Sharing Account Data with an Executor — Privacy Rules Financial Advisors Must Follow

A deceased client's adult daughter calls your office and asks a simple question: "How much money did Dad have?" Your instinct is to help a grieving family member. Your compliance obligation is to say no — at least until you've verified who she is and whether she has legal standing to receive that information.

Privacy Protections Don't Die with the Client

Under the Gramm-Leach-Bliley Act (GLBA) and SEC Regulation S-P, financial institutions must maintain safeguards protecting nonpublic personal information (NPI). The critical point most advisors miss: these protections remain fully active after the client's death.

GLBA defines a covered "Consumer" to include the "individual's legal representative." For assets held solely in the decedent's name, account details go to the verified legal representative, such as the court-appointed executor or administrator. Joint owners, successor trustees, and other people with separate authority may access information for their accounts under the applicable ownership documents; family relationship alone does not grant access to a solely titled account.

Unauthorized disclosure of NPI can trigger civil penalties of up to $100,000 per violation. In the emotionally charged aftermath of a death, that regulatory exposure is easy to create accidentally.

Who Gets Access, and When

The hierarchy is straightforward:

Verified executor or administrator. Once someone presents court-issued letters testamentary or letters of administration and passes your firm's KYC/CIP verification, they may access information and direct transactions for estate assets within the scope of their authority and the custodian's requirements.

Successor trustee. If the account was held in a trust, the successor trustee designated in the trust agreement receives access upon presenting the trust documentation and death certificate. No probate court involvement needed.

Surviving joint tenant. For joint accounts with right of survivorship, the surviving owner already has access to the account. They don't need executor authority — but they can only see information related to the joint account, not separately titled accounts.

Everyone else — no access based on role alone. Adult children, siblings, former spouses, the client's business partner, and the family's CPA do not get account information solely because of their relationship or professional role; they need written authorization or another valid basis for access.

The Scenario That Creates Compliance Risk

The most common violation pattern looks like this: The surviving spouse calls, distraught, and asks you to tell her adult son the account balances so he can "help with the finances." You know the family, you know the son, and the request feels entirely reasonable.

But if the accounts were titled solely in the deceased spouse's name, the surviving spouse has no authority to authorize disclosure from those accounts unless she is the verified legal representative or has another valid basis. The 2025/2026 Regulation S-P amendments require an incident-response process for unauthorized access to or use of customer information. The 30-day notice applies when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization; the notice goes to affected individuals as soon as practicable and no later than 30 days, unless, after a reasonable investigation, the firm determines that the information has not been, and is not reasonably likely to be, used in a manner that would cause substantial harm or inconvenience. An improper disclosure still requires review, but it does not automatically trigger that notice requirement.

What You Can Share — and How to Frame It

Use a firm-approved response to explain the general process without confirming whether an account exists unless that disclosure is authorized. You can tell callers what documentation they will need to provide for the relevant account type.

When fielding calls from family members who don't yet have executor authority, try this framing:

"I want to help your family through this, and I will — once we verify the authority for each account. For probate assets, that means a certified death certificate and court-issued letters; trust accounts use the trust documents, and joint accounts use their ownership documents. We also verify the representative's identity. Once we have the required documents, we can move quickly."

This gives the caller a concrete action plan without disclosing any protected information.

Building the Documentation Trail

Every inquiry about account information — whether you disclosed anything or declined — goes into your CRM notes. Record who called, what they asked for, what you told them, and what you withheld. If you declined a request, note the reason and what documentation you told them to provide.

The Financial Advisor's Deceased Client Protocol includes a privacy decision tree that maps common disclosure requests to their Regulation S-P requirements, with pre-written response templates for each scenario.