Your buyer wants a second look at the place before they write. You are in a meeting. You text them the lockbox code. That is a violation, and it is the most common one there is. RECO's wording leaves no room: an agent must not provide a lockbox code to anyone, including a buyer, an appraiser, a home inspector or any other service provider, without the express written consent of the seller.
Everything below comes from RECO's Bulletin 7.2 on lockboxes and Bulletin 7.1 on protection of property, read on September 19, 2026. Your local board's lockbox rules sit on top of these, not instead of them, and RECO expects your brokerage to have a policy that satisfies both.
The consent is written, and it happens before the box goes on
A lockbox goes on a door only with the seller's written consent. Not a nod at the listing appointment, not a line in an email thread. RECO's guidance is that the seller's agent should document the authorisation in a written direction to the brokerage, that the seller should sign it, and that the seller should be given a copy before the lockbox is installed.
There is a step before that one which is easier to skip. You have to explain the risks first, and RECO lists them: keys get lost, boxes get left improperly closed, boxes get broken into, and codes get shared with people who should not have them. Any of those can end in theft or damage. That explanation is required whether the house is occupied, sitting empty between owners, or vacant for months.
The practical read: the conversation and the signature both belong at the listing appointment, in the same pass as the rest of the paperwork, because going back for a signature after the box is already hanging on the door is not a sequence that ends well if anything happens in between.
The code is not yours to give out
This is the one worth reading twice. RECO's list of people you may not hand the code to, absent the seller's express written consent, is:
- a buyer, including your own client
- an appraiser
- a home inspector
- any other service provider
And separately: you must not give the key to another agent. The key goes back in the box at the end of your appointment, and the property gets secured, by you.
Read the list against a normal week. The inspector who wants to start before you can get there. The contractor giving a quote. The buyer who wants to measure for a sofa. The stager. Every one of those is a service provider or a buyer, and every one of those is a written-consent conversation with your seller, not a text message.
When a code does get shared with another brokerage's representative, RECO's stated minimum is that temporary access expires within seventy-two hours of being issued. Not "soon". Seventy-two hours.
Your seller's insurer may have an opinion
Here is the line almost nobody quotes. RECO says the seller's agent should encourage the seller to contact their property insurer before agreeing to a lockbox at all, because using one may affect their coverage.
Think about what that means if a house is cleared out during a listing. The seller finds out at claim time that the policy took a view about uncontrolled access, and the person who put the box on the door without mentioning insurance is you. It costs one sentence at the listing appointment and it belongs in your notes.
Restrictions get repeated every single time
Sellers attach conditions. No photographs. Nobody in the basement apartment, there is a tenant. Shoes off. Do not let the cat out.
RECO's position is that all restrictions must be clearly communicated every time access is granted. Once, in the listing remarks, is not communicating them. That is a per-appointment obligation, which in practice means it belongs in the confirmation message that goes out with the appointment, not in a field somebody may or may not scroll to.
You stay for the whole appointment
Bulletin 7.1 is blunt about supervision. The buyer's agent is expected to be present and to continuously supervise the people granted access. You remain in attendance for the duration and you do not leave other people unsupervised on the property.
That rules out the habit of letting a buyer wander back through while you take a call in the driveway, and it rules out letting the inspector finish up alone because you have a two-thirty across town.
On the way out: any door or window opened during the viewing gets closed and locked, and the key goes back into the box. RECO also asks you to remind people that they are walking through someone's home, and that furniture, appliances and personal belongings are not to be touched or disturbed unless that has been permitted.
Unaccompanied access is a separate consent
There is a way to let someone in without you standing there, and it is narrow. The seller has to have consented in writing to that specific person having access without an agent present, and the written consent has to state the date and time, the purpose, and how long they may be there.
So an unaccompanied inspection is possible. It is just not possible on a verbal from the seller, and it is not possible as a standing arrangement covering whoever turns up.
What "expect to be prosecuted" means
RECO does not hedge here. Its wording is that an agent who accesses a property without the seller's consent, or who allows someone else to access a property unaccompanied without the seller's consent, should expect to be prosecuted. It goes on to say agents will face serious sanctions for unauthorised access and for other infractions that show a disregard for protection of property.
Unauthorised includes two things people do not always count as unauthorised: getting in outside the scheduled appointment window, and getting in for a purpose the seller did not agree to. Arriving twenty minutes early and letting yourself in is the first. Going back to take photographs after a showing is the second.
The technology argument
RECO encourages electronic lockboxes, and its reasoning is evidentiary rather than aesthetic: they record who accessed the property, when, and for how long, and they can change codes automatically. Routine code changes are named as leading practice, with the seventy-two hour expiry as the floor.
The quiet benefit is that a log answers a question a combination box cannot. When a seller calls to say something is missing, an electronic box tells you who was in the house. A four-digit code that has been in circulation since the listing went live tells you nothing, including about yourself.
What to do this week
Look at your last five listings. Is there a signed written direction authorising the lockbox for each one, and did the seller get a copy before the box went on? If the answer is a signed listing agreement and nothing else, that is the gap.
Check where your codes have been. Not to feel bad about it. To find out whether a code issued in June is still live, and to change it.
Put restrictions in the appointment confirmation. Wherever your showing confirmations are generated, the restrictions belong in the message itself, because "every time" is the standard and a listing-remarks field is not every time.
Add one sentence to the listing appointment. Ask them to check with their insurer. It takes ten seconds and it is the item on this page most likely to matter later.
Read your brokerage's lockbox policy. RECO expects one to exist and to satisfy your local board as well. If you have never seen it, that is worth knowing before you need it.
Frequently asked questions
Can I give the code to my own buyer client? Not without the seller's express written consent. RECO's list of people you may not give it to names a buyer explicitly, and it does not carve out buyers you represent.
Can I give the code to a home inspector? Same answer. Inspectors and appraisers are both named. If the seller wants the inspector to have independent access, that is a written consent naming the person, the date and time, the purpose, and the duration.
Does a verbal okay from the seller count? No. The consent to install is written, and the consent to share a code is express and written. A text message from the seller saying "sure, go ahead" is a poor substitute for a signed direction, and it is the seller's memory against yours if it is ever disputed.
How long can a temporary code last? Seventy-two hours is RECO's stated minimum standard for temporary codes issued to another brokerage's representative. Shorter is fine. Indefinite is not.
Do these rules apply to a vacant property? Yes. RECO says the risk explanation is required regardless of whether the property is occupied, unattended or vacant. An empty house is arguably the case where a shared code costs the most.
What if my board's rules say something different? Follow both. RECO expects brokerage lockbox policies to comply with the rules of the local board or association as well, so a stricter board rule is not in conflict with this, it is simply the one that binds you.
Where is the authoritative version? RECO's own Bulletin 7.2 and Bulletin 7.1. Bulletins are guidance explaining duties under TRESA and its regulations; they are revised, and RECO is the source that governs. This article is a practice summary, not legal advice.
If you want the rest of the map, we keep a plain-English index of every RECO bulletin, and a longer piece on the advertising rules, which is the other section agents trip over most.