Elder Financial Exploitation: FINRA Rule 2165 and the Aging Advisor
A guide to implementing FINRA's elder-exploitation toolkit, Rule 2165, trusted contacts, the Senior Safe Act, and what happens when the advisor, not just the client, is the one experiencing cognitive decline. Educational, not legal advice.
Educational guide · Last reviewed August 2, 2026
By Dontay Phillips, Founder & Principal Attorney, ClearScope Counsel
Most elder-exploitation compliance programs are built around one assumption: a competent advisor is watching a client whose judgment may be slipping. That assumption holds most of the time. It fails completely in the scenario firms are least prepared for: an aging advisor, often a sole practitioner in a smaller market, serving an aging book of clients, where neither person's decline is independently observed by anyone.
FINRA's protective architecture (Rule 2165, trusted contacts, the Senior Safe Act) presumes a competent advisor watching a vulnerable client. In a thin market where one advisor holds the relationships, the passwords, and the institutional knowledge, that assumption can fail on both sides at once, and there is no regulatory equivalent of Rule 2165 for the advisor.
The scale of the client-side problem
Elder financial exploitation is widespread and growing. The FBI's Internet Crime Complaint Center has reported billions of dollars in annual losses to victims 60 and older, with the trend moving in one direction over the past several years. FinCEN's review of Bank Secrecy Act filings tied to elder financial exploitation has separately identified tens of billions of dollars in reported suspicious activity, a figure that includes attempted as well as completed transactions. Government studies consistently conclude that reported losses are a fraction of the true number, since shame, cognitive impairment, and a victim's relationship to the perpetrator all suppress reporting.
Two distinct threat patterns require different controls. Stranger-perpetrated scams (romance, tech-support, government-impersonation, investment fraud) dominate the volume of reported complaints. Trusted-person exploitation, by family, caregivers, agents under a power of attorney, or the advisor relationship itself, is harder to detect, more chronic, and often produces the largest loss per victim. A program built only to catch outside scammers will miss the second category entirely.
The FINRA toolkit for client-side exploitation
The regulatory framework here is mature. Four pieces work together.
Rule 2165 — temporary holds
Permits, but does not require, a firm to place a temporary hold on a disbursement or a securities transaction when it reasonably believes financial exploitation of a "Specified Adult" has occurred, is occurring, or will be attempted. A Specified Adult is a natural person 65 or older, or an adult 18 or older the firm reasonably believes has a mental or physical impairment that renders them unable to protect their own interests. The initial hold runs up to 15 business days, extendable by 10 more if an internal review supports the belief, with a further extension available once the matter has been reported to a state regulator, agency, or court. The firm must notify the customer and the trusted contact (unless the trusted contact is the suspected exploiter), conduct an internal review, and keep records of the request, the hold, and the findings.
Rule 4512 — the trusted contact
Requires reasonable efforts to obtain a trusted contact person at account opening. The firm may disclose to that contact to address possible exploitation, confirm contact information or health status, or identify a legal guardian, power-of-attorney holder, or trustee. A trusted contact has no trading or account authority; the account can still be opened or maintained if the firm made reasonable efforts and the client simply declines to name one.
The Senior Safe Act
Gives covered financial institutions and eligible, trained employees immunity from civil and administrative liability for good-faith, reasonable-care reports of suspected exploitation to a covered agency. The immunity is conditioned on documented training; it protects the report, not other conduct, and it does not preempt stricter state duties.
State law and the NASAA Model Act
A large majority of states have adopted some version of NASAA's Model Act to Protect Vulnerable Adults from Financial Exploitation, which layers mandatory reporting to the state securities regulator and Adult Protective Services on top of the FINRA framework. States differ on who counts as a mandated reporter and on mandatory versus permissive reporting, so a firm with clients in more than one state needs a jurisdiction-by-jurisdiction map keyed to client residence, not firm domicile.
| Framework | Trigger | What it does | Reporting |
|---|---|---|---|
| Rule 2165 | Reasonable belief of exploitation of a Specified Adult | Temporary hold on disbursements and securities transactions | Notify customer + trusted contact; internal review |
| Rule 4512 | Account opening (all customers) | Establishes a trusted-contact channel | N/A |
| Senior Safe Act | Good-faith report of suspected exploitation | Federal immunity for the report, if trained | Enables reporting to covered agencies |
| NASAA Model Act | Reasonable belief of exploitation of an eligible adult | Delayed disbursement; permissive third-party notice | Mandatory to state regulator + APS (state-specific) |
What's changing: Regulatory Notice 26-02
On January 8, 2026, FINRA published Regulatory Notice 26-02, requesting comment on amendments to Rules 4512 and 2165 and a new proposed Rule 2166. The comment period closed March 9, 2026. None of this is adopted yet, but the direction is clear enough that firms should start planning around it now rather than waiting for a final rule.
- Rule 4512 amendments. Let firms use "emergency contact" as an alternative label to "trusted contact person," and let a customer designate one trusted contact across all of their accounts at the firm instead of naming one account by account. FINRA's own data is the reason: its 2024 Investor Survey found only 42% of investors have named a trusted contact (up from 38% in 2021), and of the 53% who haven't, about half say they would be willing to if asked.
- Rule 2165 amendments. Extend the maximum hold period from 55 business days to 145 business days, through three additional 30-business-day extensions, each conditioned on the firm following up with the relevant authority and continuing to hold a reasonable belief of exploitation. The proposal also expands hold-extension reporting to expressly include federal authorities, not just state regulators, and broadens who at a firm can place, extend, or terminate a hold beyond supervisory, compliance, or legal titles to include a "specialized senior investor protection or fraud prevention role."
- New proposed Rule 2166 ("Temporary Delays for Suspected Fraud"). A separate, more streamlined safe harbor available for any customer, not just a Specified Adult. It would permit a temporary "speed bump" delay of up to five business days on a transaction or disbursement when the firm reasonably believes fraud is targeting the customer, with notification obligations modeled on Rule 2165 but a shorter, simpler runway.
FINRA's own notice cites the FBI's report of $16.6 billion in total fraud losses across all ages in 2024, a 33% increase over 2023. Rule 2165 only covers Specified Adults; proposed Rule 2166 is FINRA's answer to fraud that doesn't respect an age cutoff.
Confirm the final rule text before revising your written supervisory procedures. If the amendments adopt substantially as proposed, the 145-day hold ceiling and the account-wide trusted contact will be the two changes worth building into training first.
Red flags for advisor training
- Behavioral. Confusion about long-held accounts, repeated questions, missed appointments, or an inability to recall a recent transaction.
- Transactional. A sudden, atypical wire; a new or changed beneficiary; liquidation of long-held or illiquid positions; or an address, email, or phone change followed closely by a disbursement request.
- Relational. A new "friend" or caregiver present on every call, isolation from family, or a third party who answers for the client and won't let them speak alone.
- Digital. Email-domain changes, unusual login patterns, remote-access software on the client's device, or instructions that arrive only by email with no callback possible.
No one red flag proves exploitation. The risk rises sharply when several appear together: a contact-information change, a newly presented power of attorney, liquidation of a long-held position, and a first-time wire to an account tied to the new agent.
When an advisor may be experiencing cognitive decline
Cerulli Associates has reported that roughly a third of financial advisors plan to retire within the next decade, controlling a large share of industry assets, and that a meaningful share of them have no documented succession plan. Average advisor age keeps climbing. None of that is controversial. What gets far less attention is the compliance gap sitting underneath it: there is no Rule 2165 analog for the advisor. FINRA's senior-investor notices, trusted-contact rules, and hold authority all protect the client from a third party or from their own declining judgment. Nothing in that framework is built to catch a declining advisor before a client is harmed by the advice itself.
Named, adjudicated cases where an advisor's own cognitive decline is established as the cause of a specific error are genuinely scarce in the public record, and that scarcity is itself worth noting rather than treated as evidence the problem is rare. Confidential arbitrations, negotiated exits, and Form U5 language that omits medical cause all suppress the record. Firms manage a declining producer through a quiet retirement long before anything reaches a public docket.
Tools firms already have, repurposed
Nothing here requires new rulemaking. FINRA Rule 3110 (supervision), 3120 (supervisory control), and branch inspection requirements can all be tuned to catch a declining producer the same way they catch any other supervisory problem: rising error rates, late responses, missed continuing education, deteriorating documentation, or an unusual spike in exceptions and overrides. Rule 4370 already requires a written business-continuity plan; the question is whether it names a real successor with real access, or sits in a binder no one has opened since it was drafted.
Age-neutral, by legal necessity
The ADEA generally bars mandatory retirement of employees, and the narrow exceptions (bona fide executive, BFOQ) do not fit a rank-and-file registered representative. The ADA constrains medical inquiries of current employees to what is job-related and consistent with business necessity. EEOC v. Sidley Austin LLP, N.D. Illinois No. 05 C 0208 (EEOC v. Sidley Austin), a 2007 settlement in which the law firm paid $27.5 million to 32 partners forced out under a mandatory-retirement policy, is the clearest illustration in the professional-services context: age-based exit policies invite liability even at the partner level. The defensible path is the same one firms already use for other supervisory problems: objective, performance- and compliance-based monitoring, not an age cutoff.
Where the two risks compound
The highest-risk, least-observed scenario is the aging advisor with a book of aging clients in a thin market: a small town or secondary city with a shallow buyer pool, a sole-practitioner or single-OSJ structure, and no local successor. The advisor may be the only person with a complete picture of a declining client's finances, and no one else is positioned to notice either person's decline. It is exactly the situation the client-protection framework assumes cannot happen, because it assumes a competent advisor is doing the watching.
Building a program that protects clients and addresses advisor decline
- Adopt a written vulnerable-adult policy naming who makes the hold decision (a designated Senior Investor Protection Officer or a committee) and the escalation path from frontline observation to internal review to SAR to state reporting.
- Confirm Senior Safe Act training is delivered and documented firm-wide; it is a precondition for the immunity, not a formality.
- Run a trusted-contact collection drive and track coverage as a metric, not a one-time checkbox at onboarding.
- Require a documented succession plan for every producing advisor, not just the firm-level Rule 4370 plan, with a named backup who has real, tested access to systems and client files.
- Build an age-neutral risk score for representatives: complaint trends, trade-correction rates, documentation quality, and out-of-pattern activity, with defined triggers for heightened supervision.
- Put heightened review on senior-suitable products, annuity switching, non-traded REITs, and structured or illiquid products sold to clients 65 and older.
Frequently asked questions
No. It permits a hold when the firm reasonably believes exploitation has occurred, is occurring, or will be attempted. It does not create an obligation to act, but it does create procedural conditions, notice, internal review, and recordkeeping, once a firm chooses to rely on it.
No. A trusted contact has no trading or account authority. The firm may only contact that person to address possible exploitation, confirm information, or identify a legal representative.
Generally no. HIPAA governs covered health-care entities, not broker-dealers, and does not bar a firm from acting on what it observes. Firms may lawfully share concerns with trusted contacts, Adult Protective Services, and law enforcement within the Senior Safe Act and NASAA Model Act frameworks.
Generally no. The ADEA bars mandatory retirement for most employees, and the narrow exceptions rarely fit a registered representative. Firms should build objective, performance-based monitoring instead of an age-based policy.
A succession plan that exists on paper but was never tested: a named successor without real system access, without a relationship to the client base, and without a plan for temporary incapacity rather than only permanent departure.
Primary sources and further reading: FINRA Rule 2165, FINRA Rule 4512, FINRA Regulatory Notice 26-02, and the NASAA Model Act to Protect Vulnerable Adults from Financial Exploitation.
Get your senior-investor and succession program reviewed.
Flat-fee review of your Rule 2165/4512 program, Senior Safe Act training, and advisor succession plans, checked against how they'd actually hold up in an exam.