Building secure trust management and trading platforms

The short answer

Software that manages assets on behalf of others, whether a trust company administering estates, a family office, or a firm offering trading to clients, has to answer four questions at any moment:

1. What does each client or trust own right now?
2. How did it get there? (every deposit, trade, fee, distribution and correction)
3. Who approved each change, and were they allowed to?
4. Does our record agree with the custodian, bank or broker?

If the platform can answer those reliably, the rest (client portals, dashboards, statements, mobile apps) is presentation. If it cannot, no interface will make it trustworthy.

Start with the ledger

The core of the platform is a ledger, not a set of balance fields.

• Double-entry and append-only. Every movement is recorded as balanced entries. Corrections are new reversing entries, never edits or deletions.
• Separate client and firm money. Client assets held in trust must be kept distinct from the firm's own funds in both the data model and the reports.
• Multiple asset types. Cash in naira and in foreign currencies such as US dollars, securities, units in pooled funds and, for some platforms, real property or private holdings, each with its own valuation method. Exchange-rate sources and revaluation rules need to be explicit, because the naira rate can move materially between statement dates.
• Point-in-time views. You must be able to reproduce a statement exactly as it looked on a past date, even after later corrections.
• Daily reconciliation. Automated comparison against custodian and bank records, with breaks routed to a person and tracked until cleared.

Controls that regulators and auditors expect

Financial platforms need controls built into the workflow, not added afterwards:

• Role-based access with least privilege. A relationship manager can view a client; only operations can release a payment.
• Maker-checker (four-eyes) approval for payments, distributions, trade overrides, fee changes and changes to banking details.
• Limits and alerts on transaction size, frequency and destination.
• Immutable audit logs that record who did what, when, from where and what changed, retained for the periods your regulators and legal advisers specify.
• Segregation of duties between people who configure the system, people who operate it and people who review it.

Trading-specific requirements

If the platform places or routes orders, add:

• Order management with a clear lifecycle (created, approved, sent, partially filled, filled, cancelled) and timestamps at each step.
• Pre-trade checks for suitability rules, concentration limits, restricted lists and available cash.
• Market data from a licensed source, with the licence terms respected in what you display and store.
• Allocation of block trades to individual accounts using a documented, fair method.
• Post-trade processing that confirms settlement and updates positions only when the trade has actually settled.

Onboarding, identity and anti-money laundering

Client onboarding is where compliance and user experience meet. Plan for identity verification (including bank verification and national identity checks where your rules call for them), beneficial ownership information for trusts and corporations, risk scoring and periodic review.

Many financial businesses in Nigeria, including banks, capital-market operators and other regulated firms, have anti-money laundering and counter-terrorist financing obligations under the Money Laundering (Prevention and Prohibition) Act 2022 and the rules of their sector regulator. Reports go to the Nigerian Financial Intelligence Unit (NFIU), and designated non-financial businesses are supervised through SCUML. The platform should support those obligations (client identification records, record keeping and the information needed for reporting), but it does not decide what your obligations are. Confirm them with your compliance officer and legal counsel.

Security architecture

Assume the platform will be targeted. A practical baseline:

• Strong authentication for clients and staff, with phishing-resistant options for staff and administrators.
• Encryption in transit and at rest, with keys held in a managed key service or hardware security module and access to keys logged.
• Secure development against a recognised standard. The OWASP Application Security Verification Standard defines verification levels that suit high-assurance financial applications (OWASP ASVS).
• Independent testing before launch and after major changes, including penetration testing of the web and mobile applications and the APIs behind them.
• Monitoring of sign-ins, privilege changes and unusual transactions, with a documented incident response plan.

Banks and payment service providers must also follow the Central Bank of Nigeria's cybersecurity framework and guidelines (CBN), and capital-market operators, insurers and pension operators have their own regulators (SEC Nigeria, NAICOM and PenCom) with technology and risk expectations. Even if you are not regulated by the CBN, its guidance is a useful benchmark. Check which rules apply to your licence.

Data protection and data location

Trust and investment records are sensitive personal data. The Nigeria Data Protection Act 2023 (NDPA) applies, enforced by the Nigeria Data Protection Commission (NDPC): you need a lawful basis for processing, appropriate security, a way to honour data subject rights, and, for high-risk processing, a data protection impact assessment (NDPC). Sector rules from your regulator may also apply. There is no major public cloud region in Nigeria, so hosting means choosing between local data centres (in Lagos or Abuja, for example) and a region abroad, in line with the NDPA's rules on transfers outside Nigeria and any regulator requirements. Backups, support tools, logging services and subcontractors must be checked too.

Build, buy or combine

Commercial trust accounting and portfolio management systems exist and are often the right starting point. A custom build or extension makes sense when you have unusual products, need to combine several systems into one client view, or want a client experience the packages cannot provide. Many firms buy the core ledger and build the portal, workflow and integrations around it.

Planning checklist

Limitations

This article describes common patterns, not the requirements for your specific licence or registration. Regulatory obligations depend on what you do, where your clients are and how you are registered; take legal and compliance advice before you design. If you are planning a platform like this, our custom software development service starts with the ledger, controls and integration design.

Sources and further reading

Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.

1. Central Bank of Nigeria, Central Bank of Nigeria
2. Nigerian Financial Intelligence Unit, NFIU
3. Application Security Verification Standard, OWASP Foundation
4. Nigeria Data Protection Act 2023, Nigeria Data Protection Commission

This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.