Board of Governors of the Federal Reserve System

Commodity Futures Trading Commission

Consumer Financial Protection Bureau

Federal Deposit Insurance Corporation

Federal Trade Commission

National Credit Union Administration

Office of the Comptroller of the Currency

Securities and Exchange Commission

Interagency Guidance on Privacy Laws and 

Reporting Financial Abuse of Older Adults

PURPOSE

The Board of Governors of the Federal Reserve System (Federal Reserve), Commodity Futures 

Trading Commission (CFTC),

1 Consumer Financial Protection Bureau (CFPB), Federal Deposit 

Insurance Corporation (FDIC), Federal Trade Commission (FTC), National Credit Union 

Administration (NCUA), Office of the Comptroller of the Currency (OCC), and Securities and 

Exchange Commission (SEC) are issuing this guidance to financial institutions to clarify the 

applicability of privacy provisions of the Gramm-Leach-Bliley Act (GLBA) to reporting 

suspected financial exploitation of older adults. 

Employees of depository institutions and other financial service providers that constitute 

“financial institutions” for purposes of the GLBA may observe signs of possible financial 

exploitation of an older adult. Various federal and state authorities either require or encourage 

reporting of this type of information to the appropriate agency. This guidance clarifies that 

reporting suspected financial abuse of older adults to appropriate local, state, or federal agencies 

does not, in general, violate the privacy provisions of the GLBA or its implementing 

regulations.

2

 In fact, specific privacy provisions of the GLBA and its implementing regulations

permit the sharing of this type of information under appropriate circumstances without 

complying with notice and opt-out requirements.

3

 1 The CFTC is issuing this document as staff guidance.

2 While this guidance discusses when reporting is allowed under the GLBA, it does not address any other federal or 

state laws that may regulate such reporting. Also, the guidance does not specifically address risk management 

expectations for financial institutions related to the reporting of elder abuse. 3 This guidance’s analysis of the GLBA’s privacy provisions builds on joint guidance issued by several federal 

agencies in 2002 that specifically addressed disclosures to the Michigan Family Independence Agency. See Letter 

to Hon. Debbie Stabenow, July 3, 2002, available at

http://www.americanbar.org/content/dam/aba/administrative/law_aging/2011/2011_aging_ea_bank_rptg_op_ltr.auth

checkdam.pdf.
2

BACKGROUND

Elder abuse includes the illegal or improper use of an older adult’s funds, property, or assets.4

Recent studies suggest that financial exploitation is the most common form of elder abuse and 

that only a small fraction of incidents are reported.5 Older adults can become targets of financial 

exploitation by family members, caregivers, scam artists, financial advisers, home repair 

contractors, fiduciaries (such as agents under power of attorney and guardians), and others.

Older adults are attractive targets because they may have significant assets or equity in their 

homes. They may be especially vulnerable due to isolation, cognitive decline, physical 

disability, health problems, and/or the recent loss of a partner, family member, or friend. 

Financial institutions can play a key role in preventing and detecting elder financial exploitation. 

A financial institution’s familiarity with older adults it encounters may enable it to spot irregular 

transactions, account activity, or behavior.6

 Prompt reporting of suspected financial exploitation

to adult protective services, law enforcement,7 and/or long-term care ombudsmen8 can trigger 

appropriate intervention, prevention of financial losses, and other remedies. 

 4 See the National Center on Elder Abuse definitions available at

http://www.ncea.aoa.gov/FAQ/Type_Abuse/index.aspx. The Older Americans Act, as amended by the Elder Justice 

Act of 2009, defines exploitation as “the fraudulent or otherwise illegal, unauthorized, or improper act or process of 

an individual, including a caregiver or fiduciary, that uses the resources of an elder for monetary or personal benefit, 

profit, or gain, or that results in depriving an elder of rightful access to, or use of, benefits, resources, belongings, or 

assets.” 42 U.S.C. 1397j(8). 5 Acierno, R., M. A. Hernandez, A. B. Amstadter, H. S. Resnick, K. Steve, W. Muzzy, and D. G. Kilpatrick, 

“Prevalence and Correlates of Emotional, Physical, Sexual and Financial Abuse and Potential Neglect in the United 

States: The National Elder Mistreatment Study,” American Journal of Public Health 100(2): 292–97; Lifespan of 

Greater Rochester, Inc., et al., Under the Radar: New York State Elder Abuse Prevention Study, (Rochester, NY: 

Lifespan of Greater Rochester, Inc., May 2011).

6 Treasury Department rules require recipients of federal nontax payments to receive payment by electronic funds 

transfer, with an allowance for certain waivers from the requirement. The rule applies to recipients of Social 

Security, Veterans Affairs, Supplemental Security Income, Railroad Retirement Board, Department of Labor, and 

Office of Personnel Management benefit payments. Benefit recipients may have payments directly deposited to an 

account at a financial institution or to a Direct Express debit card account. See 75 Fed. Reg. 80315 (Dec. 22, 2010). 

Financial institutions should be mindful that this change may result in additional electronic funds transfer activity 

involving the accounts of older adults. 

7 Financial institutions file “Suspicious Activity Reports” with the Financial Crimes Enforcement Network 

(FinCEN), a Bureau of the U.S. Department of the Treasury, involving money laundering and terrorist financing as 

well as activities related to elder abuse and other consumer fraud. The reports assist law enforcement in identifying 

individuals and organizations involved in financial crime. See FinCEN, Advisory to Financial Institutions on Filing 

Suspicious Activity Reports Regarding Elder Financial Exploitation, FIN-2011-A003 (Feb. 22, 2011), available at

http://www.fincen.gov/statutes_regs/guidance/pdf/fin-2011-a003.pdf. 8 Long-Term Care Ombudsmen are advocates for residents of nursing homes, board and care homes, assisted living 

facilities and similar adult care facilities. Under the federal Older Americans Act, each state has an Office of the 

State Long-Term Care Ombudsman that addresses complaints and advocates for improvements in the long-term care 

system. Local ombudsman staff and volunteers work to resolve problems of individual residents. For more 

information, see http://www.aoa.gov/AoARoot/AoA_Programs/Elder_Rights/Ombudsman/index.aspx. To find your 

local ombudsman program, search by location at www.eldercare.gov.
3

DISCUSSION OF PRIVACY PROTECTIONS

The GLBA establishes a general rule that a financial institution may not disclose any nonpublic 

personal information about a consumer to any nonaffiliated third party unless the financial

institution first provides the consumer with a notice that describes the disclosure (as well as other 

aspects of its privacy policies and practices) and a reasonable opportunity to opt out of the 

disclosure, and the consumer does not opt out. However, section 502(e) of the GLBA provides a 

variety of exceptions to this general rule that permit a financial institution to disclose information 

to nonaffiliated third parties without first complying with notice and opt-out requirements. 

Generally, disclosure of nonpublic personal information about consumers to local, state, or 

federal agencies for the purpose of reporting suspected financial abuse of older adults will fall 

within one or more of the exceptions.9 These disclosures of information may be made either at 

the agency’s request or on the financial institution’s initiative. 

The following are specific exceptions to the GLBA’s notice and opt-out requirement that, to the 

extent applicable, would permit sharing of nonpublic personal information about consumers with

local, state, or federal agencies for the purpose of reporting suspected financial abuse of older 

adults without the consumer’s authorization and without violating the GLBA: 

• A financial institution may disclose nonpublic personal information to comply with 

federal, state, or local laws, rules and other applicable legal requirements, such as state 

laws that require reporting by financial institutions of suspected abuse. (15 U.S.C. 

6802(e)(8) and implementing regulations at ___.15(a)(7)(i)).10

• A financial institution may disclose nonpublic personal information to respond to a 

properly authorized civil, criminal, or regulatory investigation, or subpoena or summons 

by federal, state, or local authorities or to respond to judicial process or government 

regulatory authorities having jurisdiction for examination, compliance, or other purposes 

as authorized by law. (15 U.S.C. 6802(e)(8) and implementing regulations at 

___.15(a)(7)(ii)-(iii)).

• A financial institution may disclose nonpublic personal information to protect against or 

prevent actual or potential fraud, unauthorized transactions, claims, or other liability. (15 

U.S.C. 6802(e)(3)(B) and implementing regulations at ___.15(a)(2)(ii)). For example, 

this exception generally would allow a financial institution to disclose to appropriate 

authorities nonpublic personal information in order to:

o report incidents that result in taking an older adult’s funds without actual consent,

or

o report incidents of obtaining an older adult’s consent to sign over assets through 

misrepresentation of the intent of the transaction.

 9 See Section 502(e) of the GLBA (15 U.S.C. 6802(e)). 10 The CFPB’s, FTC’s, CFTC’s, and SEC’s implementing regulations are contained in 12 CFR part 1016, 16 CFR 

part 313, 17 CFR part 160, and 17 CFR part 248, respectively. For ease of reference, this discussion uses the shared 

numerical suffix of each of these agencies’ regulations. 
4

• To the extent specifically permitted or required under other provisions of law and in 

accordance with the Right to Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.), a 

financial institution may disclose nonpublic personal information to law enforcement 

agencies (including the CFPB, the federal functional regulators, and the FTC), selfregulatory organizations, or for an investigation on a matter related to public safety. (15 

U.S.C. 6802(e)(5) and implementing regulations at ___.15(a)(4)).

In addition, a financial institution may disclose nonpublic personal information with the 

consumer’s consent or consent of the consumer’s legal representative. (15 U.S.C. 6802(e)(2)

and implementing regulations at ___.15(a)(1)). 

POSSIBLE SIGNS OF FINANCIAL ABUSE OF OLDER ADULTS

The Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published 

an advisory in February 2011 that describes potential signs of elder financial exploitation that 

might trigger the filing of a Suspicious Activity Report (SAR).

11 As described in the advisory, 

among the possible signs of abuse are:

• Erratic or unusual banking transactions, or changes in banking patterns: 

o Frequent large withdrawals, including daily maximum currency withdrawals from 

an ATM; 

o Sudden non-sufficient fund activity; 

o Uncharacteristic nonpayment for services, which may indicate a loss of funds or 

access to funds; 

o Debit transactions that are inconsistent for the older adult; 

o Uncharacteristic attempts to wire large sums of money; or

o Closing of CDs or accounts without regard to penalties. 

• Interactions with older adults or caregivers:

12

o A caregiver or other individual shows excessive interest in the older adult's 

finances or assets, does not allow the older adult to speak for himself, or is 

reluctant to leave the older adult's side during conversations; 

o The older adult shows an unusual degree of fear or submissiveness toward a 

caregiver, or expresses a fear of eviction or nursing home placement if money is 

not given to a caretaker; 

o The financial institution is unable to speak directly with the older adult, despite 

repeated attempts to contact him or her; 

o A new caretaker, relative, or friend suddenly begins conducting financial 

transactions on behalf of the older adult without proper documentation; 

 11 See footnote 6 above. 12 References to “caregiver” or “caretaker” also may apply to other individuals who may be involved in transactions 

of the type described in the FinCEN advisory.
5

o The older adult moves away from existing relationships and toward new 

associations with other “friends” or strangers; 

o The older adult's financial management changes suddenly, such as through a 

change of power of attorney to a different family member or a new individual; or

o The older adult lacks knowledge about his or her financial status, or shows a 

sudden reluctance to discuss financial matters. 

Further information about the use of Suspicious Activity Reports to report suspected elder 

financial exploitation is available in FinCEN’s “The SAR Activity Review” published in May

2013.

13 In addition, if financial institutions or other organizations are interested in raising public 

awareness among older adults and their caregivers about preventing, identifying, and responding 

to elder financial exploitation, Money Smart for Older Adults, a financial resource tool, serves as 

a helpful source of training and information.

14

 13 See “The SAR Activity Review: Trends Tips & Issues,” Issue 23, May 2013, available at

http://www.fincen.gov/news_room/rp/files/sar_tti_23.pdf. 14 Money Smart for Older Adults (June 2013), available at www.fdic.gov or www.consumerfinance.gov.