A power of attorney can give your agent real authority over your digital accounts, cryptocurrency, and online records, but only when the document is drafted with the specific language custodians look for. Handling digital assets and power of attorney together means three things: making the document durable so it survives your incapacity, adding express RUFADAA language covering both digital assets and the content of your electronic communications, and pairing that legal authority with practical access to passwords, private keys, and two-factor codes. Miss any of those and your agent will hold a document that looks valid and still gets nowhere.
The Law That Forces Providers to Recognize Your Agent
Before the Revised Uniform Fiduciary Access to Digital Assets Act, service providers routinely refused to deal with anyone other than the account holder. They pointed to federal privacy law and their own terms of service, and an agent waving a power of attorney at a tech company got nowhere. RUFADAA, now adopted in more than 40 states, created a standardized process custodians are required to follow when a fiduciary presents valid documents.
The statute sets a three-tier priority order that decides who controls what happens to your accounts:
- Platform tools come first. If you used a provider’s built-in succession tool, such as Google’s Inactive Account Manager or Apple’s Legacy Contact, that designation overrides your will, trust, or power of attorney.
- Legal documents come second. If you didn’t use the platform tool, instructions in your will, trust, or power of attorney control.
- Terms of service come last. With no instructions anywhere, the provider’s default terms decide what happens to the data.
Two things follow from this hierarchy. Your power of attorney carries genuine weight with custodians who operate under RUFADAA. And a quick setting change on a single platform can silently override months of estate planning work, so any legacy contacts you designated through a provider need to name the same person your power of attorney does.
Make the Document Durable, and Know Where Its Authority Ends
A standard power of attorney terminates the moment you become mentally incapacitated. That is a disaster for digital asset management, because incapacity is the most common reason your agent needs to act at all. Every state allows you to include a durability clause, a short declaration that the agent’s authority survives your incapacity, and without it the document becomes worthless at exactly the wrong time.
Some people use a “springing” durable power that activates only upon incapacity rather than immediately. These can create real delays because custodians usually require a physician’s certification before they’ll honor them, and getting that certification during a medical crisis is not always quick.
There is also a hard boundary to understand. Every power of attorney, durable or not, terminates the instant you die. After death, your agent has no authority whatsoever. Post-death management of your digital accounts falls to the executor named in your will or the trustee of your trust. If your plan consists only of a power of attorney, with no will or trust addressing what happens to digital assets when you die, those accounts may be locked permanently or deleted under the provider’s default policy.
What Counts as a Digital Asset
Digital assets cover more ground than most people expect, and skipping the inventory step leaves your agent guessing about where to look.
- Financial accounts: cryptocurrency held on exchanges, online-only banks, brokerage platforms, PayPal and Venmo balances, rewards programs, loyalty points, and stored gift card value. Most of these have no physical branch to walk into.
- Sentimental property: cloud photo libraries, social media profiles, and messaging histories. No dollar value, but years of personal history families often want preserved.
- Functional accounts: email, web domains, automated subscriptions, and streaming services. Your agent needs these to identify recurring charges and shut down what you no longer use.
- Business and intellectual property: manuscripts, creative work in the cloud, valuable domain names, and online storefronts. Losing access can destroy a business or forfeit revenue.
Medical portals get overlooked most often, and they carry additional HIPAA complications discussed below.
The Drafting Language Custodians Actually Look For
Generic power-of-attorney forms from office supply stores and standard online templates almost never include digital asset provisions. Your agent shows up with a document that grants broad financial authority, and the custodian’s legal team rejects it because nothing in it addresses electronic communications or digital property. Getting the language right at the drafting stage saves an enormous amount of trouble later.
At minimum, the document should include:
- Express digital asset authority. A clause specifically granting power over digital assets, electronic records, and online accounts. General “all property” language is often insufficient because custodians look for specific digital references.
- Content access consent. An explicit opt-in giving the agent authority over the content of electronic communications, not just the catalog. More on this in a moment.
- Broad operational powers. Language authorizing the agent to access, manage, transfer, modify, and delete digital records. If the document only says “access,” a custodian may allow viewing but block the agent from moving cryptocurrency or closing accounts.
- A future technology provision. A catch-all clause covering platforms and asset types that don’t yet exist.
- An account schedule. An attached list of known accounts and platforms. Not legally required, but without it your agent may not know where to start.
Many estate planning attorneys use a “digital asset rider,” an addendum drafted in language that mirrors RUFADAA’s own definitions so custodian compliance teams recognize the terminology and process it faster.
Content Versus Catalog
RUFADAA draws a sharp line between two categories of information, and your document has to account for the difference. The “catalog” of an account is metadata: who sent or received messages, timestamps, subject lines. The “content” is the actual text of emails and direct messages, plus photos and attachments. Under the Stored Communications Act, providers are generally prohibited from voluntarily sharing the content of electronic communications with third parties without the subscriber’s lawful consent.1Office of the Law Revision Counsel. 18 USC 2702 – Voluntary Disclosure of Customer Communications or Records
If your power of attorney gives general authority over “digital assets” but says nothing about the content of electronic communications, most custodians will hand over only the catalog. Your agent will see that you emailed someone on Tuesday but won’t be able to read what was said. Getting actual content requires the document to expressly grant authority over the content of electronic communications. That language is the gatekeeper. A custodian reviewing a request will check for it, and if it’s missing they will limit disclosure to the catalog. The law protects the custodian for making that call, so arguing after the fact rarely works.
Legal Authority Without Practical Access Is Nothing
A power of attorney can give your agent the legal right to manage your cryptocurrency, but if they don’t have the private keys, that right is meaningless. Unlike a bank account where a custodian can grant access after reviewing legal documents, cryptocurrency held in a private wallet has no central institution to petition. Whoever holds the private key controls the coins.
A power of attorney is useful for crypto in two situations: when the currency sits on a regulated exchange that functions like a traditional financial institution, or when a physical copy of the private key is stored somewhere the agent can reach, like a safe deposit box. For anything else, legal authority alone won’t get past the encryption. The power of attorney should explicitly reference private keys, wallet credentials, and blockchain account information, and it needs to be paired with secure storage of the credentials themselves. Encrypted password managers with shared access, fireproof safes, and bank safe deposit boxes are common approaches.
Two-factor authentication creates the same problem across every kind of account. If your accounts require a code sent to your phone and your agent doesn’t have that phone, the legal documents won’t help. Plan for this by storing backup codes somewhere your agent can reach, adding your agent’s device as a trusted device where the platform allows it, or documenting each account’s recovery procedure. Keep these details with the account schedule attached to your power of attorney.
Platform Legacy Tools Sit Above Your POA
The major technology companies have built their own succession tools, and RUFADAA puts those tools at the top of the priority order. Google’s Inactive Account Manager lets you designate up to ten trusted contacts who receive selected data after a period of account inactivity you define; Google looks at sign-ins, Gmail usage, and Android check-ins to determine inactivity.2Google. About Inactive Account Manager Apple’s Legacy Contact grants access to photos, messages, notes, files, and device backups after death, but not to purchased media, payment information, or passwords stored in iCloud Keychain, and the contact needs both an access key generated at setup and a death certificate.3Apple Support. How to Add a Legacy Contact for Your Apple Account Meta’s legacy contact for Facebook can pin a post, manage tribute posts, update the profile photo, and download shared content, but cannot read private messages or log into the account.
Two points matter here. First, if you’ve designated someone through one of these tools and named a different person in your power of attorney, the platform tool wins. Keep them aligned. Second, most of these tools are built for death or permanent absence, not for the temporary incapacity where an agent under a durable power of attorney needs to step in and manage an account over time. The durable power remains the essential document for living-but-incapacitated situations.
Medical Portals Need a Separate Document
Patient portals are protected under HIPAA, not the Stored Communications Act, and the rules work differently. If your agent qualifies as a “personal representative” with authority to make healthcare decisions under state law, HIPAA gives them the same access rights to medical information you would have yourself, including mental health records. Two exceptions apply: psychotherapy notes kept separately from the patient chart are outside the HIPAA right of access, and a provider who believes the patient is at risk of abuse or neglect by the person claiming authority can deny access.4U.S. Department of Health & Human Services. Does Having a Health Care Power of Attorney Allow Access to the Patient’s Medical and Mental Health Records Under HIPAA
The practical point: a healthcare power of attorney and a financial power of attorney do different jobs. If you want your agent to handle both your bank accounts and your medical portals, you need either a single comprehensive document covering both roles or two separate documents. Most people need both.
Getting the Document in Front of a Custodian
Having the right document is only part of the job. Each custodian runs its own review process, and none are fast.
A typical submission includes a certified copy of the power of attorney, a written request for specific data or access, a certification under penalty of perjury that the document remains in effect, and account identifiers linking the principal to the account. For springing powers, expect a request for physician certification of incapacity. Review commonly takes several weeks. Legal teams verify the agent’s identity, confirm the document’s validity under the applicable state’s version of RUFADAA, and check for conflicting instructions left through the platform’s own tools. These requests route to specialized compliance departments, and calling regular customer service won’t speed anything up.
Once approved, custodians handle access differently. Some send a downloadable archive; some issue temporary credentials or transfer assets to a new account in the agent’s name; a few charge processing fees. The agent should store downloaded data securely and document every action taken, because the agent owes a fiduciary duty to act in the principal’s best interest and may have to account for it later.
Where the Agent’s Own Liability Starts
An agent managing digital assets walks a narrower path than most realize. The Computer Fraud and Abuse Act makes it a federal crime to exceed authorized access to a computer system. Penalties reach up to one year in prison for a first offense, up to five years if the access was for financial gain or furthered another crime, and up to ten years for repeat offenses. The statute also creates civil liability, with a two-year limitations period for anyone damaged by a violation.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
What this looks like in practice: if the power of attorney grants authority over financial accounts but says nothing about email, and the agent logs into the principal’s email anyway, that access may exceed what was authorized. The same risk attaches to accessing accounts not listed or implied by the document, or to using accounts after the power of attorney has been revoked or terminated. Courts have found that violating a platform’s terms of service can itself constitute exceeding authorized access.
RUFADAA offers some protection to custodians who comply with fiduciary requests in good faith, but that immunity runs to the custodian, not the agent. The agent’s protection comes from staying inside the scope of the document and acting as a prudent fiduciary. Reaching beyond that scope, or using the principal’s data for personal benefit, strips away the legal cover the document otherwise provides.