Standard operating procedures · IPMahir with CapabilityNext

Client data procedures for independent finance professionals

What to do, step by step, in every situation that can put client information at risk: fifteen data-incident procedures, seven anti-money-laundering procedures, six routines and the templates that go with them. Each procedure has its own link, so you can send a colleague straight to the one they need.

Download the full PDF (22 pages) Statutes, rules and ISO standards Contact us for prices

A working procedure, not legal advice. Notification decisions are confirmed with your agency or dealer and your advocate. Reporting duties under anti-money-laundering law differ by sector, so confirm which apply to you.

Five rules for every procedure

Contain first. Stop the exposure before you investigate, and change passwords from a clean device.
Assume the worst until shown otherwise. Stolen passwords usually mean stolen sign-in tokens; ransomware usually means copied data.
Tell people early, in plain words. Clients should hear it from you.
Write it down as you go. The log is your evidence of reasonable care.
Fix the cause, then close the log.

Part A1 · Data incidents

SOP-01 · Lost or stolen device (laptop, phone, tablet, USB stick)
SOP-02 · Information sent to the wrong person (email, text, chat or shared link)
SOP-03 · Phished sign-in or taken-over account (email, cloud, software, portal)
SOP-04 · SIM swap or phone-number hijack
SOP-05 · Fake instruction for money, bank details or documents
SOP-06 · Malware, ransomware or password-stealing malware (including after a family download)
SOP-07 · Notice that your software vendor has been breached
SOP-08 · Someone leaves, or a login is shared (leaver and access routine)
SOP-09 · Client asks what information you hold about them (access request)
SOP-10 · A helper or colleague mishandles client information
SOP-11 · Client details pasted into a public AI tool
SOP-12 · The AI assistant or an automation sends something wrong
SOP-13 · A shared link or folder is open to anyone
SOP-14 · Paper records lost, stolen or thrown away unshredded
SOP-15 · Retiring, selling, recycling or replacing a device

Part A2 · Anti-money-laundering and fraud prevention

SOP-16 · Identify and verify a client, payer or third party
SOP-17 · Suspicious activity or attempted transaction (suspicious transaction report)
SOP-18 · Large cash received ($10,000 or more)
SOP-19 · Politically exposed person, head of an international organisation, or their family and close associates
SOP-20 · Third-party payer, unclear ownership or unexplained source of funds
SOP-21 · Compliance programme: set up and review
SOP-22 · FINTRAC or another regulator asks for records, or an examination begins

Part B · Routines

R1 · Weekly (15 minutes)
R2 · Monthly (30 minutes)
R3 · Quarterly (60 minutes)
R4 · Annually (half a day)
R5 · Before adopting any new software, app or AI tool
R6 · Before a new helper starts

Part C · Tools

Part A1 · Data incidents

SOP-01 Lost or stolen device (laptop, phone, tablet, USB stick)

Trigger: A device that holds, or can sign in to, client information is lost, stolen or missing for more than an hour.
Severity: High if unlocked, unencrypted or signed in. Medium if encrypted and locked.
Owner: The professional. Helper reports at once.

First 15 minutes	Do not wait to see if it turns up. Lock it from another device, then wipe it remotely if it cannot be recovered. From a clean device, change your email and cloud passwords, sign out all sessions and revoke app access. For a phone, call the carrier to suspend the SIM.
First hour	Open your client-and-device map: which clients were on it (files, email, downloads, photos, chats, saved passwords)? Check whether it was encrypted and screen-locked. That sets the level of harm. If stolen, report to police and keep the file number.
Same day	Use the notification decision tree (Part C) to decide who must be told. Tell your agency or dealer compliance contact. Tell affected clients where identity, bank or health details could be misused. Open an entry in the incident log.
Within 72 hours	Watch sign-in alerts and bank activity for affected clients. Give clients plain advice on what to watch for. Replace the device from a clean restore, not from a copy of the lost one.
Within 30 days	Review why it was exposed: encryption, auto-lock, remote wipe, local copies, backups. Fix the cause and note it in the log.

Tell and record. Agency or dealer; affected clients if harm is possible; police if stolen; regulator decision per Part C.

Related ISO/IEC 27002 controls: 8.1 User endpoint devices · 8.24 Use of cryptography · 5.9 Inventory of information and assets · 7.9 Security of assets off-premises · 8.13 Information backup
IPMahir support: Device protection set-up, client-and-device map, first-hour call, evidence file entry.

First 15 minutes	Try to recall the message. Do not forward it, and do not open the attachment again. If it was a shared link, switch the link off now. Write to the recipient: it was sent in error, please delete it and confirm in writing.
First hour	Save the sent item and your request as evidence. List exactly what was sent (message, attachments, links). Work out who the recipient is: another client, a known party or a stranger.
Same day	Tell the client concerned, in plain words: what, when, what you did, what to watch for. Tell your agency privacy contact. Run the decision tree (Part C). Log the incident.
Within 72 hours	Get the recipient's written confirmation of deletion. Follow up once if needed.
Within 30 days	Turn off address auto-fill, switch on delayed send and external-recipient warnings. Send documents by secure link, not attachment. Add a recipient check to your training.

First 15 minutes	From a clean device, change the password and sign out all sessions. Revoke app access and tokens. Turn on authenticator-app sign-in. Check forwarding rules, filters, delegates and recovery email or phone.
First hour	Review login history, sent and deleted items. List what the mailbox or system could reveal. Warn contacts who received fake messages. Change any other account that used the same password. Tell the software vendor.
Same day	Decide harm: which clients' information could the attacker read? Tell clients who received messages from your account. Tell your agency. Run the decision tree. Log the incident. If money moved or was requested, call your bank now and go to SOP-05.
Within 72 hours	Scan the device for malware (SOP-06). Password theft often means the device is infected. Monitor sign-in alerts.
Within 30 days	Move all accounts to app-based or key-based sign-in. Use a password manager. Run a short scam-spotting session for everyone.

First 15 minutes	From another phone, call your carrier, report a SIM swap and get your number back. From a clean device, secure email first (password, sign out all sessions), then cloud, software and bank accounts. Switch from text-message codes to an authenticator app or key.
First hour	Review recent sign-ins and transfers. Contact your bank and card issuers. Check your carrier account for changes.
Same day	Warn clients and your agency about messages that came from you. Decide harm and run the decision tree (Part C). Log the incident.
Within 72 hours	Set a carrier PIN or number lock. Remove phone-number recovery wherever you can.
Within 30 days	Store your account recovery plan offline. Rehearse it once.

First 15 minutes	If you have NOT acted: stop. Do not reply. Phone the real client on the number you already hold. If you HAVE acted: call your bank at once and ask for a recall; they can contact the receiving bank. Do not use contact details from the message.
First hour	Keep the original emails with headers. Report to the police and the Canadian Anti-Fraud Centre (antifraudcentre-centreantifraude.ca). Secure the mailbox (SOP-03): the sender may be inside your client's or your account.
Same day	Tell the client by phone. Tell your agency or dealer and your professional liability insurer, as their terms require. Run the decision tree. Log the incident.
Within 72 hours	Follow up with the bank and keep a record of every call.
Within 30 days	Make the call-back rule permanent for every money or bank-detail instruction. Require a signed form for bank changes. Add a second approval above a set amount.

First 15 minutes	Disconnect the device from Wi-Fi and the network. Do not restart or wipe yet. Do not pay or negotiate. From a clean device, change passwords and sign out all sessions. Disconnect backup drives.
First hour	Note the time and the ransom text. Photograph the screen. List what the device could reach: email, cloud, software, client files. Check that your backups are intact and not connected.
Same day	Treat as a breach unless shown otherwise: ransomware often copies data before locking it. Tell your agency and your insurer. Report to police and the fraud centre. Run the decision tree. Log the incident.
Within 72 hours	Rebuild from a clean image, not from the infected machine. Restore from a tested backup. Rotate every credential. Confirm two-step sign-in.
Within 30 days	Separate work and family devices. Allow installs only from official app stores. Keep an offline backup and patch on a schedule.

First 15 minutes	Check the notice is genuine: type the vendor's address yourself, do not click links in the email. Scammers copy these notices. Change your password and turn on two-step sign-in. Sign out all sessions.
First hour	Read what the vendor says was accessed, and when. List which of your clients are in that system. Write to the vendor: data categories, dates, steps taken, whether regulators were told, support offered.
Same day	You remain responsible for client information your provider holds. Decide with your agency and advocate how and when to tell clients. Run the decision tree. Log the incident.
Within 72 hours	Send clients a clear notice if harm is possible. Follow vendor updates. Check your connected apps.
Within 30 days	Review the vendor: contract, security report, where data is stored. Decide whether to stay. Update the vendor file.

First 15 minutes	On the day they leave, list every system they used. Disable their individual logins. Change any shared password, then stop sharing it. Revoke tokens and connected apps. Collect devices.
First hour	Remove them from email forwarding, delegation, shared folders and calendars.
Same day	Check the access log for the last 30 days: any downloads of client data? Remind them in writing of their confidentiality duty.
Within 72 hours	If a former person is still signing in, treat it as an incident: SOP-03 steps, log review and the decision tree.
Within 30 days	Quarterly: export the user list of each system. Remove dormant accounts and unneeded rights. Confirm two-step sign-in for each account.

First 15 minutes	Write down the date you received it. Acknowledge it in writing.
First hour	Confirm who is asking: call back on a number you hold. If someone is asking for the client, confirm their authority in writing.
Same day	Search every place: paper, email, each software system, phone, notes and backups. List what exists. Mark information about other people, and anything you may withhold, and note the reason.
Within 72 hours	Prepare the reply. Explain anything withheld, with reasons. Record a correction request if the client asks for one.
Within 30 days	Reply in writing within the legal time limit (generally 30 days). Keep a copy of the request and your reply. Check which vendors also hold the data.

First 15 minutes	Stop the exposure: delete the photo or message, ask any recipient to delete it. Stay calm. Learn the facts. Do not blame; people hide mistakes when they fear blame.
First hour	List which clients and what details were involved.
Same day	Tell affected clients if harm is possible. Tell your agency. Run the decision tree. Log the incident.
Within 72 hours	Give the helper short training on the specific habit. Record it.
Within 30 days	Update the written rules and the day-one checklist for every helper. Add the case, without names, to your training.

First 15 minutes	Stop. Take a screenshot of what was entered, with the time, tool and account. Delete the chat and history. Use the tool's data controls to opt out of training and retention.
First hour	Read the tool's terms: does it keep or train on what you type? Was it a work or personal account? List which clients' details were entered.
Same day	Assess sensitivity. Tell your agency. Decide whether to tell the client: yes where health, ID or bank details were entered. Run the decision tree. Log the incident.
Within 72 hours	Ask the vendor for deletion if it offers it. Move the task to an approved tool.
Within 30 days	Adopt an AI use rule: no real client details in public tools. Add AI wording to client consent. Train everyone.

At the time	Many agencies do not accept cash at all. If your agency does not, say so politely and decline. It is the strongest control. If cash is accepted: identify the person handing it over (SOP-16) before accepting it, and record on whose behalf. Count it with a witness and give a receipt.
Same day	Record the transaction in the cash log. Deposit as your policy requires. Ask yourself whether anything is suspicious. If yes, go to SOP-17 as well.
Within the deadline	The compliance officer files a large cash transaction report with FINTRAC within the time limit (15 calendar days after the transaction).
If it looks like structuring	Several amounts just under the threshold, spread over days or offices, is a warning sign. Treat it as SOP-17. Never explain to a client how to avoid a report.
Afterwards	Keep a copy of the report, the cash log and the identification record for the required period.

Insurance	Cash premiums, or premiums paid by a person unrelated to the policyholder; payment from several accounts or from abroad; early cancellation or surrender with a penalty and a request to pay out to a third party; overpayment followed by a refund request; policies far beyond the client's means; frequent changes of owner or beneficiary.
Mortgage	A large deposit or down payment with no clear source; gifted or third-party funds that do not fit; early payoff by a third party; rapid purchase and sale; private lenders or guarantors who cannot be explained; a client who avoids documents.
Investments	Deposits from third parties; money in and then straight out with little activity; several deposits just under a reporting limit; account details that do not match the client; instructions that change often; a client unwilling to say why they are investing.
Any sector	Reluctance to give ID or information; ID that looks altered; urgency with no reason; a client who asks how to avoid reports; an explanation that changes; transactions that make no business sense; pressure on you to skip checks; an offer of a reward to look away.

First 15 minutes	Pause the assistant or automation so nothing more is sent.
First hour	Find what was sent, to whom and what it showed. Check the template, the data merge and the instructions.
Same day	Correct in writing with each affected client, especially if advice or figures were wrong. Tell your agency. Run the decision tree if personal information was exposed. Log the incident.
Within 72 hours	Find the cause. Add an approval step and limits on what it can read and send. Test with dummy data before switching it back on.
Within 30 days	Review every automation and the activity log. Update the AI use rule.

First 15 minutes	Switch off the link or sharing now. List the files that were reachable.
First hour	Read the access or activity log: who opened or downloaded, and when.
Same day	Tell affected clients if an unknown person accessed their documents. Run the decision tree. Log the incident.
Within 72 hours	Remove anything not needed from the folder.
Within 30 days	Use named-person, expiring links from now on. Audit all shared links every quarter.

First 15 minutes	Secure the area. Report a theft or break-in to the police. Use your file index to list what is missing.
First hour	List the clients involved and the details on the papers. Look for scanned or other copies.
Same day	Tell affected clients if the papers could be misused. Tell your agency. Run the decision tree. Log the incident.
Within 72 hours	Monitor for misuse. Replace any records you must keep.
Within 30 days	Lock cabinets. Keep paper out of cars and homes. Scan and store securely. Use cross-cut shredding. Follow a retention schedule.

First 15 minutes	Confirm your backup is complete and tested.
First hour	Sign out of every account. Remove the device from account device lists and "find my" services.
Same day	Erase and reset the device, including encryption keys. Remove the SIM and memory cards.
Within 72 hours	Record the make, serial number, date and method in your device list.
Within 30 days	If recycling, use a certified recycler and keep the receipt.

Before you start	Ask your compliance contact which transactions in your sector require identification, and which methods are accepted. Explain to the client why you need it. Your privacy notice should say so. Prepare the record form so nothing is missed.
At the meeting	Check the original document: valid, not expired, and the photo matches the person. Record: full name, date of birth, address, occupation, document type, number, place of issue, expiry date, date checked and who checked it. If someone else is paying or benefits, record who they are and their link to the client. For a company or trust, record who owns and controls it. Never accept a photo of an ID sent by ordinary text or email.
Same day	File the record in the protected identity-records store. Delete any temporary copies from phones, downloads and email. Enter the check in the verification log.
If you cannot verify	Do not proceed with the transaction. Write down why you could not verify. Tell your compliance contact the same day. If anything about the refusal looks suspicious, go to SOP-17.
Ongoing	Keep records for the required period (generally five years). Keep them protected and retrievable. Refresh information for higher-risk clients.

In the moment	Stay polite and calm. Ask the ordinary business questions you would normally ask. Do not accuse the client or hint at suspicion. Do not accept cash or process the transaction until you have spoken to your compliance contact. Write down exactly what was said and done: who, when, amounts, documents, behaviour.
Same day	Tell your compliance officer or agency compliance contact the same day, in person or by phone, not by casual message. Keep the original documents and notes. Do not discuss it with colleagues who do not need to know.
As soon as practicable	The compliance officer decides whether the grounds are met and files the suspicious transaction report with FINTRAC as soon as practicable after the grounds to suspect are established. Keep a copy of the report and your notes, protected, with restricted access.
What you must not do	Do not tell the client, or anyone who might tell them, that a report is being made or considered. Tipping off can be an offence. Do not delete or alter records. Do not investigate by yourself.
Afterwards	Agree with the compliance officer whether to continue or end the relationship. Ask what control would have caught this earlier, and add it. Store STR files separately with limited access.

At onboarding	Ask the question in plain words at onboarding. Check public information if the answer is unclear. Remember that being a politically exposed person is not a crime.
Before you proceed	If the answer is yes or likely, follow your agency policy before going ahead, which normally includes approval from senior management. Establish the source of funds and the source of wealth and ask for supporting documents.
Same day	Record the determination, who approved it and why. Add the client to your higher-risk list.
Ongoing	Apply enhanced monitoring: review activity more often and look for changes in pattern. Treat unusual activity under SOP-17.
Review	Review yearly. Remove the flag only as the rules allow, and record why. Confirm with your compliance contact exactly which requirements apply to your sector and products.

At the meeting	Ask who is paying and why, and where the money comes from, in plain words. Write down the answers in the client's own terms.
Same day	Verify the payer as you would a client (SOP-16). For companies and trusts, record the owners and controllers. Compare the explanation with what you know about the client's means and business.
If it does not add up	If the explanation is vague, changes, or does not fit, treat it as SOP-17 and tell the compliance officer. Do not accept the funds until you have the compliance officer's view.
Afterwards	File the explanation and the evidence with the client record.
Review	Review third-party payments quarterly. Your policy may decline payments from unrelated third parties altogether.

Set up	Appoint a named compliance officer and a back-up. Record the appointment.
Written procedures	Write down your policies and procedures: identification, record keeping, reporting, politically exposed persons, ongoing monitoring.
Risk assessment	Assess your risk: clients, products and services, how you deal with clients, where they and their money are, and any new technology you use. Update it yearly.
Training	Keep a written training plan and run training for everyone who deals with clients. Keep attendance records.
Review	Review the effectiveness of the programme at least every two years, and report the findings to senior management. Keep the report. Confirm with your compliance contact which of these apply to you directly and which are covered by your agency or insurer's programme.

First 15 minutes	Do not ignore it, and do not delay. Note the date and time. Read exactly what is asked and the deadline. Check the contact is genuine by calling back on an official number. Scammers impersonate regulators.
First hour	Tell your compliance officer, your agency and your advocate. Stop routine deletion of any related record.
Same day	Collect the records from your protected store. Give only what is asked, and no more. Log what you collect and what you send.
Within the deadline	Reply in writing and by a secure channel, within the deadline. If you need more time, ask in writing before the deadline.
Afterwards	Debrief. Fix any gap found and update the evidence file.

Client data procedures for independent finance professionals

Five rules for every procedure

Part A1 · Data incidents

Part A2 · Anti-money-laundering and fraud prevention

Part B · Routines

Part C · Tools

Part A1 · Data incidents

SOP-01 Lost or stolen device (laptop, phone, tablet, USB stick)

SOP-02 Information sent to the wrong person (email, text, chat or shared link)

SOP-03 Phished sign-in or taken-over account (email, cloud, software, portal)

SOP-04 SIM swap or phone-number hijack

SOP-05 Fake instruction for money, bank details or documents

SOP-06 Malware, ransomware or password-stealing malware (including after a family download)

SOP-07 Notice that your software vendor has been breached

SOP-08 Someone leaves, or a login is shared (leaver and access routine)

SOP-09 Client asks what information you hold about them (access request)

SOP-10 A helper or colleague mishandles client information

SOP-11 Client details pasted into a public AI tool

SOP-12 The AI assistant or an automation sends something wrong

SOP-13 A shared link or folder is open to anyone

SOP-14 Paper records lost, stolen or thrown away unshredded

SOP-15 Retiring, selling, recycling or replacing a device

Part A2 · Anti-money-laundering and fraud prevention

SOP-16 Identify and verify a client, payer or third party

SOP-17 Suspicious activity or attempted transaction (suspicious transaction report)

SOP-18 Large cash received ($10,000 or more)

SOP-19 Politically exposed person, head of an international organisation, or their family and close associates

SOP-20 Third-party payer, unclear ownership or unexplained source of funds

SOP-21 Compliance programme: set up and review

SOP-22 FINTRAC or another regulator asks for records, or an examination begins

Part B · Routines that stop most incidents

R1 Weekly (15 minutes)

R2 Monthly (30 minutes)

R3 Quarterly (60 minutes)

R4 Annually (half a day)

R5 Before adopting any new software, app or AI tool

R6 Before a new helper starts

Part C · Tools

C1 Notification decision tree

C2 Plain-words notice to a client

C7 Red flags by sector

Get the full document