Broker-Dealer Audit: Net Capital, Customer Protection, and Filings

A broker-dealer’s annual audit must be performed by a PCAOB-registered, independent public accounting firm and must cover far more than the financial statements: under SEC Rule 17a-5, the auditor also has to test compliance with the Net Capital Rule, the Customer Protection Rule, and the firm’s internal controls, then issue either a compliance report opinion or an exemption report review. The complete package — audited financials, supplemental schedules, and the compliance or exemption report — is due within 60 calendar days of the firm’s fiscal year end. The broker-dealer audit requirements below walk through who can do the work, what the auditor must examine, and where the filing goes.

Who Can Perform the Audit

Only a PCAOB-registered public accounting firm can audit a broker-dealer. This applies to every registered broker or dealer, not just those that are publicly traded. The Sarbanes-Oxley Act amended Section 17(e) of the Exchange Act to replace “independent public accountant” with “registered public accounting firm,” and for fiscal years ending after December 31, 2008, all broker-dealer audits must be conducted by a PCAOB-registered firm.¹ The Dodd-Frank Act later gave the PCAOB direct registration, inspection, standard-setting, and disciplinary authority over those auditors.²

The auditor also has to be independent under Rule 2-01 of Regulation S-X, which prohibits financial interests in the firm, managerial relationships, and other arrangements that could compromise objectivity.³ Independence is not a formality. A finding that the auditor lacked independence can invalidate the entire filing and expose both the firm and the auditor to enforcement action.

Two PCAOB attestation standards apply specifically to broker-dealer engagements. Attestation Standard No. 1 governs examination engagements for compliance reports at firms that carry customer accounts or hold customer funds. Attestation Standard No. 2 governs review engagements for exemption reports at firms claiming an exemption from the Customer Protection Rule.⁴ Both are separate from the opinion on the financial statements, and each has its own procedures and reporting.

What the Audit Has to Cover

SEC Rule 17a-5 sets out what the annual report must contain: audited financial statements, supplemental schedules, and either a compliance report or an exemption report.⁵ Behind those documents, the auditor has to work through four main areas: net capital compliance, customer protection, financial statement accuracy (including how the firm values securities and recognizes revenue), and internal controls. Net capital and customer protection deserve the closest look, because they are where the audit differs most sharply from a general commercial engagement.

Net Capital Rule Compliance

SEC Rule 15c3-1 requires every broker-dealer to maintain a minimum level of liquid capital at all times. The calculation begins with the firm’s net worth, strips out illiquid assets like fixed assets and prepaid expenses, and then applies “haircuts” — standardized percentage deductions to proprietary securities positions that account for market risk. The result is net capital, which has to clear both a minimum dollar amount and a ratio requirement.⁶

The Two Ratio Methods

Firms choose between two computation methods. Under the basic method, aggregate indebtedness to all other persons cannot exceed 1,500% of net capital, or 800% during the firm’s first 12 months of operation.⁷ Under the alternative method, net capital cannot fall below the greater of $250,000 or 2% of aggregate debit items computed under the Reserve Formula in Exhibit A to Rule 15c3-3. Firms electing the alternative method must notify their examining authority in writing, and the election is effectively permanent unless the SEC approves a change.⁶

Minimum Dollar Amounts by Activity

Beyond the ratio test, the rule sets minimum dollar amounts that vary with what the firm actually does. The auditor verifies that the firm meets the highest applicable threshold:

$250,000 for firms that carry customer or broker-dealer accounts and hold funds or securities for those persons
$150,000 for brokers’ brokers qualifying under paragraph (a)(8)
$100,000 for firms exempt from Rule 15c3-3 under paragraph (k)(2)(i), and for dealers generally
$50,000 for introducing firms on a fully disclosed basis that receive but do not hold customer securities
$25,000 for firms that only buy, sell, or redeem shares of registered investment companies
$5,000 for firms that neither receive nor hold customer funds or securities

These minimums come directly from Rule 15c3-1(a)(2).⁶ OTC derivatives dealers face far steeper requirements: $100 million in tentative net capital and $20 million in net capital.

Deficiencies and Same-Day Notification

A shortfall does not wait until the annual audit. Under Rule 17a-11, a firm whose net capital drops below the minimum must notify the SEC and its designated examining authority that same day, and the notice must specify both the requirement and the current amount.⁸ If the firm is also a futures commission merchant, the CFTC gets notified as well. Auditors test whether any deficiencies occurred during the year, because even brief, cured deficiencies must be disclosed in the compliance report.

Enforcement consequences are real. In a 2025 case, FINRA censured and fined a firm $125,000 after finding it had conducted business on 96 days while below its minimum net capital. The deficiencies stemmed from improper capital withdrawals by a principal and the misclassification of income, and the firm lacked written supervisory procedures addressing either issue.⁹

How the Auditor Tests Net Capital

Audit work here goes beyond recalculating the formula. The auditor verifies the underlying financial data, independently confirms proprietary positions with third-party custodians and clearing firms, tests whether each haircut percentage was applied to the correct position category, and confirms that illiquid assets were properly excluded. The auditor also evaluates whether the firm’s internal monitoring caught any intra-year deficiencies and whether notifications were properly made.

Customer Protection Rule Testing

SEC Rule 15c3-3 exists so that a broker-dealer’s customers can get their cash and securities back even if the firm fails.¹⁰ Carrying firms must maintain a Special Reserve Bank Account for the Exclusive Benefit of Customers, funded based on a formula comparing total credits owed to customers against total debits owed by customers. When credits exceed debits, the difference is deposited into the reserve account.

Computation frequency depends on size. In 2024, the SEC finalized amendments requiring carrying firms with average total credits of $500 million or more to compute the formula daily rather than weekly. Smaller carrying firms continue to compute weekly or monthly, depending on their circumstances. Any required deposit must be made no later than one hour after banking business opens on the second business day following the computation.¹¹

The audit does not stop at the math. The auditor also verifies the written agreement between the firm and the bank holding the reserve account. Under Rule 15c3-3(f), the agreement must state that assets in the account cannot be used as security for any loan to the broker-dealer and that the bank cannot assert any right, lien, or claim against the funds.¹² If the bank reserves the right to comply with court orders or levies, additional provisions require the bank to immediately notify the SEC, SIPC, and the firm’s examining authority. Auditors examine the actual agreement on file to confirm every required clause is present. They also recalculate the reserve formula independently, sample individual customer account balances and trace them to the general ledger, and confirm the reserve account balance directly with the bank as of the computation date.

Financial Statement Testing: Valuation and Revenue

The financial statement side of the audit hinges on how the firm values its positions and recognizes revenue, because both feed directly into net capital. Commission revenue is recognized on the trade date, when the execution obligation is satisfied. Underwriting revenue is generally recognized when the offering closes. Principal transaction revenue depends on changes in the fair value of positions the firm holds, which makes valuation testing central.

The fair value hierarchy in ASC 820 sorts inputs into three levels, and audit intensity climbs with each one. Level 1 is quoted prices in active markets for identical instruments; verification is a matter of confirming the position and the closing price. Level 2 uses observable inputs other than quoted prices, common for corporate bonds and interest rate swaps, and the auditor validates pricing sources and models. Level 3 relies on unobservable inputs — the firm’s own assumptions — and often requires the auditor to engage independent valuation specialists to assess management’s models. Level 3 positions carry the highest risk of misstatement and can distort net capital if overvalued.

Expense allocation gets extra attention when the broker-dealer is a subsidiary within a larger financial holding company, because these firms often share IT, compliance staff, and office space under cost-sharing agreements. Inflated allocations from a parent can artificially reduce a subsidiary’s net capital, turning what looks like an accounting issue into a regulatory one. Related party transactions, including management fees and intercompany loans, need adequate disclosure and arm’s-length pricing.

Internal Controls and Written Supervisory Procedures

The auditor walks through controls over the entire trade lifecycle — execution, clearance, settlement, and recording — tracing transactions from order entry to the general ledger and testing reconciliations between the firm’s books and clearing firm or custodian statements. IT controls over trading systems, customer databases, and general ledger applications feed into this work, because every regulatory calculation depends on that data being accurate and complete.

FINRA Rule 3110 requires every member firm to establish, maintain, and enforce written supervisory procedures reasonably designed to achieve compliance with applicable securities laws and FINRA rules.¹³ The WSPs must name the individuals responsible for each supervisory review, describe what those individuals will do, specify the frequency of review, and explain how supervision will be documented.¹⁴ The audit team samples employee activity in areas like communications review, suitability determinations, and personal trading to test whether the WSPs are actually being followed.

Compliance Report or Exemption Report

Every annual filing includes one or the other. Which one depends on whether the firm held customer funds or securities during the year.

Compliance Report

A firm that carried customer accounts or held customer funds during the fiscal year files a compliance report. Management asserts whether the firm established and maintained effective Internal Control Over Compliance, whether it was in compliance with Rules 15c3-1 and 15c3-3(e) at year-end, and whether the underlying data came from the firm’s books and records. Any material weaknesses in Internal Control Over Compliance during the year have to be described.¹⁵

Under PCAOB Attestation Standard No. 1, the auditor performs an examination engagement, the highest level of assurance, and issues an opinion on those assertions. That means independently evaluating the design and operating effectiveness of controls over net capital compliance and customer asset protection.

Exemption Report

A firm that claimed an exemption from Rule 15c3-3 throughout the entire fiscal year files an exemption report instead. The report identifies which paragraph of Rule 15c3-3(k) the firm relied on, states whether the firm met those conditions all year, and describes any exceptions.¹⁵ The auditor’s engagement is a review under PCAOB Attestation Standard No. 2, a lower level of assurance than an examination but still requiring inquiries and procedures sufficient to identify conditions that would make the firm’s assertions materially inaccurate.¹⁶

Material Weakness vs. Significant Deficiency

When the auditor identifies control problems, classification matters. A material weakness is a deficiency, or combination of deficiencies, severe enough that there is a reasonable possibility a material misstatement would not be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to warrant the attention of those overseeing the firm’s financial reporting.¹⁷ A material weakness in the compliance report can trigger regulatory scrutiny, restrict the firm’s ability to expand, and damage its standing with clearing firms and counterparties.

What Gets Filed, Where, and When

The complete package — financial statements, supplemental schedules (including the Net Capital Computation and Reserve Formula Calculation), the compliance or exemption report, and the auditor’s reports — is due within 60 calendar days after the firm’s fiscal year end.¹⁵

Firms file with the SEC electronically through EDGAR and with FINRA through FINRA’s Firm Gateway.⁵ These are two separate submissions, not a single filing that reaches both regulators. Missing the 60-day deadline can trigger restrictions on business activities and draw immediate regulatory attention.

SIPC Filing

Every SIPC member broker-dealer files the SIPC-7 General Assessment Form within 60 calendar days of fiscal year end.¹⁸ The assessment rate effective January 1, 2026, is 0.15% of net operating revenues.¹⁹ Rule 17a-5(d)(6) separately requires SIPC members to file a copy of their annual audit report with SIPC itself, a step firms sometimes overlook when focused on the SEC and FINRA filings.⁵ The SIPC deadline counts every calendar day, including weekends and holidays; if the last day falls on a weekend or federal holiday, the due date rolls to the next business day. The auditor should verify that the SIPC-7 assessment calculation lines up with the audited financial data, because discrepancies between the annual report and the SIPC filing can attract attention from both organizations.

1
U.S. Securities and Exchange Commission. PCAOB Registration of Auditors of Non-Public Broker-Dealers Frequently Asked Questions
2
Public Company Accounting Oversight Board. Information for Auditors of Broker-Dealers
3
Securities and Exchange Commission. Order Extending the Annual Reports Filing Deadline for Certain Smaller Broker-Dealers
4
Public Company Accounting Oversight Board. Attestation Standards
5
FINRA. Annual Reports
6
eCFR. 17 CFR 240.15c3-1 – Net Capital Requirements for Brokers or Dealers
7
FINRA. SEA Rule 15c3-1 and Related Interpretations
8
eCFR. 17 CFR 240.17a-11 – Notification Provisions for Brokers and Dealers
9
FINRA. Disciplinary and Other FINRA Actions – October 2025
10
eCFR. 17 CFR 240.15c3-3 – Customer Protection – Reserves and Custody of Securities
11
U.S. Securities and Exchange Commission. Final Rule – Daily Computation of Customer and Broker-Dealer Reserve Requirements
12
Financial Industry Regulatory Authority. Bank Notification Used in Conjunction With a Special Reserve Bank Account
13
FINRA. FINRA Rule 3110 – Supervision
14
FINRA. Supervision
15
eCFR. 17 CFR 240.17a-5 – Reports to Be Made by Certain Brokers and Dealers
16
Public Company Accounting Oversight Board. Attestation Standard No. 2
17
Public Company Accounting Oversight Board. Auditing Standard No. 5 – Appendix A – Definitions
18
SIPC. SIPC-7 Instructions
19
SIPC. Assessment Rate