The first 90 days should protect continuity before pursuing growth. A buyer’s immediate priorities are to confirm that commission flows, authorities and system access work; secure and reconcile the transferred records; identify clients needing prompt service; and measure what is actually happening against the acquisition assumptions.

Treat the period as four controlled stages: settlement day, days 1–30, days 31–60 and days 61–90. Pace changes according to evidence. A large introduction campaign or rapid refinance push can create avoidable service and compliance risk when contact details, file ownership or client circumstances are still uncertain.

Day 0: prove that operational control exists

Do not treat a signed completion statement as proof that the book is operating. Use a settlement control sheet and have a named owner sign off each dependency:

  • written confirmation of the aggregator’s transfer, commission effective date and payment account;
  • buyer entity, Australian credit licence or credit representative status, lender accreditations and any conditions applying to servicing or new credit assistance;
  • live access to the aggregator platform, CRM, document store, email channels, complaints register and commission reports;
  • a frozen settlement data file, record count and agreed exception list;
  • role-based user access, multifactor authentication, removal or restriction of obsolete credentials and logging of administrator actions;
  • the approved client communication, sender, reply channel and escalation process; and
  • the seller’s remaining access, handover hours, open matters and exit date.

ASIC says a credit licensee’s general conduct obligations include operating efficiently, honestly and fairly, maintaining competence, managing conflicts, supervising representatives and having dispute-resolution arrangements (ASIC). The buyer and its advisers should determine how those obligations apply to the chosen licence and representative structure before anyone contacts clients or provides credit assistance.

Transferred records require more than a successful import. OAIC guidance says an APP entity must take reasonable technical and organisational steps to protect personal information it holds; “holds” can extend to information controlled through a third-party provider (OAIC). Keep an access register, quarantine unexpected files and document which system is authoritative rather than distributing uncontrolled copies.

Days 1–30: stabilise cash, access and client service

Build a daily exception routine for the first week, then a weekly control meeting. Reconcile the opening loan population to the first available aggregator report and, when paid, the bank receipt. Record missing loans, duplicate records, unexplained deductions, changed ownership codes and payment timing separately. Do not erase the settlement snapshot when correcting live data.

At the same time, triage service rather than treating every client alike. Priority queues may include open complaints, hardship or arrears indicators, loans approaching fixed-rate expiry or maturity, unresolved lender requests, incomplete applications and clients who asked for contact. Confirm the legal and contractual basis for the transferred information and the agreed communication before using it.

Client communications should identify the new contact arrangement, provide a reliable reply path and explain how to raise a concern. Avoid suggesting that the client has approved a refinance, ongoing advice relationship or data use merely because a book was sold. ASIC’s enforceable internal-dispute-resolution standards apply to Australian credit licensees, among other financial firms (ASIC RG 271). Route anything expressing dissatisfaction through the approved complaints process, even if it first reaches an ordinary service inbox.

Prepare a breach-response route as well as access controls. Where the Notifiable Data Breaches scheme applies, OAIC guidance requires an eligible breach to be notified to affected individuals and the Commissioner, while a suspected eligible breach must be assessed quickly (OAIC). Privacy and legal specialists should confirm coverage and response obligations; the operating team should know whom to call and preserve evidence.

Days 31–60: repair contactability and test retention risk

By the second month, replace the broad transition list with evidence-led segments. For each record, track whether contact details passed validation, whether a permitted communication was delivered, whether the client responded, whether a service need exists and whether ownership or authority remains disputed. Keep “not yet contacted”, “invalid details”, “no response” and “declined contact” separate; they imply different risks.

Use controlled remediation. Compare CRM fields with permitted source records, investigate returned messages, log corrections and apply an identity-verification process before discussing a loan. Do not fill gaps with purchased data or informal seller knowledge without privacy and legal review.

Retention analysis should distinguish natural run-off, lender discharge, refinance through the buyer, refinance elsewhere, sale of property, arrears-related change and data error. Review loans with credible repricing or refinance triggers, but do not turn acquisition-price protection into the client objective. ASIC’s mortgage-broker guidance says the best interests duty applies when providing regulated credit assistance and that evidence of compliance will come predominantly from broker records (ASIC RG 273). Any new recommendation therefore needs a current client inquiry, appropriate process and adequate record—not a pre-set retention script.

Use the seller’s handover surgically during this stage. Bring the seller into scheduled introductions for agreed relationship-sensitive clients and into fact-finding on exceptions, not routine operations. Record the question, answer, owner and deadline. This converts handover time into resolved dependencies rather than unstructured availability.

Days 61–90: establish the steady-state operating rhythm

The final month should show whether the book can be controlled without daily seller involvement. Close or formally assign unresolved access and data exceptions. Document standard workflows for client requests, complaints, loan reviews, privacy incidents, commission queries and lender escalation. Confirm that each workflow has an owner and a backup.

Compare actual receipts, loan count, discharges and servicing effort with the acquisition model. Explain variance by cause instead of hiding it in one retention percentage. If the buyer forecast assumed low service effort but the acquired base generates substantial record repair, complaint work or repricing requests, update capacity and cash-flow assumptions.

Use a compact control dashboard rather than dozens of vanity measures:

Control area Evidence to review by day 90
Commission continuity Expected versus reported trail, bank reconciliation, missing-loan and deduction exceptions
Authorities and access Active authorisations, accreditations, system-user review and unresolved restrictions
Record quality Complete core fields, duplicates, unsupported changes and records still quarantined
Client service Priority queue age, response ownership, overdue actions and complaint status
Contactability Validated details, delivered communications, responses and separated non-contact reasons
Retention Discharges and refinances coded by evidenced cause, not one blended assumption
Handover Questions resolved, introductions completed, open items and remaining seller dependency

Set internal targets that match the book and service model; this article does not prescribe universal percentages. The useful question is whether the measure is defined consistently, supported by source data and linked to an action.

Changes to defer until the control base is reliable

There may be good reasons to change the CRM, brand, review cadence, pricing or communication style. Sequencing matters. Defer a broad system migration, mass marketing campaign or portfolio-wide refinance program until access, records, complaints and commission mapping are stable enough to measure the effect. Run small controlled tests, retain rollback options and avoid changing several variables at once.

At day 90, the buyer should have a documented control environment, an evidence-based service plan and a revised forecast. Unresolved legal rights, licensing conditions, privacy questions, complaints, tax treatment or purchase-price adjustments should remain visible and be referred to the appropriate lawyer, compliance adviser, privacy specialist, accountant or valuation adviser.

Sources

Disclaimer

This article provides general information only. It does not constitute legal, tax, accounting, financial, credit, valuation or other professional advice. Circumstances differ. Obtain advice from appropriately qualified advisers before acting or entering a transaction.