The Family-Office Investment Operating Model: Faster Decisions with Institutional Controls

1. Convert speed from a personality trait into a system

Speed in a family office often comes from a short chain between the opportunity and the principal. That chain can be commercially valuable. It can also carry hidden delay because a team with undefined authority repeatedly asks the principal to resolve process questions. Decisions are revisited when assumptions, conflicts or conditions were not captured. Execution waits for ownership, legal, banking or tax steps that began after approval.

An operating model makes speed repeatable. It states the investment mandate, authority, evidence, challenge and record required at each stage. A defined route lets the team reject out-of-mandate opportunities quickly, advance strong opportunities with a consistent workplan and escalate material exceptions with the relevant facts already organised. The principal retains reserved decisions and receives fewer avoidable process escalations.

Institutional control in this context means clear accountability, reliable information, proportionate review and evidence that the agreed process operated. It does not require a large bureaucracy. The Institute of Internal Auditors' Three Lines Model assigns governance accountability to the governing body, management responsibility to first and second-line roles, and independent assurance to internal audit.[8] A family office can adapt the underlying separation even when several roles are outsourced or part time.

The model should begin with a written design choice: which advantages the family wants to preserve and which failure modes it wants to reduce. Advantages may include patient capital, concentrated knowledge, discretion, local networks and flexible holding periods. Failure modes may include relationship-driven concentration, undocumented exceptions, weak cash forecasting, stale valuations, conflicts, poor custody controls and unclear succession of authority.

2. Establish the legal and regulatory perimeter before designing workflow

A family office label does not determine regulatory status. The relevant facts include who receives services, who owns and controls the office, which activities it conducts, how it is remunerated, where people and entities operate, whether outside capital is accepted, and whether the office advises, arranges, manages or holds assets. Each jurisdiction applies its own definitions and permissions.

The SEC rule excludes a qualifying family office from the United States Investment Advisers Act definition of investment adviser when the office has only family clients, is wholly owned by family clients and controlled by family members or family entities, and does not hold itself out publicly as an investment adviser.[1][2] The final rule also addresses specific categories of family clients and transition matters. The exclusion is fact dependent. An office that introduces non-family capital, expands its services or changes ownership may require fresh analysis.

The DIFC Family Arrangements Regulations 2023 replaced the prior single-family-office regulations and create a framework for family businesses, entities, offices and structures within the DIFC.[3] ADGM materials identify family offices, holding companies, special purpose vehicles and foundations as available structures, while the ADGM beneficial-ownership framework applies to legal entities within its stated exceptions.[4][5] These sources support entity design and governance analysis. They do not determine the treatment of an office in another jurisdiction.

The perimeter map should list every family, holding, investment, operating, trust or foundation entity; its ownership and control; its directors and authorised signatories; its service relationships; its accounts and custody arrangements; and the activities undertaken by each team member or adviser. Legal counsel should identify licensing, fiduciary, corporate, tax, sanctions, AML, reporting and data obligations. The map becomes a controlled input to decision rights, onboarding and transaction execution.

Table 1. Mandate and governance charter for a family-office investment function

The fields form an operating-model template. Reserved matters, thresholds and legal duties must follow the family's governing documents and applicable law.

3. Translate family intent into an investable mandate

The investment mandate should connect family objectives to decisions. A broad statement such as preserving and growing wealth provides limited guidance when the office must compare a direct business acquisition, a private fund, liquid securities, real estate and a strategic family-business investment. The mandate needs time horizon, liquidity, risk capacity, currency needs, concentration appetite, income requirements, return objectives, stewardship preferences and prohibited exposures.

Family assets may serve different purposes. A liquidity pool can cover known distributions, commitments, tax and operating expenses. A strategic pool can hold family businesses or assets with control, identity or legacy value. A return-seeking pool can pursue diversified compounding. A catalytic or philanthropic pool can pursue stated impact objectives. Mixing these pools can create false comparisons and unclear performance expectations.

The strategic allocation should show ranges and rebalancing authority. Private-market commitments require pacing analysis because committed capital, invested capital and net asset value follow different paths. Direct investments may require follow-on capital. Real assets can carry operating and refinancing obligations. The mandate should therefore link each allocation to cash requirements, unfunded commitments and downside capacity.

Constraints need operational definitions. A 10 per cent single-name limit should specify the denominator, valuation date, treatment of guarantees and whether family operating businesses are included. A leverage limit should state whether it applies at asset, vehicle and consolidated levels. A geographic rule should distinguish issuer domicile, operating exposure, currency and legal structure. Clear definitions reduce discretion at the moment of decision.

4. Design decision rights before an opportunity arrives

Decision rights should answer four questions: who proposes, who analyses, who challenges and who approves. A fifth question is who executes and records the decision. Combining all five in one person can be necessary in a very small office, but the resulting concentration should be explicit and mitigated through independent advice, dual authorisation, periodic review or principal oversight.

Reserved matters typically include changes to mandate, investments above a materiality threshold, leverage, guarantees, related-party transactions, conflicts that cannot be resolved under standing policy, new jurisdictions, litigation-sensitive situations and exceptions to risk limits. Delegated matters can include small follow-ons, approved-manager subscriptions within allocation, hedging under policy and routine treasury placements.

Thresholds should combine size and consequence. A small investment can create material reputational, cyber, sanctions, legal or control exposure. A large follow-on into a well-understood holding may involve less new uncertainty than a smaller investment in a new jurisdiction. The delegation matrix should therefore use amount, portfolio concentration, liquidity, leverage, control rights, related parties, risk classification and deviation from mandate.

Every approval should identify the authority used. If a committee acts under delegation, the decision record should state the relevant mandate provision and any conditions. If the principal approves an exception, the record should state the reason, affected limits, duration and monitoring response. Exceptions without recorded consequences can become silent policy changes.

The map is a governance model. Actual rights, memberships, quorums and reserved matters must follow governing documents, applicable law and the family's chosen delegation.

[/FIGURE]

5. Build one controlled sourcing and triage funnel

A family office can receive opportunities from principals, family members, banks, managers, advisers, founders, sponsors and personal networks. Separate inboxes and informal messages make the true funnel difficult to see. Every opportunity should enter a common register with source, date, sponsor, confidentiality status, asset type, jurisdiction, expected ticket, decision deadline and initial mandate fit.

Triage should be fast and evidence light. The objective is to determine whether the opportunity belongs in the mandate, whether the office can complete suitable diligence within the available time, whether the relationship or conflict profile is acceptable, and whether expected return and strategic fit justify further work. A decline reason should be recorded so sourcing quality and recurring mandate mismatches can be analysed.

The funnel should distinguish sourced, screened, qualified, diligenced, approved, executed and monitored stages. Stage definitions need entry and exit criteria. An opportunity is not qualified because a meeting occurred. It is qualified when the office has enough information to confirm mandate fit, credible access, preliminary economics, process, ownership and a viable diligence route.

Time limits preserve capacity. A screened opportunity without required information after a defined period can be closed or paused. Diligence should have a workplan and decision date. An expired approval should return for confirmation if terms or facts changed. These controls reduce a backlog that appears active while consuming attention without advancing.

Table 2. Deal-funnel stages, evidence and control gates

Stage times are hypothetical operating assumptions. Actual timing should reflect transaction complexity, information quality, legal requirements and negotiating leverage.

6. Use explicit qualification to protect scarce attention

Qualification should combine mandatory gates and comparative scoring. Mandatory gates include legal ability, credible access, mandate fit, conflict manageability, minimum information and operational feasibility. Comparative scoring can then rank strategic fit, expected risk-adjusted value, downside protection, manager or sponsor quality, governance rights, liquidity, complexity and diligence burden.

Scoring should support judgment and expose disagreement. A weighted average can hide a severe weakness. Red-line conditions should therefore remain separate. Examples include unverifiable ownership, unavailable audited information where material, unacceptable sanctions exposure, unclear custody, rights inconsistent with the thesis, or a structure the office cannot administer.

Source quality should be measured. The register can compare qualified and executed opportunities by channel, decline reason, cycle time, fee burden and realised outcome. A trusted relationship may remain valuable even if conversion is low because it produces differentiated access. The analysis should separate access quality from relationship status.

The office should also state a capacity budget. Each qualified opportunity consumes investment, legal, tax, finance, operations and principal time. Advancing too many live deals can reduce diligence quality. A weekly funnel review can cap simultaneous diligence cases and identify which work should stop, accelerate or outsource.

Volumes and conversion rates are hypothetical modelling assumptions for process illustration. They do not represent family-office market benchmarks or expected investment activity.

[/FIGURE]

7. Scale diligence to risk, structure and reversibility

Diligence should be proportionate, documented and connected to the decision. A liquid security purchased through an established custodian may require a different workplan from a direct minority investment, private fund commitment, property acquisition or structured credit exposure. The office should maintain diligence modules that can be assembled for each transaction.

Core modules include commercial, financial, legal, tax, ownership, regulatory, sanctions, management, operational, technology, cyber, valuation, structure, insurance, integrity and exit. Private funds add mandate, team, attribution, strategy, terms, operations, valuation, conflicts, service providers and portfolio construction. Direct investments add customer, supplier, product, market, management incentives, governance rights, financial quality and value-creation plans.

The diligence plan should identify each question, evidence requested, reviewer, source, status, finding, decision impact and resolution. A data room alone is not a diligence record. The decision record should distinguish facts verified from supplied documents, management representations, third-party evidence, adviser conclusions, open points and conditions.

Operational and third-party risk deserve attention because a lean office often relies on administrators, custodians, banks, cloud providers, advisers and outsourced finance. The Basel Committee's principles for third-party risk cover governance, risk assessment, due diligence, contracting, onboarding, monitoring, business continuity and exit within their banking scope.[17] A family office can use these categories to structure supplier oversight while adapting them to its own legal duties and scale.

8. Make ownership, sanctions and integrity evidence decision-ready

Complex structures require a current understanding of legal ownership, beneficial ownership, control, source of wealth or funds where applicable, and relevant counterparties. FATF Recommendations set international standards on customer due diligence, beneficial ownership, record keeping and risk-based controls.[6] FATF's 2024 guidance on legal arrangements addresses trusts and similar structures and emphasises adequate, accurate and up-to-date beneficial-ownership information.[7]

Sanctions screening should extend beyond a name check when ownership or control is material. UK financial sanctions guidance explains that restrictions can apply to entities owned or controlled directly or indirectly by a designated person, including entities not named individually on the list.[18] The guidance describes ownership, board-appointment and control tests. Jurisdictions differ, and legal advice is required where facts or obligations are unclear.

The investment file should preserve the entity chart, source dates, registries or documents consulted, sanctions and adverse-information results, identified gaps, reviewer and conclusion. Ongoing monitoring is necessary where ownership, governance or geographic exposure can change. A screening result is time-specific.

Integrity review should remain evidence led. Personal reputation and source relationships can inform the plan, but they do not replace verification. Allegations should be assessed for source credibility, relevance, resolution and current status. The office should avoid converting incomplete public information into a statement of fact.

9. Treat conflicts as a decision variable

Family-office conflicts can arise through family relationships, directorships, co-investments, adviser remuneration, referral fees, personal holdings, access allocations, transactions with family businesses, parallel vehicles and service-provider relationships. A conflict may be actual, potential or perceived. The consequence depends on authority, information, economics and the decision affected.

A standing register should record role and relationship conflicts. Each transaction should also include a specific declaration from committee members, deal team and material advisers. Disclosure should identify the nature of the interest, affected decision and proposed management response. A generic declaration of interests is weak if the transaction-specific effect remains unclear.

Responses include disclosure, information barriers, independent valuation, alternate sourcing, separate advice, recusal, changed allocation, additional approval or declining the transaction. Recusal should cover materials, discussion and vote as appropriate, with the remaining quorum confirmed. The minutes should record the resolution without unnecessarily distributing sensitive personal detail.

The FRC's Stewardship Code 2026 establishes principles for asset owners, asset managers and service providers, while its guidance specifically asks organisations to describe how stewardship conflicts are managed.[10][11] The Code is voluntary and aimed at its defined signatories. Its emphasis on policy, activities, outcomes and transparent conflict management provides a useful benchmark for process design.

Table 3. Conflict register and transaction-resolution fields

The examples support governance design. Legal duties, disclosure obligations, privacy requirements and remedies depend on the entity, transaction and jurisdiction.

Cases and ratings are hypothetical modelling assumptions. Placement supports triage and does not determine legal duties or an appropriate resolution.

[/FIGURE]

10. Make valuation independent enough for the decision

Valuation affects allocation, performance, risk, fees, collateral, liquidity and follow-on decisions. Listed prices can be observable, while private assets may rely on company information, models and judgment. The policy should define methodology, frequency, data hierarchy, materiality, reviewer independence, overrides and governance.

IFRS 13 defines a framework for fair-value measurement and a hierarchy based on observable and unobservable inputs within its accounting scope.[12] IFRS 9 addresses classification and measurement of financial instruments within its scope.[13] A family office should align accounting valuations with its reporting framework while recognising that an investment decision may also require downside, liquidity and realisable-value analysis.

IOSCO's valuation principles for collective investment schemes emphasise documented policies, consistent application, periodic review, error handling and conflict management within their stated scope.[14] Those principles are relevant when a family office assesses a fund manager's operating controls. Direct holdings may require an independent valuation specialist when information is limited, a conflict is material or the valuation drives a consequential transaction.

The monitoring report should separate reported value, valuation date, methodology, key assumptions, uncertainty and cash-realisation evidence. A single number can imply more precision than the inputs support. Scenario ranges and sensitivity can show which assumptions matter, while the official accounting value remains clearly identified.

11. Build an investment-committee pack that answers the decision

The committee pack should lead with the decision requested, authority, amount, structure, deadline and recommendation. It should then present the thesis, fit with mandate, expected return and downside, liquidity, concentration, terms, diligence conclusions, conflicts, legal and tax structure, execution plan, monitoring plan and unresolved matters.

The pack should be concise because underlying work remains available in controlled appendices and the data room. Concision depends on disciplined evidence, not omitted risk. A committee should be able to identify the principal reasons to invest, reasons to decline, assumptions that determine value, loss pathways, rights that protect the thesis and facts still subject to confirmation.

Conditions should be specific and testable. A condition such as satisfactory legal review does not identify the required outcome. A controlled condition states the document, clause or evidence required, responsible reviewer, completion date and authority to confirm satisfaction or approve a waiver.

Version control matters when terms change quickly. The cover should state the version, cut-off date, preparer and material changes since the prior circulation. Late papers should be identified. The committee chair should decide whether changed information requires more time, a conditional decision or a reconvened meeting.

Table 4. Minimum investment-committee pack and ownership

The pack is a decision template. Evidence depth should be proportionate to risk, complexity, commitment, rights and reversibility.

The exhibit is a template. It does not prescribe committee composition, legal conclusions, return metrics or approval thresholds.

[/FIGURE]

12. Make committee meetings a decision process

The committee calendar should allow members enough time to read the pack, declare conflicts and request clarification. The chair should confirm quorum, authority and conflicts before substantive discussion. The deal lead presents the recommendation, while designated reviewers present material challenges directly rather than through the sponsor.

Discussion should test thesis, downside, assumptions, evidence gaps and execution. A pre-mortem can ask how the investment could fail, which indicators would show deterioration and which rights remain usable. The committee should distinguish risks accepted as part of the return thesis from risks expected to be mitigated before or after closing.

Decision outcomes should include approve, approve with conditions, defer, decline or refer to a higher authority. Conditions should have owners and expiry. A deferral should state the evidence required for reconsideration. A decline should record the principal reasons without producing unnecessary narrative about counterparties.

Minutes should capture attendees, conflicts, quorum, materials, key challenges, decision, authority, conditions, dissent and follow-up. They are a governance record rather than a transcript. The decision log should reconcile to executed terms and the portfolio system so the office can test whether conditions were completed and the approved exposure was respected.

13. Carry approval conditions into execution

Execution converts a committee decision into legal ownership, cash movement, custody, books and monitoring obligations. A transaction can satisfy the investment thesis and still fail operationally if entities, signatures, settlement instructions, filings or post-close rights are poorly controlled.

The closing checklist should begin from the approved terms and conditions. It should reconcile final documents against the committee pack, identify changes, confirm authority, complete legal and tax steps, validate counterparties and bank instructions, arrange custody or title evidence, schedule funding and establish accounting treatment. Material changes return to the authorised decision maker.

Payment controls require segregation and independent verification. Bank instructions should be validated through a trusted channel. Dual authorisation should follow policy. The operations team should record the asset, legal owner, commitment, funded amount, unfunded obligation, currency, valuation basis, cash-flow schedule, contacts, documents, rights, reporting timetable and key dates.

The first monitoring review should be scheduled before close. Board or observer appointments, information rights, covenant dates, capital calls, tax filings, insurance, valuation and cyber obligations need named owners. A close binder should preserve the final approved and executed record.

14. Protect information, systems and third-party dependencies

Family offices hold sensitive identity, financial, legal, family and investment information. Threats can include payment fraud, account takeover, document theft, impersonation, supplier compromise and loss of access to critical records. Information controls belong in the investment operating model because sourcing, diligence, execution and monitoring depend on secure communication and systems.

NIST Cybersecurity Framework 2.0 is designed for organisations of different sizes and sectors and organises outcomes around Govern, Identify, Protect, Detect, Respond and Recover.[9] Its Govern function addresses context, strategy, roles, policy, oversight and supply-chain risk. A family office can map its critical investment processes and service providers to these outcomes.

Practical controls include managed identities, least privilege, multi-factor authentication, secure data rooms, encryption, device management, payment verification, retention, backups, incident playbooks and tested recovery. Personal messaging channels should not become the only transaction record. Sensitive documents should have access, download and forwarding controls proportionate to risk.

Supplier onboarding should verify ownership, security, access, subcontracting, data location, insurance, continuity, incident notification and termination support. Ongoing review should focus on critical services. Concentration can arise when one administrator, bank, custodian or technology platform supports many entities and transactions.

15. Connect monitoring to the original underwriting case

Portfolio monitoring should begin with the approved thesis and risks. Each investment needs a compact set of indicators for financial performance, operating progress, cash, liquidity, valuation, leverage, governance rights, compliance, conflicts and exit. Measures should state source, definition, owner, frequency and trigger.

Monitoring should distinguish information received from analysis performed by the office. A manager's quarterly report can be the source for net asset value, while the office separately assesses valuation change, cash yield, concentration and commitment pacing. Direct investments may require management accounts, covenant data, board materials and operating metrics.

The FRC Stewardship Code 2026 applies to its defined signatories and emphasises integrating stewardship with investment, engagement, rights and responsibilities, manager oversight and service-provider monitoring.[10][11] A family office can use these categories to define ownership behaviour even if it does not seek signatory status.

Escalation should lead to action. A breach can trigger inquiry, enhanced reporting, valuation review, legal analysis, exercise of rights, hedging, follow-on conditions, sale preparation or formal impairment consideration. The record should show the evidence, decision and outcome.

Table 5. Portfolio-monitoring cadence and escalation ownership

Frequencies and triggers are hypothetical examples. Actual cadence should reflect asset liquidity, rights, reporting availability, risk and governing obligations.

Cadence and activities are hypothetical operating assumptions. Asset-specific obligations and risk events can require more frequent review.

[/FIGURE]

16. Manage cash, concentration and unfunded obligations together

Liquidity governance should cover cash, marketable assets, expected inflows, capital calls, debt service, tax, distributions, operating costs, guarantees and follow-on reserves. A family office can appear liquid on a net-asset basis while carrying obligations that cluster under stressed market conditions.

The forecast should use base, delayed-distribution and severe-call scenarios. It should identify assets that can be sold, the time and discount likely required, borrowing capacity and family approvals. Private-market net asset value is not equivalent to available cash. Credit lines can support timing but add cost, covenants and refinancing risk.

Concentration should be viewed across issuer, sponsor, asset class, sector, geography, currency, custodian, bank, adviser and underlying exposure. Funds can create hidden overlap. Direct and fund positions may both depend on the same company, technology theme or refinancing market. The office should aggregate exposures where data permits and state gaps where look-through is unavailable.

Follow-on policy should be agreed before pressure arises. The office should state whether reserves are automatic, discretionary or subject to a new case. Supporting a challenged holding can protect value or deepen loss. The decision should revisit thesis, alternatives, priority in the capital structure, governance rights, dilution and total exposure.

17. Add assurance without building a large control function

A lean office can obtain assurance through role separation, external specialists, periodic control testing and governing-body review. The objective is to provide confidence that important processes and controls are designed and operating, while preserving management accountability.

The assurance map should cover mandate compliance, conflicts, cash and payment controls, custody and title, valuation, performance, legal entities, tax filings, sanctions, data access, cybersecurity, supplier oversight, document retention and business continuity. It should identify who owns each risk, who monitors it and who provides independent review.

Independent review can be targeted. A valuation specialist can review material unobservable valuations. Counsel can test regulatory-perimeter assumptions after activity changes. Cyber specialists can conduct access and resilience testing. External audit can address financial statements within its engagement. Internal audit or a qualified provider can assess governance and controls without taking first-line responsibility.

Findings should have severity, owner, due date and closure evidence. Repeated exceptions may indicate that the design is impractical, ownership is weak or capacity is insufficient. The governing body should receive material overdue actions and decide whether risk is accepted, remediated or avoided.

18. Mobilise the operating model in ninety days

Implementation should begin with the current portfolio, entities, people, service providers and decisions. The office can document the actual process, identify urgent gaps and establish a minimum controlled route before refining systems. A large technology programme is unnecessary for the first version.

The first month should confirm legal perimeter, mandate, decision rights, entity and authority maps, live commitments, cash controls and conflict declarations. The second month should launch the common funnel, diligence workplan, committee pack, decision log, closing checklist and portfolio templates. The third month should operate a full cycle, test controls, review exceptions and set the assurance plan.

Data migration needs care. Historical investments may lack original underwriting cases or consistent cost and valuation records. The office should preserve known facts, identify missing evidence and avoid reconstructing certainty. A legacy-position review can establish current ownership, cash flows, valuation basis, rights, obligations, conflicts, reporting and exit considerations.

Success measures should reflect operating outcomes: proportion of opportunities with complete triage records, committee packs circulated on time, conditions closed, cash movements independently verified, conflicts resolved before decisions, holdings with current monitoring data, overdue actions and cycle time by funnel stage. These measures reveal quality and speed together.

Table 6. Ninety-day mobilisation plan for the investment operating model

The sequence is illustrative. Timing should reflect office size, portfolio complexity, legal perimeter, data quality, current incidents and available resources.

Conclusion

A family-office investment operating model should preserve access, judgment and principal engagement while making authority, evidence, challenge and execution reliable. The design begins with family objectives and legal perimeter. It then connects mandate, decision rights, sourcing, diligence, conflicts, committee decisions, closing and monitoring in one controlled system.

The practical test is whether the office can answer a small set of questions quickly. Which entity and authority are acting? Why does the opportunity fit? What evidence supports the thesis and downside? Which conflicts exist and how were they resolved? Which conditions remain? Where will cash and title move? Who will monitor the holding, and what evidence will trigger action?

An office that can answer those questions from current records can move with greater confidence. Governance becomes part of execution. The principal receives decisions framed around objectives, exposure, alternatives and consequences, while the team gains authority to advance routine work within clear boundaries.

The model should remain proportionate and iterative. A new jurisdiction, outside investor, strategy, service, cyber incident, succession event or material control failure can change the perimeter and required safeguards. Annual review is useful, and event-driven review is essential when the underlying facts change.

Appendix A. Investment-committee challenge questions

1. Which family objective, entity and mandate provision support this investment?
2. What is the exact decision requested, and who has authority to make it?
3. What evidence would cause the office to decline the opportunity today?
4. Which assumptions determine value, and where are their switching points?
5. How can capital be lost, trapped, diluted or called sooner than expected?
6. Which ownership, sanctions, integrity, legal, tax and regulatory facts remain open?
7. Which conflicts exist among family members, advisers, sponsors and decision makers?
8. Which rights protect the thesis, and can the office exercise them operationally?
9. What changed since the pack was circulated, and does the committee need more time?
10. Which conditions must be completed before signing or funding?
11. Who will own monitoring, and which indicators will trigger engagement or exit?
12. How does the investment affect consolidated liquidity, concentration and obligations?

Appendix B. Minimum portfolio-record fields

The portfolio system should record the legal owner, asset, instrument, counterparty, sponsor, commitment, funded amount, unfunded obligation, currency, acquisition date, cost, cash flows, valuation, valuation date, method, source and uncertainty. It should also record governance rights, board or observer roles, reporting rights, covenants, guarantees, security, restrictions, key-person provisions, conflicts, related parties and service providers.

Monitoring fields should include original thesis, principal risks, current indicators, breaches, actions, owners, due dates, next review, distributions, capital calls, fees, tax events, document location and exit considerations. The system should distinguish supplied data from office analysis and preserve source dates.

Access should follow role and sensitivity. Changes to authority, bank accounts, ownership, valuation and payment instructions should be logged. Records should be retained according to applicable law, entity policy and contractual obligations. Sensitive personal and family information should be limited to people with a defined need.

References

1. U.S. Securities and Exchange Commission, Family Offices, final rule overview and resources, last reviewed 7 April 2023. https://www.sec.gov/rules-regulations/2011/06/family-offices
2. U.S. Securities and Exchange Commission, Final Rule: Family Offices, Release No. IA-3220, issued 22 June 2011. https://www.sec.gov/rules/final/2011/ia-3220fr.pdf
3. Dubai International Financial Centre Authority, Family Arrangements Regulations 2023, updated April 2023. https://assets.difc.com/v1/media/edge/images/dubaiintern0078-difcexperie96c5-production-3253/media/project/difcexperiences/difc/difcwebsite/documents/familydocs/family_arrangements_regulations_updated_april23.pdf
4. Abu Dhabi Global Market, Non-Financial Service Structure in ADGM, accessed 29 August 2026. https://www.adgm.com/documents/publications/en/non-financial-service-structure-in-adgm.pdf
5. Abu Dhabi Global Market, Beneficial Ownership and Control, accessed 29 August 2026. https://www.adgm.com/operating-in-adgm/obligations-of-adgm-registered-entities/beneficial-ownership-and-control
6. Financial Action Task Force, The FATF Recommendations, updated February 2025. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html
7. Financial Action Task Force, Guidance on Beneficial Ownership and Transparency of Legal Arrangements, published 11 March 2024. https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Transparency-Legal-Arrangements.html
8. Institute of Internal Auditors, Statements of Position: Three Lines Model, published 8 July 2026. https://www.theiia.org/en/resources/statements-of-position/
9. National Institute of Standards and Technology, The NIST Cybersecurity Framework 2.0, published 26 February 2024. https://doi.org/10.6028/NIST.CSWP.29
10. Financial Reporting Council, UK Stewardship Code 2026, published 3 June 2025 and effective 1 January 2026. https://www.frc.org.uk/library/standards-codes-policy/stewardship/uk-stewardship-code/
11. Financial Reporting Council, UK Stewardship Code 2026 Guidance, published 3 June 2025 and updated 30 October 2025. https://www.frc.org.uk/library/standards-codes-policy/stewardship/uk-stewardship-code-2026-guidance/
12. IFRS Foundation, IFRS 13 Fair Value Measurement, issued standard. https://www.ifrs.org/issued-standards/list-of-standards/ifrs-13-fair-value-measurement/
13. IFRS Foundation, IFRS 9 Financial Instruments, issued standard. https://www.ifrs.org/issued-standards/list-of-standards/ifrs-9-financial-instruments/
14. International Organization of Securities Commissions, Principles for the Valuation of Collective Investment Schemes, published May 2013. https://www.iosco.org/library/pubdocs/pdf/IOSCOPD413.pdf
15. Financial Conduct Authority, Required Permissions for Asset Management Firms, accessed 29 August 2026. https://www.fca.org.uk/firms/authorisation/wholesale-markets/permissions-asset-management
16. Basel Committee on Banking Supervision, Principles for the Sound Management of Third-Party Risk, published December 2024. https://www.bis.org/bcbs/publ/d577.htm
17. Office of Financial Sanctions Implementation, UK Financial Sanctions General Guidance, updated 12 May 2026. https://www.gov.uk/government/publications/financial-sanctions-general-guidance/uk-financial-sanctions-general-guidance
18. Organisation for Economic Co-operation and Development, G20/OECD Principles of Corporate Governance 2023, published 11 September 2023. https://doi.org/10.1787/ed750b30-en
19. Committee of Sponsoring Organizations of the Treadway Commission, Internal Control: Integrated Framework, framework resources, accessed 29 August 2026. https://www.coso.org/internal-control
20. U.S. Securities and Exchange Commission, Staff Responses to Questions About the Family Office Rule, updated 17 January 2012. https://www.sec.gov/divisions/investment/guidance/familyofficefaq.htm