Trusts

Malthusian

At the risk of being a downer, I think that's likely to be a dead end.
The grandfather could simply have given £4,000 to the mother and aunt and left them to set up accounts. End of paper trail. The aunt will have no idea what her sister did.
Or there may have been an account with an irrevocable designation with no obvious meaning (e.g. the husband's initials and nothing else) - in which case the husband can't make a Subject Access Request.
For the husband to make an SAR the account would have to be specifically in their name. And if this was the case, it would have been difficult for the mother to steal the money. If it was specifically set up as a trust account for a named beneficiary, the provider would normally only pay withdrawals to the husband or to another trust account.
There's nothing to lose by asking but I think her answer is likely to be "no idea what sis did with the money, sorry".