Client Confidentiality

What client confidentiality covers

An adviser may learn a client’s account balance, income, debts, health concerns, family situation, tax position, business plans, and investment objectives. Much of this information is sensitive even when it is not a security or an account number. A professional should protect it from unnecessary access and avoid using it for personal benefit. The client shared the information to receive financial services, so the professional should handle it in a way that respects the purpose and applicable privacy rules.

Confidentiality and privacy overlap, but they are not identical. Confidentiality concerns how a professional handles information entrusted through a relationship. Privacy rules may define particular types of information, notices, disclosures, safeguards, and exceptions. A firm may also have contractual obligations, state privacy requirements, cybersecurity procedures, and record-retention duties. The Series 65 tests the core ethical idea: client information should not be casually disclosed, misused, or exposed through careless practices.

The first step in a scenario is to identify the information and the proposed use. A client’s portfolio and home address sent to an unapproved marketing vendor raises a different issue from an account statement sent to the client’s authorized accountant. Ask who wants the information, why it is needed, whether the client authorized the sharing, what legal rule applies, and whether reasonable safeguards are in place. The professional should not assume that possession of information creates permission to use it for any purpose.

Regulation S-P and covered firms

SEC Regulation S-P addresses privacy of consumer financial information and safeguarding customer records. It applies to specified financial institutions, including SEC-registered investment advisers and broker-dealers. The regulation includes notice and information-sharing rules, safeguards for customer information, and requirements concerning disposal of consumer report information. Its scope is defined by the rule; it should not be described as a complete privacy code for every person, data type, business, or state.

The SEC’s 2024 amendments require covered institutions to maintain written incident-response programs for unauthorized access to or use of customer information, including procedures for timely notice to affected individuals when sensitive customer information is involved. The amendments also broaden covered information and require written records related to compliance. The large-entity compliance date was December 3, 2025, and the small-entity date was June 3, 2026, so both dates had passed by October 2026. These dates are useful when reading current materials, but the article’s core principle is the duty to safeguard information.

Regulation S-P requires covered institutions to adopt written policies and procedures addressing administrative, technical, and physical safeguards for customer records and information. Administrative controls may include access rules, employee training, and vendor oversight. Technical controls can include authentication, encryption, logging, and secure data transfer. Physical controls may protect paper files, devices, and office spaces. The proper design depends on the firm’s operations and information risks; a policy is only useful if employees follow it.

An adviser’s exam question may mention an email sent to the wrong person, a lost laptop, a stolen account password, or an unapproved file-sharing service. These facts point to a safeguarding issue and possibly an incident-response obligation. The professional should follow firm procedures promptly, report the incident to the appropriate compliance personnel, preserve relevant records, and avoid making unsupported promises to the client. The firm determines its legal response under applicable rules and the incident’s facts.

Disclosure to service providers and other parties

Financial firms often use custodians, portfolio systems, accountants, technology providers, administrators, and other vendors. A necessary service may require access to client information. Regulation S-P contains rules and exceptions for certain disclosures, including disclosures to service providers under specified conditions. A firm should limit information to what the service requires, use appropriate contractual protections, and assess the provider’s security practices. Service-provider access is not a license to use client information for unrelated purposes.

A client may also authorize disclosure to an accountant, attorney, family member, or another adviser. The professional should confirm the scope of the authorization and use a reliable communication method. A client who authorizes a portfolio summary for a tax preparer has not necessarily authorized the adviser to share all health and family information. The minimum information needed for the stated purpose is usually the more careful approach.

Some disclosures may be required or permitted by law, court process, regulator inquiry, or other recognized exception. The professional should not obstruct a lawful request, but should route it through the firm’s compliance or legal process. This helps confirm the request is valid, determine which records are responsive, and preserve an accurate record of what was produced. A casual email from someone claiming to be an official should not be treated as a verified legal demand.

A useful example is a regulator requesting records for an examination. Client confidentiality does not automatically authorize the adviser to ignore a lawful regulatory request. The firm should verify the request, identify its scope, and respond through established channels. The client’s information should be shared only to the extent required or permitted. Confidentiality calls for careful handling, not obstruction of lawful supervision.

Privacy notices and information-sharing choices

Regulation S-P requires privacy notices in specified circumstances and describes categories of information, recipients, and practices that may need to be explained. The notice should accurately reflect the firm’s practices. Where a right to opt out applies, the consumer must receive the required choice and a usable way to exercise it. Some disclosures fall within statutory exceptions and do not require an opt-out; the exact provisions govern.

A privacy notice does not itself establish that every future disclosure is appropriate. A notice should accurately describe the firm’s practices, but staff must still follow the rule, client instructions, and internal policies. If a firm’s actual vendor relationship changes, the notice and controls may need review. If a client asks how information is used, the adviser should answer based on the firm’s real procedures rather than reciting a generic privacy statement.

The distinction between a consumer and a customer can matter under Regulation S-P. The rule’s definitions and notice requirements depend on the nature of the financial relationship and the type of information. For example, an individual who provides information while seeking a financial service may be a consumer even if no continuing customer relationship is established. A Series 65 candidate usually needs to understand that the rule has defined scope, not apply a single notice requirement to every name in a prospect list.

Confidentiality is not absolute secrecy

A professional should not promise that information will never be disclosed. A client may authorize sharing; a firm may need to provide information to a custodian or service provider; a regulator may issue a lawful request; or a disclosure may be permitted under a specific exception. The firm should explain privacy practices accurately and protect information in each permitted context. Absolute secrecy could conflict with law, operations, or the client’s own request.

At the same time, convenience is not a valid reason to share private client information broadly. An adviser should not discuss a client’s account at a social event, forward statements to a personal email account, or use client data to market unrelated products without appropriate authority. Even when a law permits a disclosure, the firm should consider whether the disclosure is necessary and consistent with its commitments. Ethical handling can require more care than the minimum legal permission.

Client confidentiality also differs from insider-trading confidentiality. Information about a client’s holdings is private and should be protected. Material nonpublic information about an issuer may trigger restrictions on trading or tipping under securities laws. A person could encounter both types of information in a professional setting, but the legal questions are different. Protect client records under privacy and fiduciary obligations; handle issuer information under insider-trading controls.

A worked case: a family member asks for an update

An adult child calls an adviser and asks how much money a parent has in the managed account. The child says the information is needed to help with household budgeting. The parent has not authorized the disclosure. The adviser should not provide the account balance simply because the caller is family. The adviser should check the account’s authorization records and applicable legal authority, such as a valid power of attorney or other documentation accepted by the firm.

If the parent authorizes the child to receive a limited account summary, the adviser should record the scope and verify the recipient’s identity. Permission to receive a statement may not authorize the child to trade, change beneficiaries, or obtain tax records. The firm should distinguish information access from legal authority over the account. That distinction protects both the client and the family member from misunderstandings.

If the caller claims to hold power of attorney, the adviser should follow the firm’s process to verify and review the document. A professional should not make an informal legal determination under pressure. Once authority is validated, the adviser can share only what the document and client relationship permit. The ethical analysis is fact-specific: family status by itself is not the same as client consent or legal authority.

A worked case: a vendor requests full account files

A portfolio software vendor asks an adviser to upload full client statements, tax returns, identity documents, and correspondence so the vendor can test a new planning feature. The feature may need account balances and holdings, but it may not need tax returns or identity documents. The adviser should ask whether the vendor is approved, what information the function actually requires, what contract and security controls apply, and whether the client-facing privacy disclosure covers the arrangement.

A safer process uses the least information that can perform the task, limits access to authorized personnel, and records the provider’s role. If the vendor’s request is outside the approved scope, the adviser should not upload the records until the firm’s compliance and information-security teams review it. Convenience or a software demonstration does not establish a lawful disclosure or adequate safeguards.

Suppose the vendor suffers a breach after receiving the data. The adviser should report the event through the firm’s incident-response procedures. The firm determines whether the incident involves covered customer information, which notices and timing rules apply, and what corrective measures are needed. The adviser should not independently delay reporting to avoid embarrassment or send an improvised notice that could misstate what happened.

A worked case: an email sent to the wrong recipient

An adviser intends to send a quarterly statement to a client but selects an email address that belongs to another person with a similar name. The message includes account value, holdings, and recent transactions. The adviser notices the error a few minutes later. The immediate steps are to follow firm procedures, notify compliance or the incident-response contact, preserve the relevant facts, and avoid forwarding additional records until the incident is assessed.

The adviser should not decide alone that the event is harmless because the message was opened only once or because the recipient promised to delete it. Those facts can be reported, but the firm must assess the information exposed, the recipient, the possibility of further access, and applicable notification requirements. The firm may contact the recipient to request deletion or containment, but that step does not replace reporting and documentation.

A common exam trap is to treat confidentiality as a choice between secrecy and immediate public notification. The correct response is controlled escalation. The firm investigates, applies legal thresholds, takes containment measures, and sends notices when required. The adviser should give accurate information and cooperate. Avoid promising that no harm occurred before the firm understands the facts.

Data minimization, access, and secure communication

A practical confidentiality program begins with knowing where client data lives and who can use it. Firms should grant access based on job duties, revoke access when employees leave, train staff on handling sensitive information, and monitor systems for inappropriate use. Employees should use approved storage and communication tools. A personal cloud drive or personal email account may lack the controls, oversight, and retention features the firm requires.

When sending information, verify the address, recipient, attachment, and purpose. Use secure portals or other approved channels for sensitive records. Avoid placing confidential details in subject lines, open chat rooms, or public documents. If a client asks to use an unsecure method, follow firm policy and explain any available secure alternative. A client preference matters, but it does not automatically override the firm’s legal and security responsibilities.

Information should be retained and destroyed under the firm’s records policy and applicable law. Deleting a record immediately after a client asks may violate retention rules. Keeping copies forever can also create unnecessary exposure. Secure disposal applies to electronic and paper records. The adviser should use the firm’s retention schedule rather than improvise a solution based on convenience.

Common exam mistakes

One mistake is assuming that every disclosure requires the client’s express written consent. Regulation S-P contains specified exceptions and notice rules, and other laws may require disclosure. Another mistake is assuming that a privacy notice grants blanket permission to share information for any purpose. The governing rule, notice, client authorization, and actual use must align.

A second mistake is confusing ownership of a record with permission to distribute it. An adviser may retain account records for legal and operational reasons, but that does not make them appropriate marketing material. A third mistake is believing that client confidentiality prevents the firm from cooperating with a valid regulator or court process. Verify and route legal requests through the proper channel, then disclose only what is required or permitted.

A final mistake is treating a breach response as merely a public-relations decision. Incident response is a regulated and operational process. Report promptly, preserve evidence, contain access, assess what was exposed, and follow notification rules. Do not conceal, minimize, or independently characterize an event before the firm completes its review.

Practice questions with explanations

Question one: a client’s spouse asks for the account balance, but the client has not authorized disclosure and no legal authority is documented. What should the adviser do? The adviser should not disclose the information based solely on the family relationship. Verify the client’s authorization or legally recognized authority through firm procedures. A spouse’s interest or concern does not automatically permit access.

Question two: a registered adviser uses a vendor to process account data under an approved service contract. Is all client information automatically available to the vendor? No. The firm should limit data to what the service needs, use appropriate safeguards and contractual controls, and follow Regulation S-P and internal policy. A vendor relationship can support certain disclosures, but it does not justify unnecessary data sharing.

Question three: a laptop containing customer information is stolen. The adviser believes the device had a password and decides not to tell compliance. What is the best response? Follow the firm’s incident-response procedures and report the event promptly. The firm should assess the information, encryption, access risk, and applicable notification requirements. The adviser should not decide alone that no response is necessary.

Question four: a regulator sends a verified, lawful request for client records. Does confidentiality require refusal? No. The firm should handle the request through legal or compliance channels, confirm its scope, preserve records, and provide information as required or permitted. Confidentiality calls for careful handling rather than obstruction of lawful regulatory duties.

Key takeaways

• Protect client information from unnecessary access, use, or disclosure.
• Regulation S-P requires covered firms to maintain privacy and safeguard practices, with defined scope and exceptions.
• Verify client authorization and legal authority before sharing account information with family members or others.
• Use approved vendors and secure channels, and limit information to what a service requires.
• Report suspected incidents through firm response procedures and let the firm assess legal notices and remediation.