The PAB Report Nobody Reads Until It’s Wrong

Each small carrying broker-dealer carries out a Rule 15c3-3 computation for its broker-dealer proprietary accounts together with the computation of the customer reserve. And each year the same small number of PAB and custody findings reappear in the audits of firms that believed their controls were adequate.

It’s a well-known situation: a template that stopped working a year ago and for which no one has reexamined it, a daily review that has been put off until some later time, and a supplemental schedule that was signed without it having been read through once.

The cases that keep reappearing are as follows.

The PAB Account Was Treated Like a Customer Account

The first example is a mistake that many small carrying firms make. Each week the calculation of customer reserves receives full attention, while the PAB calculation is copied from the same template using the same assumptions, and no one takes the time to check whether a correspondent broker’s balances actually should be placed in customer-type buckets. Most of the time they should be in some other category altogether.

A PAB credit is different from a customer credit since the debit items which the firm can offset against it are more limited, the notifications to the bank are separate, and the reserve deposit is kept in its own account together with its own written agreement.

When staff runs the two computations as parallel exercises, the audit turns up misclassified items, an underfunded PAB reserve, or the classic: a PAB reserve account that was opened but never had the 15c3-3(f) bank notification properly executed. That last one shows up in real filings, and it’s exactly the kind of housekeeping error a fresh set of eyes catches immediately, which is a good argument for engaging specialized broker-dealer auditors who see the same computation across dozens of firms.

Possession or Control Slipped All Quarter

Custody reports almost never begin with a missing security; instead, they start with a security that had been in the wrong place for three days, then five, and then for the entire month, since the daily review of possession or control wasn’t really carried out on a daily basis. The rule is based on a particular test, which states that fully paid for securities together with any excess margin securities must be under the firm’s control, and any deficit has to be identified and corrected within a specified time frame.

In small companies, there is typically a single individual who carries out the review. Whenever that person is absent, the exception report runs and then remains unattended. It is not until the auditor selects a sample that the trail reveals deficits that had stayed open after the required buy-in date or securities that were financed with a counterparty who had no business holding them. There is generally no loss; the conclusion is that the control failed to operate.

The Reserve Deposit Was Right on Friday and Wrong on Monday

Timing is the third recurring case, and it’s about to get harder. Under amendments the SEC adopted in late 2024, carrying broker-dealers above a rolling $500 million threshold have moved from weekly to daily customer and PAB reserve computations. Firms below the threshold still compute weekly, but the direction of travel is clear, and audit expectations have already tightened around the accuracy of the as-of date, the timing of the deposit, and the supporting bank confirmations.

The way things go is well known: when a settlement or a sweep takes place, the credits jump on Friday afternoon, the amount deposited on Monday morning is based on outdated figures, and as a result the reserve is underfunded for the whole of the following business day. Although in each individual case it seems insignificant, when it occurs over the course of a year it amounts to a control deficiency which the auditor has to report.

Small Firms Can Stop Repeating the Same Finding

PAB and custody controls are real controls, not paperwork. They need a backup who can run them when the primary owner is out, evidence that survives a sample test months later, and a review of the supplemental schedules by someone who didn’t prepare them. PCAOB inspection findings keep flagging the same weaknesses year after year, which suggests the fix is structural rather than technical.

The PAB report is only carefully examined on two occasions: when the auditor visits and when a regulator puts a question. It is the firms that regard it as an active document throughout the rest of the year which end up not being caught.