Financial advisor confidentiality is governed mainly by SEC Regulation S-P, which requires registered investment advisers, broker-dealers, and investment companies to safeguard your nonpublic personal information and limit when they can share it. The duty is real, and violations can bring fines, suspensions, or a permanent industry bar. It is not absolute, though. Court subpoenas, regulatory demands, service-provider arrangements, and suspicious-activity rules all carve into it, and — unlike your conversations with a lawyer — nothing you tell your advisor is protected by a legal privilege.
What Information Is Actually Protected
Federal law protects your “nonpublic personal information,” a term the Gramm-Leach-Bliley Act defines to cover three buckets: information you give the firm, information the firm generates by serving you, and information the firm otherwise obtains about you.1Legal Information Institute. 15 USC 6809(4)(A) – Definition of Nonpublic Personal Information
In practice that means your Social Security number, income, account balances, asset and debt statements, investment holdings, credit card numbers, and anything pulled from your credit report. Even a customer list compiled using nonpublic data is protected, regardless of whether the individual names on it happen to be public.1Legal Information Institute. 15 USC 6809(4)(A) – Definition of Nonpublic Personal Information The only real carve-out is information that is genuinely publicly available.
The Rules That Create the Duty
Regulation S-P, adopted by the SEC in 2000 under the Gramm-Leach-Bliley Act, requires covered firms to adopt written administrative, technical, and physical safeguards for your records and to dispose of data securely when it is no longer needed.2U.S. Securities and Exchange Commission. Regulation S-P The SEC overhauled the rule in May 2024, adding written incident response programs, a 30-day customer breach notification, and ongoing due diligence over third-party service providers.3U.S. Securities and Exchange Commission. SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information Larger firms had to comply by December 3, 2025; smaller firms have until June 3, 2026.4FINRA. SEC Regulation S-P Compliance Date Approaching for Some Entities
FINRA enforces its own customer information protection standards for brokerage firms.5FINRA. Customer Information Protection And if your advisor is a Certified Financial Planner, the CFP Board layers on a separate ethical duty: CFP professionals may not disclose nonpublic personal information about any prospective, current, or former client, with only narrow exceptions.6CFP Board. Client Confidentiality and Privacy
Every covered firm has to send you a privacy notice at the start of the relationship explaining what it collects, how it uses that information, which categories of nonaffiliated third parties may receive it, and how you can opt out of some of those disclosures.7eCFR. 17 CFR 248.10 – Limits on Disclosure of Nonpublic Personal Information to Nonaffiliated Third Parties Read it. It is the single best document for understanding how your firm actually handles your data.
When Your Advisor Can Share Your Information
Confidentiality has several recognized exceptions. Some let the firm share without asking; others require it to.
When You Consent
The most common exception is your own authorization. Ask your advisor to coordinate with your attorney, accountant, or estate planner, and the advisor can share what is needed for that coordination. The SEC has said explicitly that safeguarding sensitive information does not stop an advisor from providing necessary details to other professionals servicing your account when you consent.8U.S. Securities and Exchange Commission. Investment Adviser Codes of Ethics
Service Providers and Joint Marketing
The firm can share your data with companies performing business functions on its behalf, such as custodians, clearinghouses, IT vendors, and compliance software providers, without giving you an opt-out. Two conditions apply: you must have received the initial privacy notice, and the firm must have a contract restricting the provider to using your information only for the services it was hired to perform.9eCFR. 16 CFR 313.13 – Exception to Opt Out Requirements for Service Providers and Joint Marketing The same structure covers joint marketing arrangements with other financial institutions. Under the 2024 amendments, firms must also actively monitor these providers rather than sign a contract and move on.3U.S. Securities and Exchange Commission. SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information
Subpoenas, Court Orders, and Regulators
Your advisor has to hand over your information in response to a valid subpoena, court order, or request from a regulator like the SEC or FINRA. There is no discretion. The firm has no legal basis to refuse a properly issued demand, and refusing would expose it to sanctions.
Suspicious Activity Reports
Broker-dealers are required under the Bank Secrecy Act to file Suspicious Activity Reports when they detect transactions that may involve money laundering, terrorist financing, or other financial crimes.10FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting Registered investment advisers are not yet subject to this requirement; FinCEN extended the effective date of the investment-adviser rule to January 1, 2028, and until then advisers may file voluntarily.11Financial Crimes Enforcement Network. FinCEN Issues Final Rule to Postpone Effective Date of Investment Adviser Rule to 2028 Either way, once a SAR is filed the firm is prohibited from telling you about it. Tipping off a customer about a SAR is itself a federal offense.
Firm Sales and Advisor Departures
When an advisory firm is sold or a representative retires, your account data typically transfers to the successor. Regulation S-P generally requires notice and an opt-out before nonpublic information moves to a nonaffiliated third party, and you always have the right to move your account somewhere else instead of following the new representative.12FINRA. FINRA Provides Guidance on Succession Planning
Your Conversations Are Not Legally Privileged
This is the gap that surprises most clients. There is no recognized legal privilege for communications between you and your financial advisor. Federal courts limit discovery to nonprivileged matter, and the list of recognized privileges — attorney-client, doctor-patient, spousal — does not include financial advisors.13Legal Information Institute. Federal Rules of Civil Procedure Rule 26 – Duty to Disclose; General Provisions Governing Discovery
If you are in a lawsuit, a divorce, or a government investigation, the opposing side can subpoena your advisor and compel testimony about your finances, your strategy, and the substance of your conversations. Your advisor cannot refuse by claiming privilege. Regulation S-P and FINRA’s rules protect you against voluntary or careless disclosure; they do not override a court order. If you need to discuss something genuinely sensitive, have that conversation with your attorney, who can then relay what is necessary to your advisor under attorney-client privilege.
If Your Data Is Breached
Under the 2024 amendments, if your advisor’s firm discovers that your sensitive information was, or is reasonably likely to have been, accessed without authorization, the firm must notify you as soon as practicable and no later than 30 days after becoming aware of the incident.3U.S. Securities and Exchange Commission. SEC Adopts Rule Amendments to Regulation S-P to Enhance Protection of Customer Information The firm must also maintain a written incident response program to detect, contain, and recover from unauthorized access.14Federal Register. Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information
Two narrow exceptions can delay notice: a written determination by the U.S. Attorney General that notification would pose a substantial risk to national security or public safety, which can push the notice back in increments of up to 30 days, and an internal determination that the compromised data is not reasonably likely to cause you substantial harm.14Federal Register. Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information
Extra Protections if You’re a Senior
Older clients get a targeted set of rules that actually cut the other way. Under FINRA Rule 2165, when a brokerage firm reasonably believes financial exploitation of a “specified adult” — someone 65 or older, or 18 or older with a mental or physical impairment — has occurred or been attempted, the firm can place a temporary hold on disbursements or transactions. The initial hold runs up to 15 business days, extendable by 10 more business days if the firm’s review supports the concern, and by a further 30 business days if the firm has also reported the matter to a state regulator or court, for up to 55 business days total.15FINRA. Frequently Asked Questions Regarding FINRA Rules Relating to Financial Exploitation of Senior Investors
The federal Senior Safe Act gives advisors and their firms immunity from lawsuits when they report suspected exploitation of a senior citizen to a government agency in good faith and with reasonable care. To qualify, the person making the report must have completed training on identifying and reporting exploitation before the disclosure, and the firm has to keep records of who has completed it.16Office of the Law Revision Counsel. 12 USC 3423 – Immunity From Suit for Disclosure of Financial Exploitation of Senior Citizens
What to Do if Your Confidentiality Is Violated
Start with the firm. Write to the branch manager or compliance department, describe what happened, and ask for a written response. That creates a record and gives the firm a chance to investigate before you escalate. Unresolved complaints tend to attract regulatory attention, so many firms take internal complaints seriously.
If the response is inadequate, file a complaint with the regulator. The SEC accepts tips and complaints about investment advisors and can impose discipline including fines and suspensions.17U.S. Securities and Exchange Commission. Submit a Tip or Complaint FINRA’s Complaint Program investigates misconduct by brokerage firms and their employees, and can impose fines, suspensions, disgorgement, or permanent bars from the securities industry. If you aren’t sure which regulator has jurisdiction, FINRA will evaluate the complaint and forward it if it belongs somewhere else.18FINRA. File a Complaint
You may also have a claim for damages. Depending on the facts, that can include breach of fiduciary duty, negligence, or invasion of privacy, with recovery for direct financial losses, credit monitoring and identity restoration costs, and in some cases emotional distress. Many brokerage account agreements contain mandatory arbitration clauses, which route customer disputes to FINRA arbitration rather than court. A securities attorney can tell you which claims are available and whether arbitration is required under your account agreement.