCheck; national securities exchanges such as the NYSE and Nasdaq, which enforce listing and trading standards; the Municipal Securities Rulemaking Board (MSRB); and the National Futures Association (NFA) for derivatives. The Public Company Accounting Oversight Board (PCAOB), while not technically an SRO, oversees auditors of public companies under SEC supervision. For CFEs, these bodies are vital partners and information sources: their filings, disciplinary records, and enforcement databases help detect red flags, verify registrations, and build fraud cases.

Securities Regulators and Self-Regulatory Organizations: A Complete CFE Exam Guide

Why This Topic Is Important

Securities fraud is one of the most damaging categories of white-collar crime, and it sits squarely within the Financial Transactions and Fraud Schemes section of the CFE Exam. A fraud examiner cannot investigate, report, or refer securities fraud without understanding who regulates the securities markets, what authority each body has, and how the pieces fit together. Exam questions in this area test whether you can distinguish a government regulator from a self-regulatory organization (SRO), whether you know which body approves rules, who can bring criminal charges, and which organization protects investors when a brokerage firm fails. In practice, this knowledge tells you where to look for public records (registration filings, disciplinary histories, enforcement actions) and to whom a suspected securities violation should be referred.

What It Is: The Regulatory Landscape

Securities regulation is a layered system. At the top are government agencies created by statute. Beneath them are self-regulatory organizations: private, non-governmental membership bodies that write and enforce rules for their own members under authority delegated by law and subject to government oversight. Alongside these are state regulators, investor-protection entities, and international coordinating bodies.

1. The U.S. Securities and Exchange Commission (SEC)
• Created by the Securities Exchange Act of 1934 (the Securities Act of 1933 governs the initial offering of securities; the 1934 Act governs secondary trading and created the SEC).
• Led by five commissioners appointed by the President and confirmed by the Senate for five-year staggered terms; no more than three may belong to the same political party.
• Principal divisions: Corporation Finance (reviews disclosure filings), Enforcement (investigates and prosecutes violations), Investment Management (mutual funds and advisers), Trading and Markets (broker-dealers, exchanges, SROs), and Economic and Risk Analysis.
• The SEC has civil and administrative authority only. It cannot bring criminal charges; it refers criminal matters to the Department of Justice.
• Remedies: injunctions, civil monetary penalties, disgorgement of ill-gotten gains, officer and director bars, cease-and-desist orders, suspension of trading in a security (generally up to ten business days), and revocation of broker-dealer or adviser registration.
• Operates the EDGAR database of public filings and the Whistleblower Program under Dodd-Frank, which pays 10 to 30 percent of monetary sanctions when sanctions exceed $1 million.
• Oversees SROs: every SRO rule change must be filed with and approved by the SEC.

2. The Commodity Futures Trading Commission (CFTC)
• Independent federal agency created in 1974 under the Commodity Exchange Act.
• Regulates futures, options on futures, and (since Dodd-Frank) swaps. It does not regulate stocks or bonds; that is the SEC's domain.
• Its designated SRO is the National Futures Association (NFA).

3. State Securities Regulators
• Each state has a securities administrator enforcing state blue sky laws (the term comes from early schemes selling interests backed by nothing but the blue sky).
• Many states base their statutes on the Uniform Securities Act.
• States register securities offered within their borders, license broker-dealers and agents, and register smaller investment advisers (generally those with less than $100 million in assets under management, per Dodd-Frank).
• The North American Securities Administrators Association (NASAA) coordinates state, provincial, and territorial regulators across the United States, Canada, and Mexico. NASAA is an association, not a regulator with enforcement power of its own.

4. Self-Regulatory Organizations (SROs)
An SRO is a non-governmental organization that has statutory authority to create and enforce industry rules for its members, subject to oversight by a government regulator. Key SROs:
• FINRA (Financial Industry Regulatory Authority): formed in 2007 by the consolidation of the National Association of Securities Dealers (NASD) and the member-regulation functions of the New York Stock Exchange. It is the largest SRO, registered with the SEC as a national securities association under Section 15A of the Exchange Act. FINRA registers and examines broker-dealers, licenses registered representatives through qualification exams (such as the Series 7), writes conduct rules, surveils trading, runs the BrokerCheck public database, operates the dominant arbitration and mediation forum for investor disputes, and disciplines members with fines, suspensions, and permanent bars. FINRA cannot imprison anyone; it refers criminal conduct to the SEC or law enforcement.
• Securities exchanges such as the NYSE, Nasdaq, and Cboe are SROs for their listed companies and members.
• Municipal Securities Rulemaking Board (MSRB): writes rules for dealers and advisors in municipal securities but does not itself enforce them; enforcement is carried out by FINRA, the SEC, and bank regulators.
• National Futures Association (NFA): SRO for the derivatives industry, overseen by the CFTC.

5. Public Company Accounting Oversight Board (PCAOB)
• Created by the Sarbanes-Oxley Act of 2002.
• A private, nonprofit corporation that registers, inspects, and disciplines the auditors of public companies and sets auditing standards.
• Overseen by the SEC, which appoints its board and approves its rules and budget. Often described as a quasi-regulatory body; it regulates auditors, not issuers or brokers.

6. Securities Investor Protection Corporation (SIPC)
• Created by the Securities Investor Protection Act of 1970.
• A nonprofit membership corporation, not a regulator and not a government agency.
• Protects customers when a member broker-dealer fails and customer assets are missing: up to $500,000 per customer, including a $250,000 limit on cash.
• It does not protect against market losses, bad investment advice, or fraud by an issuer.

7. International Regulators and Coordination
• IOSCO (International Organization of Securities Commissions): the global standard-setter for securities regulators; its Multilateral Memorandum of Understanding (MMoU) facilitates cross-border information sharing and enforcement cooperation.
• Examples of national regulators: United Kingdom Financial Conduct Authority (FCA); Canada regulates at the provincial level (e.g., Ontario Securities Commission) coordinated through the Canadian Securities Administrators, with the Canadian Investment Regulatory Organization (CIRO) as the SRO; Australia ASIC; Hong Kong SFC; Germany BaFin; Japan FSA and SESC; the European Union's ESMA.

How It Works: Oversight, Enforcement, and the Examiner's Role

The oversight chain. Congress passes securities laws. The SEC (or CFTC) administers them, adopts rules, and oversees the SROs. SROs adopt their own rules, which take effect only after SEC approval, and enforce them against members. States enforce blue sky laws in parallel. Because jurisdictions overlap, a single broker misconduct case may trigger a FINRA disciplinary action, an SEC civil suit, a state license revocation, and a DOJ criminal prosecution simultaneously.

The enforcement process. Matters originate from SRO surveillance referrals, examinations, investor complaints, whistleblower tips, media reports, or self-reports. The SEC opens an informal inquiry, may escalate to a formal investigation with subpoena power, and then either closes the matter, settles (often with no admission or denial of wrongdoing), brings an administrative proceeding before an administrative law judge, or files a civil action in federal court. FINRA's process runs through its Department of Enforcement, with hearings before a panel and appeals to the National Adjudicatory Council, then to the SEC, and ultimately to a federal court of appeals.

Registration as a fraud detection tool. Most securities offerings must be registered with the SEC or qualify for an exemption, and most people selling securities must be registered with FINRA and licensed in the states where they sell. Unregistered securities sold by unlicensed persons are the single most common red flag of investment fraud. A fraud examiner should check EDGAR for issuer filings, BrokerCheck for broker histories, the Investment Adviser Public Disclosure (IAPD) system for advisers, and the state administrator for licensing status and complaints.

Referral. When a fraud examiner uncovers probable securities violations, appropriate referrals include the SEC's Office of Market Intelligence or Tips, Complaints, and Referrals portal, FINRA, the state securities administrator, and, for criminal matters, the FBI or U.S. Attorney. Futures-related matters go to the CFTC or NFA.

How to Answer Exam Questions on This Topic

CFE questions on regulators are mostly recall and classification questions. Expect formats such as: Which of the following is an SRO? Which agency may approve a rule proposed by FINRA? Which organization protects customers of a failed broker-dealer? What type of enforcement action may the SEC bring? Which law created the SEC? Who regulates futures?

Work through them with a three-step approach:
1. Classify the entity named in the question or answers: government agency, SRO, state body, investor-protection corporation, or international association.
2. Match the power to the entity: criminal prosecution (DOJ only), civil and administrative actions (SEC, CFTC, states), membership discipline (FINRA, exchanges, NFA), rule approval (SEC over SROs), auditor oversight (PCAOB), customer asset protection (SIPC).
3. Eliminate distractors that assign a power to the wrong body, such as the SEC sending someone to prison, SIPC reimbursing market losses, or NASAA licensing brokers.

Exam Tips: Answering Questions on Securities Regulators and Self-Regulatory Organizations

• SEC is a government agency; FINRA is an SRO. If an answer choice calls the SEC a self-regulatory organization, it is wrong. If a question asks for an SRO, look for FINRA, an exchange, the MSRB, or the NFA.
• The SEC cannot bring criminal charges. It pursues civil and administrative remedies and refers criminal cases to the Department of Justice. Any answer implying SEC-imposed jail time is a distractor.
• SRO rules require SEC approval. Remember the hierarchy: Congress writes laws, the SEC writes and approves rules, SROs write member rules that the SEC approves.
• FINRA = NASD + NYSE Regulation (2007). Older exam material may reference the NASD; treat it as FINRA's predecessor.
• Disgorgement means giving back ill-gotten gains; it is distinct from a civil penalty, which is punitive. Know both terms.
• SIPC is not a regulator and not insurance against losses. It covers missing customer assets when a broker-dealer fails, up to $500,000 including $250,000 in cash. It never covers a decline in market value or losses from fraud by an issuer.
• PCAOB regulates auditors of public companies and was created by Sarbanes-Oxley; it is overseen by the SEC. Do not confuse it with FINRA (brokers) or the SEC (issuers).
• CFTC and NFA handle futures and derivatives; the SEC and FINRA handle securities. A question about a commodity pool or futures commission merchant points to the CFTC/NFA.
• Blue sky laws are state laws, enforced by state securities administrators and coordinated through NASAA. NASAA itself is an association, not an enforcement agency.
• Securities Act of 1933 = primary offerings and registration; Securities Exchange Act of 1934 = secondary markets and creation of the SEC. This pairing is a frequent exam point.
• Whistleblower awards under Dodd-Frank range from 10 to 30 percent of sanctions when the recovery exceeds $1 million.
• Internationally, think IOSCO for the coordinating body and its MMoU for cross-border cooperation; recognize the FCA (UK), ASIC (Australia), and the provincial model in Canada.
• Read for the word that changes the answer: approve, enforce, criminal, civil, member, government, non-governmental. Exam distractors usually hinge on one of these words.
• When two choices both seem plausible, pick the one that is most specific and most directly responsible. For example, FINRA, not the SEC, directly administers broker qualification exams, even though the SEC oversees FINRA.

Quick Review Summary

• SEC: federal agency, five commissioners, created by the 1934 Act, civil and administrative enforcement, oversees SROs, refers crimes to DOJ.
• CFTC: federal agency for futures, options on futures, and swaps; NFA is its SRO.
• State regulators: blue sky laws, licensing, coordinated by NASAA.
• SROs: FINRA (broker-dealers and registered representatives), exchanges, MSRB (municipal rules), NFA (derivatives); all subject to government oversight.
• PCAOB: auditor oversight, created by SOX, overseen by SEC.
• SIPC: customer protection at failed broker-dealers, $500,000 limit with $250,000 cash, not a regulator.
• IOSCO: international coordination of securities regulators.

Master these distinctions, and the regulator questions on the CFE Exam become some of the most reliable points you can earn.
Test mode:

CFE - Securities Regulators and Self-Regulatory Organizations Example Questions

Test your knowledge of Securities Regulators and Self-Regulatory Organizations

Question 1

A fraud examiner at a brokerage firm finds that a registered representative steered retail clients into unsuitable products. The representative split the resulting commissions with an outside promoter who is not registered and is not associated with any member firm. The firm's compliance officer plans to refer the matter to the securities self-regulatory organization (SRO) to which the firm belongs. Which remedy falls within the SRO's own authority in this matter?

Question 2

In securities regulation, which of the following BEST describes a self-regulatory organization?

Question 3

What is the primary role of the International Organization of Securities Commissions (IOSCO) in securities regulation?

More Securities Regulators and Self-Regulatory Organizations questions
13 questions (total)