Death Audit Compliance: A Practical Guide for Regulated Organizations

In 2023, the Pension Benefit Guaranty Corporation discovered that a single pension fund had received $127 million in overpayments tied to nearly 3,500 deceased participants. The error was traced back to inadequate death audit procedures, and the fallout has reshaped regulators’ view on mortality verification across multiple industries. Today, death audit compliance is governed by federal certification programs, state-level mandates, and an expanding set of privacy and data security standards. The stakes have never been higher, and the consequences of falling short have never been more visible.

This guide walks through what death audit compliance requires today, how federal certification works, how matching technology fits into the picture, and what organizations should look for in a compliant death audit partner.

Death audit compliance refers to the set of legal, regulatory, and procedural requirements that organizations must meet when accessing, processing, and acting on mortality data. The framework spans several layers:

1. Federal certification to access the Social Security Death Master File (DMF) and its Limited Access version (LADMF)
2. State insurance regulations that mandate periodic DMF comparisons and unclaimed property reporting
3. ERISA fiduciary obligations for retirement plans that govern accurate participant recordkeeping
4. Data privacy and security standards that protect sensitive personal information throughout the audit process

Any organization can be compliant in one of these areas, but still fall short in another.

A pension plan that meets ERISA recordkeeping standards but uses an uncertified vendor to access LADMF data is exposed to federal penalties. An insurer that maintains DMF certification but fails to apply a consistent matching methodology across policy types may run afoul of state regulators.

True death audit compliance requires attention to all four layers simultaneously.

The Social Security Death Master File is the most widely referenced source of mortality data in the United States, and access to it is tightly controlled. Following the Bipartisan Budget Act of 2013, Congress restricted access to death records during the three-calendar-year period after an individual’s death. This restricted dataset is known as the Limited Access Death Master File, or LADMF.

To obtain LADMF access, an organization must be certified through the National Technical Information Service (NTIS) under 15 CFR Part 1110. The certification process requires applicants to demonstrate:

• A legitimate fraud prevention interest or business purpose rooted in law, regulation, or fiduciary duty
• Systems, facilities, and procedures capable of safeguarding the data according to standards comparable to Section 6103(p)(4) of the Internal Revenue Code
• Written attestation from an Accredited Conformity Assessment Body (ACAB) confirming that security controls meet NTIS requirements

Certified organizations must renew their certification annually, undergo a full independent ACAB attestation every three years, and submit to scheduled or unscheduled audits by NTIS at any time. The framework draws heavily on recognized security standards, including NIST 800-series publications, SOC 2, and ISO 27001, which ACABs frequently use as evaluation baselines.

Matching a participant or policyholder record against a death record is rarely a clean process. Names are misspelled, dates of birth are entered incorrectly, Social Security numbers are missing from obituaries, and the same individual may appear in different databases with slightly different identifying details. Strict deterministic matching, which requires every field to align exactly, misses a significant percentage of true matches.

Fuzzy matching, also called probabilistic record linkage, addresses this problem by analyzing the similarity of multiple identifiers and assigning confidence scores, rather than requiring perfect alignment.

A modern fuzzy matching engine compares:

• Name variations, including nicknames, hyphenations, transliterations, and common misspellings
• Dates of birth, accounting for transposed digits and partial matches
• Geographic signals, such as last known address, state of residence, and place of death
• Cross-source corroboration, where the same individual appears in multiple independent databases

Regulators increasingly expect insurers and pension administrators to use fuzzy matching rather than relying on exact-match logic. Compliant death audit programs use fuzzy matching tuned to balance sensitivity (catching real deaths) against specificity (avoiding false positives), with human or algorithmic validation as a final step before reporting.

While specific regulatory frameworks vary by industry, the underlying expectation has converged around a common standard: organizations must take reasonable, documented steps to identify deceased individuals in their populations and respond appropriately.

A compliant program typically reflects several core practices:

• Regular comparisons against multiple data sources, including the Social Security Death Master File, state vital records, obituary databases like Obit360, and proprietary mortality sources
• Consistent matching methodology applied uniformly across the entire population, rather than selectively
• Documented validation procedures that distinguish confirmed matches from possible matches and reduce false positives
• Audit-ready reporting that captures match confidence scores, source attribution, and chain-of-custody records
• Timely action on confirmed matches, including stopping payments, initiating beneficiary outreach, or updating research records as appropriate

Regulators reviewing a death audit program will look for evidence that each of these elements is in place, with documentation that can be produced on demand. Organizations that treat death audits as a check-the-box exercise rather than an ongoing compliance discipline are increasingly finding themselves on the wrong side of enforcement actions and audit findings.

Death Audit Data Privacy and Security Requirements

Mortality data is sensitive personal information, so the privacy of death audit data is governed by overlapping federal and state frameworks. Organizations conducting death audits must consider:

• NTIS LADMF security guidelines (Publication 100), which establish baseline controls for organizations accessing the LADMF
• HIPAA, where health study participants or insurance policyholders are involved, and protected health information may be implicated
• State data privacy laws, including the California Consumer Privacy Act (CCPA), the New York SHIELD Act, and similar state frameworks
• Gramm-Leach-Bliley Act (GLBA) safeguards for financial institutions handling nonpublic personal information

Practical compliance requires encryption of data in transit and at rest, role-based access controls, audit logging, regular personnel security training, vendor risk management, and documented incident response procedures. Our platform is housed in a Class A security building with 24-hour security and follows protocols to satisfy these overlapping requirements.

For organizations evaluating their current death audit program or selecting a new partner, the following death audit compliance checklist provides a practical starting point:

• Verify federal certification. Confirm that any vendor accessing the LADMF on your behalf holds current NTIS certification and is up to date on annual and triennial attestations.
• Confirm matching methodology. Ask whether the vendor uses deterministic matching, fuzzy matching, or a hybrid approach, and how match confidence is scored and validated.
• Review data source coverage. A compliant death audit program should pull from the Social Security Death Master File, state vital records, national obituary databases, and proprietary sources rather than a single feed.
• Assess monitoring frequency. Daily or near-real-time updates reduce the lag between a death event and its identification, lowering financial exposure between audit cycles.
• Evaluate security controls. Look for SOC 2, ISO 27001, or NIST-aligned attestations, encryption protocols, access controls, and documented incident response procedures.
• Confirm reporting and audit trails. Compliant programs produce documentation that can withstand regulatory review, including match confidence scores, source attribution, and chain-of-custody records.
• Review contract terms. Vendor agreements should specify data handling responsibilities, breach notification timelines, indemnification provisions, and audit rights.

Organizations that work through this checklist methodically tend to identify gaps in their existing programs before regulators do.