Summary. A modern estate contains assets that no probate court can order transferred, because they exist only as entries on servers governed by contracts the decedent clicked through and never read. The Revised Uniform Fiduciary Access to Digital Assets Act, adopted in nearly every state, resolves the access problem by creating a priority scheme in which an online tool provided by the platform beats the will, which beats the terms of service. Cryptocurrency held in self-custody presents a different and harsher problem: there is no custodian to compel, and a private key lost at death is value destroyed permanently rather than merely inaccessible. This article covers the legal framework for fiduciary access, the practical mechanics of inventorying and transferring digital property, the drafting language that actually works, and the security discipline that keeps a plan from becoming a theft vector.

A client dies. The executor finds a laptop, a phone, and a filing cabinet with nothing useful in it. Over the following months they discover: a photo library of forty thousand images spanning three decades, held by a provider that will not discuss the account; a small business whose entire customer relationship history lives in a cloud CRM billed to a card that has been cancelled; a domain name renewing automatically that the family's website depends on; two exchange accounts; an unknown quantity of cryptocurrency in a hardware wallet with no recorded recovery phrase; and eleven years of email that may or may not contain the only record of a substantial loan the decedent made to a friend.

None of this appears on a Form 706. Some of it is worth money, some of it is worth more than money, and one category of it is gone permanently.

Why this is hard

Three distinct problems, frequently conflated.

The access problem. The fiduciary cannot get in. The account is protected by a password, two-factor authentication, and a terms-of-service agreement that prohibits transfer and may purport to terminate the account on death. The provider, asked politely, cites federal privacy law and declines.

The ownership problem. Much of what people call a digital asset is not property at all. A streaming library is a revocable license. Airline miles are a contractual promise subject to program rules that usually forbid transfer. A social media account is a permission to use a service. What the estate owns is frequently a bundle of contract rights that the contract says are not assignable.

The custody problem. For self-custodied cryptocurrency there is no provider to compel and no recovery mechanism. Possession of the private key is ownership. A court order directing transfer of bitcoin held in a wallet whose seed phrase nobody has is unenforceable against mathematics.

RUFADAA solves the first problem competently, addresses the second partially, and does nothing at all about the third.

RUFADAA: the framework

The Revised Uniform Fiduciary Access to Digital Assets Act, promulgated in 2015 and now adopted in nearly every state, governs a fiduciary's access to a decedent's or principal's digital assets.

Definitions that matter

A digital asset is an electronic record in which an individual has a right or interest, excluding the underlying asset or liability unless it is itself an electronic record. A bank account accessed online is not a digital asset; the record of it may be.

The Act distinguishes:

  • Content of electronic communications — the substance of email, messages, and similar communications. Access is restricted.
  • A catalogue of electronic communications — the metadata: who communicated with whom, and when, without content. Access is easier.
  • Other digital assets — documents, photographs, files, virtual currency, domain names, and account balances.

This distinction is not an arbitrary drafting choice. It tracks the Stored Communications Act, 18 U.S.C. §§ 2701–2712, which prohibits a provider of electronic communication service or remote computing service from knowingly divulging the contents of a communication except in enumerated circumstances — one of which is disclosure with the lawful consent of the originator or addressee. RUFADAA is constructed to supply that consent.

The three-tier priority

The core of the Act is a hierarchy, in RUFADAA § 4:

First, the online tool. If the provider offers an online tool — a legacy contact, an inactive account manager, a memorialization setting — that allows the user to direct disclosure, and the user has used it, that direction controls, and it overrides a contrary provision in a will or trust. Critically, it controls only if the tool permits the user to modify the direction at any time.

Second, the estate planning document. If no online tool has been used, a direction in a will, trust, power of attorney, or other record controls.

Third, the terms of service. If neither of the above applies, the provider's terms govern.

The practical instruction follows immediately: an online tool designation beats the will. A client whose will directs digital assets to a daughter, but whose Google Inactive Account Manager names a former partner, has by operation of law given the account to the former partner. Reviewing and setting online tools is now a standard part of executing an estate plan, and it must be done by the client at the keyboard — counsel cannot do it for them.

What a fiduciary gets

A personal representative may obtain the catalogue and other digital assets on request with the required documentation, but obtains content only where the user consented — through an online tool, a will provision, or other record — or a court orders disclosure. RUFADAA §§ 7 and 8.

An agent under a power of attorney obtains the catalogue and other assets only if the power of attorney grants authority, and content only with express grant of authority. RUFADAA §§ 9 and 10. The default is no access, which means a general durable power of attorney drafted before RUFADAA is likely insufficient.

A trustee who is the original user has full access; a successor trustee has catalogue and other assets, and content only with express authorization. RUFADAA §§ 11–13.

A conservator or guardian may obtain access by court order after a hearing. RUFADAA § 14.

The request procedure

Section 15 sets out what the fiduciary must provide — a written request, a certified death certificate, letters of appointment or a certified copy of the relevant instrument, and, where required, evidence linking the account to the decedent. The provider may require additional identifying information and may seek a court order.

The provider has sixty days to comply, and the fiduciary may seek a court order for non-compliance. The Act gives providers meaningful latitude: a provider may grant full access, partial access, or provide a copy in a record of the assets; may charge a reasonable administrative fee; and need not disclose assets deleted by the user. Section 16 gives providers immunity for good-faith compliance.

Section 6 also permits a provider to decline an unduly burdensome request, and providers use this. In practice, obtaining anything beyond a data export is difficult, and obtaining email content without an explicit consent is very difficult.

Cryptocurrency and the custody problem

Why it is different

For assets held with a custodian — a centralized exchange, a regulated trust company, a brokerage holding a spot ETF — the analysis is ordinary. The custodian holds the asset, has a death procedure, requires letters testamentary and a death certificate, and transfers or liquidates. This is an account, and RUFADAA and general probate practice handle it.

For assets held in self-custody, nothing works that way. The blockchain records that a quantity of value is controlled by a key. Whoever possesses the private key controls the asset. There is no issuer, no registrar, no transfer agent, and no one to serve with an order.

The consequences are stark:

  • A private key that dies with the owner destroys the asset permanently. Not "makes it hard to recover" — destroys it. Substantial quantities of bitcoin are provably immobile for this reason.
  • Conversely, anyone who finds the key owns the asset, immediately and irreversibly. A seed phrase written on paper in a desk drawer is a bearer instrument.

Estate planning for self-custodied assets is therefore a security engineering problem as much as a legal one, and the two objectives — ensuring the fiduciary can access it, and ensuring nobody else can — are in direct tension.

Approaches that work

Custodial holding. The simplest answer for most clients. Moving assets to a regulated custodian converts an intractable problem into an ordinary account transfer. Many holders resist this for reasons ranging from principled to ideological, but for an estate of modest crypto holdings it is usually correct advice.

Multi-signature arrangements. A wallet requiring, say, two of three keys, with keys held by the owner, a trusted family member, and counsel or a professional custodian. No single holder can move funds, and the loss of any one key is survivable. This is the technically strongest approach and requires real competence to implement.

Shamir secret sharing. Splitting a seed phrase into shares such that a threshold number reconstructs it. Similar properties to multi-signature, implemented at the key level.

Sealed instructions with split custody. The seed phrase divided physically, with portions held by different parties — a safe deposit box, counsel's vault, a trusted individual — and instructions in a letter that does not itself contain the key.

A dead man's switch or timelock. Available on some platforms and via smart contracts. Powerful and fragile; a mechanism nobody tests will fail.

What must not happen: the seed phrase must never appear in the will. A will admitted to probate is a public record in most jurisdictions. Writing a recovery phrase into a will publishes it.

Drafting for crypto

The instrument should:

  • Grant the fiduciary express authority to access, control, hold, sell, exchange, and transfer digital assets and virtual currency, and to take custody of keys and credentials.
  • Authorize the fiduciary to retain volatile assets without liability, overriding the Uniform Prudent Investor Act's diversification duty, which would otherwise arguably require immediate liquidation of a concentrated volatile position.
  • Address whether the fiduciary may liquidate immediately on receipt — often the prudent default given volatility during administration — or must consult beneficiaries.
  • Authorize engaging technical experts and paying them from the estate.
  • Provide indemnity for good-faith action in an area where the fiduciary is unlikely to be expert.

Tax treatment

Virtual currency is property, not currency, under Notice 2014-21. Consequences: it receives a step-up in basis at death under § 1014; every disposition by the estate is a taxable event; and the estate must value holdings at date of death or the alternate valuation date, which for thinly traded assets requires a defensible methodology. Section 6045 broker reporting for digital assets, and Form 1099-DA, now apply to custodial dispositions, which improves the basis record considerably for exchange-held assets and not at all for self-custody.

Other categories, and what they are actually worth

Email and messaging. Rarely valuable, frequently essential. Email is where the evidence of everything else lives — account confirmations, receipts, loan agreements, the existence of assets nobody knew about. This is the category most restricted by the Stored Communications Act and most worth obtaining consent for in advance.

Photographs and personal files. Usually the most emotionally significant asset in the estate and legally the simplest, since they are "other digital assets" rather than communications content. The practical obstacle is device encryption rather than law.

Social media. Generally not transferable. Most platforms offer memorialization or deletion, chosen through an online tool. Where an account has commercial value — a monetized channel, a substantial following — the analysis changes and platform terms should be read carefully, because the terms usually prohibit transfer while the revenue stream is contractually assignable.

Domain names. Genuinely valuable property, transferable through the registrar with proper documentation. Renewal lapses are a common and irreversible loss; a domain that expires and is registered by someone else is gone.

Websites, blogs, and monetized content. May carry copyright, advertising revenue, and goodwill. The copyright is inheritable property under 17 U.S.C. § 201(d); the advertising account is a contract.

Loyalty programs and airline miles. Governed entirely by program terms. Some permit transfer on death, some permit it for a fee, many prohibit it and routinely allow it in practice on request. Worth asking, not worth litigating.

Digital media libraries. Almost always non-transferable licenses. Clients are consistently surprised.

Gaming accounts and virtual items. Terms typically prohibit transfer, though secondary markets exist. Value can be substantial in specific games.

Business assets. The most commonly neglected category. A closely held business's customer data, code repositories, cloud infrastructure, payment processor accounts, and administrative credentials are frequently held under a single founder's personal login. When the founder dies, the business can be operationally paralyzed while the estate negotiates with providers. This is a business continuity problem that estate planning is well positioned to catch and usually does not.

The criminal statutes nobody mentions

A fiduciary who logs into a decedent's account using credentials found in a desk drawer is doing something that RUFADAA was written to make unnecessary, and that may be unlawful without it.

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, prohibits accessing a computer without authorization or exceeding authorized access. Van Buren v. United States, 593 U.S. 374 (2021), narrowed "exceeds authorized access" to cover only obtaining information from areas of a computer the person is not entitled to access at all, which substantially reduces the risk that violating terms of service is itself a federal crime. But accessing an account the fiduciary has no authorization to access remains squarely within the statute, and many states have their own computer crime statutes that were not narrowed by Van Buren.

The Stored Communications Act, 18 U.S.C. § 2701, separately prohibits unauthorized access to stored communications and provides a civil remedy under § 2707.

The practical implications:

Do not use the decedent's credentials to log in as a substitute for the RUFADAA process, however tempting and however clearly the family agrees. The authorization the statutes require comes from the user's consent or a court order, not from the family's consensus.

A password left in a letter is not authorization to access an account if the terms of service prohibit sharing credentials — though after RUFADAA and Van Buren the risk is much lower than it once was, and a documented consent plus fiduciary authority is a strong position.

Impersonating the decedent to the provider — answering security questions, using their phone for two-factor authentication — is worse, because it may be fraud in addition to unauthorized access.

Document the authority. A fiduciary who proceeds under an express grant in a will or trust, with letters of appointment, following the § 15 procedure, has a defensible position. One who improvises does not.

What to actually do: the client's side

Build an inventory. Not a list of passwords — a list of what exists and where. Financial accounts, exchanges and wallets, email, cloud storage, domains and hosting, subscriptions with recurring charges, social accounts, business systems, devices, and loyalty programs. Note for each: what it is, roughly what it is worth, who should receive it, and whether it should be preserved or deleted.

Use a password manager, and plan its succession. A single encrypted vault with a documented emergency access mechanism is the cleanest solution available. Most reputable managers offer a designated emergency contact with a waiting period. This one step resolves most of the access problem.

Set the online tools. Google Inactive Account Manager, Apple Legacy Contact, Facebook legacy contact, and the equivalents. These override the will, so they must be consistent with it. Review them when the estate plan changes.

Address two-factor authentication. The single most common practical obstacle. A fiduciary with the password and without the phone has nothing. Store recovery codes with the plan, use an authenticator whose backup the fiduciary can reach, and avoid making a single mobile number the only recovery path.

Say what should be deleted. Many clients care more about this than about transfer. An express direction to delete specified material, and authority for the fiduciary to do so, belongs in the plan.

Do not put secrets in the will. Passwords, seed phrases, and account numbers go in a separate, updatable, non-public document — referenced by the will, stored securely, and revised without amending the instrument.

Update it. A digital inventory is stale in eighteen months. Tie the review to an annual event the client already does.

What to do: the drafter's side

Every plan should now include:

  • Express digital asset authority in the will, the trust, and the power of attorney, granting both catalogue and content access, using RUFADAA's terminology so that the consent is unambiguous.
  • Explicit lawful consent under the Stored Communications Act to disclosure of content to the fiduciary — the magic language that unlocks email.
  • Authority to bypass, reset, or circumvent access controls and to obtain and use credentials.
  • Authority regarding virtual currency, including retention notwithstanding diversification duties.
  • A direction concerning deletion and privacy, distinguishing assets to transfer from material to destroy.
  • Naming a digital fiduciary where appropriate — a person with the technical competence to do this work, who may not be the person best suited to administer the rest of the estate. Several states expressly permit designation of a separate fiduciary for digital assets.
  • Powers of attorney conforming to RUFADAA §§ 9 and 10, which require express authority. A pre-2016 power of attorney almost certainly lacks it, and this is a common reason a plan fails during incapacity rather than at death.

Primary authority

  • Revised Uniform Fiduciary Access to Digital Assets Act (2015), in particular § 2 (definitions of digital asset, catalogue, and content), § 4 (the online tool, instrument, terms-of-service priority), § 6 (provider discretion and unduly burdensome requests), § 7 and § 8 (personal representative access to content and other assets), § 9 and § 10 (agent under a power of attorney), §§ 11–13 (trustees), § 14 (conservators), § 15 (request procedure and the sixty-day response), and § 16 (provider immunity).
  • 18 U.S.C. §§ 2701–2712 — the Stored Communications Act, including § 2702(b)(3) (disclosure with lawful consent) and § 2707 (civil action).
  • 18 U.S.C. § 1030 — the Computer Fraud and Abuse Act; Van Buren v. United States, 593 U.S. 374 (2021) — narrowing "exceeds authorized access."
  • 26 U.S.C. § 1014 — basis step-up, applied to virtual currency as property; § 6045 and Form 1099-DA — digital asset broker reporting.
  • IRS Notice 2014-21 and Rev. Rul. 2019-24 — virtual currency treated as property, and the treatment of hard forks.
  • 17 U.S.C. § 201(d) — transfer of copyright ownership by will or intestacy.
  • Uniform Prudent Investor Act § 3 — the diversification duty that a crypto retention clause must override.
  • Uniform Probate Code § 3-715 and Uniform Trust Code § 815 — general fiduciary powers, which digital asset authority supplements rather than replaces.
  • State computer crime statutes — frequently broader than the CFAA and unaffected by Van Buren.

The fiduciary's first ninety days

A sequence, because the order matters and some doors close.

Week one: secure the devices. Take physical custody of the laptop, phone, tablet, and any hardware wallets or security keys. Do not wipe, factory reset, or "return" a leased phone. Do not let a family member "clean up" the computer. Note whether devices are currently unlocked — a phone that is powered on and unlocked is a temporary and precious resource, and an unlocked device should be prevented from locking while a plan is made.

Week one: stop the bleeding. Identify recurring charges and decide which to cancel and which to keep. A cloud storage subscription that lapses may delete the photo library after a grace period. A domain that expires is unrecoverable. Cancel the gym; pay the registrar.

Week two: find the credentials. Look for a password manager, a written inventory, an estate planning binder, a safe deposit box. Check whether the decedent used an online tool at the major providers — these are usually visible from the account settings once access is obtained, and legacy contacts are notified by the provider directly.

Week two: get appointed. The RUFADAA request procedure requires letters of appointment. Nothing formal happens with providers until they exist.

Weeks three to six: send the requests. For each provider, a written request with the death certificate, letters, and the instrument granting authority, citing the applicable RUFADAA section and quoting the consent language from the will or trust. Expect a sixty-day response window, form-driven portals rather than correspondence, and partial compliance.

Weeks three to six: address volatile assets. If the estate holds cryptocurrency and the fiduciary has access, decide about liquidation promptly and document the reasoning. A fiduciary who holds a volatile concentrated position through a fifty percent drawdown without authority to retain has a surcharge problem; one who sells before a doubling has an unhappy beneficiary. The instrument's retention clause, or a beneficiary consent, is the protection.

Ongoing: preserve before you delete. Export everything obtainable before closing any account. Providers frequently offer a full data export that is easier to obtain than ongoing access, and once the account is closed the data is gone.

Ongoing: document. Every request, every response, every access, and the authority relied on. Digital asset administration is new enough that a fiduciary may need to explain their conduct to a court that has not seen many of these, and a clean record is the whole defense.

Two problems RUFADAA does not solve

The joint-life problem

RUFADAA governs access by a fiduciary for a decedent or an incapacitated principal. It says nothing about the far more common situation of a shared digital life: a couple's joint photo library, a family calendar, a shared streaming account, an email address that received correspondence for both.

When one spouse dies, the survivor frequently has practical access and no legal clarity about it. The photos are theirs too, in every sense except the one the terms of service recognize. Providers' policies vary and few address it.

The workable answers are prospective. Shared accounts should be genuinely shared — family plans, shared albums, and shared vaults where the provider supports them, rather than one person's account that everyone uses. Where a single account holds material belonging to both, an express provision in both instruments acknowledging the survivor's interest and directing the fiduciary to preserve and transfer it is worth including, though it binds the family rather than the provider.

The incapacity gap

The harder practical problem is not death but incapacity, and it is worse for three reasons.

First, RUFADAA's default for an agent under a power of attorney is no access at all absent an express grant, and no content access absent an express grant referencing content. A general durable power of attorney executed before the Act, or one drawn from a form that predates it, will not work.

Second, there is no death certificate. Providers have well-developed procedures for death and almost none for incapacity, and the documentation an agent can offer — a physician's certificate, a power of attorney — does not fit the portal.

Third, incapacity is often gradual, and the window during which the principal can still set up an online tool, share a password vault, or add an emergency contact closes quietly. By the time the family recognizes the problem, the principal can no longer grant the access that would solve it.

The instruction for planners is to treat digital access as an incapacity issue first and an estate issue second. Update the power of attorney with express RUFADAA authority; set up the password manager's emergency access while the client can; add the agent as an authorized user or account recovery contact where providers permit it; and do this early in the engagement rather than at the signing, because the client has to do it themselves, at a keyboard, and it is the step most often deferred and never completed.

Model language

The clauses below illustrate the structure that RUFADAA and the Stored Communications Act together require. They are illustrative, not a form, and must be conformed to the enacted statute in the governing jurisdiction.

In the will and the trust:

Digital assets. I authorize my [personal representative / trustee] to access, use, control, modify, delete, transfer, and dispose of my digital assets and digital accounts, including the content of my electronic communications, as those terms are defined in the Revised Uniform Fiduciary Access to Digital Assets Act as enacted in the governing jurisdiction. I give my lawful consent, for purposes of 18 U.S.C. § 2702 and any successor provision, to the disclosure to my [personal representative / trustee] of the content of my electronic communications and of the catalogue of my electronic communications by any custodian. This authority is intended to constitute a direction under Section 4 of that Act, and I direct that it govern except to the extent a contrary direction is given by me through an online tool offered by a custodian.

On virtual currency:

My [fiduciary] is authorized to take custody of, hold, retain, sell, exchange, stake, and transfer virtual currency and other digital assets, and to obtain and use private keys, seed phrases, recovery codes, and credentials for that purpose. My [fiduciary] shall not be liable for retaining a concentrated or volatile position in any digital asset, and any duty to diversify under the Uniform Prudent Investor Act or otherwise is waived as to such assets. My [fiduciary] may engage technical advisers and custodians and pay reasonable compensation for their services from the estate or trust.

On access controls:

My [fiduciary] is authorized to bypass, reset, recover, or circumvent any password, encryption, authentication device, or other security measure protecting my digital assets or the devices on which they are stored.

In the power of attorney — the provision most often missing, and the one RUFADAA requires to be express:

My agent is granted authority over my digital assets, including the content of electronic communications sent or received by me, within the meaning of the Revised Uniform Fiduciary Access to Digital Assets Act as enacted in the governing jurisdiction, together with the lawful consent described above.

Naming a separate digital fiduciary, where the person best suited to the technical work is not the personal representative:

I appoint [name] to serve as my digital fiduciary with respect to my digital assets, to act in that capacity with the authority granted above and in coordination with my personal representative.

Two cautions. Nothing above is a substitute for the client setting the provider's online tool, which by statute overrides all of it. And no key, password, or recovery phrase belongs in any of these documents — the instrument grants authority; a separate, private, updatable memorandum supplies the means.

Valuation and reporting

Digital assets create reporting obligations that are easy to miss and increasingly enforced.

Date-of-death valuation. For exchange-traded cryptocurrency, the customary approach follows the estate tax convention for publicly traded securities — the mean of the high and low on the valuation date, drawn from a consistently applied principal exchange. For thinly traded tokens, illiquid NFTs, and assets without a reliable quoted market, a qualified appraisal is necessary, and the appraiser should document the methodology, the market selected, and any discount for lack of marketability. NFT valuation in particular is contested and poorly served by floor-price data.

The alternate valuation date under § 2032 can be significant here, because six months of crypto volatility routinely moves values by large percentages. Remember that the election is all-or-nothing across the estate and available only if it reduces both the gross estate and the tax.

Income in respect of a decedent. Most digital assets receive a basis step-up under § 1014. Watch for exceptions: accrued staking rewards, unpaid royalties from monetized content, and revenue earned but unpaid at death may be IRD under § 691, which does not receive a step-up and carries a § 691(c) deduction for estate tax paid.

Foreign account reporting. An exchange organized outside the United States may trigger reporting on FinCEN Form 114 (the FBAR) and Form 8938 under § 6038D. The applicability of FBAR to digital asset accounts has been the subject of announced regulatory intent, and the position has shifted; check the current guidance rather than a prior year's conclusion. The penalties for non-filing are severe enough that the question deserves a real answer.

Income tax during administration. Every disposition by the estate is a realization event. Staking, lending, and yield arrangements generate ordinary income to the estate. An estate that holds and transacts in digital assets will file a Form 1041 with schedules the preparer may not have seen before, and engaging a preparer with actual digital asset experience is worth the premium.

Basis records. For custodial assets, Form 1099-DA and the broker reporting rules now supply a record. For self-custodied assets there is no reporting and no records, and reconstructing basis after death is often impossible — which, given the step-up, is usually harmless for the estate and matters greatly for lifetime gifts of the same assets.

Related articles

This article is provided for general informational purposes and does not constitute legal, tax, or security advice. RUFADAA has been adopted with variations, and a small number of states have not adopted it at all; confirm the enacted text in the applicable jurisdiction. Provider policies, online tools, and digital asset tax reporting rules change frequently. Never place a private key, seed phrase, or password in a document that will become a public record.