A family office is rarely only an investment function. It can sit at the junction of operating businesses, property, philanthropy, household staff, travel, personal security, succession and a network of advisers. Information that looks harmless in one setting can become sensitive when combined across them.
That is why private-wealth due diligence should not be a deeper version of a corporate database check. It should be a focused, purpose-limited examination of the people, opportunities and dependencies capable of affecting the family's assets, privacy or decision-making.
Scale does not guarantee institutional control
PwC's 2025 Family Office Deals Study analysed more than 20,000 family offices and recorded $439.6 billion in deal value during the first half of 2025. 1 The sector can deploy institutional-scale capital while retaining the speed, informality and personal relationships of a private organisation.
That combination is often a competitive advantage. It can also produce concentration: one trusted executive may manage investments, payments and personal arrangements; an introduction may carry more weight than an investment memorandum; and the boundary between family, office and operating-company information may be unclear.
Due diligence should preserve the advantages of trusted relationships and speed while introducing independent challenge at the points where error or manipulation would be hardest to unwind.
Five risk rings around the principal
Opportunity
Investments, co-investors, counterparties, philanthropic projects and claims of access or performance.
People
Senior hires, advisers, household roles, introducers, partners and individuals seeking trusted proximity.
Structure
Entities, trusts, delegated authority, signatories, conflicts, service providers and succession arrangements.
Information
Travel, family relationships, health, holdings, routines, communications and data shared across advisers.
Reputation
Public associations, disputes, political exposure, online narratives and the conduct of connected parties.
The introduction is evidence of access, not quality
Private opportunities often travel through trusted networks. An introduction from a respected adviser is relevant context, but it does not establish the underlying proposition or reveal the scope of checks the introducer performed.
The due-diligence task is to preserve the relationship while independently testing the material claims: legal identity, authority, track record, ownership, regulatory position, conflicts, source of opportunity and the path by which money or information will move.
The FCA's guidance on clone firms captures a broader principle. Fraudsters can copy the identity and reference number of a genuine firm; users must verify the contact route and permissions independently. 4 In private markets, genuine names and advisers can also be inserted into a narrative without their knowledge or beyond the authority they actually gave.
A family-office label is not a control framework
In November 2025 the Financial Times reported that BDO had ended company-secretarial support for Singapore family office DW Capital after US and UK authorities imposed sanctions on entities and individuals linked to the Prince Group. The authorities alleged that the wider group was connected to a transnational scam network; investigations and legal processes continued. 5
The example should not be used to infer that every professional connected to a structure knew of alleged underlying conduct. It demonstrates the opposite due-diligence point: incorporation, professional service providers, tax status or the description 'family office' do not validate the source, purpose or control of activity beyond the scope actually examined.
For advisers, the practical question is not whether a reputable name appears somewhere in the structure. It is what that party was retained to do, what information it received and which proposition the client is being asked to rely upon.
Decisions that deserve independent challenge
| Decision | Material questions | Proportionate output |
|---|---|---|
| Co-investment | Who controls the vehicle, originated the opportunity and benefits from fees or related transactions? | Entity and conflict map; selected track-record verification; decision gaps |
| Senior appointment | Are identity, career, qualifications, interests and relevant claims coherent? | Role-specific background research with privacy boundaries |
| New adviser or introducer | What authority, permissions, incentives and relationships sit behind the recommendation? | Credentials, conflicts, network context and authenticated contact route |
| Philanthropic commitment | Does the organisation operate as presented, and can funds be traced to the intended purpose? | Governance, controllers, partners, delivery record and monitoring questions |
| Significant personal commitment | Which identity, history, interests or claims are material to the client's stated concern? | Focused, sensitive research confined to relevant information |
| High-value supplier | What access to homes, systems, routines or personal data will the supplier receive? | Corporate substance, ownership, personnel and information-security review |
Cyber risk follows trust and context
Deloitte reported that 43 per cent of surveyed family offices had experienced a cyberattack in the preceding 12 to 24 months, with 25 per cent attacked three or more times. Almost a third had no cybersecurity strategy. 2 The figures are survey evidence rather than a census, but they fit the operating risk: concentrated wealth, small teams, valuable context and extensive external relationships create attractive targets.
A technically convincing attack becomes more powerful when it includes travel plans, adviser names, a genuine transaction or a family voice. Verification procedures should therefore cover both systems and decisions: independent callback, dual payment approval, minimal public exposure, secure adviser coordination and a rehearsed route for challenging an unusual instruction.
Background and corporate research can help identify copied identities, suspicious domains, connected entities and inconsistencies. It does not replace security engineering, incident response or digital forensics.
Privacy without opacity
Research with a defined purpose
Define the decision and do not collect personal information simply because it can be found.
Need-to-know handling
Limit circulation, recording and retention of sensitive personal and family information.
Independent verification
Authenticate people, firms, permissions and payment routes outside the introduction chain.
Conflict visibility
Record who introduced, advises, manages, receives fees and benefits from the decision.
Escalation routes
Agree when legal, tax, regulatory, cyber, protective-security or other specialist advice is required.
Clear deletion
Retain what is needed for the decision and applicable obligations; dispose of surplus material securely.
The adviser protects the quality of the decision
Sensitive research should be compliant, necessary and proportionate, with a defined purpose and a clear connection to the client's decision or legitimate interest.
A good report also protects the subject from overstatement. It distinguishes verified facts, material indicators, allegations and unknowns; records credible alternative explanations; and avoids treating absence of a public footprint as evidence of concealment.
The objective is neither total knowledge nor a risk-free decision. It is to give the principal and trusted advisers a defensible understanding of what matters, what remains uncertain and where trust should be supported by an independent check.
Implications for decision-makers
- Treat introductions and professional associations as context, not transferred due diligence.
- Connect investment, people, governance, cyber and privacy risks around the actual decision.
- Use narrow scopes and need-to-know handling for sensitive personal research.
- Preserve privacy while making authority, conflicts and verification routes explicit.
The label does not describe the control environment
'Family office' describes a function and client relationship more readily than it describes a uniform institutional model. One office may employ investment, legal, tax and security specialists with formal committees and segregation of duties; another may be a small team coordinating external advisers around one principal. The same label can therefore sit over very different levels of governance, documentation and independence.
This variation matters when third parties rely on apparent institutional credibility. A reputable adviser, familiar email domain or regulated firm name can be imitated or misrepresented; the FCA continues to warn about clone firms that copy details of genuine authorised businesses. 6
For professional advisers, the relevant issue is not whether a family office looks sophisticated but whether authority, conflicts, beneficial interests and the source of a representation are clear enough for the decision being made. The privacy expected in private-wealth matters increases the value of disciplined verification because it reduces the amount of information available for casual cross-checking.
Real-world context: complex private wealth creates complex recovery questions
Rukhadze v Recovery Partners [2025] UKSC 10 arose from asset-recovery services following the death of Georgian businessman Arkadi Patarkatsishvili. The Supreme Court described assets in disorganised and often hidden locations around the world and competing claims by governments and others. Without implying wrongdoing by a family office, the case illustrates the practical complexity that can surround internationally dispersed private wealth and the advisers around it.
Public source: UK Supreme Court, Rukhadze and others v Recovery Partners GP Ltd and another [2025] UKSC 10.
Sources and reading
Sources were accessed and checked for this edition on 23 August 2026. Reported allegations and ongoing proceedings are identified as such in the text.
- 1
PwC. Global Family Office Deals Study 2025. 23 September 2025.
- 2
Deloitte. Family Office Insights Series - Global Edition. 2024 study, accessed 17 July 2026.
- 3
UK Finance. Annual Fraud Report 2026. 11 June 2026.
- 4
Financial Conduct Authority. Clone firms and individuals. updated 22 March 2023.
- 5
Financial Times. BDO quit role supporting Singapore family office linked to scam empire. 4 November 2025.
- 6
Financial Conduct Authority. Clone firms and individuals. accessed 23 August 2026.
Scope note
This article provides general information and analysis. It is not legal, insolvency, financial, regulatory, cybersecurity or other professional advice. Public records and reported material can be incomplete, delayed or disputed; an indicator is not proof of misconduct.
About the author
Carratu International
Carratu International provides investigation, intelligence and due diligence support to organisations, professional advisers and private clients. Each instruction is scoped around the decision, the evidence available and the need for proportionate, clearly qualified reporting.
Discuss a related matter