A family-office checklist for choosing a UHNW concierge: ownership, references, data security, subcontractors, payments and practical red flags.
Executive Summary
A UHNW concierge can hold an unusually broad picture of a client’s life: residence access, travel schedules, guest names, card details, medical preferences, family routines and last-minute movements. That makes provider selection a security and governance exercise, not simply a service-quality decision. A disciplined vetting process should test ownership, references, data handling, subcontractors, payment controls and incident response before convenience is allowed to create uncontrolled access.
Key Takeaways
- Verify the company, not just the salesperson. Establish ownership, operating entities, insurance, physical presence and who is contractually responsible.
- References should resemble your use case. A provider excellent at restaurant access may be unsuitable for complex family logistics.
- Data security is central. The provider may process itineraries, passport details, addresses and payment information.
- Subcontractors extend the risk perimeter. Drivers, villa managers, fixers, guides and local partners should be governed rather than invisible.
- Start small. A limited initial mandate is often a better test than immediately transferring the family’s entire lifestyle operation.
Why Concierge Vetting Matters More at UHNW Level
The difference between a hotel concierge and a private lifestyle operator is the volume and sensitivity of information involved. A UHNW provider may coordinate private aviation, villas, security teams, household staff, medical appointments, event access and high-value purchases. The family office should therefore treat the relationship as a privileged supplier arrangement.
The UK National Cyber Security Centre’s supply-chain guidance emphasises understanding what suppliers can access and building assurance into supplier management. That principle transfers directly to private-client services.
1. Verify the Legal and Commercial Entity
Confirm the contracting entity, ownership, directors, registered address, jurisdictions of operation and professional insurance where relevant. If the provider markets itself as global, ask which services are delivered by its own employees and which depend on affiliates or local contractors.
The brand presented to the client may not be the legal entity holding data or receiving funds. That distinction should be understood before onboarding.
2. Test References for Comparable Complexity
Generic testimonials are weak evidence. Ask for references from clients or advisers with a comparable operating profile: multi-residence families, principals who travel with children, complex aviation requirements, seasonal residence patterns or unusually sensitive security needs.
A strong reference should describe reliability under pressure, discretion, financial controls and how the provider behaves when something goes wrong — not simply whether it can secure difficult reservations.
3. Map the Data the Provider Will Hold
The Information Commissioner’s Office recommends proportionate due diligence on processors and written contracts covering security, confidentiality, sub-processors, deletion and audit rights. A family office should apply the same discipline to concierge providers that handle personal data on its behalf.
Map passports, itineraries, home addresses, guest lists, payment information, children's details and medical data. Then decide what genuinely needs to be shared, how long it is retained and who can access it.
4. Understand the Subcontractor Network
Many concierge businesses deliver through local partners. That model can be highly effective, but it creates a second layer of access. Ask how chauffeurs, guides, villa staff and destination fixers are selected, contracted and removed from systems after the assignment ends.
5. Examine Money Flows
Clarify whether the provider pays suppliers on the client’s behalf, holds deposits, adds markups, receives commissions or passes through third-party costs. Large or unusual payments should have verification controls. The family office should also understand cancellation liabilities and who owns supplier refunds if plans change.
6. Test Incident Response Before the Incident
Ask what happens if a passport is lost, a principal is delayed, a chauffeur fails to arrive, a supplier is compromised or an itinerary leaks. The quality of an escalation process often reveals more about a provider than its marketing material.
Red Flags
- Reluctance to identify the legal entity or subcontractors.
- Pressure to move immediately to a large retainer without a trial scope.
- Informal handling of passport, payment or medical data.
- No clear separation between client funds and operating funds.
- References that cannot speak to complex family-office use cases.
- Vague answers about who can view itineraries and residence information.
APX Perspective
A premium concierge should reduce operational risk, not create a new concentration of it. The right provider becomes part of the family’s operating infrastructure and should therefore withstand the same questions applied to other trusted suppliers: who are you, what can you access, who do you share it with, how are funds controlled, and what happens when the normal plan fails?
Frequently Asked Questions
How should a family office verify a concierge provider?
Check the legal entity, ownership, references, insurance, data-security practices, subcontractors, payment controls and incident procedures before granting broad access.
Are concierge reviews enough?
No. Public reviews can help with service quality, but UHNW due diligence should rely more heavily on comparable private references and verifiable operating controls.
Should a family office use one global concierge or several specialists?
Either can work. The important issue is governance: responsibilities, data access and escalation should be clear regardless of how many providers are used.
Related APX Intelligence
Sources & Further Reading
APX Intelligence is provided for general informational purposes only and does not constitute legal, security, data-protection or procurement advice. Requirements vary by jurisdiction and by the nature of the services being provided.
