The short answer
Software managing others' assets (estates at a trust company, a family office, client trading) must always answer:
- What does each client or trust own now?
- How did it get there? (deposits, trades, fees, distributions, corrections)
- Who approved each change, and were they allowed?
- Does our record agree with the custodian, bank or broker?
Then portals, dashboards, statements and apps are presentation; without that, no interface makes it trustworthy.
Start with the ledger
The core is a ledger, not a set of balance fields.
Double-entry, append-only
Balanced entries; corrections are reversing entries, never edits or deletions.
Client and firm money apart
Client assets in trust kept distinct from firm funds in data and reports.
Multiple asset types
Naira and foreign currency, securities, fund units, sometimes property or private holdings, each valued separately.
Point-in-time views
Reproduce any past statement exactly, even after later corrections.
Daily reconciliation
Automated against custodian and bank records; a person tracks breaks until cleared.
Make exchange-rate sources and revaluation rules explicit: the naira can move materially between statement dates.
Controls that regulators and auditors expect
Built into the workflow, not added afterwards:
| Control | In practice |
|---|---|
| Role-based access, least privilege | Relationship managers view clients; only operations releases payments |
| Maker-checker (four-eyes) | Payments, distributions, trade overrides, fees, banking detail changes |
| Limits and alerts | Transaction size, frequency, destination |
| Immutable audit logs | Who, what, when, from where, what changed; retention set by your regulators and legal advisers |
| Segregation of duties | Different people configure, operate and review |
Trading-specific requirements
If it places or routes orders, add:
- Pre-trade checksSuitability rules, concentration limits, restricted lists, available cash.
- Order managementCreated, approved, sent, partially filled, filled, cancelled; each timestamped.
- AllocationBlock trades to individual accounts by a documented, fair method.
- Post-tradeConfirm settlement; update positions only once actually settled.
Use licensed market data and respect the licence terms in what you display and store.
Onboarding, identity and anti-money laundering
Onboarding is where compliance meets user experience: identity verification (bank verification and national identity checks where rules require), beneficial ownership for trusts and corporations, risk scoring, periodic review.
Many Nigerian financial businesses (banks, capital-market operators, other regulated firms) have anti-money laundering and counter-terrorist financing obligations under the Money Laundering (Prevention and Prohibition) Act 2022 and sector rules. Reports go to the Nigerian Financial Intelligence Unit (NFIU); SCUML supervises designated non-financial businesses. The platform supports these obligations (identification, record keeping, reporting information) but does not decide them: confirm with your compliance officer and legal counsel.
Security architecture
Assume it will be targeted. A practical baseline:
Strong authentication
For clients and staff; phishing-resistant options for staff and administrators.
Encryption
In transit and at rest; keys in a managed service or hardware security module, access logged.
Secure development
To a recognised standard; OWASP ASVS levels suit high-assurance finance.
Independent testing
Penetration tests of web, mobile apps and APIs, before launch and after major changes.
Monitoring
Sign-ins, privilege changes, unusual transactions; a documented incident response plan.
Banks and payment service providers must also follow the Central Bank of Nigeria's cybersecurity framework and guidelines (CBN); SEC Nigeria, NAICOM and PenCom set technology and risk expectations for capital-market, insurance and pension operators. For others, CBN guidance is a useful benchmark. Check which rules apply to your licence.
Data protection and data location
Trust and investment records are sensitive personal data. The Nigeria Data Protection Act 2023 (NDPA), enforced by the NDPC, requires a lawful basis, appropriate security, a way to honour data subject rights and, for high-risk processing, a data protection impact assessment (NDPC). Sector rules may add more.
A hypothetical phased build
A hypothetical small trust company administers a few hundred estates and family trusts using spreadsheets and an accounting package. It commissions a platform in phases:
- A double-entry ledger per trust, reconciled daily against its bank and custodian files.
- Maker-checker approval for distributions and changes to beneficiary banking details.
- A read-only beneficiary portal with statements and documents.
- Trading through its custodian's interface, added only after the ledger and controls have run cleanly through a year-end.
Build, buy or combine
Commercial trust accounting and portfolio management systems are often the right start. Build or extend for unusual products, one client view across several systems, or a client experience packages cannot provide. Many firms buy the core ledger and build the portal, workflow and integrations around it.
Planning checklist
Records and ledger
- Asset types, currencies and valuation methods listed
- Client and firm funds separated in the data model
- Reconciliation sources and frequency defined
Controls
- Roles and permissions mapped to real job functions
- Maker-checker rules defined for payments, distributions and banking changes
- Audit log content and retention agreed with compliance
Compliance
- Applicable regulators and rules confirmed with counsel
- Anti-money laundering obligations mapped to platform features
- Data protection impact assessment completed
Security and operations
- Target security verification level chosen
- Penetration testing scheduled before launch
- Incident response and business continuity plans written and tested
Limitations
Common patterns, not your licence or registration requirements: those depend on what you do, where your clients are and how you are registered, so take legal and compliance advice before you design. Our custom software development service starts with the ledger, controls and integration design.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Central Bank of Nigeria, Central Bank of Nigeria
- Nigerian Financial Intelligence Unit, NFIU
- Application Security Verification Standard, OWASP Foundation
- Nigeria Data Protection Act 2023, Nigeria Data Protection Commission
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.