Transfer agent record changes: the share register's weakest field
There is a category of shareholder who never logs in, never calls, and never notices: the registered holder of an inherited position, a demutualised policy, or shares bought in 1987 and forgotten. The controls protecting them were designed for shareholders who pay attention.
Which field on a share register is the weakest?
The payment destination attached to a holding. A transfer agent treats address, bank details and holder name as one class of record maintenance, but only one of them causes dividends and redemption proceeds to arrive somewhere new.
- Dormant registered holdings are targeted precisely because the holder does not monitor them and the notification channel is the address being changed.
- Medallion signature guarantees are a real control with real coverage gaps, and they were designed for a paper-mediated world.
- Tier the register fields by value at risk, and accept that the accessibility constraint here is severe — this population is elderly and frequently offline.
Part of Private capital and fund identity
Who actually holds shares in registered form
Most retail investors hold in street name through a broker. Registered holders — people whose names appear directly on the issuer's register — are a smaller and unusual population: participants in old employee plans, recipients of demutualisation shares, inheritors of physical certificates, and long-term holders who never transferred into a brokerage.
They skew old. They frequently do not monitor the position. Many do not know they hold it. Some are deceased and the estate has not been settled.
That combination — value, inattention, and a paper-era control environment — is why the register is targeted.
The sequence
An attacker who identifies a dormant registered holding follows a predictable path:
- Change the address of record. Dividends and all correspondence now route to the attacker.
- Wait out any hold period the transfer agent applies.
- Change the payment destination, or request a certificate.
- Eventually, attempt a transfer or sale of the position.
Step one is the whole attack. Every subsequent notification goes to the new address, so the legitimate holder learns nothing.
What medallion guarantees do and do not cover
A medallion signature guarantee is a stamp from a participating financial institution warranting the signature's authenticity and the signer's capacity. It is a meaningful control, backed by the guarantor's liability, and it is required for transfers and many high-value changes.
| Change type | Medallion typically required? | Exposure |
|---|---|---|
| Address change | Usually not | High — this is the enabling step |
| Payment destination change | Sometimes | High |
| Transfer of ownership | Yes | Moderate — the strongest control point |
| Certificate replacement | Yes, with surety bond | Moderate |
The control is strongest where the attack ends and weakest where it begins. That is the wrong shape.
Tiering the register
Score each changeable field by the value a wrongful change enables, not by how administrative it feels.
| Tier | Fields | Value at risk | Control warranted |
|---|---|---|---|
| T1 | Payment destination, address of record | Full position value over time | Holder-bound authorisation plus dual notification |
| T2 | Name change, tax certification | Moderate | Holder-bound authorisation |
| T3 | Communication preferences, dividend reinvestment election | Low | Current process |
Address change belongs in T1 because of what it enables, not because of what it is. That reclassification is the substantive recommendation.
Dual notification, which costs almost nothing
Before any technology, one process change has disproportionate effect: on an address change, notify both the old and the new address, and hold the change for a period.
Several transfer agents do this. Those that do not should, and it requires no enrolment, no credential and no capital expenditure. It is the highest-return intervention available here and it should precede anything more ambitious.
The accessibility constraint, which is unusually severe
A credential-based control for this population runs directly into its demographics. An eighty-eight-year-old registered holder may have no smartphone, no email address, and no assistance.
Any design must therefore treat the assisted path as primary rather than as an exception — telephone verification against information the transfer agent holds and the attacker does not, in-person verification at a participating institution, or a notarised instruction.
A scheme that improves security for the holders who can enrol and leaves the rest exactly as exposed has helped the wrong half of the population, since the unenrollable half is the targeted one.
What to measure
- Address changes per 10,000 registered holders per year, and the share on accounts with no other activity in 24 months.
- Payment destination changes within 90 days of an address change. This correlation is the signature.
- Escheatment volume, which is the downstream indicator of positions that went unclaimed for reasons nobody investigated.
Why registers are attractive targets
| Property | Effect |
|---|---|
| Long dormancy | Holders may not look for years |
| Periodic payments | Dividends arrive on a schedule |
| Corporate actions | Large one-off proceeds |
| Maintenance workflow | Changes processed as data quality |
Dormancy plus scheduled payments is the specific combination. A change made quietly produces income for several cycles before anyone notices, and the holder least likely to notice is the one who has not logged in for years.
Objections and honest limits
“We verify identity on register changes.” Against documents or knowledge, both of which are obtainable. The question is whether the holder authorised the change, which is different from whether the requester knows their details.
“Corporate actions have their own controls.” On the action. The destination the proceeds pay to was set earlier, through the maintenance queue.
Tiering a register record
- Separate payment fields from maintenance fields. Different queue, different bar.
- Require a holder signature on payment changes. Not a document upload.
- Hold the first payment after a change. The cheapest containment.
- Re-affirm dormant holders before a corporate action. Where the large proceeds are.
Terms used here
- Transfer agent
- The party maintaining the register of holders and processing distributions and corporate actions.
- Corporate action
- An event producing proceeds to holders — a redemption, a tender, a special dividend.
- Dormancy
- A long period without holder contact, during which a changed payment destination goes unnoticed.
Frequently asked questions
Why is address change the critical field? Because it redirects every subsequent notification, including the ones that would alert the holder to further changes. It is the enabling step for everything after it.
Do medallion guarantees not cover this? They cover transfers and some high-value changes. Address changes typically do not require one, which is where the gap sits.
What about holders who cannot use any digital control? The assisted path must be primary for this population. A credential-only design would protect the holders least likely to be targeted.
Is dual notification really enough on its own? It is not sufficient, and it is the cheapest meaningful improvement available. Implement it first regardless of what else you do.
Why is dormancy the risk multiplier? Because scheduled payments continue while nobody is looking, so a changed destination produces income for several cycles before discovery.
Is identity verification on changes sufficient? It tests whether the requester knows the holder's details, not whether the holder authorised the change.
When should a dormant holder be re-affirmed? Before a corporate action, which is when the large proceeds move.
Where this fits in Manav
Manav binds the authorising individual to the exact record change or instruction, and produces a receipt a custodian, a transfer agent or a regulator can verify without calling the issuer.
Sources and further reading
- SEC — transfer agent regulation
- Medallion signature guarantee programme standards and participant obligations.
- FCC — protecting consumers from SIM swap and port-out fraud