Audit Confirmations vs. Rule 10b-10 Trade Confirmations Under PCAOB AS 2310
Updated October 2026, to separate audit confirmations from trade confirmations. First published December 2025.
Ask a broker-dealer's operations team about confirmations and you'll hear about Rule 10b-10, the notice that goes to a customer for every trade. Ask the firm's auditor and you'll hear about a request the auditor sends to a bank, a clearing firm, or a counterparty to confirm a balance straight back to the auditor. An earlier version of this post treated the two as one requirement. They come from different rulebooks and answer to different people.
The auditor's side changed recently. The PCAOB replaced its confirmation standard, and the new AS 2310 applies to audits of fiscal years ending on or after June 15, 2025. For a broker-dealer with a December year-end, the audit of its 2025 annual reports was the first one under it.
Rule 10b-10: A Disclosure to Your Customer
SEC Rule 10b-10 requires a broker-dealer to give its customer written notification "at or before completion" of each transaction. The notice gives the date and time of the trade, or says the time is available on request. It gives the identity, price, and number of shares or units, and whether the firm traded for the customer as agent or for its own account as principal. When the firm is the customer's agent, it also discloses its remuneration. Paragraph (b) lets a firm send periodic statements in place of trade-by-trade confirmations for certain plans and money market fund transactions, if it gives the customer prior written notice and sends the statements on the schedule the rule sets.
The confirmation is the firm's own disclosure. Nobody replies to it, and the rule doesn't ask for a reply. When it goes wrong, the problem is in what the notice says or whether it went out at all. Two FINRA settlements reported in May 2013 show what that looks like:
- Guggenheim Securities was censured and fined $15,000. It failed to deliver trade confirmations to certain institutional customers and sent others debt confirmations that lacked information Rule 10b-10 requires. The same case covered quarterly account statements it didn't send to institutional DVP and RVP accounts. The firm sent corrected confirmations after it found the problem.
- Howe Barnes Hoefer & Arnett was censured and fined $22,500 in a case that also covered OATS reporting. Its confirmations misstated reported trade prices and didn't properly disclose its compensation on riskless principal trades, and one of them didn't disclose that the firm acted as principal.
AS 2310: Evidence the Auditor Collects
An audit confirmation runs the other way. The auditor sends a request to a third party that knows the facts, such as a bank, a clearing firm, or a stock loan counterparty, and that party answers the auditor directly. The purpose is evidence. The standard says audit evidence from a knowledgeable external source is generally more reliable than evidence that comes only from inside the company. Broker-dealer audits fall under PCAOB standards because Rule 17a-5(g) requires the accountant's examination of the annual financial report, and of a compliance report where the firm files one, to follow them.
The standard has a long history under an older name. The AICPA adopted AU section 330, The Confirmation Process, in 1991, effective in 1992. The PCAOB took it on as an interim standard in 2003 and renumbered it AS 2310 as of December 31, 2016. On September 28, 2023, the PCAOB adopted a new AS 2310, The Auditor's Use of Confirmation, in Release No. 2023-008, and rescinded the old one. The SEC approved it on December 1, 2023, for audits of fiscal years ending on or after June 15, 2025.
The new standard changes several points that reach a broker-dealer's operations desk:
- The auditor selects the items to confirm, sends the requests, and receives the responses (paragraph .15). Requests go directly to the confirming party and responses come directly back (.16). An intermediary that transmits them electronically is allowed if the auditor evaluates it (.17).
- If a response goes to anyone other than the auditor, the auditor asks the confirming party to resend it directly. If no direct response arrives, the auditor treats the item as a nonresponse (.22).
- A nonresponse gets a follow-up with the confirming party (.21), and then alternative procedures for that item (.23).
- Negative confirmation requests, which the recipient answers only if it disagrees, don't provide enough evidence on their own (.12).
- Cash held by third parties now has to be confirmed, or checked by directly accessing information held by a knowledgeable external source (.24).
The adopting release explains why control over the process got its own paragraphs. PCAOB inspections had found auditors who didn't maintain that control, including cases where company personnel took part in sending or receiving confirmations.
Side by Side
| Rule 10b-10 trade confirmation | AS 2310 audit confirmation | Rule 17a-13(b)(3) verification | |
|---|---|---|---|
| Who sends it | The broker-dealer | The auditor | The broker-dealer |
| Who gets it | The customer | A bank, clearing firm, counterparty, or other third party | Whoever holds or owes securities that have sat in one status for more than 30 days |
| What it's for | Disclosing the terms of a trade | Audit evidence about a balance or a transaction's terms | Verifying securities the firm controls but doesn't hold |
| Reply expected | No | Yes, directly to the auditor | Yes, to the firm |
| If no reply comes | Not applicable | Follow-up, then alternative procedures | An unresolved difference, which can become a short security difference |
| Whose rule | SEC, under the Exchange Act | PCAOB, approved by the SEC | SEC, under the Exchange Act |
The third column is the quarterly securities count, which our guide to Rule 17a-13(b)(3) covers in detail. It belongs in this table because your firm's 17a-13 confirmations and your auditor's confirmations look alike and go to many of the same counterparties. Under paragraph .15, though, the auditor has to send and receive its own.
What This Means for the Operations Desk
- When your auditor plans confirmations of your bank, clearing, and counterparty balances, give it the population and the contacts. Don't mail the requests or collect the replies on its behalf, because paragraph .15 assigns those steps to the auditor.
- When a broker-dealer counterparty's auditor asks you to confirm stock loan, borrow, or fail positions you have with that firm, answer the auditor directly. A reply routed through your counterparty can end up treated as a nonresponse under paragraph .22, and the follow-up comes back to your desk.
- Keep a copy of every audit confirmation you answer. It's a communication relating to your business, so Rule 17a-4(b)(4) requires you to keep it for three years, the first two in an easily accessible place.
What an unanswered 17a-13 confirmation can cost in net capital and buy-ins is covered in our post on Rule 17a-13 violations.
This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.