Paper 027 · Vendor Governance

The Obligations You Inherit

When a house that handles the affairs of wealthy clients engages a vendor, it does not hand off the risk — it adopts it. The chain of custody, the data duties, the conduct of the vendor's people, the sanctions and money-laundering exposure all stay with the house that signed. Here is the chain you actually inherit, the statutes that travel with it, and the one discipline that contains them.

Audience Principals · CMOs · family-office Chiefs of Staff · brand owners · heads of procurement · the houses that hold or handle for the wealthy Published June 26, 2026

This file is offered from the standpoint of a tenured marketing and manufacturing house — not a financial, investment, legal, or advisory firm. It is general commentary on standing and stewardship, not financial, investment, legal, tax, or compliance advice. Read it as perspective, and consult your own licensed advisers and compliance counsel before acting.

A Note from the House

We are not the quintessential know-it-all international experts in why a partner's failures arrive with your name and your statutes attached. We are a house with some experience in the area that also happens to have always done our homework steadfastly. To help keep us abreast, we also run Markets Edge, Sports Edge, Voyage Edge, The Briefing, and Fending — reporting every three hours — and we have a little more than most in the way of real-world experience serving the layer of relationships this paper describes.

This is a working operator's field notes, never the definitive treatise. The human interaction and a little humble kindness should never get undersold. You literally never know exactly whose money you are interacting with unless it's your own; and let's be honest, most people don't notice until it's too late who funded the fund.

If something in here contradicts what you've seen on the floor, yours is probably more accurate — and we'd like to know.

— The House · Virginia Beach · Hako Shikin LLC

1 · The Pattern

A house vets the vendor's work with great care — the proofs, the portfolio, the price — and forgets to vet the vendor's chain. The contract is signed on the strength of the deliverable, and the question of who stands behind the deliverable, and who stands behind them, is left unasked. It is the most common and most expensive omission in the engagement of a partner, because the obligations of that partner do not stay with the partner. For a house that handles the affairs of the wealthy, they run — quietly, entirely, and with the force of law — to you.

You do not outsource a risk by hiring it. You adopt it — and the law files it under your name.

2 · Why the Obligation Runs to You

The mechanism is simple and unforgiving. The world cannot see your vendor's org chart, its sub-suppliers, or the conduct of the people it employs; it sees only your name on the outcome. When a partner mishandles a client's data, ships from a tainted source, or employs someone whose public conduct becomes a story, the harm does not attach to the obscure supplier three links down — it attaches to the recognizable house at the top of the chain. The supervisory framework now makes this explicit: the Interagency Guidance on Third-Party Relationships (the Federal Reserve, FDIC and OCC, 2023) holds an institution answerable for the partners it keeps and treats a supplier's failure as a failure of the principal who chose it. You did not merely buy a service. You assumed a chain — and every duty that runs along it.

3 · The Statutes That Travel With the Chain

This is the landmine a house walks onto the moment it lets a vendor near a wealthy client's affairs: the obligations do not transfer to the vendor performing the work — they remain, in full, with the house. A principal who has not read the chain has not read the exposure. The ones that travel furthest:

Client data stays your duty

Under Regulation S-P and the Gramm-Leach-Bliley Act — and the 2024 amendments that add vendor-oversight and breach-notification duties — the house remains responsible for protecting a client's nonpublic personal information after it passes to a vendor. The vendor's breach is the house's breach.

Supervision cannot be outsourced

FINRA Rule 3110 and its outsourcing guidance (Regulatory Notice 21-29) require a house to supervise an outsourced function as though it performed it; the SEC's proposed adviser outsourcing rule (206(4)-11) would require documented due diligence and ongoing monitoring before any covered function is handed out.

Money and sanctions do not transfer

Bank Secrecy Act and anti-money-laundering duties, and OFAC sanctions screening, remain the house's own. It answers for whatever its chain lets through, however far down the failure occurred.

Privacy travels past the federal floor

State regimes — California's CCPA and CPRA — and, for any client touched abroad, the GDPR, require written data-processing terms with every vendor that handles client information, and bind the house, not only the vendor.

Selection is itself a fiduciary act

For a house that owes a fiduciary duty, the choice and oversight of a vendor is part of that duty. A negligent selection is not the vendor's failure — it is a breach of the house's own.

Not one of these obligations moves to the vendor. Every one of them stays with the house that signed.

4 · The Chain You Actually Inherit

01Their sub-suppliers — the makers behind your maker, whom you never met and never approved.

02Their data handling — every client record of yours that passes through a system you have never seen.

03Their people's public conduct — the posts and behavior of anyone who touches your brand or your client.

04Their compliance posture — the standards they keep, or do not, when no one is auditing.

05Their confidentiality discipline — whether your client's work, volumes, and identity stay inside their walls.

06Their solvency and continuity — whether they will still exist, and still hold your assets, next quarter.

5 · Reading Your Vendor Chain

One accountable house

A single partner owns the whole chain, custody is documented, and you could name everyone who touches your client's goods or data.

Keep it. One accountable house, marked up once, is the only arrangement you can actually audit — and the only one whose failures you can see coming.

Mostly mapped

The chain is largely known; one link still runs through a sub-supplier you have never vetted.

Close it. The blind link is exactly where the inherited duty goes unwatched.

Several vendors, no map

Three or four partners, none accountable for the whole, your client's work and data spread across systems you have not seen.

Map it this quarter. You cannot govern — or defend — a chain you cannot draw.

You could not name who handles it

Asked today, you could not say whose hands a client's affairs actually pass through.

This is an exposure wearing the costume of a convenience. Pull the chain into one accountable house now, while it is still yours to direct.

6 · The One Rule

Put your standards in writing and into the vendor's hands before the first order — because unshared rules are not rules, and the failure of a standard you never communicated is your failure, not theirs. A code of conduct that lives only in your head governs nothing; a data duty you never papered protects no one. Hand them over, require them down the chain, make acceptance a condition of the work — the obligations you inherit can only be contained by the standards you actually transmit.

7 · What Principals Self-Inflict

Assuming the contract covers conduct. A statement of work governs the deliverable, not the behavior of the people who make it — and behavior, and a mishandled record, are what become the headline and the filing.

Never papering the data terms. The data moves on a handshake; the duty never does. Without a written processing agreement — audit rights, breach-notice clauses, deletion on exit — a vendor's leak becomes your filing, your fine, and your apology to the client, while you hold no contract with which to make the vendor answer for any of it.

Ignoring the vendor's people in public. The conduct of anyone who touches your client becomes your client's exposure the moment it is seen.

Mistaking a large vendor for a clean one. Size is not diligence; the biggest house can carry the dirtiest link, and its scale only widens the blast radius.

8 · The House's Notes

Write the code of conduct and the data terms, and put both in the vendor's hands before the first order — make acceptance a condition of the work.
Require chain-of-custody and audit rights you can actually exercise, and a name for every set of hands a client's affairs pass through.
Set a public-conduct standard for anyone who touches the work, and say so plainly; the standard you never named, you cannot expect.
Screen the chain you inherit — sanctions, solvency, sub-suppliers — as deep as the chain runs, not as shallow as the contract.
Prefer one house accountable for the whole chain; the fewer the handoffs, the fewer the obligations — and statutes — you inherit blind.

Research by H. Goodman

Cited, illustrative and anonymized: the supervisory and statutory regime that keeps the obligation with the principal — the Interagency Guidance on Third-Party Relationships (Federal Reserve, FDIC and OCC, 2023); Regulation S-P and the Gramm-Leach-Bliley Act and their 2024 amendments on vendor oversight and breach notification; FINRA Rule 3110 and Regulatory Notice 21-29 on supervising outsourced functions; the SEC's proposed adviser outsourcing rule (206(4)-11); Bank Secrecy Act / anti-money-laundering and OFAC sanctions obligations; and state and cross-border privacy regimes (California's CCPA and CPRA, the GDPR). House signals: the vendor-governance files, the inherited-exposure files. Offered from the standpoint of a tenured marketing and manufacturing house, not a financial, investment, or legal adviser — general commentary on stewardship, not advice.