Elder financial exploitation policy: laws, contacts, records first

An elder financial exploitation policy sets out how a bank or credit union notices, responds to and reports suspected exploitation of older customers: who may delay a payment and under which state's law, who calls a trusted contact and what they may say, who reports to adult protective services and the police, how a suspicious activity report is referred without tipping anyone off, and how staff are trained and the evidence kept. The hard part is not the drafting. It is that the inputs sit in different places: statutes in the compliance department, consents in branch files, training in the learning system, SAR rules in the BSA programme. Botminds' Elder Financial Exploitation Detection is software for fraud and BSA teams that runs such a policy on each case, with agents preparing every step and people deciding; it works only as well as the inputs it is given. This guide is the list, with an owner and a location for each.

What should an elder financial exploitation policy include?

Every step of a case, each with a decision-maker, a legal basis and a clock. The interagency statement on elder financial exploitation gives the outline in its nine sections: governance and oversight, employee training, transaction holds and disbursement delays, trusted contacts, suspicious activity reports, reporting to law enforcement and adult protective services, providing records to the authorities, community networks, and customer outreach. It describes practices, not requirements. A policy turns them into rules a teller can follow at 9:52 on a Thursday.

Do banks need an elder abuse policy?

No federal rule requires a stand-alone elder policy, but the rules a bank already follows only work with written procedures behind them. The interagency statement says institutions "may consider enhancing or creating risk-based policies, internal controls, employee codes of conduct, ongoing transaction monitoring practices, and complaint processes" to manage elder exploitation. The Senior Safe Act's protection depends on training and on a record of each person trained. The SAR rules need a referral path. And some state hold laws make written procedures a condition of using the hold at all.

Florida is the clearest example of that last point. Before placing a delay under its 2024 law, a financial institution must "Develop, maintain, and enforce written procedures regarding the manner in which suspected financial exploitation is reviewed internally", alongside training policies for employees who perform or approve transactions. For broker-dealers, FINRA's hold rule requires written supervisory procedures before a firm relies on it. A bank without a policy in a state like Florida does not merely lack good practice; it lacks the power to delay.

The statement also sets one limit every elder policy has to respect. Protective policies are encouraged, it says, "provided such policies do not result in age discrimination that is impermissible under the Equal Credit Opportunity Act (ECOA)." A rule that applies extra scrutiny to everyone over 65 may be sensible for deposit transactions and wrong for credit decisions. The policy should say which products and which decisions it covers.

Who approves an elder exploitation hold?

Someone other than the person who proposed it, with the authority set by amount and length. State laws leave the internal approval to the institution: Washington's hold is discretionary and protected if decided "in good faith"; Florida's requires the institution to promptly start "an internal review of the facts and circumstances". The policy has to say who reviews and who signs.

Two design choices in that table matter more than the numbers. First, the maker never approves their own step, so a single person under pressure at the counter cannot both propose and confirm a restriction on a customer's money. Second, the clocks are attached to the step, not kept in someone's head. In the sample, the delay approved at 10:31 on Thursday 22 October ends on Thursday 29 October, the notice is due Monday 26 October and the review result Monday 2 November: the agents compute those dates, and a missed one goes to the BSA officer.

What state laws must the policy cover?

Every state where the institution has customers, for three things: whether it may hold and for how long, whether it must report and to whom, and what age or vulnerability the law protects. The FTC's October 2024 overview lists 24 states with transaction-hold laws for financial institutions. The CFPB counted 26 states and the District of Columbia, as of April 2019, that require financial institutions or certain financial professionals to report suspected exploitation. The ages vary: 60 in some states, 62 in Delaware, 65 in others, often with a separate test for vulnerable adults.

For a multi-state bank this is a table, not a paragraph, and it changes. Florida's delay law dates from 2024; the FTC's overview says it is "a best effort" as of its date. A policy should name the source and effective date of each state's rule and say who checks it. The state-by-state detail, with Washington and Florida worked through, is in elder financial abuse laws by state.

What is a trusted contact process?

A written procedure for inviting customers to name someone the institution may call if it suspects exploitation or cannot reach them, recording their consent and its scope, and deciding when staff may use it. The CFPB's 2021 advisory gives the elements: "Create a policy that explains when and how your staff can reach out to a trusted contact"; request advance consent and "Offer this option to account holders of all ages"; allow more than one contact; and revisit the consent when, for example, the account holder "adds an additional owner to the account, establishes a new power of attorney or trust".

That last trigger is where policies are weakest. In the sample case, a new joint owner was added 19 days before the large request; a policy that reviews trusted-contact consent when an owner is added would have prompted a call to the member's niece that week. The process also needs a branch for the worst case: what staff do when the trusted contact is the person exploiting the customer. The CFPB suggests asking for a second contact and involving adult protective services or the police. The full treatment is in the trusted contact person guide.

The trusted-contact call, limited to what the member agreed to

How do you document Senior Safe Act training?

By keeping the course content and a completion record for each covered person, and producing both on request. The statute requires the institution to "maintain a record of each individual" in a covered position who has completed the training, wherever and whenever it was completed, and to provide it "upon request" to an agency that examines it. The content must be kept and made available too, except for people who have left.

The useful test of that documentation is a single case, not a percentage. On the day a teller reports and a supervisor files, were both trained? A policy should require that check before any external report, and say what happens if it fails: in the sample, an overdue employee cannot be the reporting employee, and the report is routed through a trained colleague with the reason kept on the case.

Training records read before every report

The SAR chapter: referral, clock, and every place it must not appear

The SAR chapter should be short and absolute. It names who refers a case to the BSA team and how; requires FinCEN's key term "EFE FIN-2022-A002" and the elder checkbox; starts the 30-day clock at initial detection; and lists every document and screen a SAR must never reach. The rule behind the list is categorical: "No bank, and no director, officer, employee, or agent of any bank, shall disclose a SAR or any information that would reveal the existence of a SAR." In elder cases that includes the delay notice, the trusted-contact call, the adult protective services report, branch comment fields and anything a joint owner can see. What the file behind the referral must show is in the elder exploitation SAR guide.

How often should the policy be reviewed?

The elder guidance sets no schedule, so the useful answer is: at least once a year and whenever a source changes. In the last three years the sources moved repeatedly. Florida added a delay law in 2024. FinCEN published its elder trend analysis in April 2024. The interagency statement was issued in December 2024 and revised on 2 June 2026, when the agencies removed its reference to reputational risk. The FBI's figures show which scams are growing each spring.

A review should also look at the cases. How long did each concern take from the teller's report to the first protective step? How many delays were released early, how many extended, how many proposals did people override, and why? In the sample solution, every agent, threshold and rule is versioned, and overriding an agent's proposal needs a reason code, so those questions have answers.

Every open case in Elder Financial Exploitation Detection, with its next step, owner and clock

What an Elder Financial Exploitation Detection pilot needs from you, and what it does not do

A pilot of Elder Financial Exploitation Detection starts from the inputs in the first figure: your elder protection policy, the hold and reporting laws of your states, your notice templates and consent form, read access to the core, teller, digital banking, card and monitoring systems and the learning management system, and a sample of past cases to run it on. Most of the work is gathering those, which is also most of the work of writing the policy.

What the solution does not do is as specific. It does not write your policy or decide which state rule applies to a customer who lives in one state and banks in another; your compliance team sets that. It does not file SARs, upload reports without a person or change a member's details. It is designed for the steps in the sample policy, so an institution whose process differs sharply should expect configuration work in the pilot. How agents and people divide each case is in banks' elder fraud prevention, and the full case is on the Elder Financial Exploitation Detection page.

Questions people ask

Who should own the elder exploitation policy?

Usually the BSA or compliance officer, with fraud, retail and consumer protection as contributors. The interagency statement singles out "open lines of communication" across BSA compliance, fraud prevention and consumer protection, including fair lending, because each holds part of the picture.

Can a policy apply only to customers over a certain age?

It can, but carefully. State hold laws protect people from 60, 62 or 65 depending on the state, plus vulnerable adults of any age, and the statement warns that protective policies must not produce age discrimination that is impermissible under the Equal Credit Opportunity Act, whose Regulation B gives special protections to applicants 62 or older.

Should the policy require customers to name a trusted contact?

Banks may offer it; they are not required to collect one. Broker-dealers must make "reasonable efforts" to obtain a trusted contact under FINRA Rule 4512, but may still open an account without one. The CFPB recommends offering the option to account holders of all ages.

Does an elder policy need to cover powers of attorney?

Yes. FinCEN lists a sudden change of power of attorney among its behavioural red flags, and the CFPB's study of elder SARs found the highest average losses when the suspect was a fiduciary such as an agent under a power of attorney. The policy should say what staff check when a new agent appears.

What records does an elder exploitation policy need to keep?

At least the SAR and its supporting documents for five years from filing, a record of each covered employee's Senior Safe Act training, and whatever your state hold law requires; Florida, for instance, requires a written record of each delay kept for at least five years.