Estate planning compliance for financial advisors: What to bring to your firm

What to bring to compliance before offering estate planning

Your clients are asking for estate planning help, and you’ve found a service that seems built for the job: attorneys handle the legal work, the process fits your practice, and the need is already there.

Now you have to get it through compliance.

That's the easy part to say. What happens next usually isn't — partly because "compliance" doesn't mean the same thing for every advisor. If you're affiliated with a broker-dealer, it's a real department, usually centralized at the firm's home office rather than down the hall, but a defined team with a process. If you run your own RIA with a few employees, it might be a partner or ops lead who also carries the compliance title. If you're a true solo shop, there's a good chance it's you: every RIA is required to name a Chief Compliance Officer, and in a one-person practice, that's routinely the advisor himself, sometimes backed by a third-party consultant on retainer. All three versions face the same underlying questions. Only the name on the other end changes.

FINRA and the SEC publish the obligations firms must meet. Neither publishes a universal estate planning approval form, and neither tells an individual advisor exactly what to put in front of whoever reviews this for them. Each firm — or each solo advisor, acting in that role — has to evaluate the service against its own registrations, business model, policies, and compensation structure.

That means the most useful question isn't "Is estate planning allowed?" It's: What would my compliance team need to see before it could make a responsible decision?

The answer is a documented proposal that makes the service, the risks, and the controls easy to evaluate — not a product demo.

Important: This guide is educational, not legal or compliance advice. Firm policies, state law, licensing, registrations, and the proposed service model can change the analysis. Follow your firm's procedures and obtain approval before changing your client offering.

Don't walk in with a product demo

A platform demonstration explains what the client sees. It doesn't answer the questions compliance owns — who's actually providing each part of the service, where the advisor's role stops, when the attorney takes over, what client data moves and how it's protected, who's compensated and how, and how the firm will supervise and document all of it.

FINRA's guidance on third-party vendors makes the underlying principle explicit: outsourcing a function doesn't outsource the firm's supervisory responsibility, and there's no single vendor-management approach that fits every firm — the controls have to match the firm's size, business model, and what the vendor actually does. Don't ask whoever reviews this to approve a vague idea. Give them a defined operating model, starting with one page.

The one-page operating summary

The first page of the proposal should let a reviewer understand the service without sitting through a sales call.

This forces a useful distinction: "offering estate planning" can describe several materially different arrangements, and compliance can't evaluate a phrase. It can evaluate a specific division of responsibility.

Build the proposal around seven decisions

1. Is the service inside the firm's approved scope?

Start with current registrations, advisory agreements, disclosures, and written policies.

For an investment adviser, Form ADV asks firms to identify the advisory services they provide, and Part 2 is meant to give clients current, plain-English disclosure of the firm's practices and conflicts. A new estate planning workflow doesn't automatically require an amendment, but whoever handles compliance should determine whether the firm's description of services, fees, or conflicts would become materially inaccurate without one.

For a registered representative, an arrangement outside the scope of the member firm may raise the firm's outside-business-activity process. FINRA Rule 3270 requires prior written notice when a registered person takes on certain compensated business activity outside the firm; the firm then evaluates whether the activity interferes with the rep's duties or could be seen as part of the firm's own business, and has authority to limit or prohibit it. Whether a given estate planning arrangement triggers this depends on the facts and the firm's own procedures — there isn't a universal answer, which is exactly why this needs to be asked rather than assumed.

Prepare:

• A description of the proposed service and client experience
• The proposed agreement among client, firm, advisor, vendor, and attorney
• A list of current ADV, client-agreement, or outside-activity provisions the service may affect
• A clear request for a determination on which disclosures or approvals apply

2. Are the legal roles documented clearly enough?

"Attorney-supported" and "attorney-reviewed" can describe very different models. Whoever reviews this shouldn't have to infer who's responsible for the legal work.

Document:

• When the attorney-client relationship begins
• How the attorney is selected and licensed for the client's jurisdiction
• Which work is performed by the attorney, the platform, and the advisor
• How legal questions get escalated
• Who reviews and approves final documents
• What happens if a client's circumstances exceed the platform's scope
• How complaints or errors are handled

Write the advisor's role just as clearly: what the advisor may do, what must be referred to counsel, what's prohibited. Don't rely on a vendor's claim that its service is "compliant" — ask for the process and documents behind that claim.

3. Has the vendor passed privacy, security, and operational review?

Estate planning intake can involve unusually sensitive information — assets, account ownership, family relationships, beneficiaries, health-care preferences, incapacity decisions, identity data.

The SEC's 2024 amendments to Regulation S-P require covered institutions to maintain a written incident response program, oversee service providers through due diligence and monitoring, and notify affected individuals within 30 days of certain breaches. Large entities had to comply by December 2025; smaller entities by June 2026 — meaning this is a live, binding requirement now, not a future one. FINRA's own third-party risk guidance points to initial and ongoing vendor diligence, data inventories, contract controls, incident planning, and the return or destruction of data at termination as the kinds of practices firms are expected to have.

Ask the vendor for:

• A security overview and any independent audit reports
• A data-flow diagram
• The categories of data collected
• Hosting, encryption, access-control, retention, and deletion practices
• Incident-response commitments
• Contract language covering data ownership, regulatory access, and return or destruction of data at termination

The advisor does not conduct the firm’s technical review. Their role is to provide the responsible team with the documentation needed to begin.

4. Are compensation and conflicts visible?

Whoever reviews this needs a complete economic picture, even when the advisor doesn't believe the arrangement creates a conflict.

Document:

• What the client pays
• What the firm pays
• Whether the vendor, attorney, advisor, firm, affiliate, or related party receives compensation
• Whether pricing changes based on plan type, assets, referrals, or product implementation
• Whether estate planning can lead to recommendations involving managed assets, insurance, securities, or other compensated services
• What the client will be told about these relationships

The SEC's staff bulletin on conflicts of interest is direct on this: firms must identify and address conflicts in light of their actual operations, and records matter — a firm needs to be able to show how it evaluated and managed them. CFP Board's Code of Ethics and Standards of Conduct adds a professional benchmark: when recommending another professional, a CFP® professional needs a reasonable basis for the recommendation and must disclose certain compensation or material economic benefits connected to it.

5. Has the firm seen the actual client language?

Do not ask compliance to approve a service while leaving the marketing for later. The words used to describe attorney involvement, legal protection, outcomes, pricing, and advisor responsibilities can change the risk.

Prepare:

• The advisor's conversation guide
• Intro email
• Web or landing-page copy
• Presentation slides
• FAQ
• Vendor materials
• Disclosures
• Any follow-up messages sent through the platform

FINRA Rule 2210 currently requires a registered principal to approve most retail communications before they're used or filed — that's the standard broker-dealer reps operate under today, though FINRA has an open proposal that would replace mandatory pre-approval with a firm-administered, risk-based review instead; it hasn't been adopted. RIAs fall under the SEC's Marketing Rule, which specifically governs testimonials, endorsements, and case studies. For a solo RIA, this means checking materials against your own written policies before they go out, not waiting on someone else's sign-off. A case study, a LinkedIn post, and a one-pager can each need a separate pass — bundling them into a single request is one of the more common reasons a review takes longer than expected.

6. Can the firm supervise the workflow?

FINRA Rule 3110 requires member firms to maintain a supervisory system and written procedures appropriate to their business, including review of relevant communications with evidence that the review happened. A reviewer needs to see the specific controls, not just the roles already defined above.

Document:

• Who approves a client invitation into the service
• What the advisor can see of a client's legal intake
• What moves into the CRM
• Which questions require immediate attorney escalation
• What records must be retained

7. Is there a controlled launch plan?

A controlled launch gives a reviewer something concrete to evaluate, rather than asking for a firm-wide commitment with undefined behavior.

Propose:

• A small group of trained advisors
• A defined client segment
• Required training before access
• Only pre-approved communications
• A named escalation path
• A review point after the first group of cases

The point isn't to pressure anyone with a deadline, but to apply the same principle running through every decision above — a specific, bounded proposal moves faster than an open-ended one.

Ask for decisions, not reassurance

"Are we good to use this?" invites a broad answer, usually after a broad review. A better conversation works through specific decisions: Does the model fit the firm's approved services? What vendor, legal, privacy, and security diligence is required? Do the firm's agreements or disclosures need revision? Is an outside-business-activity notice relevant? What client communications can be approved? Who owns the next step on each open item?

One way to open it:

"I'm not asking for approval based on the vendor's sales claims. I've mapped the proposed service, the advisor and attorney roles, compensation, client communications, data flow, and launch controls. I'd like help identifying what diligence, disclosures, and supervision are required before we move forward."

That gives a reviewer something to examine, revise, or reject — and it signals the advisor understands the difference between enthusiasm for a service and authorization to offer it.

Where Estate Guru fits

Estate Guru gives advisors a stronger starting point for compliance review. Its attorney-led model places licensed, state-specific attorneys in the legal workflow and creates a clearer division between the advisor’s role and the practice of law. But the firm, or a solo advisor overseeing their own compliance, must still evaluate communications, data handling, compensation, supervision, and recordkeeping. Estate Guru’s value is not simply claiming compliance; it is helping advisors document the model, answer those questions, and move the review forward.

Frequently asked questions

Does FINRA approve estate planning platforms? No. FINRA publishes rules and guidance for member firms, not endorsements of specific platforms. The advisor's own firm — or the advisor, if they're their own compliance function — decides whether and under what conditions a service may be used.

Is offering estate planning automatically an outside business activity? Not automatically. It depends on the service model, compensation, and the advisor's actual role. Registered persons should provide the notice their firm requires and let the firm apply its own outside-activity procedures to the specifics.

Does an RIA need to amend Form ADV before adding estate planning? Not necessarily. Compare the proposed service, fees, and conflicts against current filings and client disclosures, and determine whether anything on file would become materially inaccurate without an update.

Can an advisor start once the vendor passes a security review? No — security is one part of the decision. Legal scope, licensing, compensation, conflicts, client communications, supervision, disclosures, and training may all still need review.

What's the advisor's actual job in this process? Define the business case and proposed workflow, gather the vendor's documentation, identify the intended client communications, and answer factual questions plainly. The evaluation itself belongs to whoever is responsible for compliance — which, for a solo RIA, is the advisor wearing that hat.

‍

Our platform is attorney-led, which means we bring the attorney to you. Keep in mind: We are not a law firm and do not provide legal advice–that’s what our in-network attorneys are for. While we work to make sure our information services are accurate, they’re meant as resources. Our materials and services don’t substitute for the advice of an attorney.