How to share client data with an RIA buyer during due diligence?
Share client data with an RIA buyer in three stages: blind household AUM and revenue before the LOI; identifiable files only for confirmatory sampling after it; mass transfer of named client records at close, with the client-consent process the firm already uses.
The Regulation S-P sale-or-merger exception belongs to the firm. California can be stricter. Ask your compliance counsel. This page is not a template.
Staged client-data share (definition). Blind household AUM and revenue before the LOI.
Identifiable files only for confirmatory sampling after it.
Mass transfer of named records at close, with the firm’s client-consent process.
A Drive dump of the book is not this share.
Three stages, not one folder
A registered investment adviser sharing client files with a buyer is disclosing nonpublic personal information. 17 CFR 248.15(a)(6) (eCFR, current as of 30 September 2026) excepts the notice and opt-out requirements when you disclose that information “in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit if the disclosure of nonpublic personal information concerns solely consumers of such business or unit.” Kitces (22 November 2023) is plain that the exception belongs to the financial institution, not a departing adviser, and that the seller should still anonymize or redact nonpublic personal client information until later in the transaction. How to strip names is how to anonymize client data when selling a wealth management firm. What belongs in the folders is what documents a buyer needs to acquire a financial advisory practice. The general company-sale staging is how an M&A advisor should stage data room access from IOI to LOI.
| Gate | What opens | Who sees it | What stays closed |
|---|---|---|---|
| NDA, before the LOI | Blind household AUM and revenue, fee mix, age bands, concentration, Form ADV | Every bidder who has signed the NDA | Names, addresses, account numbers, unredacted household rosters |
| After the LOI, confirmatory | A sampled set of identifiable files the exclusive bidder has earned | The exclusive bidder, and outside advisors under the NDA | Mass transfer of the named book |
| Close, with consent | Named client records, custodian transfers, assignment of advisory agreements | The buyer, on the firm's client-consent process | A dump that skipped consent because the deal signed |
Several aggregators bidding
One room with one audience per bidder is the default. Each aggregator sees only the folders that audience has earned. Q&A stays in the room: one group per bidder, and a published answer reaches only that bidder. How to keep competing buyers out of each other’s questions is how to keep buyers from seeing each other’s questions in a data room. Reply-all on a process email is how the wall fails.
| Control | What it does | How it fails |
|---|---|---|
| One audience per bidder | Each aggregator sees only allowed sections and files. | One shared Drive folder, or one DocSend link forwarded down the chain. |
| Agreement signed at the door | No file opens until the NDA is signed, versioned, with a certificate per signer. | Emailing the CIM while the NDA is still in draft. |
| Q&A private to that bidder | A published answer reaches only that audience. | A shared Q&A spreadsheet, or answering in email. |
| Watermark and page log | Preview and download carry the viewer. The log shows who opened which page. | A forwarded PDF with no trace. |
California, and the vendor as service provider
Cal. Fin. Code 4052.5 (California Financial Information Privacy Act) requires explicit prior consent before a financial institution sells, shares, transfers, or otherwise discloses nonpublic personal information to a nonaffiliated third party, except as 4053, 4054.6, and 4056 allow. 4056(a) does not apply to information that is not personally identifiable to a particular person. This page does not pick which 4056 exception, if any, covers a given deal. Ask your compliance counsel.
The SEC’s 16 May 2024 amendments to Regulation S-P (Rel. 34-100155; Federal Register 3 June 2024) define a service provider as “any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.” A data-room vendor holding client files fits that description. 17 CFR 248.30(a)(5) requires the covered institution to oversee that vendor, including a notice from the vendor as soon as possible, but no later than 72 hours after becoming aware of a breach in a customer information system it maintains. FINRA’s compliance-date reminder puts larger entities on 3 December 2025 and smaller entities on 3 June 2026. The firm stays responsible. No room on this page satisfies Regulation S-P for the firm. See What is Cashpian?, and pricing.
FAQ
Does Regulation S-P let me share client files with a buyer?
17 CFR 248.15(a)(6) excepts notice and opt-out for a proposed or actual sale, merger, transfer, or exchange of all or a portion of a business or operating unit, if the disclosure concerns solely consumers of that business or unit.
The exception belongs to the firm.
Ask your compliance counsel.
When do named clients go in the room?
After the LOI, for confirmatory sampling.
Blind household AUM and revenue go earlier.
Mass transfer of named records waits for close and the firm's client-consent process.
What if several aggregators are bidding?
One audience per bidder.
Keep Q&A in the room, one group per bidder.
A published answer reaches only that bidder.
Email is how the wall fails.
Does using a data room make the firm Regulation S-P compliant?
No.
Under amended Regulation S-P, a vendor permitted access to customer information is a service provider the firm must oversee.
The covered institution stays responsible for notice and oversight.
Ask your compliance counsel.
Sources
- eCFR, 17 CFR 248.15, current as of 30 September 2026, retrieved 2026-10-01. Section 248.15(a)(6) is the sale-or-merger exception quoted above.
- SEC, Press Release 2024-58, 16 May 2024, and Rel. 34-100155, published 3 June 2024 (89 FR 47786), retrieved 2026-10-01. Incident response, 30-day individual notice, service-provider oversight.
- FINRA, Cybersecurity Advisory - SEC Regulation S-P compliance date reminder, retrieved 2026-10-01. Larger entities 3 December 2025; smaller entities 3 June 2026.
- California Legislative Information, Cal. Fin. Code 4052.5 and 4056, retrieved 2026-10-01. Opt-in, with the 4056 carve-outs counsel must read.
- Kitces, 5 Important Legal Steps Of An RIA Sale, Merger Or Acquisition, 22 November 2023, retrieved 2026-10-01. Anonymize until later. The sale-of-business exception belongs to the firm.
If the files are already in a folder, grade which row they are on. Cashpian is a gated room for that packet. It is not a listing portal. It does not sell the company or run the deal.