Vulnerable Adult Financial Exploitation

Recognizing financial exploitation

Financial exploitation can involve a stranger, a family member, a caregiver, a new acquaintance, or someone already authorized to help manage an adult’s affairs. Conduct may include taking money without permission, misusing a power of attorney, pressuring a customer to change a beneficiary, or persuading the customer to transfer assets through deception or undue influence. The key issue is whether another person is wrongfully obtaining or controlling the customer’s money, securities, or property.

A customer may be at risk without having a diagnosed illness or losing the ability to make decisions. Age alone does not show that a person is incapacitated. Under FINRA Rule 2165, a “Specified Adult” includes a natural person age 65 or older and a person age 18 or older whom the member reasonably believes has a mental or physical impairment that makes the person unable to protect their own interests. The rule’s definition is specific to its purposes; state statutes may use different terms or thresholds.

Warning signs can include unusual large withdrawals, sudden changes in beneficiaries, a new person who speaks for the client, a client who appears confused about a transaction, or pressure to send money urgently to an unfamiliar recipient. A single unusual instruction is not proof of exploitation. The firm should ask questions, review relevant account activity, speak directly with the customer when possible, and follow its escalation procedures. The goal is to distinguish a genuine customer decision from a transaction driven by coercion, deception, or unauthorized control.

An adviser or representative should avoid making assumptions based on age, disability, accent, family structure, or a customer’s choice to make a risky investment. Older adults retain the right to make their own decisions. The professional should focus on observable facts: inconsistency with the customer’s prior instructions, a suspicious third party, inability to explain the transfer, or evidence that an authorized person is acting for personal gain. Respectful questions can reveal whether the customer is choosing freely.

FINRA Rule 2165: who and what it covers

FINRA Rule 2165 applies to FINRA member firms and the accounts of specified adults over which those adults have authority to transact. It defines financial exploitation to include wrongful or unauthorized taking, withholding, appropriation, or use of a specified adult’s funds or securities. It also includes conduct by a person, including someone using a power of attorney or guardianship, to obtain control through deception, intimidation, or undue influence, or to convert the adult’s money, assets, or property.

The rule authorizes, but does not require, a member firm to place a temporary hold on a disbursement of funds or securities or on a securities transaction when the firm reasonably believes exploitation has occurred, is occurring, has been attempted, or will be attempted. The firm must notify relevant authorized parties and trusted contacts within two business days, subject to exceptions when a person is unavailable or the firm reasonably believes that person may be involved in exploitation. The firm must immediately begin an internal review.

Rule 2165 gives a firm a way to pause certain activity while it investigates a credible concern. It is not a general power to freeze an account because a representative disagrees with a customer’s investment choice. The hold must relate to a reasonable belief of financial exploitation and comply with the rule’s procedures. A firm should involve supervisory, compliance, or legal personnel authorized under its written procedures rather than leave the decision to an individual representative acting alone.

The rule also requires written supervisory procedures for identification, escalation, and reporting, names the titles of people authorized to place, terminate, or extend holds, and requires the firm to retain records. Training must be developed and documented. The record should show the suspicious request, facts supporting the reasonable belief, the person who authorized the hold, notifications, internal review, and any extension rationale. Documentation makes the firm’s judgment reviewable.

How long can a FINRA temporary hold last?

Under the current Rule 2165, a temporary hold generally expires no later than 15 business days after it begins. The firm may extend it for up to 10 additional business days if its internal review supports the reasonable belief that exploitation occurred, is occurring, or is likely. A further extension of up to 30 business days is available when the firm has reported or notified a state regulator, competent agency, or court and the internal review continues to support the belief. A regulator or court may also terminate or extend a hold as allowed by the rule.

These periods are measured in business days, not calendar days. If a firm places a hold on a Monday, weekends and market holidays affect the calendar date on which the 15-business-day period ends. The firm must track the actual rule deadline and any extension conditions rather than estimate. The clock begins when the initial hold is placed, and an extension must be supported by the required review and external report where applicable.

Rule 2165 does not automatically prevent every transaction in the customer’s account. Its scope concerns a disbursement or securities transaction when a reasonable exploitation belief exists. The firm should tailor the restriction to the suspected activity and follow the rule. A customer may still have legitimate needs, such as rent, medical expenses, or routine bills. The firm should promptly assess the facts and avoid turning a temporary safeguard into an indefinite freeze.

As of October 12, 2026, FINRA has proposed additional amendments to Rule 2165 and related customer-account provisions. A proposal is not an effective rule. Use the currently codified Rule 2165 for present requirements unless and until FINRA and the SEC complete the rulemaking and FINRA announces an effective date. Exam questions that specify a date or provide rule text should be answered from that source.

A trusted contact is not an account owner

FINRA Rule 4512 requires member firms to maintain the name and contact information for a trusted contact person age 18 or older for covered noninstitutional accounts, subject to the rule’s terms. At account opening, the firm must disclose in writing that it may contact the trusted person and share account information for specified purposes, including addressing possible exploitation, confirming the customer’s contact information or health status, identifying a legal representative, or as permitted under Rule 2165.

A trusted contact is a source of information, not a substitute decision-maker. Naming an adult child or friend does not give that person authority to place trades, withdraw assets, change account beneficiaries, or act as power of attorney. If a trusted contact asks to access the account, the firm must verify separate legal authority or customer authorization. The designation can help a firm check whether a customer is safe, but it does not transfer control.

A customer may decline to provide a trusted contact. FINRA Rule 4512 allows an account to be opened or maintained if the firm makes reasonable efforts to obtain the information. The trusted-contact disclosure should make clear what the firm may share and when. A contact may be helpful when the firm cannot reach the customer, but the firm should not assume that a contact has the customer’s best interests at heart in every situation.

If the trusted contact is the person suspected of exploitation, Rule 2165’s notice exception matters. The firm should not alert a potentially abusive person in a way that gives them more control or prompts them to move assets. The rule allows the firm to withhold notice when it reasonably believes the trusted contact or an authorized person has engaged, is engaging, or will engage in exploitation. The firm should document the basis for the decision and follow its procedures.

FINRA rule and NASAA model act are different

NASAA’s Model Act to Protect Vulnerable Adults from Financial Exploitation offers a separate state-law framework. The model act calls for qualified individuals to report a reasonable belief of attempted or actual exploitation promptly to Adult Protective Services and the state securities regulator. It authorizes disclosure to a designated third party in defined circumstances, prohibits disclosure to a third party suspected of exploitation, and provides a model process for delayed disbursements and immunity for good-faith compliance.

The NASAA model act describes eligible adults as people age 65 or older and adults who fall within a state’s adult-protective-services statute. Its model delay is generally up to 15 business days, with a possible additional 10 business days requested by a state regulator or APS agency and longer action available through a court. Each jurisdiction decides whether and how to adopt the model. State enactments may use different definitions, reporting routes, deadlines, or hold authority.

FINRA Rule 2165 is an SRO rule for member firms and covers both disbursements and securities transactions under its current text. NASAA’s model act is state model legislation or regulation that can impose reporting duties on qualified individuals and covered firms after adoption. They overlap in their protective purpose but are not interchangeable. In a question asking what a FINRA member may do, apply Rule 2165. In a state-law scenario, apply the enacted state text or clearly stated model assumption.

A financial professional should not assume that the FINRA rule displaces state reporting obligations. A state statute may require a report even when a FINRA member has placed no hold. Conversely, a model act’s protections do not apply merely because NASAA approved it. Confirm local adoption and its current language. The exam often tests this distinction by describing a model rule but asking what is binding in a particular jurisdiction.

A worked case: an urgent wire request

An 82-year-old client asks to wire $90,000 to a person she met online two months ago. The caller joins the conversation, answers questions for the client, and says the money must arrive that afternoon for a private medical investment. The customer’s prior profile shows a conservative portfolio and no history of private placements. These facts do not prove exploitation, but the urgency, new recipient, unusual amount, and third-party pressure support prompt escalation and a direct conversation with the customer.

The firm should attempt to speak privately with the client, confirm the purpose and recipient, and ask whether anyone is pressuring her. It should review the account history, payment instructions, and any recent changes in contact details or trusted contacts. If the firm reasonably believes the disbursement may be exploitation, an authorized supervisor may place a Rule 2165 hold, notify relevant parties within two business days subject to the suspected-party exception, and begin an internal review immediately.

The representative should not tell the caller that a hold is in place if the caller may be involved. The firm should consider whether that notification could increase risk. It should also avoid promising that the customer will recover money or that the transfer is definitively fraudulent. The purpose is to pause, investigate, and follow the applicable procedures while preserving the client’s dignity and decision rights.

A worked case: a family member holds power of attorney

A customer’s niece presents a power of attorney and requests a $40,000 transfer to her own account. The document appears valid, but the customer previously told the adviser that she wanted to retain enough cash for assisted-living expenses. A power of attorney can authorize an agent to act, but it does not authorize self-dealing or abuse. The firm should review the document, determine who may act, and assess whether the requested transfer suggests conversion or undue influence.

If the firm has a reasonable belief that the niece is exploiting the customer, it should not notify her automatically as an authorized party if the rule’s suspected-person exception applies. The firm should use compliance and legal procedures to assess the account authority, transaction, and state reporting duties. The adviser should speak with the customer if possible and document the customer’s wishes. A relative’s status or legal document does not end the inquiry.

The distinction between authority and benefit is important. A fiduciary or agent may have power to transact for a principal but still owe duties and be restricted from using assets for personal purposes. A transaction can be formally authorized yet exploitative if control was obtained through deception, intimidation, or undue influence. The firm should focus on the purpose and effect of the transaction, not only the signature on the document.

A worked case: the customer is making an unusual but informed choice

A 70-year-old customer asks to sell a diversified portfolio and purchase a small business owned by a longtime friend. The investment is concentrated and illiquid, but the customer can explain the risks, has independent advice, and has set aside money for living expenses. Age and risk alone do not establish exploitation. The adviser should still evaluate suitability or fiduciary duties, conflicts, valuation, liquidity, and diversification, but should not treat a capable adult’s unusual choice as evidence of abuse.

If a relative is pressuring the customer or answering every question, the professional should find an opportunity to speak directly with the customer. Ask open questions rather than leading ones: “What do you expect to receive from the investment?” and “What would happen if the business failed?” The customer’s own explanation can help assess understanding and pressure. A high-risk investment may be a poor recommendation without being financial exploitation.

This example prevents a common error: confusing vulnerability with incapacity or exploitation. A person may need assistance with some tasks and retain the ability to choose investments. A professional should report or place holds when the legal standard is met, not simply because the client is old or makes a decision the professional would not make. Use objective facts and follow the rule’s threshold.

How to respond and document concerns

When a concern arises, preserve relevant records and report it promptly through the firm’s designated escalation channel. Record what the customer requested, who was present, what the customer said in their own words, any unusual changes, the source of the concern, and the time of each step. Avoid adding conclusions that the facts do not support. A concise factual record helps compliance assess whether the rule’s reasonable-belief standard is met.

If the customer is in immediate physical danger, the firm may need to coordinate with appropriate authorities under its policies and applicable law. Financial exploitation can be one part of a broader safety concern. A representative should not investigate beyond training or confront a suspected exploiter alone. Compliance, adult protective services, law enforcement, regulators, or legal counsel may need to be involved depending on the facts and state requirements.

After the initial response, continue to assess the customer’s legitimate needs. A temporary hold should not block routine necessary payments longer than the rule permits without proper extension. The firm should communicate with the customer in a manner that does not expose them to additional pressure. If the concern proves unfounded, the firm should remove the hold and restore ordinary service promptly.

Practice questions with explanations

Question one: a member firm reasonably believes that a specified adult is being exploited through a $25,000 disbursement. May it place a temporary hold? Rule 2165 permits, but does not require, a hold on a disbursement or securities transaction if its conditions are met. The firm must notify relevant parties within two business days, subject to exceptions, and immediately begin an internal review.

Question two: a customer names her son as a trusted contact. Does that let him trade or withdraw funds? No. The designation permits limited contact and information sharing under the rule. It does not give the son transaction authority, power of attorney, or account ownership.

Question three: the trusted contact is the person suspected of taking the customer’s money. Must the firm notify that contact of a temporary hold? Not if the firm reasonably believes the contact has engaged, is engaging, or will engage in exploitation, or the person is unavailable. The firm should document the basis and follow its procedures.

Question four: a state has not adopted the NASAA model act. Does the model’s reporting duty automatically apply there? No. The model act is not binding until a jurisdiction adopts it. Apply the state’s enacted law and any separate FINRA or federal requirements.

Key takeaways

• Financial exploitation can involve unauthorized taking or obtaining control through deception, intimidation, or undue influence.
• FINRA Rule 2165 defines specified adults as people 65 or older and certain adults 18 or older with impairments.
• A firm may hold a covered disbursement or securities transaction when it reasonably believes exploitation occurred or may occur.
• Rule 2165 requires timely notice, immediate internal review, written supervisory procedures, training, and records.
• A trusted contact is not an account decision-maker, and state statutes based on the NASAA model act vary by adoption.