I have a slightly different take than RatherBeGolfing (anyone surprised?). FWIW, I was also involved in drafting the original Code of Conduct many years ago.
Question: Do you have to provide the 2018 valuation? NO. It's that simple. You haven't been paid, so they don't own that work. Just FYI, in our shop we get paid FIRST before we do the val, so we just don't have that particular problem.
Question: Do you have to provide another copy of the 2017 val? NO. You previously provided them what they paid for; they owe you for work you have done but they have not paid for. You owe them nothing until they pay what they owe you, at which point you can provide them copies of prior work and you can charge them for that (get paid in advance, obviously).
Now, here's what I strongly disagree with. RBG said: "Basically, you don't have to hand over the 2018 valuation or your calculations/testing, but you do have to hand over the underlying data you collected from the client or third parties in order to do the 2018 valuation/testing like W-2s, K-1s, financials etc."
I disagree with the highlighted part of that sentence. The data we collect from clients is filled out on our forms or is provided as COPIES of original source documents (like W-2s). It is OUR information; none of it is the client's. We don't accept original documents (if we get them, like a prior plan doc, we copy and return the original at that time). Copies of financial statements that come directly to us are OURS, not the client's. Copies they make and send to us are ours, not the client's. Basically, none of that data rises to the level of "... any and all records of the Principal that are necessary for the Principal to comply with federal tax Law".
We are happy to provide copies of data, reports, etc from our files to a client who, for example, is leaving us. BUT, when they inform us they are leaving, we send them a letter (our "sign off" letter) and remind them that they have been given EVERYTHING that the new service provider needs to take over the client, but if they want things from our files, we have a fee that applies (and gets paid in advance), and we don't make it inconsequential (but it's also not outrageous - at least, I don't think so and I get to decide! ? ).
Hope you find that helpful.