Beyond the Callback – Part 1: A New Foundation

For more than two decades, the callback has been one of the defining operational controls in private fund administration. Whenever an investor requested a change to banking instructions or other sensitive account information, administrators independently confirmed the request before updating records.

It was a practical solution to a genuine problem: organizations had no reliable way to know whether an email, phone call, or signed instruction was authentic.

It was the right control for its time.

Today, however, the operating environment has fundamentally changed.

Secure investor portals, multi-factor authentication, role-based permissions, digital workflows, and comprehensive audit trails now allow organizations to establish confidence in an investor’s identity before a sensitive request is ever submitted. That seemingly simple change has significant implications for investor servicing because it shifts the focus from verifying communications to governing investor information.

Download our discussion paper: Beyond the Callback: From Communication Verification to Identity-First Governance to explore this topic in greater depth

Watch the first episode of our Beyond the Callback video series, A New Foundation

The Callback Solved Yesterday’s Problem

It is easy to criticize longstanding operational controls simply because technology has evolved. That would be unfair.

The callback became industry best practice because it addressed one of the greatest operational risks facing fund administrators. Sensitive investor requests often arrived through communication channels that could not be inherently trusted. An independent callback introduced a second layer of verification before administrators changed banking instructions, updated contact information, or processed other important investor requests.

For years, this approach significantly reduced operational risk and strengthened investor protection.

The challenge is not that callbacks have stopped working.

The challenge is that the problem they were designed to solve is no longer the only problem organizations need to address.

Investor relationships have become more sophisticated. Institutional investors frequently appoint multiple authorized representatives with different responsibilities. Regulatory expectations continue to evolve. Cybersecurity threats have become more sophisticated. Investor information is now shared across integrated operational systems rather than isolated databases.

In this environment, verifying a communication is only one part of a much larger governance process.

Governance Has Become the Real Challenge

Consider a request to change banking instructions.

Historically, the administrator’s primary concern was determining whether the request genuinely came from the investor. Once that question had been answered, the remaining work was largely administrative.

Today, the same request raises a much broader set of governance questions:

• Has the individual been authenticated?
• Are they still authorized to make this change?
• Should another authorized representative be notified?
• Does the request require additional oversight because of its sensitivity?
• Will every operational system be updated consistently?
• Can the organization demonstrate exactly how the decision was made months or years later?

None of these questions are answered simply by confirming that someone responded to a telephone call.

This is why investor change management has become a governance discipline rather than a communication verification exercise.

Identity Changes the Starting Point

Perhaps the most significant change is where trust is established.

Traditional investor servicing began with an incoming communication. An email arrived. A letter was received. A telephone call was answered. Administrators then attempted to determine whether the communication could be trusted before processing the request.

Modern investor servicing reverses that sequence.

Organizations can now establish confidence in identity before sensitive requests are accepted. Authentication occurs first. Governance follows.

This allows experienced administrators to spend less time determining whether an email is genuine and more time applying professional judgement in the areas that matter most: authority, risk, oversight, transparency, and the integrity of investor records.

Technology has not replaced governance.

It has created the opportunity for better governance.

Looking Beyond Verification

The future of investor change management will not be defined by stronger communication verification.

It will be defined by stronger governance.

Organizations that continue to design processes around unauthenticated communications will inevitably spend considerable effort proving that requests are legitimate. Organizations that establish trust at the point of interaction can instead focus on ensuring every investor change is governed appropriately from beginning to end.

That represents a fundamental shift in thinking.

Investor change management is no longer about verifying requests.

It is about governing trusted relationships.

In next week’s article, we’ll explore what that governance framework looks like in practice. We’ll introduce the Chain of Trust—a model built around five connected principles that help organizations strengthen investor protection while improving operational resilience.

Want to learn more?

Download our discussion paper, Beyond the Callback: From Communication Verification to Identity-First Governance, for a detailed exploration of identity-first governance and the Chain of Trust framework.

📄Download the discussion paper