The “Broken Handshake” Liability: Why Agency Agreements Must Define Post-Termination Asset Custody

When an agency retainer ends, the digital relationship often doesn’t. Long after the final invoice is paid, the agency may still be logged in, listed as an account owner or admin, or connected through live API keys and OAuth tokens to its former client’s systems. This article calls that leftover access orphaned administrative authority, and uses “Broken Handshake” as shorthand for the moment the commercial relationship ends but the technical one does not. Neither term is a legal standard.

The assets involved include domain registrars, cloud infrastructure (AWS, Google Cloud), ad platforms (Meta, Google Ads, TikTok), analytics and tag management, and SaaS and martech integrations. When the agreement says nothing about who holds these assets after exit, small lapses can cause real damage. A missed renewal notice, an unrevoked integration or an ad account stuck in the wrong portfolio can lead to a site outage, a data exposure or a lawsuit.

This article is general information, not legal advice. Outcomes depend on jurisdiction, the contract and the facts.

1. Anatomy of the “Broken Handshake”

In fast-moving agency work, access is granted informally to hit deadlines. At exit, offboarding is often treated as an administrative chore rather than a risk-control workflow. The gap between “contract ended” and “access actually transferred” is where problems start.

Common assets caught in custodial limbo

• Domains and DNS: Agency-held registrar accounts (GoDaddy, Namecheap and others), DNS providers such as Cloudflare, and registrant records that point to the agency or an individual employee.
• Advertising and marketing accounts: Meta business portfolios (formerly Business Manager), Google Ads manager links, TikTok ad accounts and programmatic platforms where the agency is the owner rather than a partner.
• Cloud and hosting: AWS and Google Cloud accounts or organizations, WP Engine installs, and Vercel or Netlify team seats.
• Analytics and tagging: Google Tag Manager containers, Segment workspaces, BigQuery datasets and Mixpanel projects.
• SaaS and integrations: HubSpot, Salesforce Marketing Cloud, Zapier connections and OAuth tokens that link third-party apps to client data.

2. Ownership vs. Access: What Platforms Actually Allow

Many exit disputes come down to one question: was the asset created inside the client’s account, or the agency’s? Platform rules make the answer hard to change later.

Meta. Meta distinguishes between giving someone access to an asset and owning it, and partner access never transfers ownership. Meta’s documentation states that an ad account can belong to only one business portfolio. An ad account that is created in, or claimed into, a portfolio may be permanently tied to it and can’t be moved to another. Meta also notes that accounts whose payment methods are managed by a third party can’t be moved. In practice, if an agency created the ad account inside its own portfolio, the client usually can only receive it as a shared asset. The usual workaround is a new ad account in the client’s portfolio, which costs the client its history inside the old account. Pixels and datasets follow the same one-owner model. Agencies that handle these cases report that ownership transfers go through Meta support and can take days, not minutes.

Google Ads. The model is friendlier to clients. Linking an existing account to an agency’s manager account does not by itself hand ownership to the manager. An administrator on the client account can remove a manager’s access, and Google’s documentation says client-account users can always unlink a manager that holds ownership. The practical caution is that resources defined at the manager level, such as shared audience lists or conversion tracking, may not travel with the client account. Check those before anyone unlinks during a dispute.

Domains. Since August 21, 2025, ICANN’s Registration Data Policy has made the registrant contact the only required contact for most gTLDs. Administrative, technical and billing contacts are no longer required, and many registrars have deleted that data. For most domains, control now comes down to two things: who is named as registrant, and who holds the registrar account login. Timing also matters. Under the Transfer Policy in effect as of September 2026, a material change of registrant can trigger a 60-day inter-registrar transfer lock unless the registrar offers and the holder uses an opt-out. ICANN’s Board approved a set of Transfer Policy Review recommendations on June 7, 2026, but implementation was still pending at the time of writing. Agencies should therefore plan registrant changes well before the exit date and confirm current rules with the registrar.

3. Legal Exposure When the Contract Is Silent

When a contract doesn’t allocate custody, courts fall back on general doctrines. The results vary by jurisdiction and are hard to predict.

Apparent authority mostly exposes the client

Under the Restatement (Third) of Agency §3.11, ending an agent’s actual authority does not by itself end its apparent authority. Apparent authority lasts until it is no longer reasonable for a third party to believe the agent is still authorized. This mainly protects third parties who dealt with the agent and received no notice of the termination. The practical consequence is that a client can remain bound by a former agency’s dealings with vendors who were never told the relationship ended. The agency’s exposure is different: acting beyond its actual authority after termination can make it liable to the client. Both sides therefore benefit from notifying vendors, and from the agency removing itself as the contact on the client’s accounts.

Illustrative scenario (hypothetical, not a reported case): A registrar’s renewal notice goes to a former agency’s shared inbox months after the contract ended. Nobody acts on it, and the domain lapses. The client’s loss, and any dispute over who was responsible for the notice, would turn on the contract and the facts. A clear transfer clause removes that ambiguity.

Courts treat digital assets as property

Courts have increasingly applied ordinary property doctrines to digital assets:

• Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003): The Ninth Circuit held that a domain name is intangible property that can support a conversion claim under California law.
• Salonclick LLC v. Superego Management LLC, 2017 WL 239379 (S.D.N.Y. Jan. 18, 2017): A company alleged that its former marketing contractor kept control of its domains and social media accounts after the relationship ended. At the motion-to-dismiss stage, the court let conversion and replevin claims proceed. It also let a breach-of-fiduciary-duty claim proceed against the independent contractor, based on allegations that it had access to sensitive accounts and a corporate credit card. These were allegations and not final findings.
• MasterMind Involvement Marketing, Inc. v. Art Institute of Atlanta, LLC, 389 F. Supp. 3d 1291 (N.D. Ga. 2019): A social media agency sued to collect unpaid fees. The defendants counterclaimed and sought an injunction for the return of 16 social media accounts. The court granted the injunction, ordered the agency to hand over login information and control, and found a substantial likelihood of success on a conversion claim and irreparable harm to the clients’ business and reputation. The agency’s own fee claim did not stop the order.
• JLM Couture, Inc. v. Gutman, No. 21-2535 (2d Cir. Jan. 17, 2024): This is a counterweight. In a dispute between a fashion company and its former designer, the Second Circuit vacated an order giving the company exclusive control of social media accounts. It said ownership analysis should treat accounts like other property and begin with who the original owner was. Courts do not hand accounts to whoever asks first, so documenting who created and owns each asset from day one matters.

Withholding access over unpaid fees is high-risk

Some agencies hold accounts back to pressure a client to pay a disputed invoice. MasterMind shows how poorly that can go. Absent an express contractual right, withholding client-owned accounts invites conversion and related claims, and courts can order the assets returned on an expedited basis while the fee dispute continues. A better course is to pursue the fee through the contract’s normal remedies and keep custody of the assets out of the dispute.

4. Operational Risk Analysis

Risk vector	Typical cause	Commercial impact
Administrative lockout	Agency holds the only owner or super-admin role	Client cannot add staff, change billing or update security settings
Orphaned billing	Agency or former-employee payment method remains on a client ad account or domain	Unintended charges, failed payments that pause campaigns, disputed reimbursements
Stale integrations	OAuth tokens, API keys or service-account keys never revoked	Continued data access by a party with no business need; a larger attack surface if the agency is breached
Unreachable renewals	Vendor notices go to agency staff or shared inboxes	Domain, SSL or license lapses nobody sees until the site breaks
Data-protection exposure	Client personal data left on agency servers, cloud storage or test environments	Possible GDPR and, from 2027, DPDP compliance problems (see Section 5)

5. Data Protection Obligations at Exit

Asset custody and data custody overlap. Under GDPR Article 28(3)(g), a processor must, at the controller’s choice, delete or return all personal data after the end of the services and delete existing copies unless Union or Member State law requires storage. An agency processing client personal data typically falls under this rule. The agency’s exit checklist should therefore include a documented return-or-delete step and written confirmation.

India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 were notified in November 2025 and are being phased in. Most substantive obligations, including security safeguards and erasure and retention rules, are scheduled to take effect around May 2027. In early 2026 MeitY proposed shortening some timelines for larger data fiduciaries, so check the current schedule. Agencies serving Indian clients should build deletion and return steps into their exit process now.

6. Contractual Solutions: Drafting the Asset Custody Clause

Treat asset custody and transfer as a core pillar of the agreement, alongside IP, payment and confidentiality.

Key terms to define

1. Ownership from day one. Require that assets be created in the client’s own accounts (the client’s registrar account, business portfolio and cloud organization) with the agency as a partner or user. Because platforms such as Meta don’t allow ad accounts to be moved between portfolios, this is far easier to get right at kickoff than at exit.
2. Definition of client assets. List what counts (domains, ad accounts, tag containers, hosting, repositories, SaaS subscriptions) and separate it from agency-owned proprietary tools.
3. Transfer duty and timeline. Define who receives ownership, administrative and billing roles, and within what window.
4. Sequencing. The agency removes its own access only after the client confirms it holds full control.
5. No withholding. Fee disputes are resolved through the contract’s payment remedies and never by suspending or retaining client assets.
6. Revocation of integrations. Require revocation of API keys, OAuth tokens, webhooks and SSH keys, and removal of agency payment methods.
7. Data return or deletion. Require return or deletion of client data on the client’s instruction, with written confirmation.
8. Defined liability cutoff. Limit the agency’s responsibility for events after a completed transfer, with carve-outs for gross negligence and willful misconduct.

7. Model Contractual Clauses

Illustrative language only. Have counsel adapt it to your jurisdiction and governing law. Some provisions, especially deemed-acceptance and liability-release terms, may not be enforceable everywhere.

Post-Termination Asset Custody

1. Client Digital Assets. “Client Digital Assets” means all domain names, advertising accounts (including Meta, Google Ads and TikTok), analytics properties, tag management containers, hosting and cloud accounts, source code repositories and third-party SaaS subscriptions registered, created or managed for Client during the Term.

2. Ownership at Creation. Agency shall create or register Client Digital Assets in Client’s name or within accounts owned by Client, and shall not register them in Agency’s own name or portfolios without Client’s written consent. Where a platform does not permit transfer of an asset created in an Agency-owned account, Agency shall disclose this in writing before creation and, on termination, provide continued access and a full data export.

3. Transfer Duty. Within ten (10) business days after the effective date of termination (the “Transition Period”), Agency shall:

• (a) reassign all owner, administrator, registrant and billing roles on Client Digital Assets to Client’s designated representative;
• (b) remove Agency’s own payment methods from Client Digital Assets;
• (c) revoke all API tokens, webhooks, service accounts and third-party integrations connecting Agency systems to Client Digital Assets;
• (d) remove Agency user accounts and external roles only after Client confirms in writing that it holds full administrative control of the relevant asset; and
• (e) provide written confirmation of the foregoing.

4. No Withholding. Agency shall not suspend, withhold, restrict or condition the transfer of any Client Digital Asset because of a dispute over fees or any other claim. Agency’s remedies for non-payment are limited to those otherwise available under this Agreement.

5. Data Return or Deletion. At Client’s election, Agency shall return or securely delete all Client data, including personal data, and certify completion in writing, except where applicable law requires retention.

6. Client Cooperation and Acknowledgment. Client shall designate a recipient within three (3) business days after notice of termination and shall sign an Acknowledgment of Transfer within three (3) business days after receiving each asset. If Client fails to designate a recipient or accept a transfer after two written notices, Agency’s transfer obligation for the affected asset is satisfied on documented written tender.

7. Cessation of Custody; Limitation. On completion of the transfer (or the end of the Transition Period, if Agency has met its obligations under Sections 3 to 6), Agency’s custodial and administrative duties regarding the transferred Client Digital Assets end. Agency is not liable for downtime, expiration, suspension, loss or security incidents affecting those assets after that date, except to the extent caused by Agency’s gross negligence, willful misconduct or breach of this clause.

8. The Agency Offboarding Framework: Operationalizing the Contract

A clause only works if someone executes it. This four-phase checklist uses the same timeline as the model clause.

Phase	Trigger	Key actions
1. Audit and inventory	Termination notice	Map every account, SSO login, OAuth grant, API key and billing method. Classify each asset as client-owned or agency-owned, and record where the platform won’t allow a transfer (for example, a Meta ad account sitting in the agency’s portfolio). Confirm who receives vendor notices.
2. Ownership transfer	First days of the Transition Period	Update registrant and registrar-account ownership, allowing for the registrant-change lock described in Section 2. Invite client admins to Meta, Google, cloud and tag platforms. Get the client’s written confirmation of full control.
3. Access revocation	Client confirms control	Remove agency seats and secondary emails. Revoke OAuth tokens, API keys, webhooks and SSH keys. Remove agency payment methods. Notify third-party vendors of the contact change.
4. Sign-off and data disposition	End of Transition Period	Sign an Acknowledgment of Transfer. Return or delete client data per the client’s election and applicable law. Issue written confirmation.

9. Summary Comparison: Traditional vs. Asset-Custody Contracts

Contract feature	Traditional agency contract	Asset-custody contract
Post-termination scope	Covers deliverables and final billing	Defines who owns each asset and when roles transfer
Third-party accounts	Silent; agency staff remain on domain, hosting and ad accounts	Requires transfer of owner and admin roles within a set window
Asset creation	Agency may create assets in its own accounts	Assets are created in client-owned accounts from day one
Integrations	Tokens and webhooks stay active until someone notices	Requires systematic revocation and written confirmation
Fee disputes	Withholding access is possible and risky	Prohibits withholding; fee claims go through normal remedies
Liability	Open-ended claims of negligence, conversion or breach of fiduciary duty	Clear cutoff after a completed transfer, with carve-outs

Defining post-termination custody replaces an informal exit with a predictable process. Spelling out ownership at creation, transfer timelines, revocation duties and data return or deletion reduces the risk of lockouts, lapsed domains, data exposure and disputes for both agencies and clients.

---

Originally published at https://instarenewal.com/blog/the-broken-handshake-liability-why-agency-agreements-must-define-post