Standard III(E): Preservation of Confidentiality

What does Standard III(E) require?

You must keep information about current, former and prospective clients confidential. This client confidentiality duty applies when you learn the information because of your special ability to handle part of the client’s business or personal affairs, and the information arises from or is relevant to that part of the client’s affairs.

Memorize

The duty does not depend on the client’s status. It protects former and prospective clients as well as current ones, and it continues after the relationship ends. A former client can authorize disclosure expressly, and you may then follow the terms of that authorization.

What are the three exceptions?

You may disclose confidential information only when:

1. Illegal activity. The information concerns illegal activities on the part of the client (the illegal activity exception ). You may even have an obligation to report them to the authorities.
2. Required by law. Disclosure required by law , for example a court order or regulatory demand, overrides confidentiality.
3. Permission. The client or prospective client gives client permission to disclose.

Information about a clientdefault: keep it confidential

• Who is covered Memorize status does not matter
  • Current clients
  • Former clients the duty survives the relationship
  • Prospective clients including those who never signed
• Three exceptions Memorize any one is enough
  • Illegal activity by the client may need to report to the authorities
  • Required by law for example a court order
  • Client or prospect permits it express authorization
• Not a breach Use it PCP investigations
  • CFA Institute Professional Conduct Program treat it as an extension of yourself

Two cautions apply to the exceptions. If the law requires you to keep information confidential even when it concerns illegal conduct, do not disclose. And laws that restrict the flow of information between departments of a financial institution can make an internal disclosure a breach. When in doubt, ask your employer’s compliance staff or legal counsel before disclosing.

What about CFA Institute investigations?

Standard III(E) is not meant to stop you cooperating with a Professional Conduct Program investigation . When permissible under applicable law, treat the Program as an extension of yourself if it asks for client information in an inquiry into your own conduct. You are encouraged to cooperate with inquiries into others as well. Information given to the Program is kept in strict confidence, and forwarding it is not a violation.

What about vulnerable investors?

A vulnerable investor is a client who may be affected by diminished capacity or at risk of financial exploitation. The Handbook asks you to watch for red flags of both. Examples might be a client who repeatedly forgets recent instructions, or sudden unexplained withdrawals pressed by a third party.

Use it

• Best practice: a secondary contact . Ask the client at account opening to name one, such as a trusted family member or a legal adviser, so you know whom to approach if concerns arise.
• Limited disclosure may be allowed. Where it is legally permissible, telling that person limited information about a vulnerable client does not violate III(E).
• Document such conversations.

A client who may lack capacity or be exploiteddiminished capacity or financial exploitation

• Watch for red flags Use it signs of diminished capacity or financial exploitation
• Best practice: a secondary contact Memorize trusted family member or legal adviser, set up at account opening
• Limited disclosure may be allowed Memorize where legally permissible; it does not violate III(E)
• Document the conversation Memorize record what was said and to whom

Firms support this with practices of their own: follow the firm’s vulnerable-client policies, ask for a secondary contact on every account, train staff on diminished capacity, follow internal reporting procedures, and add extra compliance review of those accounts.

How do you protect information in practice?

Information security is part of the duty because accidental disclosure is as damaging as deliberate sharing. You are not expected to become a security expert, but you must understand and follow your employer’s policies on electronic communication and on storing client data on laptops, phones and portable drives. If the firm has no procedures, encourage it to develop them. Use firm-supported channels and talk to clients about which ones suit confidential information.

The simplest and most conservative approach is not to disclose anything received from a client except to colleagues who also work for that client. If you want to share something outside the confidential relationship that does not involve illegal activity, ask yourself in what context the client gave it, and whether it is background that will help you serve the client better.

Where do the lines fall?

Situation	Verdict
An adviser tells friends at a party about a former client’s large inheritance	Violation
An adviser reports a client’s apparent money laundering to the authorities as local law requires	Not a violation (illegal activity; required by law)
A manager shares a prospect’s financial details with a colleague who needs them to prepare a proposal	Acceptable within the firm, for the client’s benefit
A member gives client records to CFA Institute’s Professional Conduct staff during an inquiry	Not a violation
A laptop with unencrypted client files is left unattended in a public place	Risk of a violation. Firms need security procedures

Compliance practices

• Communicate with clients through secure, firm-supported channels and review privacy protections regularly.
• Use access controls and encryption, and follow the firm’s rules for devices and storage.
• Train all staff who touch client records, including receptionists and associates, not only investment professionals.
• Know the privacy and disclosure laws that apply to you, and consult compliance or legal counsel before any doubtful disclosure.
• For vulnerable clients, follow the practices in the previous section.

Go deeper Confidentiality, whistleblowing and Standard I(A)

Standard I(A) says to follow the stricter of the law and the Code and Standards. In confidentiality cases that means checking local law first. Some jurisdictions require you to report a client’s crime, which fits the exceptions. Others protect client secrecy even about crime, and then you must stay silent. The Standards do not oblige you to report a client to the authorities by themselves, but they permit it when the information concerns illegal activity.

Go deeper Data protection as a firm-wide duty

Modern confidentiality failures are rarely a quiet word at a party. They are mislaid devices, mis-addressed emails, shared passwords and unsecured cloud folders. Because anyone with access can cause a breach, the compliance practices stress firm policy and training for everyone, not only the portfolio managers.