The claim behind
a reconciled total.

Two accounts can add to the right total while assigning the wrong amount to each holder. A securities-record system needs to establish whose position it has reconciled, not merely whether its arithmetic balances.

Consider a deliberately simplified register containing one hundred units of a single class of security. The supporting records establish that Alice should have sixty units and Ben forty. A migration instead assigns seventy to Alice and thirty to Ben. The total remains one hundred. A check confined to that total reports no discrepancy.

This is an original hypothetical example, not a reported incident or an estimate of error in a market. It isolates a small but consequential distinction: conserving a quantity and preserving its allocation are different tests. The recorded allocation has shifted ten units from Ben to Alice in the example without changing the number of units in existence.

Identify the record and the relationship

The SEC and FINRA’s July 2023 investor bulletin distinguishes street-name holding from registration in an investor’s own name. Under street-name arrangements, an intermediary or nominee appears on the issuer’s books, while a broker’s records identify the beneficial investor. Direct registration instead places the investor on the issuer’s books without requiring a paper certificate.

That distinction changes the question an examiner asks of a balance. Is it an issuer-level registered position, an intermediary’s aggregate holding, or an allocation to a customer? Treating those entries as though each were a separate issue of the security would double-count representations. Treating the largest aggregate as a complete account of individual holdings would lose the allocation.

The example can sit within one intermediary’s simplified customer ledger, backed by a matching aggregate position. It does not describe the full structure of U.S. custody. There are no loans, pending settlements, short positions, restrictions or corporate actions in its opening state. Those exclusions make the arithmetic transparent; a real reconciliation must specify how such items are treated rather than assume that every difference is an error.

A balanced total leaves several possible worlds

One hundred can be divided as sixty and forty, seventy and thirty, or one hundred and zero. All three pass the same aggregate check. Only the first agrees with the stipulated opening evidence. The checking procedure has not produced a false arithmetic result. It has answered a narrower question than the one the holder needs answered.

Now stipulate a distribution of two currency units per security, with no taxes, fees or other adjustments. The correct allocation produces payments of 120 to Alice and 80 to Ben. The erroneous allocation produces 140 and 60. Both disburse 200 in total. Reconciling the cash outflow to the aggregate entitlement repeats the original blind spot.

A later correction of the securities balances alone would not establish that the earlier payments had also been repaired. The exercise therefore needs separate results for the position at the relevant time, the distribution calculated from it and the subsequent remedy. This is a design implication of the example, not a statement that any particular legal remedy follows automatically.

Trace the allocation to evidence

In Section 5.1 of my public comment on the proposed transfer-agent rules, I distinguish the transfer journal, current positions and the control of authorised and outstanding totals. Those views can share an event model without losing their separate functions. The comment recommends demonstrable relationships between them rather than assurance based on a common supplier.

For the hypothetical migration, I would require a comparison at the level of each identified account and security class, using the same effective time. The comparison would retain the opening evidence and show how each permitted event produces the closing allocation. A discrepancy would retain its own identifier and explanation instead of disappearing inside an offsetting difference elsewhere.

That comparison still needs an independent basis. If the opening file and the migration check both inherit the same mistaken account mapping, agreement between them proves little about the mapping. Testing should include the identity association as well as the quantity. The evidence required to establish an entitlement is a legal and operational question; a checksum cannot supply missing authority.

Test errors that cancel

A useful controlled test would deliberately move ten units between two test accounts while preserving the aggregate. A second case would exchange two account identifiers. A third would retain the correct present balances but corrupt the historical allocation used for a distribution. Each case targets a different way that a reassuring headline total can conceal an incorrect result.

The expected outcome should be written before the test. Does the system detect the discrepancy, identify the affected positions, prevent an unsupported downstream action and retain enough evidence for an authorised correction? A passing result should state which of those outcomes was actually observed. This article proposes these cases; it does not claim that a deployed system has passed them.

The cases should also include legitimate timing differences and unresolved exceptions. A procedure that rejects every mismatch without distinguishing its cause can obstruct valid activity. Conversely, a procedure that automatically clears every balanced batch can conceal a misallocation. The object is an explainable disposition, not a permanently green dashboard.

Preserve the holder without exposing everyone

Testing allocation does not require publishing every investor’s identity. The design question is which authorised party can resolve the account relationship, inspect its supporting evidence and challenge an incorrect entry. Public visibility of a total and accountable access to individual records serve different purposes.

Aggregate reconciliation remains useful. When checked against an independently established total, it can detect omitted positions that a holder-by-holder check misses because its population is incomplete. The two checks complement rather than replace each other. For a securities system, the more demanding demonstration is that the total, its allocation and the consequences drawn from that allocation all remain explainable at the relevant time.