Regulation S-P and Deceased Client Privacy: What Advisors Can and Cannot Share

A deceased client's adult son calls your office and asks a reasonable question: "How much money is in my father's accounts?" You have known this family for years. You have met the son at client appreciation events. He seems like the obvious person to talk to.

Answering before verifying his authority may disclose nonpublic personal information without authorization and must be handled under the firm's privacy procedures.

Why Privacy Survives Death

Under the Gramm-Leach-Bliley Act and its implementing regulation — SEC Regulation S-P (17 CFR Part 248) — financial institutions must protect nonpublic personal information (NPI) of their customers. This includes account balances, holdings, transaction histories, Social Security numbers, and any other information not publicly available.

A client's death does not terminate this obligation. Account information may be shared with the legal representative or another person authorized under the account title, beneficiary designation, or trust documents once that authority is verified. Family relationship alone does not authorize access.

This applies to everyone: the surviving spouse, adult children, the deceased's attorney-in-fact (whose authority expired at death), the family's accountant, and the estate attorney unless that person is authorized by the verified representative or other applicable authority.

What Constitutes a Violation

Any disclosure of NPI to an unauthorized person is a violation, regardless of intent. Common scenarios that trip up advisory firms:

Telling a family member the account balance. Even something as seemingly harmless as confirming how much money is in the account constitutes disclosure of nonpublic personal information.

Sending account statements to the family home. If statements are still being mailed and a family member opens them, the firm has not violated privacy — but proactively sending statements to a family member who was not previously authorized is different.

Sharing holdings information with the family's CPA or attorney. Even if the family directs you to share information with their professionals, you need written authorization from the verified executor before doing so. The family's verbal direction is not sufficient.

Confirming the existence of an account. Even acknowledging that a deceased person had an account with your firm can constitute disclosure in certain contexts.

The civil penalty exposure is real: up to $100,000 per violation under GLBA enforcement provisions.

The 2025/2026 Regulation S-P Amendments

The SEC's updated Regulation S-P amendments introduced significant new requirements that directly affect deceased client account management:

Incident Response Program. Every covered firm must now maintain a written incident response program with procedures to detect, contain, and recover from unauthorized access to customer records. If NPI is improperly disclosed during a deceased client transition, this program must be activated.

Notice After a Qualifying Incident. If sensitive customer information was or is reasonably likely to have been accessed or used without authorization, the covered firm must notify affected individuals as soon as practicable and no later than 30 days after becoming aware, subject to limited exceptions. An improper disclosure to an unverified family member requires incident-response review; whether notice is required depends on the information involved and the rule's conditions.

Compliance Deadlines. Larger firms (over $1.5 billion AUM) had to comply by December 3, 2025. Smaller practices had to implement these systems by June 3, 2026. Both deadlines have passed.

The practical implication: a well-intentioned privacy slip during a client's estate transition should be handled under the firm's written incident response procedures. Mandatory notice to affected individuals applies when the incident meets the rule's criteria; the rule does not make every disclosure an automatic 30-day notice event.

What You Can Safely Do

The restrictions are strict, but they do not prevent the firm from operating. Before receiving verified letters testamentary, the firm can:

• Confirm to the caller that the firm is aware of the client's passing
• Explain the general process for estate transitions without disclosing account-specific details
• Describe what documentation the executor will need to provide
• Apply appropriate protective steps to individually owned accounts without sharing account-specific details; joint, trust, and beneficiary-designated accounts follow their own authority rules
• Express condolences and provide the firm's estate services contact information

Once the legal representative or other person authorized for the account is verified through appropriate documentation and identity checks, the firm can share information within that person's authority. That person can authorize disclosure to others, such as the CPA, estate attorney, or beneficiaries, in writing.

Practical Scripts for Privacy-Compliant Conversations

When an unverified family member asks for account information:

"I understand you need this information, and I want to help you get it as quickly as possible. For the protection of the estate, we are required by federal privacy regulations to verify the legal authority of the person managing this account before we can share account details. Once we receive the documents establishing that authority and complete our standard verification, we can share information within that person's authority. Can I explain what documents we will need so we can move this forward?"

This script does four things: it validates the request, explains the reason for the restriction, frames it as protection (not obstruction), and offers a concrete next step.

When a family member becomes frustrated or angry:

"I hear your frustration, and I want you to know this is not about bureaucracy. These protections exist specifically to prevent anyone — including people who might not have the family's best interests at heart — from accessing estate assets without proper authority. We have seen situations where unverified individuals try to access accounts. The verification process is what protects your family's inheritance."

The complete set of privacy-compliant communication templates and the verification workflow for deceased client accounts is included in the Financial Advisor's Deceased Client Guide.