How to anonymize client data when selling a wealth management firm?
Anonymize client data when selling a wealth management firm by stripping names, addresses and account numbers before the LOI, and replacing them with a household ID that lives in a key file the buyers never see.
Keep that key off the room. California can require opt-in for identifiable sharing. Ask your compliance counsel. This page is not a template.
Client-data anonymization (definition). Strip names, addresses and account numbers.
Replace them with a household ID whose key file lives off the room.
Aggregate or banded AUM is not a named household.
What the rule treats as blind
A registered investment adviser’s household roster is nonpublic personal information. 17 CFR 248.3(u)(2)(ii)(B) (eCFR / Cornell text, retrieved 2026-10-01) says personally identifiable financial information does not include “information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.” Kitces (22 November 2023) works the same cut in a sale: disclose household AUM and recurring revenue, and replace Jane Doe with Client 1 until later. Staging when those files open is how to share client data with an RIA buyer during due diligence. What the buyer still needs in the index is what documents a buyer needs to acquire a financial advisory practice.
| Field | Before the LOI | After the LOI | Off the room |
|---|---|---|---|
| Household identity | A sequential ID (Household 14) | A sampled named household the exclusive bidder has earned | The key file that maps ID to name |
| AUM and recurring revenue | The dollar, or a band (for example $1-2M) | The same dollars, now tied to a named household | Nothing. The number is the underwrite. |
| Age, tenure, fee schedule, custodian | Bands and counts. No account numbers. | Confirmatory detail on the sampled set | Full account numbers on a raw custodian export |
| Address, SSN, date of birth | Out | Out, unless counsel puts a sampled file in confirmatory | The raw CRM export |
The key file stays off the room
Build two artifacts. The room gets the blind roster: household ID, AUM, revenue, age band, tenure, fee schedule, custodian, and concentration. The seller and its counsel keep the key that maps Household 14 back to a name. If the key sits in the same tree as the roster, the next forward reconstitutes the book. Do not put the key in Q&A, in a “clean team” folder the bidder can still download, or in a spreadsheet tab named Mapping.
| Method | What it produces | Where it stops |
|---|---|---|
| Band and ID in the export | An Excel the buyer can model. No names. | You have to build it before upload. The room will not invent the bands. |
| Redacted PDF copy | Confirmed boxes burned into a sibling PDF; the original leaves that room only. | A spreadsheet becomes a redacted PDF, not a redacted spreadsheet. The buyer cannot model a PDF. |
| Key file with counsel | The map from ID to name, held off the room. | If it is in the room, anonymization has already failed. |
In-app redaction on the paid plan is that second row: the seller confirms boxes, the burn rasterizes them, and the original is detached from that room. It is not an anonymization pipeline for raw data exports. The 248.15(a)(6) sale-or-merger exception still belongs to the firm, not a departing adviser (Kitces). California Fin. Code 4052.5 is opt-in for sharing nonpublic personal information with a nonaffiliated third party, except as 4056 allows; 4056(a) does not apply to information that is not personally identifiable. Ask your compliance counsel whether a given roster is blind enough, and whether any 4056 exception applies to identifiable confirmatory files. See What is Cashpian?, and pricing.
FAQ
What counts as blind data under Regulation S-P?
17 CFR 248.3(u)(2)(ii)(B) excludes information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.
Ask your compliance counsel whether a given roster meets that test.
Where does the anonymization key file live?
Off the room.
The buyers see household IDs, bands, and revenue.
The map from ID to name stays with the seller and its counsel.
Is a redacted PDF the same as a redacted spreadsheet?
No.
In-app redaction burns confirmed boxes into a redacted PDF copy; a spreadsheet becomes that PDF, not a redacted spreadsheet.
Band the export before it ever enters the room if the buyer needs Excel.
Does California change the federal sale exception?
It can.
Cal. Fin. Code 4052.5 is opt-in for sharing nonpublic personal information with a nonaffiliated third party, except as 4053, 4054.6, and 4056 allow.
Ask your compliance counsel whether any 4056 exception applies.
Sources
- eCFR / Cornell, 17 CFR 248.3, retrieved 2026-10-01. Section 248.3(u)(2)(ii)(B) is the blind-data example quoted above. 17 CFR 248.15(a)(6) is the sale-or-merger exception.
- Kitces, 5 Important Legal Steps Of An RIA Sale, Merger Or Acquisition, 22 November 2023, retrieved 2026-10-01. Replace Jane Doe with Client 1 until later. The exception belongs to the firm.
- California Legislative Information, Cal. Fin. Code 4052.5 and 4056, retrieved 2026-10-01. Opt-in, with 4056(a) for information that is not personally identifiable.
If the files are already in a folder, grade which row they are on. Cashpian is a gated room for that packet. It is not a listing portal. It does not sell the company or run the deal.