Your FREE Series 63 Flashcards 2026 – 200+ Cards

An unethical practice is prohibited business conduct, often careless or unintentional, and is not a crime. Fraud is willful, deliberate deception and is criminal, also triggering civil liability.

Yes. Every security and transaction stays subject to the USA's antifraud provisions even when exempt from registration. Antifraud always applies.

Information a reasonable investor would consider important in making an investment decision. Misstating or omitting one with intent to deceive is fraud.

An unethical practice can lead to denial, suspension, or revocation of registration. Fraud carries criminal fines and/or prison plus civil liability.

Fraud is Felonious (willful, criminal). Unethical is just Unacceptable (prohibited, frequently accidental). When intent to deceive is stressed, lean fraud.

The firm deciding any one of: which security, how many shares, or whether to buy or sell. Any one of these three makes it full discretion.

Full discretion requires prior written authorization on file BEFORE the first discretionary trade. Broker-dealers and agents get no oral grace period.

Limited authority to choose only the time or price of a client-specified trade. It is NOT true discretion — it needs only oral consent and is valid for that trading day only.

Only oral consent. This is time/price authority, not full discretion, and the authority expires at the end of that trading day.

Only IAs and IARs. They have 10 business days of oral discretion before the written power of attorney must be in hand. BDs and agents get NO grace.

Holding or controlling, directly or indirectly, a client's cash or securities. A classic trigger is holding a third-party check for more than three business days.

Yes, if held more than three business days. Returning it promptly avoids custody; holding it beyond three business days converts the firm to having custody.

No. Having discretionary authority does not create custody, and holding client assets does not require discretion. The exam deliberately swaps the two.

$35,000 with custody, versus $10,000 with discretion but no custody. Custody raises the minimum financial requirement.

No. Commingling firm and customer funds in one account is a separate, always-prohibited practice.

Excessive trading in a client account to generate commissions. It's judged against the account's objectives, size, and resources — not by raw trade count.

High turnover in a small, conservative account relative to its objectives and resources — not simply a high number of trades.

Trading for one's own account ahead of a known large customer order to profit from the expected price move. It is prohibited.

Effecting private securities transactions outside the broker-dealer's books and supervision. It is prohibited.

A trade with no change in beneficial ownership used to fake market activity. It's a form of prohibited market manipulation, alongside matched orders.

Creating a false or misleading appearance of trading or price: wash trades, matched orders, spoofing, and layering. All are prohibited.

Only proportionally to the agent's own contribution, and only with written consent of both the customer AND the broker-dealer.

No. An investment adviser representative may NEVER share in a client account, even with consent. This contrasts with agents.

No. Guaranteeing a customer against loss, promising a fixed return, or sharing losses with a client are always prohibited outright.

No — it's prohibited UNLESS the client is in the lending business (e.g., a bank or a broker-dealer that lends). The exam exploits this conditional nature.

No. The client is not in the lending business, so it is a prohibited personal loan. Borrowing is allowed only if the client lends as a business.

Guaranteeing against loss is unconditionally prohibited. Borrowing from a client is only conditionally prohibited (allowed if the client is in the lending business).

Fees, commissions, markups, and conflicts of interest, including soft-dollar arrangements. Disclosure must be affirmative, not on request only.

Brokerage commissions used to pay for research or services, creating a conflict of interest that must be disclosed to clients.

No. Saying or implying that registration equals Administrator approval of a person or security is itself a prohibited misrepresentation.

A natural person (individual) who represents a broker-dealer or issuer in effecting securities transactions. A firm is never an agent.

Maximum $5,000 fine and 3 years in prison per willful violation. There is a 5-year statute of limitations.

Up to $5,000,000 fine and 20 years in prison, plus civil penalty up to treble damages — far harsher than USA criminal penalties.

Up to $25,000,000. Heuristic: bigger numbers are federal (ITSFEA), small numbers ($5,000 / 3 yrs) are USA criminal.

USA criminal: $5,000 / 3 years (state). ITSFEA insider trading: $5M / 20 years individual, $25M firm (federal). Bigger numbers = federal.

Trading on material nonpublic information. Under federal ITSFEA it carries far heavier penalties than ordinary USA criminal violations.

Five years. A willful violation can bring up to $5,000 and 3 years in prison if charged within that period.

Firms must safeguard nonpublic personal client information and maintain reasonable data-protection and privacy controls. It's now a tested ethics topic.

No. Any unjustified or excessive markup, commission, or fee is a prohibited unethical practice.

The NASAA model state securities law on which the Series 63 and state Blue Sky rules are based. It underlies the prohibited-practices rules.

A written authorization granting a firm discretionary trading authority over a client's account — required before a BD/agent's first discretionary trade.

Under the USA, a person who proves no knowledge of the rule or order they're charged with violating may face a fine only — no prison.

About 45% — Ethical Practices & Obligations is ~25% and Communications with Customers is ~20%. The prohibited-practices list pays off in both.

Many prohibitions are conditional (e.g., borrowing, agent sharing). Absolute answers are wrong unless the conduct truly is unconditionally prohibited, like guaranteeing against loss.

No. Discretion and custody are independent. You can have discretion without custody, and custody without discretion.

No. Promising or guaranteeing a fixed return is always prohibited, the same category as guaranteeing against loss and sharing in losses.

No. Under USA Section 405, registration is never a finding that any filing is true, complete, or not misleading. An agent may never tell a prospect a security is 'approved' or 'endorsed' by the Administrator.

Every communication must be truthful, fair, accurate, and balanced — no material fact may be misstated or omitted, and any benefit must be disclosed alongside its corresponding risk.

Only to describe a genuine guarantee already attached to the security by a third party (such as an issuer or insurer). The agent may never originate a guarantee or promise it personally.

Promising a specific gain or assured profit (e.g., 'guaranteed at least 8%'). It is prohibited in any medium; only a real third-party guarantee on the security may be stated factually.

It must be genuinely unconditional — truly free with no hidden charges, conditions, or strings. If fees apply, calling it 'free' is misleading and prohibited.

A fact a reasonable investor would consider important in making a decision. Omitting or misstating a material fact makes a communication misleading.

Advertising (broadcast sales literature) requires registered-principal PRE-approval before use. Correspondence (individual) requires only periodic review after the fact.

Communications distributed to a broad audience of many prospects (magazine ad, mass email blast, public website). Requires principal pre-approval before use.

Communications to a limited number of retail investors — generally 25 or fewer in a rolling period (e.g., a one-to-one email or letter). Subject to periodic review, not pre-approval.

Generally 25 or fewer retail investors in a rolling period. Above that broad an audience, the communication is treated as advertising requiring pre-approval.

No. Classification only changes the timing of review (pre-approval vs. periodic). All communications must satisfy the same not-misleading content standard and be retained as a firm record.

Static versus interactive. Static content is treated as advertising (pre-approval); interactive content is treated as correspondence (periodic review).

Persistent posted content such as a profile bio, a pinned post, or a website landing page that stays up. Treated as advertising — needs principal pre-approval before posting.

Real-time back-and-forth content like live chat, a chatroom exchange, or real-time comment replies. Treated as correspondence — subject to periodic review.

It becomes a business communication subject to the same communication rules. The rules apply based on subject matter (firm business/products), not on which account is used.

Sharing, liking, or helping create third-party content. Doing so makes that content the firm's own communication, subject to all the same supervision and content rules.

As advertising. Because it is static (persistent) content, it requires registered-principal pre-approval before it goes up.

As correspondence. Interactive, real-time content gets periodic (after-the-fact) review rather than pre-approval.

It explicitly pulled social media, websites, email, and online chatrooms into scope, and added cybersecurity, data protection, and privacy as named tested themes.

A signed advisory contract PLUS delivery of the firm's brochure AND the client's acknowledgment of receipt. A handshake or oral understanding is not enough.

The adviser disclosure document that must be delivered when establishing an advisory relationship. The client must acknowledge receipt; failure to deliver it is a common exam trap.

Yes. Conflicts of interest and material compensation arrangements must be clearly disclosed, not buried, so communications support suitable recommendations.

Safeguarding client data and communications from unauthorized access is now an explicit professional obligation, not just an IT concern. Firms must maintain reasonable safeguards.

Firms must protect nonpublic personal information, deliver privacy notices, and maintain reasonable safeguards against unauthorized access to customer records and communications.

Pick the most client-protective action: secure the data, limit access, and notify as required. The safe, data-protective choice is the correct one on cybersecurity scenarios.

No. It is misleading and a prohibited performance guarantee. Past performance does not guarantee future results and may never be framed as assured profit.

Yes. A real, existing third-party guarantee attached to the security may be stated factually. The agent is describing it, not originating it.

Yes. A quote or projection that implies assured profit is treated as a banned performance guarantee. The exam disguises these as friendly, reassuring language.

No. Antifraud and prohibited-practice rules apply to all communications regardless of medium — written, oral, social, or a private one-to-one email.

The Uniform Securities Act (USA) and NASAA model rules and statements of policy. The 2023 outline expanded them to cover digital communications.

The state securities official charged with administering and enforcing that state's securities law. An agent may never claim the Administrator approved or endorsed a security.

Classify it: is it advertising/static (pre-approval) or correspondence/interactive (periodic review)? Then test for misleading content, guarantees, or implied approval.

Flipping the two review requirements — pairing advertising/static with 'periodic review' or correspondence/interactive with 'pre-approval.' Lock: broadcast = pre-approval, individual = review.

After-the-fact supervisory review of communications — the lighter standard applied to correspondence and interactive content (as opposed to pre-approval).

Review and approval of a communication by a qualified registered principal BEFORE it is used or filed. Required for advertising and static content.

Yes. Regardless of classification, the communication must be retained as a firm record. Classification affects review timing, not the recordkeeping duty.

No. Offering to personally cover a client's loss is a prohibited guarantee against loss, even if well-intentioned and sent privately.

With friendly, reassuring wording that quietly crosses the line into a guarantee against loss or a specific-return promise. Treat any 'loss is impossible' implication as prohibited.

About 20% — roughly 12 of 60 scored questions. Combined with Ethical Practices it forms the ~45% ethics-and-communications cluster that decides pass/fail.

Yes. Truthful, balanced, not-misleading content is required across all communications — written, oral, and social media alike.

If the post is about the firm's business or products, the communication rules apply even on a personal account. Subject matter, not account ownership, controls.

The missing piece: an unsigned advisory contract or an undelivered brochure. The absence of either is the planted wrong action in the stem.

Disclosing risk alongside a benefit is required for balance, but it does not cure a prohibited guarantee, an implied approval, or a false 'free' claim — those remain banned.

A 'free' or 'no-cost' claim that is genuinely free with no hidden charges, conditions, or strings. Anything less makes the claim misleading and prohibited.

A firm or person in the business of effecting securities transactions for the accounts of others or for its own account. A BD is always a firm/entity, never a natural person.

A natural person who represents a broker-dealer or an issuer in effecting securities transactions. An agent is always an individual, never a firm.

No. A firm is never an agent and an individual is never a broker-dealer. Capacity (firm vs. natural person) is the first thing to decide on every question.

No, it is function-driven. If a person solicits, takes orders, or effects securities transactions, they are an agent and must register, regardless of their title.

When it has a place of business in the state OR deals with even one non-institutional (retail) client there. Registration is jurisdictional.

No. There is NO de minimis exemption for BDs or agents — even one retail client in a state triggers registration. De minimis is an investment-adviser-only rule.

When an offer is made in, directed into, or accepted in that state. Jurisdiction follows the activity, not just residence — soliciting one in-state retail investor triggers registration.

Agents, Issuers, and Banks/savings institutions/trust companies. An excluded person never met the definition, so BD registration never applies.

No. A bank itself is excluded, but a bank HOLDING company is not — it must register if it acts as a broker-dealer. This is a top-tested distractor.

A firm with no place of business in a state is excluded from BD registration if its only clients there are other BDs, institutions, or existing customers temporarily present in the state.

An issuer sells its own securities to finance operations; it is not effecting transactions for the accounts of others, so it never meets the BD definition.

Clerical/administrative staff who don't effect transactions, persons representing an issuer in certain exempt securities/transactions, and issuer reps in specified employee-benefit-plan work with no commission.

No. A clerk/secretary who effects even one trade or receives transaction-based pay loses the clerical exclusion and becomes an agent who must register. Function over title.

A salary-only issuer employee handling an exempt security/transaction can be excluded from 'agent.' A broker-dealer employee doing the identical trade must ALWAYS register.

They represent the issuer (not a BD), the security/transaction is exempt, and they receive no transaction-based (commission) compensation — salary only. Changing any one fact collapses the exclusion.

An excluded person never fit the definition, so registration simply doesn't apply. An exemption frees a security or transaction that DOES meet the definition from registration.

An application (Form U4), a fee, and a consent to service of process. A BD also files an application, fee, and consent to service of process.

A document appointing the Administrator as attorney-in-fact to receive legal papers on the registrant's behalf. It is filed once with the initial application and never expires.

Form U4 — the Uniform Application for Securities Industry Registration, filed via CRD.

No. Only broker-dealers may be required to meet minimum net capital/net worth and post a surety bond. Agents have no net-capital requirement of their own.

When the Administrator requires it — commonly when the firm has custody or exercises discretion over client assets.

No. A state may not impose financial or recordkeeping requirements on a BD exceeding the federal SEC standard — federal law sets the ceiling. States may still require exams like the Series 63.

At noon on the 30th day after a complete filing, absent a denial or pending proceeding.

Registrations expire December 31 each year and must be renewed annually.

One employing broker-dealer or issuer. An agent cannot be registered independently of an employer.

All three parties: the old firm, the new firm, AND the agent must promptly notify the Administrator.

The firm files Form U5 (termination notice) within 30 days when an agent leaves or is terminated.

Within 30 days. Material updates to a U4 (and U5 terminations) must be filed within 30 days.

Within 10 days — statutory-disqualification events require a faster U4 update than ordinary material changes (30 days).

30 days after the Administrator receives it, if no proceeding is pending.

Up to one year after a withdrawal becomes effective, the Administrator retains jurisdiction to revoke or suspend the registration.

3 years under the USA, with the most recent two years readily accessible. (Investment advisers must keep records 5 years — the 3-vs-5 swap is a top trap.)

The most recent two years of records must be producible within 24 business hours of an Administrator's request.

Broker-dealers = 3 years; investment advisers = 5 years. The exam deliberately swaps these numbers as a distractor.

Yes. Every BD must reasonably supervise its agents. Failure to supervise is itself a ground for denial, suspension, or revocation of the firm's registration, independent of any agent's misconduct.

A broker-dealer selling non-deposit investment products on bank premises. It requires specific disclosures to retail customers.

The products are (1) not FDIC-insured, (2) not a bank deposit, and (3) may lose value.

File prompt notice of the material change with the Administrator. BDs must report any event that could affect the firm's qualification.

At any reasonable time. The Administrator may inspect a broker-dealer's books and records during normal business operations.

A statutory ground (e.g., violation, failure to supervise) AND a finding that the action is in the public interest. Both are required.

Yes. Even with no place of business in the state, soliciting a single retail (non-institutional) client there triggers BD registration. No de minimis relief exists.

Yes — banks, savings institutions, and trust companies are excluded (the 'B' in AIB). But bank holding companies are NOT excluded.

No. The agent's registration is tied to one employer; a move requires the old firm, new firm, and agent to notify the Administrator, with new registration through the new firm.

The Uniform Securities Act (USA) — the NASAA model 'Blue Sky' state law — and NASAA model rules. The Series 63 turns on testing fact patterns against the USA's exact definitions.

Decide whether the player is a firm or a natural person. A BD is always a firm; an agent is always a natural person. Get capacity right and most questions answer themselves.

The IA is the firm/entity that advises on securities for compensation; the IAR is the natural person who advises, manages accounts, or supervises those who do. Never blur the two.

An IA (firm) registers via Form ADV (state or SEC). An IAR (person) registers via Form U4 in the state.

A fiduciary duty — full and fair disclosure of all material facts, including conflicts of interest. This is higher than the suitability standard owed by agents/broker-dealers.

$100M in AUM. Between $100M and $110M the adviser may choose SEC or state registration.

$110M in regulatory AUM. At or above $110M the adviser is a federal covered adviser and must register federally.

When AUM falls below $90M. The 90/100/110 buffer band prevents constant switching between state and federal registration.

Yes. It must file a notice filing and pay a fee in any state where it has a place of business. States keep anti-fraud and notice-filing authority — 'owes the state nothing' is a wrong answer.

An IA/IAR is exempt from state registration if it has 5 or fewer retail clients in 12 months AND no place of business in that state.

No. It applies only to advisers and IARs. For broker-dealers and agents, even one retail client triggers state registration.

No. The de minimis exemption requires BOTH 5 or fewer retail clients in 12 months AND no place of business in the state. An in-state office defeats it regardless of client count.

$35,000 minimum net worth. Bonding and surprise-examination rules also attach to advisers with custody.

$10,000 minimum net worth. Discretion alone is not custody.

Holding client funds or securities, having access to a client's account, or holding a third-party check for more than three business days.

No. Discretion (authority to trade without prior approval) is not custody, and custody is not discretion. This distinction is heavily tested.

Up to three business days. Holding it more than three business days triggers custody status; return it promptly to avoid that.

A written description of services, fees, and term, plus the client's acknowledgment of receiving the firm's brochure (Form ADV Part 2). Performance fees and assignment require specific disclosure/consent.

Form ADV Part 2. It is the disclosure brochure delivered to clients describing services, fees, and conflicts.

A security is an investment of money in a common enterprise with an expectation of profit from the efforts of others. All four elements must be met.

Yes. Variable annuities and variable life are securities. Fixed annuities and whole life are NOT securities because the buyer bears no investment risk.

No. Fixed annuities and whole life insurance are not securities — the guaranteed payout carries no investment risk to the buyer.

Fixed annuities, whole life, collectibles, commodities, precious metals, and condominiums bought for personal use fall outside the definition of a security.

The entity that issues or proposes to issue a security and receives the proceeds of the sale.

A transaction in which the issuer does not receive the proceeds — essentially secondary-market trading between investors.

A security is exempt because of WHAT IT IS; a transaction is exempt because of HOW or TO WHOM it is sold. Decide the security first, then the transaction.

Yes — through an exempt transaction. A non-exempt security sold in an exempt transaction (e.g., a private placement) need not be registered for that offering.

No. Exempt never means exempt from fraud. The Administrator's anti-fraud authority reaches every security and every transaction, registered or exempt.

10 or fewer retail offerees in 12 months, with no general solicitation and no commissions on retail sales. Institutional buyers are unlimited.

No. A private placement allows no commissions on retail sales (and no general solicitation). Commissions on institutional sales are permitted.

An exclusion means the person/item never met the definition. An exemption means the definition WAS met but registration is released. Swapping these terms is a common trap.

US government/agency, municipal, Canadian government, bank/S&L, insurance company, and nonprofit securities; plus commercial paper $\le 270$ days, $50K+, top-3 rated.

Yes. Municipal securities are exempt securities by virtue of what they are. The issuer's governmental status grants the exemption.

Maturity of 270 days or less, denomination of at least $50,000, and one of the top three credit ratings.

Isolated non-issuer transactions, unsolicited orders, sales to fiduciaries/institutions, transactions with underwriters, and private placements ($\le 10$ retail offerees/12 mo).

Yes. An unsolicited customer order (the client initiates, not the agent) is an exempt transaction. It is one of the most common exempt-transaction examples.

A security preempted from state registration by NSMIA — e.g., exchange-listed securities, investment company shares, and Reg D Rule 506 offerings. States keep only anti-fraud and notice-filing authority.

Only anti-fraud authority and the right to require a notice filing and fee. States cannot impose full registration review.

Notice filing (federal covered securities), coordination (issuers filing federally), and qualification (intrastate or fallback, most disclosure).

To federal covered securities, such as investment company (mutual fund) shares. The state collects a fee and documents but does not conduct a full review.

Issuers simultaneously filing a federal registration statement under the Securities Act of 1933. It becomes effective at the same time the federal registration clears.

Intrastate or non-federal offerings; it requires the most disclosure, including a balance sheet generally within four months of filing. Effective when the Administrator so orders.

Absent a stop order, a registration becomes effective at noon of the 30th day after filing.

Registration by qualification. It is the fallback/intrastate method requiring full disclosure including financial statements, effective when the Administrator orders.

No. Sharing in client accounts is prohibited for investment advisers and IARs — never permitted, unlike the limited proportional sharing sometimes allowed for agents.

Registration by coordination, because the issuer is filing a federal registration statement under the 1933 Act and wants simultaneous state effectiveness.

Yes. An investment contract is a security under the Howey test, as are certificates of indebtedness and other evidences of debt. Apply Howey to each instrument rather than guessing by name.

The state official or agency that administers and enforces the Uniform Securities Act (Blue Sky law) within a state. Not a court, but holds broad administrative enforcement powers.

Remedies and Administrative Provisions is about 11% of the exam, roughly 7 of the 60 scored questions.

Make rules and orders, conduct investigations in or outside the state, issue subpoenas, inspect records, and deny, suspend, or revoke registrations.

The Administrator needs BOTH a public interest finding AND a statutory ground (e.g., willful USA violation, injunction, or felony conviction). Neither prong alone is enough.

No. The Administrator must petition a court to obtain an injunction. Issuing injunctions is a court power, not an administrative one.

No. Only a court can sentence, imprison, or convict of a crime. The Administrator handles administrative actions only.

No. Awarding damages to harmed investors is a court power. The Administrator cannot award damages directly.

No. The Administrator may issue a cease-and-desist order WITHOUT a prior hearing, but cannot enforce it alone — contempt requires going to court.

An emergency order that immediately denies, suspends, or postpones a registration's effectiveness. The Administrator must then promptly notify the party and offer a hearing.

Yes. The Administrator may revoke the exempt status of a transaction or security.

No. The Administrator may issue rules and orders interpreting the Act but cannot alter or override the USA itself.

When the offer or sale is made IN the state, directed INTO the state, or accepted IN the state. The issuer's home state does not control.

Only the originating (broadcast) state's Administrator has jurisdiction. The states where it is merely received do not.

A newspaper published in-state but with more than two-thirds (over 2/3) of its circulation out-of-state falls outside any state's jurisdiction.

A filing appointing the Administrator as attorney-in-fact to receive legal papers, with the same force as personal service on the registrant.

Once, with the initial application, and it stays in effect permanently.

USA criminal penalties: 5-year statute of limitations, $5,000 maximum fine, and up to 3 years in prison. A willful act is required.

No. Criminal violations require a willful act and are prosecuted by the courts, not the Administrator.

5 years. A willful violation is required for criminal prosecution.

$5,000, imposed by a court.

3 years, imposed by a court.

USA: $5,000 fine / 3 years prison. Federal Investment Advisers Act of 1940: $10,000 fine / 5 years prison. Do not confuse the two.

No. A person with no knowledge of the violated order may be fined but NOT imprisoned under the USA.

A suit must be filed within the EARLIER of 3 years from the sale or 2 years from discovery. The sooner of the two controls.

No. It is the sooner of 3 years from the sale OR 2 years from discovery of the violation — whichever comes first.

Recovery = purchase price + interest + attorney fees and court costs − income (dividends/interest) already received by the buyer.

The buyer is made whole, not enriched, so any dividends or interest already collected are deducted from the recovery amount. It is the most-tested trap.

Loss-based: purchase price − sale price + interest and costs − income received. (The current value is replaced by actual sale proceeds.)

Recovery = $10,000 + $600 + $500 − $400 = $10,700. The $400 income received is subtracted.

A seller in violation offers to buy back the security on statutory terms (price + interest + costs − income received), instead of waiting to be sued.

30 days. Failing to respond within 30 days bars any later suit and releases the seller.

At noon on the 30th day after a complete application is filed, absent a stop order.

No. The effective date plus Administrator notification are required. Passing the exam alone does not confer registration.

30 days after the Administrator receives the withdrawal request, absent a proceeding.

The Administrator retains jurisdiction to bring an action for up to 1 year after a registration is withdrawn.

Form U5 (agent termination) is filed within 30 days. All state registrations expire on December 31 each year.

Anyone aggrieved may seek judicial review by appealing to court within 60 days of the final order.

No. The order remains in effect during review unless the court grants a stay.

A person who requests a hearing in writing must be granted one within 15 days of the request.

15 days = hearing granted after written request; 30 days = registration effective / rescission response / U5; 60 days = appeal a final order to court.

Anywhere — the Administrator may issue subpoenas and conduct investigations in any state, not just the home state.

Rules apply generally to all persons; orders apply to specific persons or situations. The Administrator may issue both.

Undoing a transaction by returning the buyer to their pre-sale position — refunding price plus interest and costs, minus income received.

Not necessarily. A registration action needs a public interest finding plus a statutory ground (which may be a willful violation, injunction, or felony), not proof of fraud specifically.

No. To enforce a violated order or hold a person in contempt, the Administrator must go to court.

USA criminal statute of limitations is 5 years; the penalty figures ($5,000/3 yrs) differ from the IA Act ($10,000/5 yrs). Watch the swap on exam questions.