Deceased customer and estate management¶


ID	`MOD-138`
System	SD08
Repo	`bank-app`
Build status	Not started
Deployed	No

Purpose¶

Manages the end-to-end lifecycle of a deceased customer's accounts, from notification of death through account freeze, legal personal representative (LPR) registration, estate access, distribution of balances, and final account closure. This module exists to ensure that bereaved families and estates are treated with appropriate care, that the bank meets its legal obligations under estate administration law, and that account access is granted only where legally authorised — protecting both the estate and the bank from fraud.

Errors in deceased estate handling are a consistent source of financial ombudsman complaints in both NZ and AU. The regulatory focus from the FMA and ASIC on vulnerable customer obligations extends explicitly to how banks treat deceased estates and the people dealing with them.

Legal framework¶

Executor vs administrator¶

An executor is a person named in the deceased's will to administer the estate. An administrator is appointed by the court where there is no will (intestate), or where the named executor is unable or unwilling to act. Both are legal personal representatives (LPRs) with equivalent authority to administer the estate.

The LPR's authority derives from:

Grant of probate — a court order confirming the validity of the will and authorising the executor to act. Issued by the High Court (NZ) or the relevant state Supreme Court (AU).
Letters of administration — a court order appointing an administrator where there is no valid will or no executor able to act.

Until probate or letters of administration are granted, no person has legal authority to deal with the deceased's estate other than to safeguard it. The bank cannot release funds to family members, co-account holders (except for joint accounts with survivorship), or even a named executor prior to production of the relevant court order — unless the small estate concession applies.

Small estate concessions¶

Both NZ and AU have simplified processes for small estates where obtaining full probate would be disproportionately costly and burdensome.

New Zealand: A bank may release estate funds without probate where the total estate held at that bank is below approximately NZD 15,000 (the exact threshold is set by individual banks in compliance with general practice; there is no statutory maximum). The LPR must provide a statutory declaration or affidavit of claim confirming their relationship to the deceased, that they are entitled to the funds, and that no other person has a competing claim.
Australia: Similar small estate provisions apply, generally at approximately AUD 15,000 per financial institution. State succession legislation (e.g., Succession Act 2006 (NSW), Administration and Probate Act 1958 (Vic)) sets the framework but the practical threshold is determined by each bank's policy.

The small estate threshold is configurable per jurisdiction in this module. The bank's back-office team retains discretion to require full probate even for estates below the threshold if there are competing claims or suspicious circumstances.

Joint accounts¶

Joint accounts with a right of survivorship (the standard structure in NZ and AU) pass automatically to the surviving account holder on death — the surviving holder gains sole ownership by operation of law. The bank does not require probate for joint account funds to pass to the survivor. However, the account must still be administratively updated to remove the deceased customer as a holder, and death notification must be recorded.

Accounts held as tenants in common (less common in retail banking) require the deceased's share to pass through the estate.

Account freeze¶

On receipt of a notification of death, confirmed by a back-office staff member, the following actions are taken immediately (within 60 seconds):

All outgoing payments from the deceased customer's accounts are suspended — direct debits, standing orders, scheduled payments, and any pending payment instructions are cancelled or placed on hold.
Any existing PoA or EPoA on the deceased's accounts is set to revoked_by_death via MOD-126. PoA ceases by operation of law on the death of the grantor; this action makes the legal position explicit in the system.
The account state is updated to deceased_estate via MOD-007.
Incoming credits continue to be received. Employers, government agencies, or other payers may continue to send credits to the account — these are held for the estate and form part of the distributable balance.

Outgoing credit card transactions on a linked card are also blocked. If the deceased held an overdraft or credit facility, the facility is placed into maintenance mode — interest continues to accrue against the estate liability but no further draws are permitted.

The freeze is recorded in the estate log with the notifying staff member's identity and timestamp.

LPR registration workflow¶

Before any person can be granted access to a deceased customer's accounts, they must be registered as the LPR for that estate. The registration workflow:

Identity verification — the proposed LPR must pass eIDV via MOD-009. If the LPR is already a customer with a verified KYC record, their existing record is used. If they are not an existing customer, they complete eIDV as a non-account-holder.
Authority document upload — the LPR uploads the relevant authority document to MOD-073:
Grant of probate (executor)
Letters of administration (administrator)
Small estate affidavit or statutory declaration (small estate pathway)
Back-office review — a back-office staff member reviews both the eIDV result and the uploaded document. The review requires:
Confirming the grant/letters are addressed to the person claiming to be the LPR.
Confirming the document references the correct deceased person (name, date of death).
Confirming the document is not expired or superseded.
A two-step approval: the reviewing agent approves, and a supervisor countersigns before access is activated.
Access activation — once both approvals are complete, the LPR is granted estate_access scope on the deceased's accounts. This scope allows the LPR to view balances and transaction history, initiate distributions, and request account closure. It does not allow the LPR to originate new financial commitments (new direct debits, loans, etc.).

All steps are logged immutably via MOD-047 and in the estate event log.

Small estate process¶

Where the total balance across all the deceased's accounts at this bank is below the configured small estate threshold for the relevant jurisdiction, the simplified pathway applies:

The LPR (typically a family member) still completes eIDV via MOD-009.
In lieu of probate, the LPR submits a statutory declaration or affidavit of claim confirming:
Their identity and relationship to the deceased.
That they are entitled to the funds (as sole beneficiary, executor under an unproved will, or nearest surviving relative in the absence of a will).
That no other person has a competing claim to the funds.
Back-office approval is required — a single approver (no supervisor countersign required for small estates below threshold).
Distribution to the declared beneficiary is processed once the affidavit is approved.

The system checks the total balance across all accounts and compares it against the jurisdiction threshold at the point of LPR registration. If the balance exceeds the threshold, the simplified pathway is blocked and the system directs the LPR to obtain probate or letters of administration.

Data model¶

-- app.deceased_estates
CREATE TABLE app.deceased_estates (
  estate_id                   UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  customer_id                 UUID NOT NULL,
  notification_date           DATE NOT NULL,
  notification_source         TEXT NOT NULL CHECK (notification_source IN (
                                'customer_family','solicitor','public_trustee','court')),
  death_certificate_id        UUID,  -- MOD-073 document reference
  estate_type                 TEXT CHECK (estate_type IN (
                                'full_probate','letters_of_administration','small_estate')),
  probate_reference           TEXT,
  lpr_customer_id             UUID,
  lpr_authority_document_id   UUID,  -- MOD-073 document reference
  estate_threshold_applies    BOOLEAN NOT NULL DEFAULT false,
  status                      TEXT NOT NULL DEFAULT 'notified' CHECK (status IN (
                                'notified','frozen','lpr_registered','active',
                                'distributing','closed')),
  notes                       TEXT,
  created_at                  TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- app.estate_distributions
CREATE TABLE app.estate_distributions (
  distribution_id    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  estate_id          UUID NOT NULL REFERENCES app.deceased_estates(estate_id),
  account_id         UUID NOT NULL,
  amount             NUMERIC(18,2) NOT NULL,
  distribution_type  TEXT NOT NULL CHECK (distribution_type IN ('full_balance','partial')),
  recipient_account  TEXT NOT NULL,
  posting_id         UUID,  -- reference to the transaction posted via MOD-001
  distributed_at     TIMESTAMPTZ
);

notification_source records how the bank was informed — this is important for regulatory purposes: deaths notified by a solicitor or court typically come with documentation already in hand; deaths notified by family members require more active document collection.

estate_threshold_applies is set to true at registration time if the total balance at notification was below the jurisdiction threshold. It is not recalculated once set — if balances change during the estate period (e.g., an employer pays a final salary), the determination stands. Back-office staff can manually override this flag with a documented reason.

Key operations¶

Notification and freeze¶

Death notification is received via the back-office channel (branch staff, phone banking staff, or digital back-office) or via written notification from a solicitor or the Public Trustee. Self-notification via the customer app is not supported for death notifications.

The back-office agent confirms the notification, creates the deceased_estates record with status = notified, and the freeze actions described above execute automatically.

PoA revocation¶

On creation of the deceased_estates record, the system queries MOD-126 for any active PoA, EPoA, or third-party authority on the deceased customer's accounts and sets each to revoked_by_death in the same database transaction as the freeze. This ensures the two actions are atomic — it is not possible for a PoA to remain active on a frozen deceased account.

LPR registration¶

The LPR registration workflow is initiated by the LPR contacting the bank (by phone, visiting a branch, or via written correspondence). The bank provides the LPR with a checklist of required documents and the upload pathway (via the back-office portal or by post/in-branch scanning). Registration is completed by back-office staff once all documents are received and the two-step approval is complete.

Estate access period¶

Once the LPR is registered and status = active, the LPR can:

View all account balances and the full transaction history.
Instruct distributions to nominated beneficiaries or recipient accounts.
Provide instructions to close credit facilities (with the outstanding balance forming an estate liability).
Request statements for all periods of the deceased's account history.

The LPR cannot open new accounts, change account terms, or grant access to any other person.

Distribution and closure¶

Distributions are initiated by the LPR and approved by a back-office agent. Each distribution is posted via MOD-001 with the estate_id and distribution_id recorded on the transaction. For full balance distributions, the account balance must be zero after the distribution posts.

Once all accounts have been distributed to zero, the back-office agent updates the account status to deceased_closed via MOD-007 and updates the deceased_estates record to status = closed. The customer record is updated to reflect deceased status — the customer is not deleted from the system, as their records must be retained for the minimum regulatory retention period.

Jurisdictional note¶

Both NZ and AU use court-issued authority documents (probate / letters of administration) as the legal mechanism for recognising an LPR. The processes are broadly equivalent but administered by different courts:

NZ: High Court grants probate and letters of administration. The New Zealand Public Trust can act as administrator where no family member applies. The Administration Act 1969 and Administration (Probate) Rules 1968 govern the process.
AU: Each state's Supreme Court (or the relevant Probate Registry) grants probate and letters of administration. Interstate grants require re-sealing in other states (though banks typically accept original state grants for accounts held in any state). The bank must accept interstate grants without requiring re-sealing given the bank's national operations.

Both jurisdictions' small estate concessions allow the bank to release funds below the threshold on statutory declaration — this avoids the expense and delay of a full court application for small estates.

Requirements¶

FR-613 — Freeze on notification: upon recording a notification of death, the system shall immediately suspend all outgoing payments from the deceased customer's accounts (direct debits, standing orders, scheduled payments) within 60 seconds of the notification being confirmed by a back-office staff member, while allowing incoming credits to continue to be received; any existing PoA or EPoA on the deceased's accounts must be automatically set to status revoked_by_death via MOD-126 in the same operation.

FR-614 — LPR registration gate: the system shall require verification of the LPR's identity via MOD-009 and upload of the LPR's legal authority document to MOD-073 (grant of probate, letters of administration, or small estate affidavit) before granting the LPR any access to the deceased customer's accounts; the back-office staff member must complete a two-step approval of both the identity check and the legal authority document before access is activated.

FR-615 — Small estate pathway: the system shall support the small estate simplified pathway; for estates where the total balance across all accounts is below the configured small estate threshold, the system must accept a statutory declaration or affidavit of claim in lieu of probate, with back-office approval, and must allow distribution to the declared beneficiary without requiring full probate — the threshold must be configurable per jurisdiction.

FR-616 — Distribution and closure: the system shall process estate distribution by posting the distribution amount from the deceased's account to the nominated recipient account or external account via MOD-001, recording the estate_id and distribution_id on the transaction, and must close the deceased customer's account and update the customer record to deceased_closed status upon confirmation that all accounts have been distributed and balances are zero.

Module dependencies¶

Depends on¶

Module	Title	Required?	Contract	Reason
MOD-007	Account state machine	Required	—	The account state machine manages the deceased_estate state and all transitions out of it.
MOD-009	eIDV & document verification	Required	—	The legal personal representative must pass eIDV before being granted any access to the deceased customer's accounts.
MOD-073	Document vault	Required	—	Death certificate, grant of probate, or letters of administration are stored in the document vault as required legal evidence.
MOD-047	Agent action logger	Required	—	All estate management actions are logged to the agent action audit trail.
MOD-126	Power of attorney and third-party authority	Optional	—	Any existing PoA or EPoA on the deceased's accounts must be automatically revoked on death notification; this module coordinates that revocation with MOD-126.

Required by¶

(No modules in this wiki currently declare a dependency on this module.)

Policies satisfied¶

Policy	Title	Mode	How
PRI-001	Privacy Policy	`GATE`	Account access for a legal personal representative (LPR) requires verification of their identity and their legal authority (probate/letters of administration) before any access is granted; no access is provided based on claimed authority alone.
GOV-006	Internal Audit Policy	`LOG`	All deceased estate events (notification of death, freeze, LPR registration, access grants, distributions, closure) are logged immutably with the acting staff member and timestamp.
CON-003	Vulnerable Customer Policy	`AUTO`	The account holder's deceased status triggers enhanced care obligations — all estate communications are managed with empathy protocols and automated payment outflows are suspended on notification.
AML-002	Customer Due Diligence (CDD) Policy	`LOG`	The LPR must pass KYC before being granted account access; the LPR's identity and authority are recorded and available for AML audit.

Capabilities satisfied¶

(No capabilities mapped)

Part of SD08 — Customer App & Back Office Platform Compiled 2026-05-22 from source/entities/modules/MOD-138.yaml