Client Offboarding: The IT Checklist Most Firms Skip

Firms have onboarding down. A new client arrives, portal access is created, engagement letter signed, everything documented.

Offboarding is usually a phone call and then silence. The access stays, the data stays, and nobody writes anything down.

Why it matters

Because you are still holding their financial information, and under the FTC Safeguards Rule your obligations attach to the data you hold rather than the clients you currently serve. A former client whose records sit in three systems with an active portal login is exposure with no revenue attached to it.

It also matters because departing clients talk. A clean, professional exit is worth more in referrals than most marketing.

The checklist

Disable portal access on an agreed date, not immediately and not never. Tell them the date so they can retrieve what they need.

Give them their documents. Decide in advance what they are entitled to and what format it comes in. Doing this well and quickly is the single biggest driver of whether they speak warmly about you afterwards.

Remove them from anything automated. Reminder sequences, newsletters, portal notifications. A former client getting a chase for documents is avoidable and looks careless.

Decide your retention position and write it down. How long you keep their records, where, and under what protection. Professional obligations set a floor. Holding everything indefinitely because deleting feels risky is a decision too, and it should be a deliberate one.

Note where their data actually lives. Tax software, document management, email, backups, and any cloud service. Backups are the one everyone forgets, and that is fine as long as it is known and documented rather than accidental.

Update your records. If your risk analysis or data inventory lists clients or volumes, this changes it.

The awkward one

If the client is leaving for another firm, expect a request for records from that firm. Decide now who authorises that release and what you need in writing from the client first. Doing this properly protects you and takes ten minutes.

The part that pays for itself

Write the checklist once. It is a fifteen minute process per client after that, and it removes a category of risk that grows silently every year you do not do it.