Vendor stack for a lean family office

A lean family office is not a small ambition. It is a design choice: fewer full-time seats, sharper vendor selection, and an integrator who actually integrates. The failure mode is not “too few vendors.” It is a pile of overlapping subscriptions, two custodians that do not reconcile, a bill-pay platform nobody trusts with dual control, household cards that train fraudsters, and a cyber posture that assumes wealth is invisible because the family is polite.

This post maps a practical vendor stack for a lean single-family office — roughly the shape many families need between a strong advisor bench and a full institutional SFO. Adjust scale to your complexity. Keep the architecture. Yesterday’s IPS and Monday’s committee design only work if money movement, reporting, and risk transfer are operable in the real world.

Design principles before logos

1. Buy outcomes, not demos. Every vendor must map to a named risk or workflow.
2. Prefer boring in core plumbing. Custody, bill-pay, identity, and payroll are not places for novelty theater.
3. One system of record for money movement. Fragmented approvals create fraud surface and family folklore about “who sent what.”
4. Contract for exits. Data portability and termination assistance beat romantic partnership language.
5. Separate advice from custody from wire control wherever practical.
6. Measure vendors quarterly with scorecards, not holiday gift baskets and conference dinners.
7. Flow down cyber and confidentiality to anyone who touches personal data, travel, or wire instructions.
8. Name an internal owner for every vendor. Orphans become zombies that keep billing.

The stack by layer

Layer 1 — Custody and investment operations

Need: Safekeeping, settlement, corporate actions, auditable statements, and clean data exports.

Lean pattern: One primary custodian for marketable securities; specialty arrangements only when an asset truly requires them. Do not confuse art storage or yacht registration with securities custody — different risks, different vendors.

Watch-outs: Soft-dollar fog; “custom” reporting that will not export; relationship managers who blur into product distribution; sluggish corporate-action handling on complex entitlements.

FO owner: CIO/OCIO liaison or FO lead with investment-ops literacy.

Layer 2 — Aggregation, reporting, and the family dashboard

Need: Consolidated view across accounts, entities, private investments, and high-level legacy-asset TCO snapshots that the IC and LC can both trust.

Lean pattern: A reporting or aggregation platform fed by custody APIs plus disciplined manual feeds for illiquids. Resist building a mini hedge-fund technology team in year one of a lean office.

Watch-outs: Pretty PDFs that cannot answer “what is our liquidity in ninety days?”; private-equity call tracking that lives only in email; dashboards nobody opens because altitude is wrong for the audience.

FO owner: FO lead or analyst; IC defines investment altitude; LC defines TCO altitude.

Layer 3 — Cash, bill-pay, and entity payables

Need: Controlled payables for household, entities, trusts, and legacy-asset managers; dual control on releases; a clean vendor master list; out-of-band verification for bank-detail changes.

Lean pattern: Institutional-grade bill-pay or treasury workstation with role-based permissions. Personal “pay from my phone” habits do not scale and create training data for social engineering.

Watch-outs: Single-approver culture; email-only bank changes; household staff with informal access to principal cards; duplicate vendors under slightly different legal names.

FO owner: Controller or FO operations — even if outsourced — with FO lead oversight.

Layer 4 — Accounting and entity hygiene

Need: Books for the FO entity, holdcos, and major legacy LLCs; partnership accounting where required; audit-ready workpapers; intercompany clarity.

Lean pattern: Serious multi-entity accounting plus a CPA firm that understands UHNW complexity. Do not let a single asset manager’s QuickBooks become the holdco’s system of truth.

Watch-outs: Chart-of-accounts chaos; personal expenses in “miscellaneous”; basis tracking neglected until a sale; abandoned entities that still file nothing and worry everyone.

FO owner: Outsourced CFO/controller with FO lead review cadence.

Layer 5 — Tax coordination

Need: Compliance, estimates, multi-state or residency awareness, entity returns, and a specialist bench for trusts, charitable structures, cross-border issues, and asset-specific quirks (aviation personal use, vessel VAT touchpoints, collection donations, and the like).

Lean pattern: One quarterback firm or EA-led coordination node; specialists engaged through that node so advice does not conflict in silence.

Watch-outs: Three firms emailing different answers to the principal; no shared estimate calendar; document scavenger hunts every March; no owner for K-1 tracking.

FO owner: Tax quarterback; FO lead runs the document-pack rhythm.

Layer 6 — Legal architecture

Need: Corporate and trust counsel; access to asset-specific counsel (maritime, aviation, art, real estate, household employment); clean engagement letters.

Lean pattern: Primary coordinating firm; specialists on project or retainer basis; written rules for who speaks to whom so vendors cannot jurisdiction-shop advice.

Watch-outs: Counsel who only appear for transactions; household NDAs and employment docs treated as afterthoughts; structure sophistication that outruns operational reality.

FO owner: Principal with FO lead as calendar and packet owner.

Layer 7 — Risk and insurance

Need: Umbrella, property, aviation/yacht/collection policies, cyber, appropriate security coverages, household employment practices, and claims advocacy. Interconnected risk mapping — not siloed certificates.

Lean pattern: A true UHNW risk broker who understands how jet, yacht, home, and staff interact; annual renewal summit on the FO calendar.

Watch-outs: Warranties nobody operationalizes; underinsured collections; cyber riders that assume enterprise IT you do not run; casual certificates for vendors who enter residences.

FO owner: Risk broker plus FO lead; LC for asset-level compliance with warranties.

Layer 8 — Cybersecurity and privacy

Need: Endpoint protection, identity and password management, email security, backups, vendor access controls, travel-device protocol, incident retainer, and tabletop exercises.

Lean pattern: Boutique cyber advisors experienced with principals and family offices; least-privilege access; out-of-band verify for any money-movement change; social-media and geolocation hygiene for public-facing family members.

Watch-outs: Consumer antivirus cosplay; shared family passwords; assistants using personal email for wire instructions; oversharing itineraries; vendors with standing remote access nobody reviews.

FO owner: Cyber firm plus FO lead; principal must model behavior or staff will not.

Layer 9 — Banking, credit, and FX

Need: Operating accounts, facilities if any, FX for multi-currency life, cash concentration logic, and clear separation from investment-product pressure.

Lean pattern: Choose transactional banking for operations quality; evaluate investment products independently against the IPS.

Watch-outs: Bundled custody-and-credit loyalty that silently violates policy; account sprawl; FX priced as a relationship tax.

FO owner: FO lead / treasury function.

Layer 10 — HR, payroll, and household employment

Need: Compliant payroll for domestic and FO staff; background checks; NDAs; contractor-versus-employee clarity; workers’ compensation and multi-state awareness.

Lean pattern: Professional household-employer payroll specialist or PEO where appropriate; written handbooks scaled to reality; counsel on classification.

Watch-outs: Cash wages; “they’re like family” substituting for compliance; off-boarding without access revocation; related-party hires without the policy from Thursday’s governance post.

FO owner: Estate manager plus FO ops plus employment counsel as needed.

Layer 11 — Travel, security, and medical readiness

Need: Travel management that respects privacy; residential and travel security advisory; medical and evacuation planning matched to itineraries; clear manifests that do not become public.

Lean pattern: One coordinator node with written security parameters; avoid five apps and a relative booking flights ad hoc.

Watch-outs: Public manifests; oversharing with vendors; security theater without advance work; medical plans that assume a home city you have left for six months.

FO owner: FO lead with security advisor; LC for lifestyle fit.

Layer 12 — Legacy-asset operators

Need: Yacht management, aircraft management or fractional oversight, vineyard GM, collection registrar and storage, property managers — each on contracts with KPIs.

Lean pattern: Best-in-class operators selected by RFP rhythm; FO-led accountability; no perpetual incumbency merely because “they know us.”

Watch-outs: Operators who bypass the FO and sell CapEx directly to a principal; opaque markups; missing maintenance reserves; safety culture that exists only in brochures.

FO owner: Legacy asset manager or FO lead; LC for experience standards; risk broker for warranty alignment.

Minimum viable lean FO stack checklist

• [ ] Primary custody with clean exports
• [ ] Aggregation that includes illiquids at least quarterly
• [ ] Dual-control bill-pay / treasury releases
• [ ] Multi-entity accounting with a named owner
• [ ] Tax quarterback plus estimate calendar
• [ ] Primary counsel plus specialist access list
• [ ] UHNW risk broker with interconnected policy map
• [ ] Cyber retainer plus identity management for principals and key staff
• [ ] Household payroll compliance
• [ ] Written vendor inventory with contract dates, fees, and termination terms
• [ ] Out-of-band wire-change protocol tested in the last twelve months
• [ ] Annual insurance renewal summit on the calendar

If you cannot check these, you do not have a lean office. You have a lean hope.

Quarterly vendor scorecard

Rate each critical vendor from one to five on: reliability, responsiveness, data quality, fee clarity, control consciousness, confidentiality behavior, and exit readiness. Any score below three on control consciousness, data quality, or confidentiality triggers remediation or replacement. Put scores in the FO lead’s quarterly packet to the principal — not in a drawer.

Ask specifically: Did this vendor ever request a shortcut around dual control? Did they email bank instructions? Did they publish or loosely share travel or family details? Did they refuse a reasonable data export? Affirmative answers matter more than a charming quarterly call.

Build vs buy vs borrow

Buy (vendor): custody technology, cyber tooling, payroll engines, travel platforms, insurance brokerage, aggregation software.

Borrow (outsourced professionals): controller, partial CIO/OCIO, specialized counsel, security advisory, fractional CHRO for household complexity.

Build (employee): only where confidentiality, daily integration, or principal chemistry demand a badge — often the FO lead first, then ops/controller, then investment capacity only when complexity justifies (see Friday).

Illustrative lean pattern: FO lead; outsourced controller; executive support; OCIO or advisory CIO relationship; specialist bench on call. That beats twelve directors with overlapping titles and no wire discipline.

Contracting habits that save seven figures

• Master services agreements with explicit data ownership and return
• Audit rights on bill-pay and on legacy-manager expense markups
• Cyber and confidentiality flow-downs
• Fee exhibits separating advice, products, and pass-throughs
• Renewal dates clustered into two calendar windows per year
• No material auto-renew without FO calendar alerts ninety days prior
• Clear statement of who may instruct wires and who may not

Onboarding and offboarding vendors

Onboarding: security questionnaire, insurance certificates, NDA, systems access least privilege, introduction to dual-control rules, test payment with tiny amount if relevant, add to vendor inventory.

Offboarding: revoke access same day, recover devices and credentials, require data return or certified destruction, final fee reconciliation, note lessons in the scorecard archive. Soft offboarding is how former vendors remain latent risk.

Failure modes of the “lean” excuse

Lean is not an excuse for missing dual control. Lean is not an excuse for the principal’s personal email as the accounts-payable system. Lean is not twelve consumer apps and a shared password doc titled “FO.” Lean means fewer seats and clearer plumbing — not lower standards.

Another failure mode: collecting logos after conferences. If a vendor does not map to a layer above, you are decorating, not operating.

Reference architecture for three common scales

Advisor-centric lean (often under the threshold where a full SFO feels natural): primary custody; reporting through custodian plus spreadsheet discipline for illiquids; outsourced bill-pay with dual control; CPA plus EA coordination; UHNW insurance broker; cyber basics; household payroll specialist; FO lead as part-time or full-time integrator. IC may be principal plus one trusted advisor. LC may be principal plus estate manager. Do not pretend this is “not a family office” — it is a family office with a thin payroll and a thick vendor map.

Classic lean SFO: FO lead; controller (W-2 or outsourced); executive support; OCIO; full Layer 1–12 coverage; quarterly scorecards; documented RACI with IC/LC. This is the sweet spot for many multi-home, multi-asset families who refuse both chaos and bureaucracy.

Scaling toward institutional: add investment ops analyst, dedicated risk liaison, and possibly internal investment lead before a trophy CIO. Upgrade aggregation tools; introduce more formal vendor RFPs; deepen cyber tabletop cadence. Still resist software sprawl.

RFP rhythm without exhaustion

You do not need to rebid everything annually. Cluster RFPs: insurance renewals on a fixed month; cyber every two to three years unless incident-driven; custody rarely but with periodic service audits; legacy-asset management when KPIs sour or contracts sunset; payroll when compliance fails. The FO calendar should show the next rebid date for each Tier-1 vendor. Exhaustion comes from ad-hoc panic rebids, not from planned ones.

When you RFP, give vendors the same packet: scope, volume estimates, control requirements, cyber requirements, reporting samples, and exit terms. Score blindly on a sheet before chemistry dinners. Chemistry matters; it should not be the first filter.

Data map: where the family’s information lives

Lean offices often skip a data map and then discover, during a divorce, audit, or cyber incident, that sensitive files live in a yacht captain’s personal Drive, an art dealer’s email, three assistants’ laptops, and a banker portal nobody owns. Build a one-page data map: categories (identity, financial, health, security, travel, staff, minors), systems, owners, backup status, and retention. This is not paranoia. It is operational dignity.

Tie the data map to vendor offboarding. If a vendor never appeared on the map, they were never really governed.

Cost transparency packet (annual)

Once a year, the FO lead should produce a vendor cost packet: fees by layer, percentage of AUM where relevant, pass-throughs, soft-dollar equivalents, and year-over-year change. Compare OCIO and manager fees to the cost of internal seats you did not hire. Principals who never see the all-in vendor cost will both overpay and under-invest in the wrong layers — usually overpaying for investment theater and underpaying for cyber and bill-pay controls.

Illustrative week-in-the-life of a healthy stack

Monday: custody and aggregation feeds refresh; FO analyst flags a capital-call notice and updates the liquidity calendar. Tuesday: dual-control payables run for household and vineyard vendors; one bank-detail change triggers out-of-band callback and is logged. Wednesday: tax quarterback receives a document-pack update for estimated payments. Thursday: cyber vendor patches endpoints after a tabletop finding; travel coordinator confirms a private itinerary without posting locations to group chats. Friday: FO lead reviews vendor scorecard drafts and sends the IC a one-page liquidity snapshot — not a forty-page vanity book.

That week is unremarkable. Unremarkable is the product.

Red flags when evaluating a shiny new vendor

• They discourage dual control as “too slow for families like yours.”
• They want custody, advice, and bill-pay in one inseparable bundle without conflict disclosures.
• They cannot explain exit and data return in plain language.
• They perform chemistry with only one spouse and avoid the FO lead.
• They promise returns, exclusivity theater, or “our other families all do this.”
• They request admin access broader than the workflow requires.
• They have no incident history to discuss — not because they are perfect, but because they will not talk.

Walk away early. Replacing a bad vendor after access sprawl is harder than declining the pitch.
Finally, align the vendor stack with Monday’s committees: IC vendors (custody, OCIO, research) report through investment cadence; LC vendors (property, crew, travel) report through lifestyle cadence; bridge vendors (banking, cyber, insurance, bill-pay) report to the FO lead with both chairs informed. Mis-filing a vendor under the wrong committee recreates the fight you already solved on paper. Review that mapping once a year during the CapEx summit week so new operators do not drift into informal dual reporting. A vendor without a named internal owner and a committee home is an unmanaged risk, regardless of brand prestige or relationship history with any single family member. Put that rule in the FO lead’s charter so it survives personality, travel schedules, and vendor charm offensives. Ownership is the control.

The stack is culture

Vendors learn your standards from what you tolerate. If invoices pay without matching, if wire changes succeed by email, if dashboards go unread, the stack decays into theater regardless of brand names.

Treat the vendor stack like a ship’s engineering diagram: few redundant pumps, labeled valves, trained people at the panels. The glamour lives in the life the office supports. The stack’s job is to be nearly invisible and extremely hard to break.

Inventory what you have this month. Kill overlaps. Put dual control on money movement. Give the FO lead authority to score and replace. Then stop collecting logos — and let Tuesday’s IPS and Monday’s committees run on rails that will not snap under ordinary pressure.

---

Related reading and tools live on the Books and Resources pages. Educational only — not legal, tax, or investment advice for your situation.