A family office is rarely only an investment function. It can sit at the junction of operating businesses, property, philanthropy, household staff, travel, personal security, succession and a network of advisers. Information that looks harmless in one setting can become sensitive when combined across them.
That is why private-wealth due diligence should not be a deeper version of a corporate database check. It should be a discreet, purpose-limited examination of the people, opportunities and dependencies capable of affecting the family's assets, privacy or decision-making.
Scale does not guarantee institutional control
PwC's 2025 Family Office Deals Study analysed more than 20,000 family offices and recorded $439.6 billion in deal value during the first half of 2025. 1 The sector can deploy institutional-scale capital while retaining the speed, informality and personal relationships of a private organisation.
That combination is often a competitive advantage. It can also produce concentration: one trusted executive may manage investments, payments and personal arrangements; an introduction may carry more weight than an investment memorandum; and the boundary between family, office and operating-company information may be unclear.
Due diligence should preserve the advantages of discretion and speed while introducing independent challenge at the points where error or manipulation would be hardest to unwind.
Five risk rings around the principal
Opportunity
Investments, co-investors, counterparties, philanthropic projects and claims of access or performance.
People
Senior hires, advisers, household roles, introducers, partners and individuals seeking trusted proximity.
Structure
Entities, trusts, delegated authority, signatories, conflicts, service providers and succession arrangements.
Information
Travel, family relationships, health, holdings, routines, communications and data shared across advisers.
Reputation
Public associations, disputes, political exposure, online narratives and the conduct of connected parties.
The introduction is evidence of access, not quality
Private opportunities often travel through trusted networks. An introduction from a respected adviser is relevant context, but it does not establish the underlying proposition or reveal the scope of checks the introducer performed.
The due-diligence task is to preserve the relationship while independently testing the material claims: legal identity, authority, track record, ownership, regulatory position, conflicts, source of opportunity and the path by which money or information will move.
The FCA's guidance on clone firms captures a broader principle. Fraudsters can copy the identity and reference number of a genuine firm; users must verify the contact route and permissions independently. 4 In private markets, genuine names and advisers can also be inserted into a narrative without their knowledge or beyond the authority they actually gave.
A family-office label is not a control framework
In November 2025 the Financial Times reported that BDO had ended company-secretarial support for Singapore family office DW Capital after US and UK authorities imposed sanctions on entities and individuals linked to the Prince Group. The authorities alleged that the wider group was connected to a transnational scam network; investigations and legal processes continued. 5
The example should not be used to infer that every professional connected to a structure knew of alleged underlying conduct. It demonstrates the opposite due-diligence point: incorporation, professional service providers, tax status or the description 'family office' do not validate the source, purpose or control of activity beyond the scope actually examined.
For advisers, the practical question is not whether a reputable name appears somewhere in the structure. It is what that party was retained to do, what information it received and which proposition the client is being asked to rely upon.
Decisions that deserve independent challenge
| Decision | Material questions | Proportionate output |
|---|---|---|
| Co-investment | Who controls the vehicle, originated the opportunity and benefits from fees or related transactions? | Entity and conflict map; selected track-record verification; decision gaps |
| Senior appointment | Are identity, career, qualifications, interests and relevant claims coherent? | Role-specific background research with privacy boundaries |
| New adviser or introducer | What authority, permissions, incentives and relationships sit behind the recommendation? | Credentials, conflicts, network context and authenticated contact route |
| Philanthropic commitment | Does the organisation operate as presented, and can funds be traced to the intended purpose? | Governance, controllers, partners, delivery record and monitoring questions |
| Significant personal commitment | Which identity, history, interests or claims are material to the client's stated concern? | Narrow, sensitive research avoiding indiscriminate collection |
| High-value supplier | What access to homes, systems, routines or personal data will the supplier receive? | Corporate substance, ownership, personnel and information-security review |
Cyber risk follows trust and context
Deloitte reported that 43 per cent of surveyed family offices had experienced a cyberattack in the preceding 12 to 24 months, with 25 per cent attacked three or more times. Almost a third had no cybersecurity strategy. 2 The figures are survey evidence rather than a census, but they fit the operating risk: concentrated wealth, small teams, valuable context and extensive external relationships create attractive targets.
A technically convincing attack becomes more powerful when it includes travel plans, adviser names, a genuine transaction or a family voice. Verification procedures should therefore cover both systems and decisions: independent callback, dual payment approval, minimal public exposure, secure adviser coordination and a rehearsed route for challenging an unusual instruction.
Background and corporate research can help identify copied identities, suspicious domains, connected entities and inconsistencies. It does not replace security engineering, incident response or digital forensics.
Discretion without opacity
Purpose limitation
Define the decision and do not collect personal information simply because it can be found.
Need-to-know handling
Limit circulation, recording and retention of sensitive personal and family information.
Independent verification
Authenticate people, firms, permissions and payment routes outside the introduction chain.
Conflict visibility
Record who introduced, advises, manages, receives fees and benefits from the decision.
Escalation routes
Agree when legal, tax, regulatory, cyber, protective-security or other specialist advice is required.
Clear deletion
Retain what is needed for the decision and applicable obligations; dispose of surplus material securely.
The adviser protects the quality of the decision
Private-client work can become intrusive if the question is not controlled. The fact that a decision is personal does not justify unrestricted investigation. Sensitive research should be lawful, necessary, proportionate and framed around information capable of changing the client's decision or protecting a legitimate interest.
A good report also protects the subject from overstatement. It distinguishes verified facts, material indicators, allegations and unknowns; records credible alternative explanations; and avoids treating absence of a public footprint as evidence of concealment.
The objective is neither total knowledge nor a risk-free decision. It is to give the principal and trusted advisers a defensible understanding of what matters, what remains uncertain and where trust should be supported by an independent check.
What to carry into the next decision
- Treat introductions and professional associations as context, not transferred due diligence.
- Connect investment, people, governance, cyber and privacy risks around the actual decision.
- Use narrow scopes and need-to-know handling for sensitive personal research.
- Preserve discretion while making authority, conflicts and verification routes explicit.
Sources and reading
Sources were accessed and checked for this edition on 17 July 2026. Reported allegations and ongoing proceedings are identified as such in the text.
- 1
PwC. Global Family Office Deals Study 2025. 23 September 2025.
- 2
Deloitte. Family Office Insights Series - Global Edition. 2024 study, accessed 17 July 2026.
- 3
UK Finance. Annual Fraud Report 2026. 11 June 2026.
- 4
Financial Conduct Authority. Clone firms and individuals. updated 22 March 2023.
- 5
Financial Times. BDO quit role supporting Singapore family office linked to scam empire. 4 November 2025.
Scope note
This article provides general information and analysis. It is not legal, insolvency, financial, regulatory, cybersecurity or other professional advice. Public records and reported material can be incomplete, delayed or disputed; an indicator is not proof of misconduct.
About the author
Verify Carratu International Ltd
VCI provides investigation, intelligence and due diligence support to organisations, professional advisers and private clients. Work is scoped around the decision, the evidence available and the need for proportionate, clearly qualified reporting.
Discuss a related matter