Safety Norms: Wealth Management Services

1Purpose, Scope, and Safety Principles

Wealth management services involve advising on and managing clients' financial assets. Typical activities include investment portfolio management, cash management, retirement and estate planning support, insurance coordination, performance reporting, and transfers between accounts. Harm in this area is mainly financial and personal: lost savings, misdirected payments, exposed identities, unsuitable advice, and inaccurate statements. A single unauthorized transfer can remove years of a client's savings in minutes, which is why controls must operate before value moves rather than after.

This document applies to all employees, contractors, and systems that touch client relationships, client money, client records, or client data. It is a starting point for locally approved procedures. Where a norm uses the word must, it is a mandatory rule to be confirmed against the firm's compliance framework. Where it uses the word should, it is recommended practice that local management may adjust.

Three principles guide every norm. First, protect client assets before convenience. Second, verify before acting on any instruction that moves value or changes details. Third, document decisions so that another qualified person can reconstruct what was done and why.

2Roles, Competence, and Accountability

Senior management owns the safety framework, approves the firm's risk appetite, and allocates resources for controls. A designated compliance officer maintains the policy set, reviews exceptions, tracks regulatory obligations, and reports to the board or governing body as required. Relationship managers are accountable for suitability, the accuracy of fact-finding, and the instructions they accept from clients. Operations staff are accountable for executing, checking, and reconciling transactions. Technology and security teams are accountable for access controls, system configuration, and data protection.

Competence and authorization must be formal and recorded. Staff should not process payments, change client bank details, approve trades, or give personalized advice unless their licensing, training, and system permissions are current. Authority should be granted in writing, with defined limits on amounts, product types, and client categories. Authority should be reviewed when roles change and removed when a person leaves or is suspended.

• Maintain a register of licensed or authorized individuals and their permitted activities, checked against official regulator registers before each permission is granted.
• Apply segregation of duties so that the person who initiates a payment or trade is never the person who approves or reconciles it.
• Require supervisors to review exceptions and sign off on overrides within a time limit set by the firm's policy.
• Recommended: hold short role briefings whenever responsibilities change so that staff understand their limits.

3Course-Specific Hazards and Risk Assessment

Hazards are the sources of harm in wealth management work. The most significant include misdirected or unauthorized payments, account takeover through social engineering, misuse of discretionary authority, unsuitable recommendations, undisclosed conflicts of interest, leakage of confidential client data, and inaccurate valuations or statements. Hazards arise in client meetings, telephone calls, email, messaging applications, shared drives, portfolio platforms, custody systems, and remote work locations.

Risk is assessed by combining likelihood with impact on client assets, client wellbeing, regulatory standing, and firm reputation. Each activity should be rated as low, medium, or high, with controls proportionate to the rating. Ratings must be reviewed whenever a process, product, or system changes, and whenever a near miss or incident reveals a weakness. Assessments should be written down, not held informally in someone's head.

Example: a request by email to move funds to a new external account is high risk because the attacker's goal is to create a loss that is hard to reverse. A request to change a mailing address is also a common fraud route, because it can redirect statements and one-time codes. Both require the same verification discipline as a payment, even though the financial impact appears smaller.

• High: moving funds to new or changed external accounts, altering beneficiary or contact details, executing large or unusual trades, and granting system administrator access.
• Medium: onboarding new clients, updating risk profiles, sharing reports with third parties, and processing routine withdrawals from established accounts.
• Low: scheduling meetings and sending general market commentary that contains no client data and no personal recommendation.

4Preventive Controls and Safe Work Practices

Preventive controls stop errors and fraud before money or information leaves the firm. Client identity must be verified using the firm's approved method before any instruction is accepted or any information is disclosed. Instructions to move money or change account details must be confirmed through a second channel, such as a callback to a telephone number already held on file. Contact details supplied in the same request must never be used for the callback. This callback control is mandatory for every high-risk instruction, regardless of how urgent or senior the requester claims to be.

Safe practice also requires that every discretionary trade or rebalancing follows the documented investment policy and the client's mandate. Staff must not act outside the mandate. Where a deviation is justified, the rationale must be recorded and approved by a designated reviewer before execution, except in a documented emergency defined by policy. Urgency alone is not a justification for skipping controls, and pressure from a client, colleague, or manager should be treated as a warning sign.

Fraud often exploits routine. Staff should treat unusual requests, such as a new payee added shortly before a large withdrawal, a request to bypass normal forms, or a request to send confirmations to an unfamiliar address, as triggers for additional checks.

• Mandatory: maintain dual authorization for payments and trades above thresholds set by the firm, with the approver independent of the initiator.
• Mandatory: reconcile client cash and holdings against custodian or platform records at a frequency set by the compliance framework, and investigate every break promptly.
• Mandatory: prohibit personal use of client accounts, sharing of passwords or one-time codes, and acceptance of transaction instructions through messaging apps the firm has not approved.
• Mandatory: record the reason for each override of a system control and obtain independent approval before the override is used.
• Recommended: use standard templates for suitability records and prompt staff to complete all mandatory fields before submission.
• Recommended: rotate review assignments periodically so that no pair of staff controls a client relationship indefinitely.
• Recommended: run tabletop exercises that simulate a fraudulent email requesting an urgent transfer, and record lessons learned.

5Equipment, Environment, Information, and Protective Safeguards

Systems and devices are the equipment of this field. Access to portfolio platforms, payment systems, and client files must follow least privilege, meaning each user receives only the access needed for the role. Each user must have a unique account. Shared or generic accounts must not be used for transaction functions. Multifactor authentication should be applied to all access to client data and payment functions, and must be applied where the firm or applicable standards require it. Access must be removed promptly when roles change or employment ends.

Information must be handled as confidential. Client data should be stored only in approved systems, shared only through approved encrypted channels, and printed only when necessary. Printed material must be shredded securely or placed in locked disposal containers. Staff working remotely should use firm-issued devices, private workspaces where others cannot view screens, and secured networks. Conversations about client affairs should not take place in public areas or where others can overhear them. Data protection and privacy obligations are jurisdiction-dependent, so the firm should verify applicable laws with qualified counsel.

Data minimization reduces exposure. Collect and retain only the information needed to provide the service and meet legal obligations, and review stored data against a retention schedule.

• Lock screens whenever a workstation is unattended, and never leave client documents on desks, printers, or in vehicles.
• Report lost devices, suspected credential exposure, or unexpected prompts for one-time codes to the security team immediately.
• Use only approved software for signatures, document exchange, and file sharing; do not use personal email or consumer file-sharing tools for client material.
• Recommended: keep a current inventory of devices and systems that hold client data, with a named owner for each.

6Incident, Near-Miss, Emergency, and Escalation Procedures

Incidents include suspected fraud, misdirected funds, unauthorized access, lost or stolen client documents, system outages that delay trades or payments, and complaints about suitability or service. Near misses, such as a caught phishing attempt or a payment stopped at the final check, must be reported because they reveal weaknesses in controls. Reporting must not be delayed for fear of blame. The firm should apply a just-culture approach in which honest, prompt reporting is protected and repeated carelessness is addressed through supervision and training.

Suspicious activity must be escalated immediately to the compliance officer or designated fraud contact. Where a transfer is in progress, staff should pause it through the approved payments process and must not attempt to recover funds on their own. Staff must not tip off a suspected party where doing so could compromise an investigation or breach reporting rules. Where there is an immediate risk to life or physical safety, staff should contact local emergency services first and then inform management.

After an incident, the response team should preserve records, contain access, assess client impact, and decide whether notification to clients, regulators, or other authorities is required. Notification deadlines vary by jurisdiction and must be confirmed with qualified advisers and the compliance function. Every step should be logged with the time, the person involved, and the decision made.

• Escalate within the time limit set by the firm's policy; if none is defined, escalate the same working day.
• Do not contact the client using details supplied in a suspicious request. Use details already held on file.
• Keep a secure log of actions taken, including who was informed and what was decided.
• Recommended: conduct a short post-incident review within an agreed period and assign owners for corrective actions.

7Records, Training, Inspection, and Review

Accurate records are a core safety control. Each client file should contain identity verification evidence, fact-finding details, the current risk profile, the suitability rationale, signed or recorded instructions, and a record of advice given. Records must reflect what actually happened. Corrections must be made as attributed amendments that keep the original entry visible, never by overwriting or deleting. Backdating or reconstructing records to appear compliant is prohibited.

Training must be completed before a person handles client money or data, and refreshed at intervals set by the firm and by applicable rules. Training should cover fraud methods, data handling, conflicts of interest, record accuracy, and escalation routes. Training completion should be recorded and tested. Retention periods for records are set by law and regulator rules, which vary by jurisdiction; verify them with qualified advisers before disposal.

• Retain records for the period required by applicable law and firm policy, then dispose of them securely and log the disposal.
• Sample a defined proportion of recent instructions and client files for review, with the proportion set by the compliance function.
• Recommended: use short scenario quizzes to check whether staff understand callback rules and escalation routes.

8Monitoring, Review, and Continuous Improvement

Monitor key indicators such as the number of exceptions, reconciliation breaks, overdue approvals, complaints, access changes, and near-miss reports. Indicators should trigger review and learning rather than being used to blame individuals. Management should review the safety framework on a schedule set by the compliance function and after any significant incident, system change, new product launch, or regulatory update.

Continuous improvement means turning lessons into changes. Each incident review should identify root causes, assign an owner, set a deadline, and confirm that the change worked. Where a control repeatedly fails, the firm should consider whether it is poorly designed, poorly understood, or poorly resourced. These norms are a starting point only. Local procedures must be drafted, approved, and tailored to the firm's products, jurisdiction, client base, and systems, and reviewed by qualified legal and compliance professionals.

• Test fraud controls through simulated scenarios and record the results.
• Publish updates to staff and confirm that each person has read and acknowledged them.
• Recommended: invite client feedback on verification experiences to improve controls without weakening them.

Implementation checklist

• Verify client identity using the approved method before accepting any instruction or disclosing information.
• Confirm every payment or change to account details through a callback to contact details already on file.
• Confirm that the initiator, approver, and reconciler are different people for each transaction.
• Check that each trade or transfer matches the client mandate and record the rationale for any deviation.
• Confirm that staff licensing, training, and system permissions are current before granting access.
• Store client data only in approved systems and lock screens whenever a workstation is unattended.
• Escalate suspicious activity to the compliance officer the same working day and pause transfers through the approved process.
• Record near misses and incidents, and correct records only by attributed amendment.
• Verify applicable laws, regulator rules, and retention periods with qualified advisers before relying on them.