Financial Exploitation of Specified Adults: FINRA Rule 2165

The last element of Function 3.3 is the protective overlay: FINRA Rule 2165 permits a firm to place a temporary hold on disbursements and transactions when the firm reasonably believes a vulnerable customer is being financially exploited. Rule 2165 pairs with FINRA Rule 4512, which requires the firm to collect a Trusted Contact Person (TCP) at account opening. Both rules are heavily tested on Series 6.

What is the purpose of FINRA Rule 2165?

• FINRA Rule 2165 permits a member firm to place a temporary hold on the disbursement of funds or securities from, or a transaction in securities by, a customer's account when the firm reasonably believes the customer is a victim of financial exploitation
• Rule 2165 provides a safe harbor from otherwise-applicable obligations (such as the duty to honor a disbursement request) when the firm follows the rule's procedures in good faith
• Paired with FINRA Rule 4512, which requires member firms to make reasonable efforts to obtain the name and contact information of a Trusted Contact Person (TCP) at account opening

"Specified Adult" Defined

A specified adult is either:

• A natural person age 65 or older, or
• A natural person age 18 or older who the member reasonably believes has a mental or physical impairment rendering the individual unable to protect his or her own interests

The "impaired adult" prong covers cognitive decline, Alzheimer's, severe physical illness, and similar conditions regardless of age (as long as the individual is 18 or older).

Exam Tip: Gotchas

• A specified adult is either 65+ or 18+ with a mental or physical impairment. The impaired-adult prong is not age-limited. A 35-year-old with advanced dementia or a stroke-induced impairment qualifies as a specified adult. The exam sometimes trips candidates into thinking Rule 2165 is senior-only.

What triggers a temporary hold under Rule 2165?

A firm may place a temporary hold when it reasonably believes financial exploitation has occurred, is occurring, is attempted, or will be attempted.

Financial exploitation includes:

• Wrongful or unauthorized taking, withholding, or use of a specified adult's funds or securities
• Acts by a third party with a power of attorney, guardianship, or similar authority to obtain control through deception, intimidation, or undue influence

Scope of the hold:

• Applies to disbursements (cash withdrawals, check requests, wire transfers)
• Applies to transactions in securities (the 2022 amendment, effective March 17, 2022, added authority to hold the transaction itself, not just the disbursement of proceeds)

Exam Tip: Gotchas

• The 2022 amendments expanded Rule 2165 to cover the transaction in securities, not just the disbursement. Pre-2022 the firm could only hold the proceeds; post-2022 the firm can prevent the underlying liquidation itself.
• "Reasonable belief" is the standard, not certainty. The firm does not need to prove exploitation before placing a hold; it needs a good-faith, reasonable belief that exploitation has occurred, is occurring, or will be attempted.

How long can a Rule 2165 temporary hold last?

The hold schedule is the most-tested number set in Rule 2165. The progression is 15 -> 25 -> 55 business days.

Memory Aid: 15 -> 25 -> 55

Stage	Days Added	Running Total
Initial hold	15	15
Internal extension	+10	25
Regulator-reported extension	+30	55

Exam Tip: Gotchas

• The initial hold is 15 business days, extendable to 25 internally, and to 55 if the firm reports to a state regulator, agency, or court. Memorize the 15 -> 25 -> 55 progression. The 25-business-day total (15 initial + 10 internal extension) is the most-tested number on the first-level exam.
• The 30-day regulator extension requires a formal report. The firm cannot extend to 55 days by internal review alone; there must be a qualifying report to a state regulator, agency, or court of competent jurisdiction.
• Once a regulator or court is involved, the cap is not automatic. Further extensions come from the regulator or court's direction, not from the 2165 timetable itself.

What procedures must a firm follow when placing a Rule 2165 hold?

Within two business days of placing a hold, the firm must notify:

• All parties authorized to transact business on the account (except any party the firm reasonably believes is involved in the exploitation)
• The Trusted Contact Person (unless the firm reasonably believes the TCP is involved in the exploitation)

Additional firm obligations:

• Conduct an internal review of the facts and circumstances giving rise to the belief of financial exploitation
• Establish and maintain written supervisory procedures reasonably designed to achieve compliance, including training of associated persons
• Retain records of the hold, the reasons for the hold, communications with the TCP and account parties, and the internal review

Exam Tip: Gotchas

• The firm must notify the Trusted Contact Person within 2 business days of placing a hold, unless the firm reasonably believes the TCP is involved in the suspected exploitation. The rep choosing the TCP at account opening should ask whether the TCP is a spouse, adult child, attorney, or other party whose relationship to the customer argues for independent oversight.
• Supervisory procedures and training are separate requirements. Having a hold process is not enough; the firm must train the associated persons on when and how to escalate.

What is a Trusted Contact Person under FINRA Rule 4512?

At account opening (and for existing accounts upon update), the firm must make reasonable efforts to obtain:

• Name of a TCP
• Contact information (phone, mail, email) for the TCP

TCP mechanics:

• The customer may decline to provide a TCP; the account may still be opened
• The firm must disclose in writing that it may contact the TCP to:
  • Address possible financial exploitation
  • Confirm the specifics of the customer's current contact information, health status, or the identity of any legal guardian, executor, trustee, or power-of-attorney holder
  • As otherwise permitted under Rule 2165
• TCP is not authorized to direct account activity; the TCP is a resource for the firm, not a de facto account representative

Think of it this way: A TCP is an emergency contact for the account, not a co-signer. The firm may reach out to the TCP to verify the customer's condition or investigate a suspected scam, but the TCP cannot place a trade, authorize a withdrawal, or override the customer's decisions.

Exam Tip: Gotchas

• A Trusted Contact Person is a resource for the firm, not a decision-maker for the account. The TCP does not have authority to place orders, move money, or override the account owner. Rule 4512 limits the TCP's role to four specific purposes; a TCP cannot become a de facto adviser or custodian.
• The customer may decline to provide a Trusted Contact. The firm must make the reasonable effort to obtain one but cannot force the customer to designate one. If the customer declines, the firm retains the ability to place a 2165 hold without the TCP notification step (the rule permits notification to account parties alone).

What are the red flags of financial exploitation?

A representative who spots any of these should escalate to supervision promptly. The firm, not the individual rep, is responsible for evaluating the 2165 hold.

• Sudden changes in stated financial objective or risk tolerance that do not match the customer's long-standing profile
• Unusual wire transfer requests (especially to international or unfamiliar beneficiaries)
• New persons present at meetings exerting control over the customer's decisions
• Requests for large withdrawals the customer cannot explain
• Signs of cognitive impairment: confusion about recent account activity, difficulty understanding routine explanations
• Romance scams, tech-support scams, grandparent scams, and Internal Revenue Service (IRS) / government impostor scams disproportionately target seniors

Exam Tip: Gotchas

• The rep escalates; the firm evaluates. The individual representative does not place the 2165 hold. The rep's job is to recognize red flags and escalate to supervision; the firm (through its supervisory structure) makes the hold decision.
• Romance scams and tech-support scams are among the most common exploitation patterns on retail accounts. A sudden large withdrawal to a "new friend online" or to pay for "computer security services" is a classic trigger for the rep to escalate.
• Red flags combine. A single unusual wire may be legitimate; an unusual wire plus a new third party at meetings plus a customer who cannot explain the purpose is enough for escalation.