Elder financial abuse laws differ by state on the three questions a bank asks first: may we hold the money, must we report, and who counts as protected. As of October 2024, the FTC's overview of state laws listed 24 states that let financial institutions hold or delay transactions when they suspect exploitation of an older or vulnerable adult, with initial holds from five business days in Washington to thirty in Nebraska and Virginia. Reporting duties follow a different map: the CFPB counted 26 states and the District of Columbia that require financial institutions or certain financial professionals to report. Ages run from 60 to 65. The federal layer underneath is thinner than many people assume. It protects reporting by trained staff and requires suspicious activity reports, but it gives a bank no power to hold. Botminds' Elder Financial Exploitation Detection is software for fraud and BSA teams that applies each state's rule as a versioned setting, computes its clocks, and leaves every hold and report to a person.
Twelve state hold laws for financial institutions: who is protected and for how long
| State | Protected adults | Initial hold | Extension |
|---|---|---|---|
| Alabama | 65 or older, or vulnerable | Until the institution reasonably believes the transaction will not result in exploitation | Not applicable |
| Connecticut | 60 or older | 7 business days | Up to 45 more business days for reasonable cause |
| Delaware | 62 or older | 10 business days after reporting | Another 30 business days in some situations, including at an agency’s request |
| Florida | 65 or older, or vulnerable | 15 business days | Up to 30 more business days if the review supports it |
| Kentucky | 65 or older, or an adult with an impairment | 15 business days, or sooner if no exploitation | Up to 25 business days if the review supports it |
| Louisiana | 60 or older, or covered by the APS law | 15 business days, or sooner if no exploitation | To 25 business days at an agency’s request |
| Minnesota | 65 or older, or vulnerable | 15 business days, or sooner if no exploitation | Up to 25 business days |
| Mississippi | 65 or older, or vulnerable | 10 calendar days, or sooner if no exploitation | 10 more days at an agency’s request |
| Nebraska | 65 or older, or vulnerable | 30 business days, or sooner if no exploitation | If continued belief of exploitation supports it |
| Texas | 65 or older, or with a disability | 10 business days, after a report to the authorities | 30 more business days at law enforcement’s request |
| Virginia | 60 or older, or incapacitated | No longer than 30 business days | Not stated |
| Washington | Vulnerable adults, including people 60 or older unable to care for themselves | 5 business days; 10 if a security is being sold | By court order |
Which states allow banks to hold elder transactions?
Twenty-four, in the FTC's October 2024 count: Alabama, Arkansas, Connecticut, Delaware, Florida, Kentucky, Louisiana, Michigan, Minnesota, Mississippi, Montana, Nebraska, Nevada, New Hampshire, North Dakota, Oregon, Rhode Island, South Carolina, Tennessee, Texas, Utah, Virginia, Washington and Wyoming. The overview lists the rest by name: "As of October 2024, the following states did not have laws about financial institution transaction holds", starting with Alaska, Arizona and California and including New York, Illinois and Pennsylvania. Some of those, the FTC notes, may have hold rules that apply only to broker-dealers or investment advisers.
The laws share a skeleton and differ in the details that decide a case. The usual trigger is a reasonable or good-faith belief that exploitation has occurred, is occurring or is being attempted; the usual conditions are notice to the people authorised on the account and a report to adult protective services or the police; and the statutes checked for this guide all protect good-faith decisions. They differ on whether the institution must report before it may hold, whether the suspected party is told, whether the receiving account can also be held, and whether law enforcement can require a hold. In Texas, the FTC records, a hold is required when law enforcement requests it.
How long can a bank hold funds for elder abuse?
From five business days to thirty, at first, depending on the state; extensions can stretch a hold to two months. Washington allows five business days for most transactions. Connecticut starts at seven with up to 45 more for reasonable cause. Florida allows fifteen and up to thirty more if the institution's review supports it. Nebraska and Virginia allow up to thirty from the start.
Initial hold allowed, in business days, in nine states
The short holds are the hard ones to use well. Five business days is enough to talk with the customer, reach a trusted contact and file a report, but not to wait for adult protective services to visit. That is why the policy's clocks have to start at the first minute, and why the date the hold ends needs to be visible to whoever owns the case. Broker-dealers work under a longer federal rule: FINRA Rule 2165 allows a temporary hold of 15 business days, extendable by 10 if the internal review supports it, and by up to 30 more once the firm has notified a state regulator, agency or court.
What is the Washington elder abuse hold law?
Revised Code of Washington 74.34.215 lets a financial institution refuse a disbursement when it reasonably believes a vulnerable adult is being exploited, for five business days, and requires it to notify the account's parties and report to adult protective services and the police. Its central sentence: if the institution "reasonably believes that financial exploitation of a vulnerable adult may have occurred, may have been attempted, or is being attempted, the financial institution may, but is not required to, refuse a transaction requiring disbursal of funds" from the vulnerable adult's account, an account of which they are a beneficiary, or the account of the suspected perpetrator.
Three details matter in practice. The refusal expires after five business days, or ten if the transaction involves the sale of a security, or sooner once the institution is satisfied, and only a court can extend it. The institution must "Make a reasonable effort to notify all parties authorized to transact business on the account orally or in writing"; the text carries no exception for a party suspected of the exploitation. And it is immune from criminal, civil and administrative liability for refusing or disbursing "if the determination of whether or not to disburse funds was made in good faith." Washington's law dates from 2010; check for amendments before relying on it.
Florida's 2024 delay law, and how it differs from Washington's
Florida's statute, section 415.10341, enacted in 2024, is longer, more procedural and more protective of the institution, and it shows where newer hold laws are heading. It applies to a "specified adult", meaning "a natural person 65 years of age or older, or a vulnerable adult", and lets the institution delay a disbursement only if it has reported the suspected exploitation under the state's reporting law first.
Two state hold laws, row by row: Washington (2010) and Florida (2024)
Washington, RCW 74.34.215: Vulnerable adults, as Washington’s adult protection law defines them.
Florida, s. 415.10341: People 65 or older, or vulnerable adults.
Washington, RCW 74.34.215: Report to APS and local law enforcement after refusing.
Florida, s. 415.10341: May delay only if it has reported under the state reporting law.
Washington, RCW 74.34.215: A reasonable effort to notify all parties authorised on the account, orally or in writing.
Florida, s. 415.10341: Written notice with the reason within 3 business days to authorised parties and any trusted contact, except anyone reasonably believed to be involved.
Washington, RCW 74.34.215: 5 business days; 10 for a sale of securities; only a court extends.
Florida, s. 415.10341: 15 business days; up to 30 more if the review supports it; a court may shorten or extend.
Washington, RCW 74.34.215: No stated precondition.
Florida, s. 415.10341: Training policies, training for staff who perform or approve transactions, and written review procedures.
Washington, RCW 74.34.215: Not specified.
Florida, s. 415.10341: A written or electronic record of each delay, kept at least 5 years.
Washington, RCW 74.34.215: Immune for decisions made in good faith.
Florida, s. 415.10341: Immune from administrative or civil liability when acting in good faith and with reasonable care.
Florida's definition of a trusted contact is also broader than many banks expect: a person 18 or older whom the account owner has named, and the definition expressly allows that person to be a joint owner or someone holding a power of attorney. In a family exploitation case the trusted contact can be the suspect, which is why Florida's notice rule excludes anyone reasonably believed to be involved, and why a policy needs a branch for that case. Florida also prescribes what the delay record holds, from the date the delay began to "The facts and circumstances that caused the employee to report suspected financial exploitation."
Are banks mandatory reporters of elder abuse?
In about half the states, yes; in the rest, reporting is voluntary and still protected. As of April 2019, the CFPB counted 26 states and the District of Columbia that "mandate reporting of suspected EFE by financial institutions or specified financial professionals", noting that the requirements vary. It recorded one addition after 2016: "Effective September 29, 2018, Ohio mandates that employees of banks, savings banks, savings and loan associations, or credit unions" report suspected financial exploitation. It also removed Illinois and Washington from its list, because their mandates were narrower than they first appeared: Washington's reporting duty attaches when a financial institution holds a transaction.
States that do not mandate reporting usually invite it. Virginia says "Any financial institution staff who suspects that an adult has been exploited financially may report" to the local department or the adult protective services hotline, and gives reporters immunity unless they acted in bad faith. The same section lets staff delay a transaction for up to 30 business days, and once they do, the report becomes mandatory: the institution "shall report such refusal or delay within five business days". The interagency statement covers the federal side: in 2013 eight federal agencies confirmed that the Gramm-Leach-Bliley Act's privacy provisions generally do not prevent such reports. The CFPB's own recommendation is to report to every appropriate responder whether or not a state requires it.
A state adult protective services report, drafted and approved before it goes
What age is elder financial abuse?
It depends on which law is asking: 65 for the Senior Safe Act, 60 for FinCEN, and 60, 62 or 65 for the state hold laws, which also protect younger vulnerable adults. The federal Act sets its line at age 65. FinCEN's advisory treats as an older adult "an individual 60 years of age or older", consistent with other federal agencies, and its elder SAR data uses that line. Among the state laws in the table, Connecticut, Louisiana, Virginia and Washington start at 60, Delaware at 62, and the others at 65.
There is a fourth number for lenders. The interagency statement notes that Regulation B, which implements the Equal Credit Opportunity Act, gives special protections to applicants 62 or older, and it warns that elder-protection policies must not produce impermissible age discrimination in credit. A bank's policy therefore needs one age per purpose, not one age.
Do federal laws allow elder holds?
Not for banks and credit unions. The federal rules give reporting protection, reporting duties and guidance, but no general power to hold a customer's money because exploitation is suspected. The interagency statement, issued in December 2024 and revised in June 2026, says that "Some state laws permit supervised institutions to temporarily hold a transaction or delay a disbursement of funds", and that "These statutes generally provide timelines for transaction holds, and some provide immunity for institutions and employees who meet specific requirements." It creates no federal equivalent. The broker-dealer world is the exception, through FINRA's rule.
The federal layer under the state laws
| Rule | What it does | Who it covers | Hold power? |
|---|---|---|---|
| Senior Safe Act, 12 U.S.C. 3423 | Immunity for disclosing suspected exploitation of people 65+ to covered agencies, if staff were trained | Banks, credit unions, advisers, broker-dealers, insurers, transfer agents | No |
| SAR rules, 31 CFR 1020.320 and the banking agencies’ rules | Report suspicious activity to FinCEN within 30 days; keep it confidential | Banks and credit unions | No |
| 2013 interagency privacy guidance | GLBA privacy rules generally do not prevent reports to authorities | Institutions supervised by eight agencies | No |
| Interagency statement on elder exploitation (2024, revised 2026) | Examples of practice; no new requirement | Supervised banks and credit unions | Points to state law |
| FINRA Rules 2165 and 4512 | Temporary holds up to 55 business days; trusted contacts sought at account opening | FINRA member broker-dealers | Yes, for members |
The practical consequence is that the same customer gets different protection at the same bank depending on where she lives. A Washington member's delay ends after five business days; a Florida customer's can run fifteen and then thirty more; a New York customer's account has no state hold law at all, as of the FTC's 2024 overview. What the interagency statement says, and what its 2026 revision changed, is set out section by section.
Do state hold laws give banks immunity?
Most do, for decisions made in good faith, and some add a reasonable-care test. Washington's immunity covers refusing or disbursing "if the determination of whether or not to disburse funds was made in good faith." Florida's covers an institution that "acts in good faith and exercises reasonable care to comply with this section", and that protection is available only if the institution reported first, trained its staff and has written procedures. The immunity is from the state's own law; it does not protect against a federal claim that an account restriction was unfair, which is why the interagency statement reminds banks of enforcement actions over restricted account access.
Immunity also does not cover the parts of a case that sit outside the statute. Telling a trusted contact more than the customer agreed to, or letting a suspected joint owner learn of a report, is a separate problem with separate law. The Senior Safe Act, for its part, protects only the disclosure to a covered agency, and only when the staff it describes were trained beforehand.
Running one rulebook across many states in Elder Financial Exploitation Detection
A multi-state institution needs each state's rule as data, with its source and effective date, applied to each customer automatically. In Elder Financial Exploitation Detection, the hold length, extension, notice recipients, notice deadline, reporting deadline and eligible age are settings in the institution's rules, versioned, and changed only with the BSA officer's approval. The sample runs under an illustrative, unnamed state's law: five business days on the branch manager's approval, up to fifteen on the BSA officer's, notice within two business days.
One delay in Elder Financial Exploitation Detection under the configured state rule, with its clocks computed
What the solution cannot do is decide which state's law applies to a customer who lives in one state and banks in another, or interpret a statute that has just changed. Those are compliance decisions, and the rule is only as current as the last version the BSA officer approved. What a policy should hold before those settings are filled in is covered in the elder financial exploitation policy guide; the full sample case is on the Elder Financial Exploitation Detection page.
Questions people ask
Does my state have an elder financial exploitation hold law?
As of October 2024, the FTC listed 24 states with hold laws for financial institutions and named 26 states and the District of Columbia without one, including California, New York, Illinois, Pennsylvania and Ohio. Laws have changed since, so check your state's current statute or the state banking regulator.
Can a brokerage hold funds longer than a bank?
Often, yes. FINRA Rule 2165 lets a broker-dealer hold a disbursement for an adult 65 or older, or an impaired adult, for 15 business days, extend it by 10 if its review supports that, and by up to 30 more after notifying a state regulator, agency or court. Bank holds depend entirely on state law.
Can law enforcement or adult protective services ask a bank to hold funds?
In some states. Washington lets an institution refuse a disbursement on information from adult protective services, law enforcement or a prosecutor, and the FTC's overview records that in Texas a hold is required when law enforcement requests it. Several states also extend holds at an agency's request.
Do hold laws cover the account receiving the money?
Some do. Washington's law reaches the account of a person suspected of the exploitation as well as the vulnerable adult's own, and the FTC's chart marks Alabama, Arkansas, Louisiana, Mississippi, Montana, North Dakota, South Carolina, Tennessee, Washington and Wyoming as covering both sending and receiving accounts.
Do hold laws apply to credit unions?
In most states, yes: the FTC's chart lists credit unions among covered institutions in states such as Alabama, Connecticut, Florida, Minnesota and Texas. The Senior Safe Act also names credit unions as covered financial institutions for its reporting immunity.