RIA Custodian Transition IT Checklist for Frederick, MD Firms

Changing custodians affects more than account paperwork. A Frederick, Maryland advisory firm may need to reconnect its CRM, portfolio accounting, billing, client portal, document archive, and staff access while clients continue requesting service. A successful transition needs a written dependency list and evidence that each essential workflow works.

Use this IT checklist with your operations lead, custodian transition team, application vendors, compliance adviser, and managed service provider. Adapt it to your firm's registration, contracts, and technology.

1. Assign an owner to every dependency

Before choosing a cutover date, identify the systems that consume custodian data. Include spreadsheet imports, scheduled reports, document links, trading tools, and integrations maintained by an individual employee. Record the source, destination, frequency, responsible vendor, and acceptance test for each connection.

• Identify who requests and approves each export or integration.
• Confirm when old access ends and new access becomes usable.
• Document support contacts and escalation coverage during the transition.
• Schedule around billing, reporting, and client-service commitments.

One project owner should maintain the combined checklist. A vendor completing its own task does not prove the next system is ready.

2. Separate account transfers from technology migration

Ask both custodians what information transfers, what remains available historically, and what requires a separate export. Do not assume transferred assets bring every statement, document, transaction record, or application setting into the new environment.

Create a controlled cross-reference between old and new account identifiers, household relationships, and application records. Have operations review exceptions such as closed accounts, partial transfers, multiple registrations, and accounts remaining at the original custodian. Preserve historical identifiers so staff can explain older reports without creating duplicate client records.

3. Verify each integration's actual capabilities

Test the specific workflow you use. Single sign-on, real-time data, daily files, and transactional functions are different capabilities. Schwab's API integration guidance, for example, directs firms to confirm available features with their platform provider.

Its daily data files separately provide close-of-business information including positions, transactions, cost basis, and account profiles. Treat those as examples of questions to ask your chosen custodian, rather than promises about another platform.

• Who activates the connection, and which account groups does it cover?
• Will historical information be imported or only new activity?
• How are failed files, duplicate imports, and missing accounts detected?
• Does billing require different identifiers or a separate authorization?

4. Control the data handoff

Approve the dataset and recipient before exporting client information. Use the custodian's or vendor's approved encrypted transfer method, restrict access to named participants, and keep exports off personal email and unmanaged devices. Use synthetic or appropriately masked data for preliminary tests where practical.

Keep a transfer log recording the dataset, date range, sender, recipient, and verification result. Compare record counts and sample critical fields after import. Record transformations such as date formats and account-number changes. Resolve missing documents or truncated fields before accepting the batch.

5. Rebuild permissions deliberately

Map each employee's role to the new platform. Separate viewing, trading, money movement, administration, and integration access according to the firm's approved responsibilities. Avoid copying broad legacy permissions simply because they already exist.

Test multifactor authentication, approved devices, and staff access from the Frederick office and authorized remote locations. Confirm that support personnel can troubleshoot without unnecessary client access. Give temporary project access an owner and an end date, and review it after stabilization.

6. Preserve usable historical records

Have compliance identify the records and retention rules that apply. For SEC-registered advisers, Rule 204-2 addresses recordkeeping, including electronic retrieval, separate duplicate storage, and safeguards. Maryland's COMAR 02.02.05.16 addresses records for advisers registered or required to register in the state.

Before losing legacy access, retrieve sample older records by client and date, verify readability, and document their location. Retention periods depend on record category and applicable requirements; migration should not reset or shorten them. Keep necessary licenses, export documentation, and access arrangements until the approved archive works.

7. Make cutover acceptance measurable

Agree on go/no-go criteria before the transition. Validate representative accounts against authoritative custodian information, checking cash, positions, transaction dates, cost basis availability, household mapping, and client-portal visibility. Have qualified operations staff review reporting and billing outputs before release.

Log discrepancies with an owner and resolution plan. Define which failures require postponing an affected workflow, and document an approved fallback. Restoring an application backup does not reverse a completed custody transfer.

Run a staff rehearsal using the actual sequence of a client service request: find the household, open the correct account, locate a historical document, and identify the next authorized action. Include someone who did not configure the system. Their questions often reveal unclear instructions, broken links, or access assumptions that routine technical connection tests can miss.

8. Close the project with clear boundaries

An MSP can coordinate technical dependencies, secure endpoints, configure approved access, and document testing. Custodians handle their account-transfer processes; software vendors handle their application-specific connections; firm leadership and compliance retain their decisions about authorizations, disclosures, records, and acceptance.

Close the transition after reconciliations, archive retrieval, staff training, and access cleanup are verified. Keep the completed checklist and unresolved exceptions together so the next client request has a clear owner.