Changing credentials and revoking manager access

Changing a password at the end of a dedicated-management relationship may close only one access route. A formal host-side mandate, API keys or active sessions may operate independently. A controlled exit means identifying permissions, resolving responsibility for outstanding orders and retaining reviewable confirmation, not sending someone a new password to test.

Inventory the active authority

Identify how viewing, trading, software connections and any other permissions were granted. A management mandate registered with the host may not depend on the owner’s login password. This article does not assume the manager has withdrawal or transfer authority. Any financial permission requires separate review against actual rules and agreements.

Revocation is different from closing a trade

Removing access does not itself establish that open positions or pending orders have been closed or cancelled. Before an ordinary planned exit, assign responsibility for monitoring and decisions and record the handover time. Simultaneous owner and manager instructions can create unintended changes. Reconcile each instruction’s actual state with the host rather than relying on a verbal message.

Suspected misuse requires the official security route

If unauthorised access is suspected, do not wait for a routine negotiated exit. Contact the host through a verified official channel for account security and access restriction. This is not a promise that every instruction can immediately be stopped or assets recovered. Preserve incident evidence without publicly exposing private information, and avoid unknown recovery links.

Review passwords, keys and sessions separately

• Change passwords through the official address using a secure personal device, without sharing them.
• Review and revoke manager-related keys using the host’s actual controls.
• Check session and connected-device termination; a password change may not end every session.
• Review owner-controlled recovery and two-factor authentication methods.
• Track cancellation of a registered mandate with a request reference and effective time.

Retain evidence without secrets

Record revoked permissions, effective times, remaining orders and reconciliation results. Before-and-after reports should be comparable, but must not contain passwords, authentication codes, private keys or recovery phrases. Use official confirmation or safe host controls to verify removal. Do not ask the manager to make unnecessary trial login attempts with old credentials.

Settlement and access are separate issues

A fee dispute belongs in the contractual review process, not in renewed password sharing or unlimited authority. If settlement is required, destinations must belong to the same user and be registered or approved under the applicable rules. Another person’s card, account or wallet is not a substitute. No actual payment or transfer is requested here.

Assign post-exit monitoring

After revocation is confirmed, a named responsible person should monitor remaining orders and new events. Silence from notifications is not proof of inactivity. Keep statements and confirmations under restricted access. A disconnected indicator on one screen does not certify that all external permissions have ended.

Before selecting a trading account or management approach, examine the exit process alongside onboarding. Use the contact and cooperation route for non-sensitive questions, not to send secrets. This checklist does not replace the host’s instructions or legal review of the agreement.