While the general concept is well-recognized and widely discussed, implementation remains uneven and often unresolved, due often to variations in insurable risk and data privacy laws across jurisdictions. The core issue is not merely technical, but relational: who bears the responsibility for ensuring that risk is appropriately identified, calibrated, and managed?

Our perspectives as lawyers in the family enterprise space focus our attention on the roles and responsibilities within the architecture of legal entities. This article introduces a framework for understanding these roles and responsibilities, inviting readers to apply it across the diverse ecosystem of international family enterprise structures.

By grounding our analysis in legal doctrine and practical governance, we aim to illuminate both the dynamics of cross border risk management and the people and positions best placed address those dynamics.

A Unified Framework

Leaders in a family enterprise are well-advised to apply a multi-faceted strategy that incorporates comprehensive risk assessments, diversified asset management, and robust crisis management plans. Insurance coverage, where available, is often the first step, but only when it addresses identifiable and insurable events.

We recommend a framework that triangulates three P’s: the people (managers, officers, directors, trustees/fiduciaries, and advisors), their preparedness (isolating assets, recognizing events, and appointing roles, responsibilities, training, and expectations), and a predicable process (identifying who gets the first call, who sends information to whom and when, etc.) that can be activated at a moment’s notice to safeguard family wealth, protect privacy, and maintain operational consistency.

People are essential because they are the foundation of risk management. Preparedness involves anticipating threats and being ready to respond efficiently. Processes reduce (but rarely eliminate) questions and doubts.

Risk can be borne within the enterprise, or it can be shifted to others through insurance or third-party engagements. In any event, aligning the three P’s allows for appropriate calibration.

Regulatory Requirements

Some key regulatory guardrails are US Bank Secrecy Act (BSA), which is the cornerstone of US anti-money laundering (AML) efforts, privacy laws such as the EU’s General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (AL Act), and US state laws like the California Consumer Privacy Act (CCPA), which governs the use and protection of personal data.

Private trust companies (regulated or unregulated) having a substantial nexus in the US must comply with the BSA by implementing an AML program that establishes internal controls, provides for independent testing, implements risk-based customer due diligence procedures, and ensures compliance with suspicious activity reporting filing obligations.

Family offices may be subject to the BSA if they provide investment advisory services. Even if not legally required, many family offices adopt AML policies to manage risk, with some opting to undertake annual external BSA/AML examinations.

Under the GDPR, any processing of personal data—whether of employees, clients, or beneficiaries—must ensure lawful, fair, and transparent data handling. This includes the following measures:

Evaluating which regulations apply and for whom depends on which jurisdictions’ laws apply to which data, and many leaders are surprised at the broad extraterritorial reach of laws like the GDPR. These laws require that a program is in place that addresses core obligations including processes for data minimization, storage limits, data integrity, confidentiality, and the adoption of appropriate technical, physical, and organizational safeguards. These measures are essential to prevent unauthorized access, identity theft, financial fraud, and reputational damage.

Risk Management Assessment

A cornerstone of a comprehensive global risk management plan is the implementation of integrated risk assessments. Regular audits addressing source and use country activities can uncover and help evaluate financial, operational, and reputational risks based on geography, services provided, and types of data involved, among other factors.

Development of a detailed global risk assessment strategy is beyond the scope of this article but is highly recommended. A starting point would include the following elements:

Roles, Responsibilities, and Governance

Effective governance—whether focused on risk management or other objectives—depends on a clear, thoughtful, and appropriate distribution of responsibilities among individuals involved in leadership, in the right place, at the right time, and in a form of legal entity that is characterized consistently across geographies. One must recognize also that some EU and other civil law countries might have “mind and management” nexus tests that could inadvertently create tax situs for operations in unintended (or intended) places.

Combining Assessment with Responsibilities: The 3P Framework in Action

The three interlocking pillars of people, preparedness, and process are the essential elements to effective crisis risk management. The assessment provides the landscape of risk for which to prepare. Recognizing responsibilities through appointments in a legal structure ensures that the right people are prepared for the role at the right time. Risks are not only identified but also proactively managed, ensuring the organization’s operational effectiveness.

For example, a family office managing philanthropic activities across Europe will regularly collect donor and beneficiary data. The 3P framework could be applied like this:

Reference

¹ Illustrated in reports such as the AlTi Tiedemann Global and Campden Wealth “2025 Family Office Operational Excellence Report” and evidenced also by the authors’ own legal practices.