Five questions a family office should be able to answer before anyone asks

The short answer

Deloitte's study of family offices found that forty-three per cent had been attacked in the past two years and that nearly a third had no plan for the day it happens; Ocorian's survey of 2026 found the same share attacked. The five questions below are the ones an office answers before it needs to. They are short, and the answers belong in the office's own record.

The five

Who, outside the family, can move money on an instruction. The administrator, the bank's relationship manager, the bookkeeper, the trustee. Each name on that list is a person a stranger can imitate. The office writes the list, and writes beside each name the control that catches an imitation: a call-back to a number the office already holds, never to one in the message, for every change of account and every payment above a line the principals set.

Which banks, administrators and advisers hold the office's data, and who checks them. An office of six people can have thirty providers with access to something that matters. The register of providers, one line each, with what they hold, who at the office oversees them and when they were last reviewed, is the single document that most often does not exist. Written once, it takes an hour a month to keep.

Whether there is a regulated vehicle in the office. A family office that manages a fund, a securitisation vehicle or an insurance wrapper answers to a regulator and, in Luxembourg, may be a regulated activity in itself under the law of 21 December 2012. The regulated part of the office carries duties the rest does not, from the register of its ICT providers to the hours within which an incident must be reported. The office should know which part is which, in writing.

Where the principals' own devices, homes and travel stand. The office can be well defended and the family reached through a child's telephone, a holiday house's network or a driver's message. The principals' protection is a separate line of work with its own discretion: identity and devices, the homes, the people around the family, and a quiet line to call. It is not an office project and should not be run as one.

Who is called first, and what they do in the first hour. A plan with named roles, the bank's fraud desk number, counsel's number and the regulator's clock written in, rehearsed once a year around a table. A third of the offices in Deloitte's study had no such page. The hour after a fraudulent transfer is when the money can still be recalled; after that it is a claim.

The instrument

The Owner's Baseline for a family office answers the five in six weeks and writes them into the office's own record, where the register of providers, the incident plan and the principals' protection each have a page, read by the office and by nobody else. The seat that follows keeps the register current and answers the questions a bank, an administrator or an investor asks, from the record, in a day.

Check the eight controls on your own office in two minutes: the free check →

Sources: Deloitte Private, Family Office Cybersecurity Report, 2024; Ocorian, family office survey, as reported in June 2026; the Luxembourg law of 21 December 2012 on the family office; Regulation (EU) 2022/2554 on digital operational resilience, for the regulated part of an office.