Financial Advisory Security & Licensee Compliance

No. MCR Associates Financial Advisory Backoffice is strictly a remote Business Process Outsourcing (BPO) and technical paraplanning support partner. We do not hold an Australian Financial Services Licence (AFSL) and do not provide personal or general financial product advice under the Corporations Act 2001 (Cth). The licensed Australian financial adviser retains 100% supervisory responsibility, client engagement ownership, and final sign-off authority on all advice documents.

• ✓ Strict operational boundary: Paraplanning and administrative execution under the direction of the supervising Australian adviser.
• ✓ Zero client contact: Our remote team never interacts directly with end retail or wholesale clients.
• ✓ Comprehensive non-solicitation covenants and mutual non-disclosure agreements (NDAs) on every engagement.

Every Statement of Advice (SOA) compiled by our team follows a structured licensee compliance checklist verifying that client goals are clearly articulated, appropriate research is conducted across approved product lists (APLs), and replacement product recommendations clearly articulate why the strategy is in the client's best interest.

• ✓ Corporations Act Section 961B safe harbour benchmark alignment across all advice strategies.
• ✓ Detailed fee differential schedules and explicit loss-of-benefit disclosure notes for superannuation and insurance replacements.
• ✓ Two-tier internal QA audit prior to delivering the draft document to the adviser.

Our team operates directly inside your practice's existing cloud-hosted software tenant (Xplan, Midwinter, Plutosoft, AdviserLogic) via encrypted VDI/VPN sessions. All client records and generated advice files remain strictly hosted within your sovereign Australian cloud ledger with zero unauthorized local data downloads or exports.

• ✓ Direct cloud execution: No data migration or third-party database sync required.
• ✓ Strict adherence to Privacy Act 1988 (Cth) and APP 8 cross-border disclosure principles.
• ✓ Endpoint restrictions: Locked USB ports, disabled local clipboard copying, and disabled printing capabilities on remote workstations.

Our remote operations adhere to enterprise-grade information security standards, including biometric physical facility access, multi-factor authentication (MFA/2FA) on all systems, encrypted communication channels, and continuous endpoint monitoring.

• ✓ Multi-factor authentication (MFA/2FA) required across all practice software seats and communication tools.
• ✓ Centralized device management with automatic security patch deployment and real-time antivirus defense.
• ✓ Clean desk policies and biometric access controls at our corporate delivery centers.

During the initial onboarding calibration phase, we review your AFSL's approved SOA/ROA templates, Xmerge coding guidelines, advice wizards, and internal compliance review checklists. Our paraplanners draft strictly according to your licensee's approved tone of voice, formatting rules, and strategy frameworks.

• ✓ Full calibration with your practice's Xmerge (.XPT), Word templates, and advice wizards.
• ✓ Integration of your firm's specific compliance sign-off sheets and audit trails.
• ✓ Regular feedback calibration loops to adapt to licensee policy or template updates.

Every engagement is governed by legally binding mutual non-disclosure agreements (NDAs), strict confidentiality provisions, and comprehensive non-solicitation covenants protecting your practice's IP, client lists, and business relationships.

• ✓ Legally binding mutual Non-Disclosure Agreements (NDAs) executed prior to onboarding.
• ✓ Strict employee background checks, credential verification, and employment confidentiality contracts.
• ✓ Complete practice ownership of all work papers, modeling files, and delivered advice documents.

An engagement begins by defining the work scope, the client-controlled software environment, access requirements, turnaround expectations and review process. A paid pilot can be used before moving to recurring capacity.

• ✓ The scope is matched to the relevant MCR Associates service desk and its published commercial model.
• ✓ The client provides or approves the operating procedures, templates and escalation path for the work.
• ✓ The client retains control over the pace and scale of the engagement.

No. MCR Associates is designed to work in the client’s existing approved software, cloud environment or virtual desktop workflow. The exact tools supported depend on the service being engaged.

• ✓ The client controls user access, permissions and multi-factor authentication.
• ✓ Work is completed within the client’s approved templates and operating process.
• ✓ The client retains ownership of its software licences, records and administrative settings.

MCR Associates’s operating model is based on client-controlled cloud software or virtual desktop access and a Zero Local Storage policy. Specific access controls are agreed with the client as part of onboarding.

• ✓ The client determines the access level required for the assigned work.
• ✓ MFA, restricted permissions and client-approved environments can be used where available.
• ✓ Confidentiality and data-handling requirements are established before operational work begins.

The client retains responsibility for final review, approvals and any regulated or client-facing decisions. MCR Associates provides operational preparation and support within the agreed scope.

• ✓ The relevant Australian licensed, registered or authorised client representative retains statutory responsibility where applicable.
• ✓ Review checkpoints and escalation paths are agreed for the client’s workflow.
• ✓ MCR Associates does not replace the client’s required principal, practitioner or decision-maker.