What compliance policies should a well-run multifamily office maintain?
A well-run multifamily office maintains written policies for conflicts, personal trading, privacy, cybersecurity, records, complaints, custody, business continuity, and vendor oversight. Policies should match the office’s activities, assign clear ownership, train employees, test controls, and receive regular review. Registered investment advisers also have specific SEC obligations.
Start with governance and conflicts
Maintain a written compliance manual that explains who owns each control, how concerns are reported, and how exceptions are approved. If the office is a registered investment adviser, SEC Rule 206(4)-7 requires policies reasonably designed to prevent violations, a designated chief compliance officer, and an annual review. The SEC says policies should reflect the firm’s risks, relationships, affiliations, clients, and service providers. SEC compliance questions
Keep a conflicts register. Cover related-party transactions, outside activities, gifts, referral payments, allocations, and compensation incentives. Disclose material conflicts clearly and obtain informed consent where required. Maintain a code of ethics covering personal trading, confidentiality, and misuse of material nonpublic information. SEC Rule 204A-1 requires registered advisers to maintain and enforce a written code of ethics. SEC code of ethics rule
Protect information, assets, and records
Use written privacy and information-security policies. Limit access by role, use strong authentication, encrypt sensitive data, review access regularly, and train staff to spot phishing and social engineering. Regulation S-P requires covered advisers to maintain administrative, technical, and physical safeguards for customer information. The SEC’s amended rule also addresses incident response and notification after unauthorized access. SEC Regulation S-P
Set retention rules for emails, messages, trade instructions, approvals, valuations, invoices, and reports. Preserve records in a form that can be produced promptly, and suspend destruction when litigation or an examination is expected. SEC guidance identifies these as core records-management questions for advisers. SEC adviser compliance questions
If the office has custody of client assets, document segregation, reconciliations, authorized payment procedures, and independent review. Registered advisers with custody may face additional SEC requirements, including an independent accountant examination in some cases. SEC custody rule
Privacy policies regarding family matters should be set up from the beginning, and violations of these policies should be met with swift repercussions in order to set an example for other team members.
Make controls work in daily operations
Adopt a complaints and incident policy with escalation deadlines, investigation steps, documentation, and corrective action. Review vendors before onboarding them, contract for security and confidentiality, and monitor critical providers. Maintain a business continuity plan covering people, systems, communications, backup locations, and recovery priorities. Test it and record lessons learned. SEC examination staff recommends plans tailored to the adviser’s operations, with redundancy for key services. SEC business continuity risk alert
Review the risk assessment at least annually and after major changes, such as a new custodian, acquisition, software platform, jurisdiction, or investment strategy. Keep evidence of training, testing, approvals, reviews, and remediation. Policies only help when staff can follow them and management checks that they work.
Related guides
- Family Governance With a Multifamily Office
- Access to Alternatives Through an MFO: A Practical Guide for Families
- Cross-Border Families and Multifamily Offices: A Practical Guide