MVA White Collar Defense, Investigations, and Regulatory Advice Blog

North Carolina recently enacted legislation designed to encourage financial institutions to take proactive steps to prevent the financial exploitation of older and disabled adults. On July 7, 2026, Governor Josh Stein signed Senate Bill 595 into law. Part XIII of the law, which became effective upon enactment, updates Article 6A of Chapter 108A of the North Carolina General Statutes and gives financial institutions (banks, savings institutions, credit unions, trust companies and other covered financial companies) new authority to delay or refuse certain transactions when exploitation of an older or disabled adult customer is suspected.

The legislation significantly expands North Carolina's prior framework, which was largely limited to mandating reporting of suspected financial exploitation to law enforcement and adult protective services. Consistent with the approach taken by multiple other states, the new law adds a more proactive tool: a financial institution may temporarily pause certain customer-directed transactions when it reasonably believes that financial exploitation of an older or disabled adult is occurring, may have occurred, or has been attempted. It also expands the definition of “financial exploitation” to explicitly include the acts or omissions of those exercising control over the customer’s assets through a power of attorney, guardianship, or conservatorship.

For financial institutions, compliance personnel, and frontline employees, the law creates both new authority and new compliance responsibilities. The statute seeks to balance two important interests: protecting vulnerable customers from fraud and abuse while preserving their ability to access and control their funds. It also recognizes the need to protect financial institutions from liability when they intervene in suspected cases of exploitation.

Financial Institutions May Delay or Refuse Suspicious Transactions

The centerpiece of Part XIII is the authority it grants financial institutions to delay or refuse transactions. When a financial institution reasonably suspects exploitation of an older or disabled adult customer based on observable conduct or information received from law enforcement, it may, but is not required to:

• delay or refuse transactions involving the customer;
• delay or refuse withdrawals or disbursements from the customer’s account;
• prevent a change in ownership of the account;
• prevent a transfer of funds from the account to another account that is owned wholly or partially by another person;
• refuse to comply with instructions under a power of attorney that was signed, or claimed to have been signed, by the customer, and
• prevent the designation, or change in designation, of beneficiaries that would receive any property, benefit or contract right of the customer.

An institution may delay a transaction for 30 business days and, if warranted, extend the delay for up to an additional 30 business days. A delay, however, must be terminated earlier if the institution concludes its internal review and determines, in its discretion, that the transaction is unlikely to result in financial exploitation or upon receipt of a court order directing the institution to release the funds.

The addition of this authority brings North Carolina law more in line with the approach taken in other jurisdictions that have adopted so-called “hold and report” laws. A March 2025 report by the American Bankers Association Foundation found that approximately half of states had enacted laws permitting depository institutions to delay or hold transactions when elder financial exploitation is suspected, while an even larger number of states authorize similar holds by broker-dealers and investment advisers under model act provisions. North Carolina is not alone in recently adopting this authority. Idaho's law became effective July 1, 2025, and Georgia's law became effective July 1, 2026, both permitting an initial 15-business-day hold that may be extended for up to an additional 15 business days.

Institutions Must Conduct Internal Reviews and Maintain Records

Financial institutions that delay or refuse transactions must satisfy certain procedural and operational requirements. An institution must promptly begin an internal review of the facts and circumstances that led to its employee’s decision to refuse or delay the transaction.

The law also imposes specific recordkeeping obligations. Financial institutions must maintain records of a delay or refusal for at least five years, including the date the action was taken, identifying information of the affected customer, the relevant business location, the name and title of the employee who suspected exploitation, and the relevant facts and circumstances giving rise to the suspicion of exploitation.

Institutions May Communicate with Trusted Contacts

Part XIII expressly provides financial institutions with the option, but not the requirement, to communicate with a customer’s trusted contact when financial exploitation is suspected. A “trusted contact” includes an individual designated by the customer, a joint account holder, authorized signer, beneficiary, agent under a power of attorney, attorney, trustee, guardian, conservator, other fiduciary, or certain family members.

This authority may be valuable when the institution needs additional information or assistance in protecting the customer. At the same time, institutions should be attentive to circumstances where the trusted contact may be involved in the suspected exploitation. In such cases, the Act expressly provides that institutions may choose not to notify, or limit information provided to, any designated trusted contact the institution believes may be involved in the exploitation of the customer.

The Law Provides Safe Harbor Protection for Good-Faith Action

To encourage proactive intervention, the statute provides financial institutions and their employees with immunity from civil, criminal, or administrative liability when acting in good faith and with reasonable care.

The law ties those protections to the institution’s prior implementation of a compliance framework containing the following elements, which is deemed by the law to represent the use of reasonable care:

• the institution has established training policies or programs reasonably designed to educate employees performing or approving transactions on issues related to financial exploitation;
• employees receive training within one year of becoming employed by the institution or its affiliate, and
• the institution has developed, maintains, and enforces written procedures governing internal reporting of suspected cases of exploitation and their internal review.

The law stipulates that its provisions do not (i) alter the institution’s obligations to its customers, trusted contacts, and those authorized to transact business on the customer’s account, provided it had a reasonable belief exploitation may have been involved, or (i) create new rights or impose new obligations or duties on institutions.

Practical Implications

Rather than focusing solely on reporting suspected exploitation after it occurs, North Carolina's new law encourages financial institutions to take proactive measures to protect older and disabled adults. By providing a statutory safe harbor, the law gives institutions greater confidence to delay or deny transactions while investigating indicators of potential exploitation.

The law makes clear financial institutions are not required to take these protective measures, but if they do, then institutions should review and update policies and programs for training their employees in identifying red flags, and design, implement and enforce reporting and internal review procedures as well as documentation and recordkeeping requirements.

Compliance, legal, operations, and front-line teams will need to work closely to ensure transaction holds are applied appropriately, preserving the institution's ability to rely on the safe harbor while avoiding unnecessary interference with legitimate customer transactions. Financial institutions that operate across state lines will also need to confirm their practices in each state are aligned with the specifics of that state’s law. State-specific nuances such as the amount of time permitted for the hold, the documentation that must be retained, and any required reporting upon placement of the hold may lead to operational complexities in implementing a single approach across all branches and customer service centers.