Iowa has handed insurers a new playbook for protecting vulnerable clients from financial exploitation.
House File 2232, signed into law by Governor Kim Reynolds on April 9, 2026, creates a new subchapter under Iowa Code Chapter 508 that gives insurers, insurance producers, and qualified individuals the authority to hit pause on disbursements and transactions when they suspect an eligible adult is being financially exploited. The bill passed the Iowa House 90-0 on March 2 and cleared the Senate 47-0 on March 23.
The law is part of a growing wave of state-level legislation aimed at curbing elder financial abuse, but what makes it particularly relevant for the insurance industry is how directly it reaches into day-to-day operations. It does not just encourage insurers to act – it builds a structured process for doing so, complete with timelines, notification requirements, and, importantly, liability protections for those who step in.
At the heart of the legislation is a delay mechanism. When an insurer or qualified individual has a reasonable belief that a requested disbursement or transaction from a life insurance policy, annuity, or other account is likely to result in or contribute to the financial exploitation of an eligible adult, they may initiate an internal review and delay the transaction. The law defines "disbursement" broadly, covering any attempt to withdraw money or access a benefit, whether it takes the form of a surrender, loan, withdrawal, partial withdrawal, accelerated benefit, or anything else.
The delay framework operates on a tiered timeline. An initial delay lasts up to fifteen business days. If the internal review continues to support the belief that exploitation is likely, the insurer can extend that to twenty-five business days. And if the concern persists, a further extension to fifty-five business days is permitted. At any point, a court can step in to terminate, extend, or modify the delay, or order other protective measures.
There are strings attached, of course. The insurer must immediately notify all persons authorized to transact business on the account of the delay and the reason for it, and in no event more than seven business days after the disbursement or transaction is delayed. The insurer must also notify the Iowa Insurance Commissioner within that same seven-business-day window, along with the status of the internal review. There is one important restriction on the notification rule: if the insurer or qualified individual reasonably believes that the authorized person has committed or attempted financial exploitation, insurance fraud, or other abuse of the eligible adult, the insurer or qualified individual is prohibited from notifying that person.
The law also allows insurers and qualified individuals to notify what it calls "permissible third parties" – individuals the eligible adult has previously designated as contacts, or persons otherwise permitted under law to receive such notice. If the permissible third party is the suspected bad actor, however, notification is again prohibited.
One of the more significant provisions for the industry is the immunity clause. Insurers and qualified individuals who act reasonably and in good faith when delaying a transaction, notifying the commissioner, or disclosing information to a permissible third party are shielded from administrative and civil liability. The law is careful to note that this immunity does not override any existing statutory or common law privileges.
On the training side, the law requires insurers to train all supervisors and employees who handle or advise on complaints, possible fraud, or investigations by June 30, 2027. The training must cover how to spot suspected exploitation, common warning signs, how to report it, and privacy and confidentiality requirements. New hires must be trained as soon as reasonably practicable, but no later than one year after their start date. Qualified individuals who have already completed at least two hours of relevant continuing education are exempt from this requirement.
The law also addresses records. Insurers must make relevant records available to the commissioner and law enforcement, whether as part of a referral or upon request pursuant to an investigation. Those records – which can include historical data and recent transaction and disbursement requests – are classified as confidential public records, meaning they are off-limits to public examination.
House File 2232 was certified by Chief Clerk of the House Meghan Nelson as originating in the House and was signed by Speaker of the House Pat Grassley and President of the Senate Amy Sinclair before being sent to the governor. With the law now on the books, insurers operating in Iowa will want to start preparing for the training mandate well ahead of the mid-2027 deadline.
