Skip to content

CFA Level II Exam · Guidance for Standard III: Duties to Clients

Preservation of Confidentiality (Standard III(E)) for CFA Level 2

Updated 7 October 2026 · Fact-checked

Standard III(E) requires you to keep information about current, former and prospective clients confidential. You may disclose it only if it concerns illegal activity, if the law requires disclosure, or if the client permits it. To solve questions, identify whose information it is, then test it against the three exceptions.

Understand Preservation of Confidentiality (Standard III(E))

Standard III(E) says members and candidates must keep information about current, former and prospective clients confidential. The exceptions are: the information concerns illegal activity by the client, disclosure is required by law, or the client or prospective client permits disclosure.

The duty protects the client relationship. Clients share personal and financial details so you can advise them well. If they feared that information would spread, they would hold back, and your advice would suffer. The duty continues after the relationship ends. It also covers prospective clients who shared information with you but never hired you.

The Standard is about information received through the relationship. It can cover facts about finances, holdings, plans and family. It does not turn every fact into a secret. Public information, such as a client's name appearing in a published filing, is not confidential in the same way. Also, the Standard covers information the client gave you. It is separate from the rules on material nonpublic information, which are Standard II(A).

The exceptions are narrow. If the information concerns illegal activity, you may disclose it to the proper authorities. The Standard permits this. It does not say you must always do it. Whether you must report depends on the law where you work, and Standard I(A) then applies. If a law or regulation requires disclosure, you must comply. If the client permits disclosure, you may share it as agreed.

In practice, you should also be careful with internal sharing. Share client information within your firm only with those who need it for the client's service, such as supervisors or compliance staff. Keep records secure, including electronic ones. The guidance also says you may share information with your firm's supervisors or compliance staff if it relates to illegal activity, so they can handle it.

Key formulas to remember

Core duty
Keep confidential all information about current, former and prospective clients
The duty covers all three groups and does not end when the relationship ends.
Exception 1
Information concerns illegal activity by the client
Disclosure to the proper authorities is permitted. It is not a general licence to share.
Exception 2
Disclosure is required by law
Comply with a legal or regulatory duty to disclose, for example a valid court order.
Exception 3
Client or prospective client permits disclosure
Disclosure goes only as far as the permission allows.
Scope limit
Duty applies to information received through the client relationship
Keep it distinct from Standard II(A), which deals with material nonpublic information.

How to solve Preservation of Confidentiality (Standard III(E)) questions

Use this method on any Standard III(E) item. Read the vignette for who shared what, with whom, and why.

  1. 1Identify the information: what was shared, and did it come from a client, former client or prospective client?
  2. 2Identify who the member or candidate disclosed it to, or plans to disclose it to, and why.
  3. 3Test the three exceptions in turn: illegal activity, legal requirement, client permission.
  4. 4If an exception applies, check its limits. Illegal activity permits disclosure to proper authorities. Permission covers only what the client allowed.
  5. 5If no exception applies, the disclosure violates Standard III(E).
  6. 6Check whether internal sharing is limited to people who need the information, such as supervisors or compliance staff.
  7. 7Check whether other Standards also apply, such as I(A) for the law or II(A) for material nonpublic information.
  8. 8Pick the option that names the correct Standard and action, and reject options that are too broad or that confuse permission with obligation.

Quickest way: Three-exception test

When to use it: Use it when a vignette shows someone disclosing or considering disclosing client information and time is short.

  1. Ask: is it client information, including former or prospective clients? If yes, the default is confidential.
  2. Scan for one of three triggers: illegal activity, legal requirement, client consent.
  3. No trigger means a violation. A trigger means disclosure may be allowed, within its limits.
  4. Watch the wording: permitted is not the same as required.

Common mistakes in Preservation of Confidentiality (Standard III(E))

  • Thinking the duty ends when the client leaves

    Students link confidentiality to an active advisory relationship.

    Fix: Remember the Standard covers current, former and prospective clients. The duty survives the end of the relationship.

  • Believing the member must always report client illegal activity

    The exception is read as a duty to report.

    Fix: The Standard permits disclosure of illegal activity. Any duty to report comes from law, which is a separate exception and links to Standard I(A).

  • Ignoring prospective clients

    People assume only paying clients are protected.

    Fix: A person who shared information while considering hiring you is protected, even if they never became a client.

  • Treating a client's consent as unlimited

    Students see 'permission' and stop reading.

    Fix: Disclosure is allowed only to the extent the client permitted. Check who may receive it and what may be shared.

  • Confusing Standard III(E) with Standard II(A)

    Both involve nonpublic information.

    Fix: III(E) protects client information from the relationship. II(A) bars trading on or sharing material nonpublic information about securities. Identify which one the facts raise, and apply both if both fit.

Worked examples

Example 1

Vignette: Mei Lin, an analyst, manages a portfolio for Kofi Mensah. Kofi's account later closed when he moved to another firm. At a dinner, a friend asks Mei Lin what Kofi's holdings were. Mei Lin says Kofi held mostly real estate funds and cash, and that he was planning a large house purchase. Q1: Does Mei Lin violate the Standards? Q2: Does the closing of the account change the duty? Options for Q1: A) No, because he is no longer a client; B) Yes, Standard III(E); C) Yes, Standard III(C).

Show the solution
  1. Identify the information: holdings and plans shared by a client during the relationship, so it is client information.
  2. Identify the disclosure: told to a friend at a dinner, with no stated reason.
  3. Test the exceptions: no illegal activity, no legal requirement, no client permission.
  4. No exception applies, so the disclosure breaches Standard III(E).
  5. Q2: the Standard covers former clients, so closing the account does not end the duty.
  6. Standard III(C), Suitability, concerns recommendations fitting client needs, so it does not fit.

Answer: Q1: B, Mei Lin violates Standard III(E). Q2: No. The duty continues for former clients.

Example 2

Vignette: Ravi Shah, a portfolio manager, learns from a client's documents that the client is using his account to move funds in a scheme that appears to break securities law. Ravi reports this to his firm's compliance officer. Later, a regulator issues a formal legal demand for the client's records. Q1: May Ravi inform his compliance officer without breaching III(E)? Q2: May Ravi provide the records to the regulator? Q3: Is Ravi required by Standard III(E) itself to report the scheme to authorities? Options for Q3: A) Yes, always; B) No, the Standard permits disclosure but any obligation comes from law; C) No, he must stay silent.

Show the solution
  1. Q1: the information concerns apparent illegal activity, so an exception applies. Sharing with compliance staff, who need to handle it, is consistent with the Standard.
  2. Q2: a formal legal demand means disclosure is required by law, which is a second exception. Ravi may comply, ideally after confirming with compliance or legal staff that the demand is valid.
  3. Q3: the illegal-activity exception allows disclosure to proper authorities but does not itself impose a duty. Any duty to report comes from applicable law, and Standard I(A) requires him to follow it.
  4. Option A overstates the Standard and option C ignores the exceptions, so B is correct.

Answer: Q1: Yes. Q2: Yes, because the law requires it. Q3: B.

Exam tips

  • Look for the trigger words: illegal activity, required by law, client consent. Their absence usually points to a violation.
  • Watch for permitted versus required. Illegal activity gives permission, and the law gives the obligation.
  • Remember former and prospective clients are covered. Wrong options often limit the duty to current clients.
  • Check whether a vignette also raises another Standard, such as I(A) or II(A), and choose the option that names the right one.
  • Internal sharing on a need-to-know basis, such as with supervisors or compliance, is usually acceptable. Casual sharing outside the firm usually is not.

Preservation of Confidentiality (Standard III(E)) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Preservation of Confidentiality (Standard III(E)): frequently asked questions

What are the exceptions to Standard III(E)?

There are three. The information concerns illegal activity, disclosure is required by law, or the client or prospective client permits disclosure. Outside these, you must keep client information confidential.

Does Standard III(E) apply to former and prospective clients?

Yes. The Standard covers current, former and prospective clients. The duty does not end when the relationship ends, and it applies to people who shared information while considering your services.

What is the difference between confidentiality and a duty to report?

Standard III(E) lets you disclose client illegal activity to proper authorities, but it does not by itself require you to. A duty to report arises from the law that applies to you, and Standard I(A) requires you to follow that law.

Is Standard III(E) the same as the rule on material nonpublic information?

No. III(E) protects information you received through a client relationship. Standard II(A) deals with material nonpublic information about securities and the ban on acting on it. A single case can raise both.