How to share an insurance book of business with buyers without client names?
Share an insurance book of business with buyers in three stages: aggregates by line and carrier before the NDA; an ID-swapped policy export after the NDA; named confirmatory accounts after the LOI, ideally through a neutral party.
GLBA 15 U.S.C. 6802(e)(7) excepts a proposed or actual sale or merger. State insurance privacy rules can add requirements. Have counsel review. This page is not a template.
Staged book-of-business share (definition). Aggregates by line and carrier before the NDA.
An ID-swapped policy export after the NDA.
Named confirmatory accounts after the LOI, ideally through a neutral party.
A Drive dump of the book is not this share.
Three stages, not one folder
An independent insurance agency sharing a book of business with a buyer is disclosing nonpublic personal information. 15 U.S.C. 6802(e)(7) (Cornell LII, retrieved 2026-10-02) excepts the notice and opt-out requirements when you disclose that information “in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit.” New York’s insurance-licensee rule tracks the same exception at 11 NYCRR 420.15(a)(6) (Cornell LII, retrieved 2026-10-02). PIA Northeast (25 September 2026) tells buyers to review customer files only under a confidentiality agreement. What belongs in the folders is what documents a buyer needs to acquire an insurance agency.
| Gate | What opens | Who sees it | What stays closed |
|---|---|---|---|
| Before the NDA | Aggregates: revenue by line and by carrier, retention, policy count, geography bands, premium bands | Every interested aggregator who has not yet signed | Names, addresses, policy numbers, unredacted AMS rows |
| NDA, ID-swapped export | A policy-level export with household IDs swapped for codes, plus commission statements and carrier mix | Every bidder who has signed the NDA | The key file that re-attaches names, and a raw AMS dump |
| After the LOI, confirmatory | A sampled set of named accounts the exclusive bidder has earned, ideally through a clean team or a neutral party | The exclusive bidder, and outside advisors under the NDA | Mass transfer of the named book |
ID-swapping has a practical limit. A large commercial account in a small town is identifiable without a name. Band premiums and widen geography so the row is a band, not a street. Have counsel review the cut.
Milly Books (21 October 2025) is plain that buyers do not contact named clients during diligence. Mass transfer of named records waits for close. Have counsel review.
Several aggregators bidding
One room with one audience per bidder is the default. Each aggregator sees only the folders that audience has earned. Q&A stays in the room: one group per bidder, and a published answer reaches only that bidder. How to keep competing buyers out of each other’s questions is how to keep buyers from seeing each other’s questions in a data room. Reply-all on a process email is how the wall fails.
| Control | What it does | How it fails |
|---|---|---|
| One audience per bidder | Each aggregator sees only allowed sections and files. | One shared Drive folder, or one DocSend link forwarded down the chain. |
| Agreement signed at the door | No file opens until the NDA is signed, versioned, with a certificate per signer. | Emailing the book while the NDA is still in draft. |
| Q&A private to that bidder | A published answer reaches only that audience. | A shared Q&A spreadsheet, or answering in email. |
| Watermark and page log | Preview and download carry the viewer. The log shows who opened which page. | A forwarded PDF with no trace. |
GLBA, New York 420, and expirations
The federal exception is 15 U.S.C. 6802(e)(7). It belongs to the financial institution, including an insurance agency that is a licensee. State insurance privacy rules can add requirements. 11 NYCRR 420.1(b)(1) (Cornell LII, retrieved 2026-10-02) applies Part 420’s financial-information rules to products obtained primarily for personal, family or household purposes. It does not apply to information about companies, or about individuals who obtain products for business, commercial, or agricultural purposes. A commercial-lines book may sit outside those rules, but 420.1(b)(2) still covers all nonpublic personal health information. Have counsel review.
Carrier agency agreements decide who owns the expirations. PIA Northeast (25 September 2026) says ownership of expirations and customer relationships may vary by carrier contract, and that some agreements restrict transfer or require approval. Independent Agent magazine (2 March 2021) cites National Fire Insurance Company v. Sullard, 97 A.D. 233 (N.Y. App. Div. 1904): in the absence of a contract to the contrary, the independent agent owns the expirations. Have counsel review the appointment contracts. This page is not a template. See What is Cashpian?, and pricing.
FAQ
Does GLBA let me share the book with a buyer?
15 U.S.C. 6802(e)(7) excepts notice and opt-out for a proposed or actual sale or merger if the disclosure concerns solely consumers of that unit.
State insurance privacy rules can add requirements.
Have counsel review.
When do named policyholders go in the room?
After the LOI, for confirmatory sampling, ideally through a counsel-supervised clean team or a neutral party.
Aggregates go earlier.
Mass transfer of named records waits for close.
Have counsel review.
What if several aggregators are bidding?
One audience per bidder.
Keep Q&A in the room, one group per bidder.
A published answer reaches only that bidder.
Email is how the wall fails.
Does using a data room make the agency GLBA compliant?
No.
GLBA and state insurance privacy rules belong to the licensee.
A room vendor does not satisfy them.
Have counsel review.
Sources
- Cornell LII, 15 U.S.C. 6802, retrieved 2026-10-02. Section 6802(e)(7) is the sale-or-merger exception quoted above.
- Cornell LII, 11 NYCRR 420.15 and 11 NYCRR 420.1, retrieved 2026-10-02. 420.15(a)(6) is the New York sale-or-merger exception. 420.1(b)(1) is the personal, family or household scope.
- PIA Northeast, The legal checklist every insurance agency buyer needs, 25 September 2026, retrieved 2026-10-02. Confidentiality before customer files. Expirations may vary by carrier contract.
- Independent Agent magazine, Independent Agents Own Their Data But Contract Language Is Still Important, 2 March 2021, retrieved 2026-10-02. National Fire v. Sullard, 97 A.D. 233 (N.Y. App. Div. 1904).
- Milly Books, A Guide to Customer & Book of Business Due Diligence, 21 October 2025, retrieved 2026-10-02. Do not contact named clients during diligence.
If the files are already in a folder, grade which row they are on. Cashpian is a gated room for that packet. It is not a listing portal. It does not sell the company or run the deal.