Skip to content

CFA Level I Exam · Guidance for Standard III: Duties to Clients

Standard III(E): Preservation of Confidentiality Explained

Updated 7 October 2026 · Fact-checked

Standard III(E) says members and candidates must keep information about current, former and prospective clients confidential. The exceptions are: the information concerns illegal activity, disclosure is required by law, or the client permits disclosure. To solve a question, identify the information, then test it against these three exceptions.

Understand Preservation of Confidentiality

Clients share private details with you: their wealth, goals, family situation and holdings. They do this because they trust you. Standard III(E) Preservation of Confidentiality protects that trust. The official text says members and candidates must keep information about current, former, and prospective clients confidential unless: the information concerns illegal activity on the part of the client or prospective client; disclosure is required by law; or the client or prospective client permits disclosure of the information.

The duty covers three groups. Current clients, former clients and prospective clients. It does not end when the relationship ends. It also applies to someone who only talked to you about becoming a client, even if they never signed.

Members must comply with the stricter of applicable law and the Code and Standards (Standard I(A)). Where local law sets no confidentiality rule, the Standard still applies. Where the law is stricter, follow the law. The Standard covers information you received in the course of the professional relationship, whether it is written, spoken or electronic.

The three exceptions are narrow. Illegal activity means the client's own illegal conduct. Required by law means a legal duty to disclose, such as a valid court order or a regulator's demand. Client permission means the client allows disclosure, ideally clearly and in writing. If none of the three applies, you stay silent.

The Standard does not stop you from sharing information with others in your firm who work on the client's account, such as supervisors or compliance staff, when they need it to serve the client. It also does not stop you from complying with a firm's legitimate recordkeeping rules. But you must not pass the information to people with no need to know. Be careful with electronic records. Store them securely and share only what is necessary.

The Standard also does not require you to hide a client's illegal conduct. It permits disclosure in that case. Whether to disclose is a judgment, and consulting your compliance department or legal counsel first is sensible. Note that the Standard permits disclosure in that case; it does not demand it unless the law does.

Key formulas to remember

Duty under Standard III(E)
Keep confidential: information about current, former and prospective clients
Applies to all three groups and continues after the relationship ends.
Exception 1
Information concerns illegal activity by the client or prospective client
Disclosure is permitted. Seek compliance or legal advice first.
Exception 2
Disclosure is required by law
For example a valid court order or regulator request. Disclose only what the law requires.
Exception 3
Client or prospective client permits disclosure
Get clear permission, preferably in writing, and keep within its scope.

How to solve Preservation of Confidentiality questions

Use the same short test on every III(E) question. It works for scenarios about disclosure, records, former clients and tips from authorities.

  1. 1Identify what information is involved and whose it is: a current, former or prospective client.
  2. 2Ask who wants it or who will receive it: a regulator, a court, another client, a friend, a colleague, the press.
  3. 3Check exception 1: does the information concern illegal activity by the client?
  4. 4Check exception 2: is disclosure required by law, such as a valid legal order?
  5. 5Check exception 3: has the client given permission, and does it cover this disclosure?
  6. 6If a colleague needs it to serve the client, internal sharing on a need-to-know basis is fine.
  7. 7If no exception applies, choose the answer that keeps the information confidential. If one applies, pick the answer that limits disclosure to what is needed.

Quickest way: Three-exception scan

When to use it: Use it when you have about 90 seconds and the stem describes someone asking for or sharing client information.

  1. Underline who the client is and who is asking.
  2. Scan the options for the three exceptions: illegal activity, required by law, client permission.
  3. Eliminate any option that discloses without one of these.
  4. Between two remaining options, pick the one that discloses less or consults compliance or legal counsel.

Common mistakes in Preservation of Confidentiality

  • Thinking the duty ends when the client leaves

    Students link confidentiality to an active relationship.

    Fix: Remember the text covers current, former and prospective clients.

  • Forgetting prospective clients

    No account was opened, so it feels like no duty exists.

    Fix: Anyone who shared information while considering your services is protected.

  • Treating a mere request from an authority as legal compulsion

    Students assume any official request must be obeyed.

    Fix: The exception is disclosure required by law. Confirm the legal obligation, ideally with compliance or counsel, and give only what is required.

  • Assuming you must always report client illegal activity

    Students confuse permission with obligation.

    Fix: The Standard permits disclosure for illegal activity. A duty to report arises only if the law requires it.

  • Banning all internal sharing

    Students read confidentiality as total secrecy.

    Fix: Colleagues who work on the client's account and need the information may receive it. Keep it to need-to-know.

  • Applying the illegal-activity exception to any questionable conduct

    Students stretch the exception to unethical or merely suspicious behavior.

    Fix: The exception concerns illegal activity by the client. Without it, stay silent unless another exception applies.

Worked examples

Example 1

An analyst at an asset manager is asked by a friend at a competing firm about a former client's portfolio holdings. The former client left the firm two years ago. According to Standard III(E), the analyst should:
A. decline to share the information.
B. share it because the client is a former client.
C. share only the largest holdings.

Show the solution
  1. Information involved: portfolio holdings of a former client.
  2. Recipient: a friend at a competitor, with no legal right to it.
  3. Exception 1: no illegal activity is mentioned.
  4. Exception 2: no legal requirement is mentioned.
  5. Exception 3: the client has not given permission.
  6. Former clients remain protected, and partial disclosure is still disclosure. So B and C are out.

Answer: A. The analyst should decline, since no exception applies and the duty continues after the relationship ends.

Example 2

A portfolio manager learns from a client that the client is using the account to launder money. The manager is unsure what to do. Under Standard III(E), the manager:
A. must keep the information confidential because the client has not permitted disclosure.
B. may disclose the information to the proper authorities because it concerns illegal activity.
C. may disclose it publicly to warn other clients.

Show the solution
  1. The information concerns illegal activity by the client, so exception 1 applies.
  2. A is wrong because the illegal-activity exception permits disclosure, so confidentiality is not mandatory in this case even without client permission.
  3. Disclosure should go to the proper authorities, not to the public or other clients, so C goes beyond what is justified.
  4. Consulting compliance or legal counsel first is good practice.

Answer: B. The manager may disclose to the proper authorities because the information concerns illegal activity.

Exam tips

  • Memorize the three exceptions in the official order: illegal activity, required by law, client permission.
  • If the facts show illegal activity by the client, disclosure to the proper authorities is permitted. Check that the activity is the client's own.
  • Watch for limited or public disclosure: telling the press or other clients is rarely right.
  • Check whether the person is a former or prospective client. The answer is still confidentiality.
  • Between two plausible options, prefer the one that consults compliance or legal counsel or discloses the minimum.

Practice questions from Guidance for Standard III: Duties to Clients

Preservation of Confidentiality in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Preservation of Confidentiality: frequently asked questions

What does Standard III(E) require?

It requires members and candidates to keep information about current, former and prospective clients confidential. The exceptions are illegal activity by the client, disclosure required by law, and client permission.

When can a CFA charterholder disclose client information?

Only when the information concerns illegal activity by the client, the law requires disclosure, or the client permits it. Otherwise the information stays confidential.

Does confidentiality apply to prospective clients?

Yes. Anyone who shared information while considering your services is covered, even if they never became a client.

Must I report a client's illegal activity?

The Standard permits disclosure in that case. You must report only if the law requires it, so check with compliance or legal counsel.