🌐English|Español|中文|Português|Français|Deutsch|Italiano
HomeKnowledge › Privacy and Confidentiality
Privacy and confidentiality · A PPLI advantage

What PPLI changes about who can see your wealth

Hold wealth in your own name and your name is on every statement, on every fund's investor list and, at the end, in a court file anyone can search. Inside a policy, an insurance company holds the investments and you hold a contract. The tax authority still sees everything. Almost nobody else does.
At the end of a life, in California
3
public court filings for a portfolio held directly: the will, the inventory with appraised values, the final accounting
0
filings for the same portfolio inside a policy owned by a trust
Cal. Prob. Code §5000; Nixon v. Warner Communications. Set out below.
In one minute

Why your name stops travelling with your money

01
Without PPLI

Your name goes wherever the money goes: custodial statements at the house, your name and the size of your cheque on every fund's investor register, and at death an inventory and an accounting in a public court file.

02
With PPLI

An insurance company owns the investments. Fund managers, administrators, court clerks and the people who open your post are looking at an institution, not at you. Nothing is filed anywhere at death.

03
The catch

This is confidentiality, not secrecy. The carrier reports the contract to the tax authority and so do you. In litigation a court can still order production. A policy sold as invisibility is a policy sold dishonestly.

Six moments when somebody gets to look

The same wealthy family, twice. Two of the six come out the same in both columns, and they are marked, because that is where a good deal of marketing goes quiet.

You die, leaving three children unequal shares

Without PPLI

The inventory and the final accounting are filed with the court. Each child reads what the others received, in a public document.

With PPLI

The death benefit is paid to the trust. Nothing is filed. The trustee tells each child what they receive, in the order you chose.

You commit to a private fund

Without PPLI

Your name and the size of your cheque sit on the investor register, in front of the general partner, the administrator and the other investors.

With PPLI

The investor of record is an insurance company's segregated account. The fund sees an institution.

Statements arrive at the house

Without PPLI

Custodial statements, K-1s and the family office report circulate to staff, an accountant, a bookkeeper and sometimes a spouse's adviser.

With PPLI

One policy statement goes to the policyholder. Where a trust owns the contract, that is a trustee's office.

A journalist looks for you on a register

Without PPLI

Entity registers may show you. In the European Union a journalist can demand access on a demonstrated legitimate interest.

With PPLI

There is no register of policies, in any country. A policy is a contract, not a company.

No difference

The tax authority asks

Without PPLI

Your accounts and income are reported in the ordinary way.

With PPLI

The carrier reports the contract under FATCA or the Common Reporting Standard, and a United States holder files Form 8938 and the FBAR. Nothing changes here.

No difference

A former spouse's lawyer serves a subpoena

Without PPLI

Anything relevant can be demanded under Rule 26, and a subpoena reaches your custodian.

With PPLI

A policy, its value and its holdings can be demanded where relevant. Only a protective order keeps them out of a public court file.

Who can reach the money, as distinct from who can see it, is a different question with a different answer, on our page on asset protection. What the insurer's account may hold, and what you can change inside it later, is on investment flexibility.

The same family, twice

The clearest way to see the difference is to run one set of facts through two structures and look at what each one leaves behind on paper.
Two families hold an identical portfolio. Same managers, same allocation, same value. Both parents die in the same year, in California, leaving three adult children in unequal shares, which is a common arrangement and almost always a considered one. The first family holds the portfolio directly. The second holds the same portfolio inside a policy owned by a trust.
Public record
Superior Court of California · Probate file
Inventory and Appraisal, then the Final Accounting
Brokerage accounts, appraised value
Private fund interests, appraised value
Residence, appraised value
Distribution to the first child
Distribution to the second child
Distribution to the third child
Every shaded figure is a real number in a file that anybody can ask for. The children learn each other's shares from this document rather than from their parents, and the conversation that follows is not the one the parents had imagined.
Not filed anywhere
The trustee's office · Policy owned by the family trust
Death benefit paid under the contract
There is no inventory, because there is no probate asset to inventory. There is no accounting in a court file. The trustee tells each child what they are receiving, in the order and with the explanation the parents chose while they were alive to choose it.
Carrier's report to the tax authority Made, as required
Document at the clerk's office None
Who knows each child's share The trustee
Same money. Same heirs. Same intentions. A different set of documents, decided years earlier by which instrument happened to hold the asset.
That is the whole point, and it costs nothing extra to get right if somebody thinks about it in time. Whether wealth should be private within a family is a real question with two respectable answers. What we insist on is that the family decide it deliberately, because the default answer is set by the instrument, and most people never realise they chose.

Map your own disclosure surface

Pick what the family holds and who you are actually thinking about. The tool answers with what those people can see today and what would change inside a policy, including the lines where the answer is nothing. It runs in your browser and sends nothing anywhere.
Disclosure map
Who can see what, in your own situation
What the family holds
Brokerage and bank accountsPrivate fund commitmentsAn operating company or holding entityReal estateA family office that produces reportsAssets that would pass under a will
Who you are thinking about
The tax authorityA former spouse's lawyer, or a creditorBusiness partners and co-investorsYour own childrenThe public and the press
This is a map of who receives documents, not legal advice and not a prediction about any proceeding. The authorities for each line are in the technical half of this page.
The part we would rather say first

And the part that is not true

A policy is not invisible to a tax authority. A cash value policy issued outside the United States is among the most comprehensively reported assets an American can hold. The carrier reports it. The holder reports it. That has been the position for more than a decade, it is not changing, and any adviser who suggests otherwise is selling something that stopped working before most of their clients had heard of it.
What confidentiality means here
Confidential from the people around a family.
What it does not mean
Visible to the government entitled to see it.
If a family's interest in this structure depends on the second half being false, the structure is wrong for them, and we say so early rather than late. What remains after that concession is still substantial, and the rest of this page sets it out with the statutes, regulations and judgments each point rests on.
Private assessment

Who can see your structure today?

An independent review can map the disclosure surface of an existing arrangement.
Confidential. Never shared.

What the law requires to be reported

The plain version is above. Here is the same point with the provisions it rests on, because a claim about reporting is only worth what its citations are worth.
The IRS answers the question directly in its own comparison table: a foreign issued life insurance or annuity contract with a cash value is reportable on Form 8938 and reportable on the FBAR. The FBAR rule reaches it through 31 C.F.R. §1010.350(c)(3)(ii), which puts an insurance policy with a cash value inside the definition of an other financial account. On the FATCA side, Treas. Reg. §1.1471-5 makes the carrier a specified insurance company and the contract a financial account once cash value passes fifty thousand dollars in a calendar year, which every policy in this market does on day one. Outside the United States the Common Reporting Standard does the same job through the carrier, and it has no cash value floor at all.
We set out the mechanics of each of those regimes elsewhere, because they belong with the tax material rather than here. The reporting picture in full is in PPLI and international clients, and the reason none of the economics depends on non-disclosure is in the section of our tax efficiency page headed what PPLI does not do.
A tax authority sees the policy. A tax authority is not the person a family is usually worried about, and none of the people they are worried about has access to an exchange of information agreement. The question worth asking is not whether the structure is invisible. It is who, specifically, gains a right to look, and through which door. The rest of this page answers that door by door.

The public record, and what never enters it

This is the strongest and least discussed privacy point in the whole subject, and it has nothing to do with offshore anything. It is a question of which documents end up in a court file.

A will becomes a public document. A beneficiary designation does not

Probate is a court proceeding. The will, the petition, the inventory and appraisal, the creditor claims and the final accounting are filed with the court, and courts are open. The Supreme Court put the principle plainly in Nixon v. Warner Communications: the courts of this country recognise a general right to inspect and copy public records and documents, including judicial records and documents. We set out the state by state position, which varies far more than most advisers expect, in our research on what a probate file discloses.
Life insurance proceeds paid to a named beneficiary do not go through that process. California Probate Code §5000(a) is representative and unusually clear, because it names insurance policies first: a provision for a non-probate transfer on death in an insurance policy is not invalid because the instrument does not comply with the requirements for execution of a will. The designation operates outside the will. It is not filed with a court. It does not appear in an inventory. There is no public document anywhere recording that the contract existed, what it held, or who received it.
That is genuine, citable privacy, and it is procedural rather than clandestine. It is also the point at which people usually object that a revocable trust achieves the same avoidance of probate, which is true and which is why we say so. The difference is what the two things disclose to the people inside them. A trust instrument is generally furnished to beneficiaries, and in most jurisdictions a trustee owes ongoing accounting duties to them. A beneficiary designation discloses one number to one person on one occasion.

One line of drafting undoes all of it

A policy payable to the estate rather than to a named beneficiary becomes a probate asset. It goes into the inventory, it is administered like a brokerage account, and it is exposed to the creditors of the insured. The usual cause is not a decision but an omission: a beneficiary line left blank, or never updated after a divorce so that it defaulted to the estate. The most valuable privacy work in an estate plan is done by whoever checks the designations, and in our experience nobody has checked them in years.

What the privacy here does not reach

Where proceeds are includible in the gross estate under §2042, they are reported on the estate tax return like anything else. The return is confidential under §6103(a), so this is a disclosure to the government rather than to the neighbours, and confusing the two produces a great deal of unnecessary anxiety. It is also the usual reason ownership sits in an irrevocable trust from the outset rather than with the insured, which is an estate planning question and we treat it there.

Registers, and the end of the anonymous entity

Much of what families believed about entity privacy in 2019 stopped being true, then partially became true again for different reasons. Both halves of that sentence matter, and the current position on each side of the Atlantic is not what most people assume.

The United States, as at August 2026

The Corporate Transparency Act was drafted to put beneficial ownership of American entities into a federal database. It has been substantially withdrawn. FinCEN's interim rule of 26 March 2025 exempted domestic reporting companies, and the final rule at 91 FR 52508, published and effective 14 August 2026, adopted that position as final. Reporting companies are exempt from reporting the beneficial ownership information of United States persons, exempt from submitting information about United States person company applicants, and United States persons are exempt from updating information already provided in connection with a FinCEN identifier.
What survives is narrow: a foreign formed entity registered to do business in a state or tribal jurisdiction, reporting only its non United States beneficial owners. Every entity created in the United States is out. The practical reading for a family is that the American entity register is not currently a disclosure surface, and that a rule reversed twice in eighteen months is not a foundation on which to build a twenty year structure. We have stopped treating register policy as a stable planning input, and we say so to clients who ask us to.

The European position after Sovim

In Europe the direction ran the other way. The Fifth Anti-Money Laundering Directive required member states to open beneficial ownership registers to any member of the general public. In WM and Sovim SA v Luxembourg Business Registers, decided by the Grand Chamber on 22 November 2022, the Court of Justice declared that requirement invalid. The interference with the rights guaranteed by Articles 7 and 8 of the Charter was serious and had not been shown to be limited to what was strictly necessary or proportionate.
The Court struck down indiscriminate public access, not the registers. Directive (EU) 2024/1640 replaced it with access for any person able to demonstrate a legitimate interest in preventing money laundering and terrorist financing, with the recitals identifying non-governmental organisations, academics and investigative journalists as within that category. Competent authorities, financial intelligence units and obliged entities were never affected and retain full access throughout. So the honest summary for a family with European entities is that the register is no longer open to the merely curious, and is open to precisely the categories of person most likely to write about them. That is a narrower protection than the headlines suggested when the judgment landed.
A policy is not an entity and does not appear in any of these registers. That is a real structural difference and it is worth stating once, plainly, without dressing it up. It is also not a reason to hold an entity inside a policy in order to make the entity disappear, which is a use we decline.

What the carrier is required to keep quiet

Institutional confidentiality is the part of this subject with real legal teeth, and it is almost never the part that gets marketed. It binds the people who hold the file.

Luxembourg, where the duty is criminal

Article 300 of the Luxembourg law of 7 December 2015 on the insurance sector places insurance undertakings and their staff under a legal obligation to keep confidential the information entrusted to them in the course of their professional activities, and extends that obligation to professionals operating in the sector, including under outsourcing arrangements. Breach is not merely a supervisory matter. It is prosecuted through Article 458 of the Criminal Code, which provides for imprisonment of eight days to six months and a fine of 500 to 5,000 euros for a person who, by state or profession, holds secrets entrusted to them and reveals them.
Read Article 458 to the end, because the carve-outs are written into it and they are the whole story. The duty does not apply where the person is called to give evidence in court, and it does not apply where the law obliges disclosure. That is precisely why Luxembourg insurance secrecy coexists with the Common Reporting Standard rather than defeating it. Article 300 was itself amended by the law of 29 March 2024, and we set out what that changed, along with who inside an institution actually reads a file, in our research on who inside a carrier sees the file.

Switzerland, and the difference between a bank and an insurer

Switzerland has no criminal insurance secrecy statute equivalent to Article 47 of the Banking Act. What protects a policyholder's data at a Swiss carrier is data protection law, contract and supervisory law. The revised Federal Act on Data Protection has been in force since 1 September 2023, and Article 62 makes breach of professional confidentiality punishable by a fine of up to 250,000 francs, prosecuted on complaint. Note the shape of that: it is a criminal fine on an individual, not an administrative penalty on a company, which is a genuine structural difference from the European regime and one that changes behaviour inside an organisation. Separately, Article 14 of FINMASA binds supervisory staff to official secrecy, and the duty survives the end of their employment.

The European baseline, and the regulator's own file

Any carrier processing data in the European Union sits under GDPR. Article 5(1)(f) requires processing that ensures appropriate security and confidentiality; Article 32(1) requires appropriate technical and organisational measures proportionate to risk; Article 9 restricts the processing of health data, which is exactly what underwriting a life produces; and Article 83(5) sets the ceiling at twenty million euros or four per cent of total worldwide annual turnover, whichever is higher. That is a processing discipline enforced by a number large enough to command attention. It is not a shield against a tax authority, because Article 6(1)(c) makes compliance with a legal obligation a lawful basis in its own right.
Regulators carry their own duties. In Bermuda, sections 52 to 52C of the Insurance Act 1978 restrict disclosure of information and then set out the gateways through which the Monetary Authority may share it with other authorities. In the United States the equivalents are at state level: 8 V.S.A. §6002(c)(3) makes information submitted to the Vermont Commissioner confidential and not to be made public, and Minn. Stat. §60D.22 classifies holding company system material as confidential or protected non-public, not subject to subpoena, and not discoverable or admissible in a private civil action. Be precise about what those statutes do. They protect the regulator's file. They are not a general shield over the policyholder's identity, and reading them as one is a mistake we have seen in more than one marketing deck.

Litigation, divorce and discovery

This is where confidentiality claims most often fall apart, and where the distinction between privacy and protection has to be held firmly. They are different subjects with different answers.
There is no insurance privilege in American civil procedure. Rule 26(b)(1) allows discovery of any non-privileged matter relevant to any party's claim or defence and proportional to the needs of the case, and adds that information within that scope need not be admissible in evidence to be discoverable. A policy, its cash value, its holdings and its beneficiary are all discoverable where they are relevant. In matrimonial proceedings they are relevant almost by definition, and the mandatory disclosure forms in California and New York name cash value expressly. The full mechanics, including subpoenas to a carrier and what happens with a foreign insurer, are in our research on what an opposing lawyer can obtain.
The counterweight is Rule 26(c)(1), under which a court may on good cause issue a protective order, including an order that confidential commercial information not be revealed or be revealed only in a specified way. That is the actual mechanism by which financial detail stays out of a public court file. It is granted case by case, it is argued by counsel, and it is nothing whatever to do with the product. Anyone who tells a family that a policy is discovery-proof has confused a structure with a protective order.
The related and separate question is whether a creditor can reach the assets, which turns on exemption statutes, situs and the law of voidable transfers rather than on confidentiality. We deal with it on the asset protection page, and the two pages agree on the governing point: an arrangement that only holds together while nobody is looking will not survive a properly drafted discovery request. The working test we apply is whether the structure still reads well when described accurately to a court, to a revenue authority and to a spouse's counsel. If the answer is no, the problem is the plan rather than the disclosure.

Confidentiality inside the family, and around it

Two categories of privacy that almost nothing in the literature addresses, both of which come up constantly once the legal questions are out of the way.

The conversation about the number

A parent wants a child to know they are provided for and does not want them to know the figure. The reasons are usually better than the request sounds: a business the child is being groomed to run, a marriage the parents are watching with reserve, or simply a view that a person of twenty-four who knows the number makes different choices from one who does not.
Whether that is the right call is a real question with two respectable answers, and it is not one we push a view on. What we do insist on is that the family decide it deliberately, because the default is set by which instrument holds the asset. A beneficiary designation discloses one figure to one person on one occasion. A trust discloses on the trust's terms, and in many states those terms cannot be switched off at all. That choice has to be made before the documents are executed, and a family that discovers it in year six has lost the option. We work through what trust law actually requires, and how far the quiet trust statutes reach, in our research on what a family must tell its own beneficiaries.

The one nobody puts in a brochure

Families with operations or relatives in places where visible wealth attracts attention think about their footprint in concrete terms, and they are usually right to. Reducing the number of institutions, registers and documents that carry a name is a practical response to a practical risk. We would rather have that conversation directly than let it hide behind the word discretion, which is doing a great deal of work in this industry and disclosing very little.

What confidentiality does not buy

The limits belong on the page rather than in year six of a relationship. Three of them are hard edges.

It is not a reason to hold the policy

If confidentiality is doing most of the work in a family's reasoning, the structure is probably wrong. A policy that does not carry enough annually taxed income to exceed its own charges is a cost regardless of how few people can see it, and we have talked families out of arrangements on exactly that ground. The arithmetic sits on the tax efficiency page and it is the test that matters. Confidentiality is a property of the structure, not a purpose for it.

Non-disclosure is expensive in a way that compounds

A failure to file Form 8938 carries a penalty of ten thousand dollars under §6038D(d), then ten thousand for each thirty day period after notice, capped at fifty thousand for the continuing failure, which the IRS describes as a potential maximum of sixty thousand. An underpayment attributable to an undisclosed specified foreign financial asset carries a forty per cent accuracy related penalty under §6662(j). FBAR penalties run separately, at 16,536 dollars for a non-willful failure and 165,353 dollars for a willful one on the figures currently in force at 31 C.F.R. §1010.821. Bittner confined the non-willful penalty to one per report rather than one per account, which helps a person with many accounts and helps nobody who filed nothing. None of these figures is the real cost, which is what a voluntary disclosure does to the next five years of a family's life.

It will not repair a structure that was built to be hidden

A policy designed around non-disclosure fails on its own terms long before anyone reaches the confidentiality question. Where the arrangement is one whose purpose is to circumvent automatic exchange, the arrangement itself becomes disclosable: the OECD model rules on avoidance arrangements and opaque offshore structures require an intermediary to report within thirty days, and in the European Union hallmark D of Council Directive (EU) 2018/822 does the same job without any main benefit test. The design intended to reduce visibility is the thing that creates a filing. That is not an accident of drafting. It is the point of the rules, and it has been for eight years.
Compliant PPLI sits comfortably outside all of it. The policy is reported by the carrier, the holder files what the holder has to file, and the confidentiality that remains is the ordinary institutional kind that a bank, a lawyer and a doctor also owe. Set against the list of people a family actually names in a first meeting, that covers nearly all of them.

Frequently asked questions

Is a PPLI policy private?

It is confidential rather than secret. The carrier reports the contract to the relevant tax authority under FATCA or the Common Reporting Standard, and a United States holder of a foreign issued policy reports it on Form 8938 and the FBAR. Outside that reporting channel the contract is not on any public register, is not filed with any court, and is held by an institution under enforceable confidentiality duties.

Does a life insurance policy go through probate?

Proceeds paid to a named beneficiary pass outside probate. California Probate Code §5000(a) is representative: a non-probate transfer provision in an insurance policy is valid without complying with the formalities required of a will. Because the transfer happens outside the estate administration, nothing about the contract enters the court file. Where the estate is probated, the will, inventory and accounting are public records, following the principle stated in Nixon v. Warner Communications.

Can a creditor or an opposing lawyer find out about a policy?

In litigation, yes, where it is relevant. Rule 26(b)(1) permits discovery of any non-privileged matter relevant to a claim or defence and proportional to the needs of the case, and there is no privilege attaching to insurance. Confidentiality in a proceeding comes from a protective order under Rule 26(c)(1), granted case by case on a showing of good cause. Whether a creditor can reach the assets is a separate question governed by exemption statutes and situs.

Does a PPLI policy appear on a beneficial ownership register?

No. Those registers record the beneficial owners of legal entities. A policy is a contract with an insurer, not an entity, and there is no register of policies. In the United States, FinCEN's final rule effective 14 August 2026 has in any case exempted domestic entities and United States persons from beneficial ownership reporting. In the European Union, public access to the registers was invalidated in Sovim and replaced by access on a demonstrated legitimate interest.

Is Luxembourg insurance secrecy still meaningful?

Yes, against private parties. Article 300 of the law of 7 December 2015 imposes a professional secrecy duty on insurers and their staff, enforced criminally through Article 458 of the Criminal Code, which carries imprisonment of eight days to six months and a fine of 500 to 5,000 euros. Article 458 expressly does not apply where the person testifies in court or where the law requires disclosure, which is why the duty coexists with tax reporting rather than blocking it.

Can a family keep the size of the policy private from its own children?

Usually, and it depends on the instrument rather than the product. A beneficiary designation discloses one figure to one recipient at one moment. A trust instrument is ordinarily furnished to beneficiaries and a trustee owes them accounting duties, so a trust owned policy discloses on the trust's terms. This is a drafting decision that has to be taken before the documents are executed, because the default is set by whichever instrument holds the contract.

Does PPLI reduce a family's reporting obligations?

No. It changes the character of what is reported rather than the fact of reporting. A policy replaces the underlying accounts with a single contract, which can simplify the mechanics, but the contract itself is a reportable financial account with no de minimis under the Common Reporting Standard and a fifty thousand dollar cash value threshold under FATCA that any policy in this market exceeds immediately.

What happens if a policy is not reported?

Form 8938 failures carry ten thousand dollars under §6038D(d), rising by ten thousand for each thirty day period after IRS notice to a further fifty thousand, with a forty per cent accuracy related penalty on any related underpayment under §6662(j). FBAR penalties currently stand at 16,536 dollars for non-willful and 165,353 dollars for willful failures. Bittner v. United States confined the non-willful penalty to one per annual report rather than one per account.

Sources and authorities

Everything above rests on statute, regulation, judgment or supervisory law rather than on market practice. Where a point is practice rather than law, the text says so. The material describes the position as at the date of last review and is not advice on any particular set of facts.
Last reviewed 2 September 2026. This page is educational and is not legal or tax advice. See our editorial standards for how we source and correct this material.
Go deeper · 6 items

The research behind each question

Public record
What a Probate File Discloses, and What a Policy Keeps Out of It
Four states, four different answers
Litigation
What an Opposing Lawyer Can Actually Obtain About a Policy
Discovery, subpoenas and divorce
Carrier duties
Who Inside a Carrier Sees the File
The institutional layer, in detail
Beneficiaries
What a Family Must Tell Its Own Beneficiaries
Silent trusts and the notice problem
Protection
Asset Protection: Structures That Protect What You Have Built
Creditors, exemptions and voidable transfers

Begin a confidential conversation

Independent expertise. No affiliations. Just clarity.
Request private consultation
Eldar Edmond Grady
Written by
Eldar Edmond Grady
Founder and Editorial Director, PPLI.com
Checked against primary sources. Statutes, regulations, judgments and supervisory law are linked in the text so any statement here can be read against the authority it rests on.
Last updated 2 September 2026
Editorial standards
Private consultation →
Step 1 of 2

Tell us about yourself

Your information is submitted over an encrypted connection and handled in accordance with our Privacy Policy. PPLI.com does not sell personal information. Any external introduction is made only with your permission.

Concierge
PPLI.comConcierge
60-second assessment · Confidential
Welcome. We're glad to show you what's possible here. Some families arrive with a specific question; others want to know whether this structure fits them at all. Which are you?
This is what we do all day, in seven languages, for families like yours.
Considering…
AI assistant · Educational only. Never personal tax, legal, or investment advice.