The Outlier Lab

Trusted Contact and Senior Investor Holds

Trusted contacts plus temporary holds on disbursements and transactions when exploitation or fraud is suspected: FINRA Rules 4512 and 2165, proposed Rule 2166, and analogous practices elsewhere.

What it is

When a customer is being deceived or exploited, every authentication control passes, because the real customer is the one acting. What helps is time and a second human perspective, and this control provides both:

  1. Trusted contact: a person the customer designates in advance whom the firm may contact about possible exploitation, to confirm contact information or health status, or to identify a legal guardian, executor, trustee or power of attorney. A trusted contact has no authority over the account: they can't see balances, trade or act for the customer.
  2. Temporary hold: a time-limited pause on a disbursement or transaction while the firm investigates, contacts the trusted contact and, where appropriate, reports to authorities.

The rules are most developed in US broker-dealer regulation (FINRA) (Brokerage and Investing), but the design generalizes to banks, fintechs and payment apps, many of which run voluntary versions.

Losses explain the urgency. The FBI's IC3 reported $7.7 billion in losses from people over 60 in 2025, up 59% from 2024. Investment fraud was the largest category for that group.

The FINRA framework

Rule 4512 (trusted contact person)

  • For each non-institutional account, firms must make reasonable efforts to obtain the name and contact information of a trusted contact person age 18 or older.
  • A missing trusted contact does not prevent opening or maintaining the account.
  • Firms must disclose in writing at account opening (electronic is fine) that they may contact the trusted contact to address possible exploitation, confirm contact information or health status, or confirm the identity of a guardian, executor, trustee or POA holder.
  • For accounts subject to periodic customer-record updates under SEA Rule 17a-3, firms must make reasonable efforts to obtain or update the information.
  • Trusted contact provisions took effect February 5, 2018 (SR-FINRA-2016-039).

Rule 2165 (temporary holds for Specified Adults)

  • Specified Adult: age 65 or older, or age 18 or older whom the firm reasonably believes has a mental or physical impairment that renders them unable to protect their own interests.
  • Scope: holds on disbursements of funds or securities and, since the March 17, 2022 amendments (SR-FINRA-2021-016), on securities transactions, when the firm reasonably believes financial exploitation has occurred, is occurring, has been attempted or will be attempted.
  • Permissive safe harbor: the rule permits holds; it doesn't require them.
  • Duration (current rule): initial hold up to 15 business days. It can be extended by 10 business days if the internal review supports the belief, and by a further 30 business days if the firm has also reported to a state regulator, agency or court. That's a 55 business day maximum unless a regulator or court extends or ends it.
  • Notification: within two business days, notify all parties authorized to transact on the account and the trusted contact(s), unless the person is unavailable or reasonably believed to be involved in the exploitation.
  • Internal review: must begin immediately.
  • Procedures and people: written supervisory procedures covering identification, escalation and reporting. Persons authorized to place, end or extend holds must be identified by title and serve in a supervisory, compliance or legal capacity.
  • Training and records: documented training, plus records of the request, the basis for belief, the authorizing person, notifications, the internal review and any extension rationale.

Proposed changes pending at the SEC (SR-FINRA-2026-018)

  • New Rule 2166, Temporary Delays for Suspected Fraud: an optional safe harbor letting firms delay a transaction or disbursement for up to 10 business days for customers of any age 18 or older, when the firm reasonably believes fraud (including ATO and identity theft) has occurred, is occurring, has been attempted or will be attempted. Regulatory Notice 26-02 (January 2026) had proposed 5 business days. FINRA raised it to 10 after comments. The firm must notify the customer within two business days. Notifying the trusted contact is optional. Only a regulator, agency or court can extend.
  • Rule 2165 amendments: the maximum hold would rise from 55 to 145 business days through three additional 30-business-day extensions. Each requires reasonable follow-up with the relevant authority, no substantive response, and a continuing reasonable belief. Federal agencies would be added alongside state agencies, and specialized senior-investor or fraud-prevention staff could place or lift holds. "Funds or securities" would broaden to "funds, securities, or other assets."
  • Rule 4512 amendments: firms could use the term "emergency contact" as an alternative to "trusted contact person." Customers could designate one contact across all current and future accounts (with an account-by-account option still offered), and the amendments clarify that more than one trusted contact is allowed.

Commenters include SIFMA (supportive) and NASAA. NASAA's letter asked for supervisory concurrence on Rule 2166 delays, customer notice at every extension, and periodic reconfirmation of cross-account designations.

Registered persons generally must decline being named a customer's beneficiary or holding a position of trust (executor, trustee, POA), unless the customer is immediate family or the firm approves in writing. This is a guardrail against insider exploitation (Insider Fraud).

What it stops (and what it doesn't)

Stops well:

  • In-flight scams: a hold plus a conversation with the customer and trusted contact often breaks the scammer's hold on the victim, especially with impersonation and investment scams.
  • Exploitation by caregivers or family where the trusted contact is someone else.
  • ATO-driven withdrawals, once Rule 2166 is adopted, since it applies when the firm suspects fraud at any age.

Doesn't stop:

  • What the firm never notices. Holds depend on detection (Scam Victim Indicators, Transaction Pattern Anomalies).
  • Determined customers after hold expiry. Holds buy time; they don't override the customer's ultimate authority.
  • Exploitation by the trusted contact. The rule lets firms skip notifying anyone they reasonably believe is involved.
  • Low collection rates. FINRA cites its Foundation's research: about 42% of investors have named a trusted contact. Of those who haven't, many don't recall being asked.

Design considerations

Collection. Collect trusted contacts actively. FINRA's oversight reports list effective practices: require a yes or no answer at account opening, ask "Who is your trusted contact?" rather than offering the option, prompt representatives when an account lacks a contact, include the request in periodic account updates, and set collection goals. Exam findings show firms asking only older customers, or leaving the request out of the 36-month update letter.

Detection. Holds depend on detection. Signals that should route to a senior or vulnerable-customer queue include sudden large disbursements, new payees or destinations, crypto-related transfers, early liquidation of long-held positions, contact changes, third-party presence on calls, and confusion or urgency in conversations. FinCEN's elder exploitation advisory and pig butchering alert list red flags (Scam Victim Indicators).

Specialized team. Effective firms designate senior-investor specialists to handle cases, contact trusted contacts, and escalate to Adult Protective Services, regulators or law enforcement (Playbook - Elder Exploitation Response Members).

Conversation design. Trained staff use open questions, avoid confrontation, name the scam pattern, and give the customer an off-ramp that saves face. The hold creates the space for this conversation (Support Team Fraud Training).

Case tracking. Every hold needs a case in the Case Management Systems with day counters, notification deadlines, extension decisions and authorizing person. FINRA has found firms that couldn't show the internal review behind holds.

Beyond broker-dealers. Banks and fintechs aren't subject to FINRA rules, but similar mechanics apply. Collect an emergency or trusted contact. Use payment holds within your terms and funds-availability rules. Report suspected elder exploitation per state law and SAR rules. On December 4, 2024, the Federal Reserve, CFPB, FDIC, NCUA, OCC, FinCEN and state financial regulators issued an interagency statement on elder financial exploitation. It lists example practices: risk-based policies and monitoring, staff training, transaction holds and disbursement delays where lawful, trusted contact designations, timely SAR filing (including voluntary SARs below mandatory thresholds), reporting to APS and law enforcement, faster responses to records requests, and joining elder fraud networks. It explicitly creates no new supervisory expectations or regulatory requirements, but examiners will read your program against it.

Diagram: Disbursement or transaction request, Exploitation or fraud indicators?, Process, Place hold, open case, Notify within two business days: authorized parties, trusted contact unless involved, Immediate internal review, Belief still supported?, Lift hold, process, Extend per rule; report to APS, regulator or court, Resolved or max period reached?, Release or court or agency action

Implementation path

StageWhat it looks likePrerequisites
CrawlTrusted contact collection with written disclosure at opening; written procedures naming authorized hold approvers; manual escalation by representatives; hold case trackingCompliance owner; account-opening form changes; training
WalkSystem prompts for missing trusted contacts; senior-investor specialist team; detection rules routing to a specialized queue; hold deadline automation; documented training; APS and regulator reporting workflowManual Review Queues; Case Management Systems; Rules Engine
RunScam and exploitation models; dashboards of trusted contact and POA data; integration with payout and ACATS controls; readiness for Rule 2166 fraud delays at any age; outcomes measured (losses averted, customer retention)Machine Learning Models; Withdrawal and Payout Controls; mature intervention program

Customer friction and trade-offs

A hold delays a customer's own money, sometimes for weeks. That's justified when exploitation is real. When it isn't, it's paternalistic and can harm the customer (missed obligations, lost opportunities) and the relationship. Industry commenters have warned against months-long freezes for customers who've done nothing wrong. Mitigations:

  • Use the shortest hold that allows an adequate review.
  • Allow legitimate transactions to continue during a hold where possible. The proposed amendments codify that firms may restrict an account while permitting legitimate activity.
  • Communicate clearly and empathetically.
  • Document the basis carefully. Over-holding invites complaints, and under-holding invites losses.
  • Respect autonomy. Diminished capacity isn't presumed from age.

Measuring effectiveness

  • Trusted contact coverage among non-institutional accounts, by segment and channel.
  • Holds placed, with outcome distribution (exploitation confirmed, scam averted, released with no finding).
  • Dollars protected by holds, measured as averted disbursements confirmed as exploitation or scam.
  • Time to first contact with the customer and trusted contact after a hold.
  • Deadline adherence for notifications and extensions.
  • Customer outcomes: complaints, retention, repeat victimization.

Common failure modes

  • Trusted contacts requested only from older customers, or not at periodic updates.
  • No written disclosure of when the trusted contact may be called.
  • Representatives unsure who can place a hold, so escalation stalls.
  • No documented internal review or training (common exam findings).
  • Hold expiry dates missed, or holds lifted without a recorded decision.
  • Notifying a trusted contact who is the suspected exploiter.
  • Treating holds as a compliance formality rather than a window for intervention.

Regulatory and policy notes

  • FINRA Rules 4512 and 2165 as above. SR-FINRA-2026-018 (Rule 2166; 2165 and 4512 amendments) is pending SEC approval. See Broker-Dealer Obligations (FINRA and SEC).

  • Senior Safe Act (2018; 12 U.S.C. 3423) grants immunity for good-faith, reasonable-care reports of suspected exploitation of people 65 and older to covered agencies, including regulators, FINRA, law enforcement and APS. Covered institutions include banks, credit unions, broker-dealers, investment advisers, insurers and transfer agents. Covered employees include supervisors, compliance and legal staff, and registered representatives. The institution is immune only if every employee who needed training had it before the report. Training is due within one year of starting for hires after May 24, 2018, and records of who completed it must be kept for examiners. The Act grants immunity but creates no duty to report.

  • State laws: many states have their own hold and reporting statutes for financial institutions and broker-dealers. FINRA's 2020 notice cited 16 states permitting holds on both disbursements and transactions at that time.

  • SARs: FinCEN's 2022 advisory asks institutions to reference "EFE FIN-2022-A002" in SAR field 2 and the narrative, and to check the elder financial exploitation box, field 38(d) (BSA-AML and SAR Filing).

  • Reporting channels: Adult Protective Services, state securities regulators, law enforcement, and the DOJ National Elder Fraud Hotline for victims.

Mechanisms addressed

Elder Financial Exploitation · Investment Scams (Pig Butchering) · Impersonation Scams · Authorized Push Payment (APP) Scams · Account Takeover (ATO) (under proposed Rule 2166) · ACATS Transfer Fraud · Generative AI and Deepfake Fraud (voice-clone family impersonation) · Insider Fraud (Rule 3241)

Customer Education and Scam Warnings · Withdrawal and Payout Controls · Payee Confirmation and Payment Friction · Funds Availability Holds · Manual Review Queues · Case Management Systems · Insider Access Controls · Controls Index

Sources and further reading