Safety Norms: Financial Planning and Wealth Management

1Purpose, Scope, and Safety Principles

This document explains how people working in financial planning and wealth management can prevent harm to clients, colleagues, and the firm. In this field, harm usually means financial loss, unauthorized access to money or personal data, unsuitable advice, inaccurate records, and regulatory breach. The safety focus is financial and informational, although the same discipline supports office and travel safety.

The norms apply to financial planners, advisers, portfolio managers, paraplanners, operations and custody staff, client service assistants, trainees, and third-party vendors who handle client money, account instructions, plans, or personal data. They cover in-person meetings, video calls, email, telephone, paper files, and approved software.

• Mandatory: act in the client's documented best interest and disclose material conflicts before advice is implemented.
• Mandatory: no single person may move client money, change client identity or payment details, and approve the same transaction alone.
• Recommended: review these norms with the local compliance function and adapt them to the firm's licenses, products, and jurisdiction.

2Roles, Competence, and Accountability

Every process needs a named owner. Senior leadership is accountable for risk appetite and for funding controls. A compliance lead maintains policies, monitors exceptions, and has authority to pause activity. A supervising principal reviews adviser recommendations. Operations staff own custody instructions and reconciliation. Information security staff own system access and incident response. Advisers own the quality and documentation of their advice.

Competence and authorization are separate. Competence means the person has training and experience for a task. Authorization means the firm has formally permitted that person to perform it. Before anyone gives recommendations, places orders, or approves transfers, the firm must confirm current licensing or registration where required and verify it with the relevant competent authority. Licensing rules are jurisdiction-dependent and are not set by this document.

• Mandatory: maintain a written authorization matrix listing who may approve transfers, open accounts, change beneficiaries, edit fee schedules, and override system alerts.
• Mandatory: trainees act only under documented supervision and cannot approve client instructions.
• Mandatory: staff must report conflicts of interest, restricted personal trading, and outside business activities to compliance.
• Recommended: collect periodic attestations confirming that staff have read these norms and understand their authority limits.

3Course-Specific Hazards and Risk Assessment

The most serious hazards are account takeover and fraudulent payment instructions, often triggered by social engineering that imitates a client, a custodian, or an internal executive. Other high-risk hazards include unauthorized trading, misappropriation through improper fees, undisclosed conflicts, and recommendations that do not match a client's objectives, time horizon, liquidity needs, or capacity for loss.

Medium-risk hazards include errors in retirement or tax projections, incorrect beneficiary or contact details, loss of paper files, and use of unapproved software that stores client data. Low-risk hazards include scheduling errors and formatting problems, which still become serious if a file is sent to the wrong recipient. Each process should have a written risk assessment that rates likelihood and impact, names the control owner, and is reviewed after incidents or significant changes.

• High: fraudulent or spoofed instructions to move funds, change bank details, or add new payees.
• High: unauthorized or unsuitable trades, excessive trading, and fee errors that overcharge clients.
• High: exposure of identity, account, or tax data through email, cloud tools, lost devices, or open discussion.
• Medium: planning assumptions that are outdated, undisclosed, or misapplied to a client's situation.
• Medium: pressure from clients, relatives, or colleagues to bypass verification steps.
• Medium: investment offers described as guaranteed or unusually high return, which may indicate fraud.

4Preventive Controls and Safe Work Practices

Money movement is the highest-consequence activity. Mandatory: every outgoing transfer and every change to payment instructions requires dual authorization by two people with appropriate authority, neither of whom originated the request. Verify any change to bank details or payees by callback to a telephone number already held on file, never a number supplied in the request. Newly added payees should face a cooling-off period and supervisor sign-off before the first payment.

Segregation of duties must be built into systems as well as policy. No one should open a client account, enter a trade, approve it, and reconcile it. Advisers should not hold custody credentials or payment release rights. Operations staff should not approve fee waivers for clients they originate. Where staffing is small, the firm must document compensating controls, such as independent review of reports by a supervisor outside the transaction chain.

• Mandatory: document a fact find covering objectives, time horizon, income, net worth, liquidity needs, tax situation, and risk tolerance, and confirm the client has reviewed it.
• Mandatory: record the rationale for each recommendation, the alternatives considered, the costs, and the conflicts disclosed.
• Mandatory: check trade tickets against approved models and client restrictions before execution, and document any deviation.
• Mandatory: calculate fees from the signed fee schedule and reconcile them on the cycle set by policy.
• Mandatory: never guarantee returns or present hypothetical projections as certainties.
• Recommended: use a second-review checklist for complex products, leverage, alternative investments, and concentrated positions.
• Escalate immediately: urgent requests to bypass normal steps, requests for secrecy, new bank details received by email, pressure to move funds quickly, and requests to route money through third parties.

5Equipment, Environment, Information, and Protective Safeguards

Approved systems carry most of the controls. Client relationship management, portfolio accounting, planning software, custodian portals, and document storage must be firm-approved, access-controlled, and logged. Personal messaging apps, personal email, and consumer cloud storage must not be used for client information. Mobile devices used for client access must be enrolled in device management, encrypted, and locked when unattended.

Information handling follows the need-to-know principle. Collect only the data needed for the advice, keep it accurate, and restrict it to people who need it. Privacy and data protection rules vary by jurisdiction, so the firm must identify which apply and confirm current requirements with qualified counsel. Third-party vendors must complete security and confidentiality due diligence before receiving client data, and contracts should specify breach notification duties.

• Mandatory: multifactor authentication on all client-data and payment systems, with unique user IDs and no shared logins.
• Mandatory: a clean desk rule; printed client material is locked away and shredded when no longer needed.
• Mandatory: discuss client matters only in private settings, not on speakerphone or in shared public spaces.
• Mandatory: send sensitive files only through approved encrypted channels, after verifying the recipient.
• Mandatory: work remotely only through approved connections and managed devices.
• Recommended: run periodic access reviews that remove access no longer needed for the current role.

6Incident Reporting, Emergency Response, and Escalation

Anyone who suspects fraud, a payment error, a data exposure, or a compliance breach must stop the affected activity and report it to the supervisor and compliance lead without delay. Do not complete a transfer, do not reply to a suspicious request, and do not use contact details supplied in that request. Preserve emails, call logs, and file versions. If the written procedure requires it, do not alert a suspected party until compliance has advised.

Data breaches and cyber incidents follow the written incident response plan. Isolate affected accounts, revoke credentials, engage the firm's security provider, and involve legal counsel. Notification to clients or authorities is jurisdiction-dependent and must be verified with qualified professionals. Physical emergencies such as fire, medical events, or threats take priority over any financial process. Call local emergency services first and follow building evacuation plans. This document does not replace official emergency procedures.

• Mandatory: report any suspected unauthorized instruction, lost device, misdirected message, or security alert to the security and compliance contacts on the day it is identified.
• Mandatory: record near misses, such as a payment stopped by callback, so the firm can learn from them.
• Mandatory: document client harm and handle it through the complaint and remediation process.
• Mandatory: decisions on suspicious activity reporting or regulator notification belong to the compliance function, which verifies applicable deadlines.
• Mandatory: staff who report in good faith are protected from retaliation.

7Records, Training, Inspection, and Review

Accurate records are a safety control. Keep contemporaneous notes of client meetings, advice rationale, approvals, client consents, and changes to client data, with an audit trail. Records must not be backfilled or altered without a traceable entry. Corrections are made as new entries showing who changed what and why. Retention periods are jurisdiction-dependent and must be confirmed by compliance.

Monitoring and review close the loop. Compliance should test controls, review exceptions and near misses, and report trends to leadership. After any incident, the firm should complete a root cause review and update the risk assessment, norms, and training. Policies should be reviewed whenever a product, system, rule, or key role changes, and at intervals set by the firm.

• Mandatory: keep the fact find, suitability record, signed agreements, trade approvals, and fee calculations in the client file.
• Mandatory: maintain logs of user access, client profile changes, and payment approvals.
• Mandatory: complete role-based training before access is granted, and refresh it when products, systems, or rules change.
• Recommended: run verification and phishing drills, and use the results to target coaching.
• Recommended: sample client files and transactions periodically for suitability, accuracy, and fee correctness.

8Practical Checklist and Conclusion

These norms are a starting point. They do not replace licensed professional judgment, formal training, approved firm procedures, or legal advice. Confirm all legal, licensing, privacy, retention, and reporting requirements with competent authorities or qualified professionals, because they vary by jurisdiction and change over time. Apply the controls consistently, and never allow urgency or client pressure to override them.

Implementation checklist

• Verify your licensing or registration and authorization limits before advising or approving any transaction.
• Require dual authorization for every transfer and every change to payment instructions.
• Confirm any bank detail change by callback to a number already held on file.
• Document the fact find, recommendation rationale, and disclosed conflicts before implementation.
• Keep administrative access and payment release rights separate from advisory roles.
• Use only approved systems, encrypted devices, and multifactor authentication for client data.
• Stop and escalate any suspicious request, secrecy request, or unfamiliar payee.
• Record near misses and incidents on the day they are identified.
• Confirm privacy, retention, and breach notification duties with qualified counsel for your jurisdiction.
• Schedule periodic access reviews, file sampling, and training refreshers.