Financial advisor confidentiality is required by federal law: SEC Regulation S-P obligates registered investment advisers, broker-dealers, and investment companies to safeguard your nonpublic personal information, give you a privacy notice, and let you opt out of certain third-party disclosures.1U.S. Securities and Exchange Commission. Regulation S-P But those protections have hard limits. Your advisor must comply with subpoenas and regulator demands, can share your data with service providers under contract, and — unlike your lawyer — cannot invoke any legal privilege to keep your conversations out of court.
What Information Your Advisor Must Keep Confidential
Federal law protects “nonpublic personal information,” which the Gramm-Leach-Bliley Act defines in three categories: what you give the firm, what the firm generates by serving you, and what the firm otherwise obtains about you.2Legal Information Institute. 15 USC 6809(4)(A) – Definition of Nonpublic Personal Information In practical terms, that covers your Social Security number, income, account balances, asset and debt statements, investment holdings, credit card numbers, and anything pulled from your credit report. Even a client list compiled from nonpublic data is protected, regardless of whether the individual names on it are otherwise public.
Regulation S-P requires firms to maintain written policies covering administrative, technical, and physical safeguards for that data, plus written procedures for destroying it securely when it is no longer needed. If your advisor holds a Certified Financial Planner designation, the CFP Board layers on an additional duty: CFP professionals may not disclose nonpublic personal information about any prospective, current, or former client, with only narrow exceptions.3CFP Board. Client Confidentiality and Privacy FINRA enforces parallel customer-information protection standards for brokerage firms.4FINRA. Customer Information Protection
The firm must give you a privacy notice at the start of the relationship explaining what it collects, how it uses that data, and which categories of nonaffiliated third parties may receive it.5eCFR. 17 CFR 248.10 – Limits on Disclosure of Nonpublic Personal Information to Nonaffiliated Third Parties Read it. It is the single best document for understanding how your specific firm handles your data. Firms that haven’t changed their policies and share only under standard exceptions are no longer required to send annual updates, so silence after year one is not automatically a red flag.6Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act
When Your Advisor Can Share Your Information
Confidentiality is not absolute. Several categories of disclosure are legally permitted, and some are legally required.
When You Give Permission
The simplest exception is consent. When you ask your advisor to coordinate with your attorney, accountant, or estate planner, the advisor can share what is needed for that coordination. The SEC has confirmed that the duty to safeguard sensitive information does not prevent an adviser from providing necessary details to professionals servicing your account, or in other situations where you authorize the disclosure.7U.S. Securities and Exchange Commission. Investment Adviser Codes of Ethics
Service Providers and Joint Marketing Partners
Your firm can share your data with the custodians, clearinghouses, IT vendors, and compliance software providers that run its back office — without giving you an opt-out — if two conditions are met. You must have received the initial privacy notice, and the firm must have a contract with the provider that restricts use of your information to the specific services the provider was hired to perform.8eCFR. 16 CFR 313.13 – Exception to Opt Out Requirements for Service Providers and Joint Marketing The same rule covers joint marketing arrangements with other financial institutions.
Under 2024 amendments to Regulation S-P, firms must now perform ongoing due diligence and monitoring of these providers rather than treating the initial contract as the end of the matter. Larger institutions had to comply by December 3, 2025, and smaller entities must comply by June 3, 2026.9FINRA. SEC Regulation S-P Compliance Date Approaching for Some Entities
Subpoenas, Court Orders, and Regulators
Your advisor must turn over your information in response to a valid subpoena, court order, or request from the SEC or FINRA. There is no discretion, and refusing a properly issued demand would expose the firm to sanctions. The confidentiality rules protect you from voluntary or careless disclosure; they do not override a court order.
Suspicious Activity Reports
Broker-dealers must file Suspicious Activity Reports under the Bank Secrecy Act when they detect transactions that may involve money laundering, terrorist financing, or other financial crimes.10FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting Registered investment advisers are not yet subject to this requirement. FinCEN finalized a rule extending anti-money laundering and SAR-filing obligations to investment advisers, but postponed the effective date to January 1, 2028.11Financial Crimes Enforcement Network. FinCEN Issues Final Rule to Postpone Effective Date of Investment Adviser Rule to 2028 Until then, advisers may file voluntarily. When any SAR is filed, the advisor is prohibited from telling you about it; tipping off a customer is itself a federal offense.
Firm Sales and Advisor Departures
When an advisory firm is sold or a representative retires, your account data typically transfers to the successor. The departing firm must inform you in writing about the transition, and you retain the right to move your account elsewhere rather than follow the new representative.12FINRA. FINRA Provides Guidance on Succession Planning
Why Your Conversations Aren’t Legally Privileged
This is the gap that catches most clients off guard. There is no financial-advisor privilege in federal court. Discovery rules limit access to “nonprivileged matter,” and the recognized privileges — attorney-client, doctor-patient, spousal — do not extend to financial advisors.13Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
In a lawsuit, divorce, or government investigation, the opposing party can subpoena your advisor and compel testimony about your finances, your investment strategy, and the substance of your conversations. Your advisor cannot refuse by claiming confidentiality. If you need to discuss something truly sensitive, have the conversation with your attorney first; your lawyer can then relay what is necessary to the advisor under the shield of attorney-client privilege.
Special Rules When the Client Is a Senior
Concerns about financial exploitation of older adults produced two rules that carve out a distinct exception to the ordinary confidentiality framework.
Under FINRA Rule 2165, when a brokerage firm reasonably believes financial exploitation of a “specified adult” — someone age 65 or older, or age 18 or older with a mental or physical impairment — has occurred or been attempted, the firm can place a temporary hold on disbursements or transactions. The initial hold runs up to 15 business days, extendable by another 10 business days after internal review, and by a further 30 business days if the matter has been reported to a state regulator or court, for a possible total of 55 business days.14FINRA. Frequently Asked Questions Regarding FINRA Rules Relating to Financial Exploitation of Senior Investors
The Senior Safe Act gives financial professionals and their firms immunity from lawsuits when they report suspected exploitation of a senior to a government agency, provided the disclosure is made in good faith and with reasonable care. To qualify, the individual making the report must have completed training on identifying and reporting financial exploitation of seniors before the disclosure, and the firm must keep records of who completed it.15Office of the Law Revision Counsel. 12 USC 3423 – Immunity From Suit for Disclosure of Financial Exploitation of Senior Citizens
If Your Information Is Breached
The 2024 amendments to Regulation S-P added a mandatory incident response and customer notification framework for SEC-regulated firms. Firms must maintain a written incident response program to detect, contain, and recover from unauthorized access to customer information.16U.S. Securities and Exchange Commission. SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information
If your sensitive information was, or is reasonably likely to have been, accessed without authorization, the firm must notify you as soon as practicable and no later than 30 days after becoming aware of the breach. The only exception is a written determination by the U.S. Attorney General that notification would pose a substantial risk to national security or public safety, which can delay notice in increments of up to 30 days.17Federal Register. Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information A narrow additional exception applies if the firm’s investigation concludes the compromised data is not reasonably likely to cause substantial harm.
What to Do if Confidentiality Is Violated
Start with the firm. Contact the branch manager or compliance department in writing, describe the breach, and ask for a written response. That paper trail matters if you escalate later, and many firms treat internal complaints seriously because unresolved ones attract regulator attention.
If the response is inadequate, file a complaint with the SEC, which handles tips about investment advisers and can impose fines and suspensions,18U.S. Securities and Exchange Commission. Submit a Tip or Complaint or with FINRA, whose Complaint Program investigates brokerage misconduct and can impose fines, suspensions, disgorgement, or permanent bars from the securities industry. If you are unsure which regulator has jurisdiction, FINRA will evaluate your complaint and forward it if it falls outside FINRA’s authority.19FINRA. File a Complaint
For monetary disputes with a brokerage firm, FINRA arbitration is often the required forum: many brokerage account agreements include mandatory arbitration clauses. Court is a separate option for damages caused by a breach, with possible claims including breach of fiduciary duty, negligence, or invasion of privacy. A securities attorney can tell you which claims are available on your facts and whether arbitration is required under your account agreement.