Your domain works. Your site loads. Your Google listing shows the right hours. Nothing is broken, because nothing is being asked to move. Then you change web developers, or an agency relationship ends, or you want to switch hosts, and you discover that the accounts your business runs on are not in your name, and the people who can fix that are not obliged to hurry.
This is worth understanding in specifics rather than as general advice to own your accounts, because the specifics are governed by published rules and the rules are less forgiving than most owners expect.
The domain, and a trap in the order of operations
Your domain has a registrant of record. That is the entity the registrar treats as the owner, and crucially it is identified by an email address, which may not be yours. If a developer registered the domain while building your site, the registrant email is often theirs.
Here is the part that catches people. The instinct on discovering this is to go and correct the registrant details immediately. Do not.
Under ICANN's transfer policy, changing the registrant name, organization or email triggers a 60 day lock during which a transfer to another registrar must be denied. Not may. Registrars are permitted to offer an opt out at their discretion, but they are not required to. ICANN's own guidance to registrants is to complete a transfer before changing contact information.
So the correct order is the opposite of the instinctive one. Move the domain to a registrar account you control first, then fix the details. Get that backwards and you have locked yourself out of moving it for two months at precisely the moment you were trying to.
A few other provisions worth knowing while you are in there. Your current registrar must give you the authorization code within five calendar days of your asking. A registrar may deny a transfer within 60 days of initial registration or within 60 days of a previous transfer. A registrar cannot block a transfer because a transfer fee is unpaid. And an expired domain sitting in the redemption grace period has to be restored by the current registrar before it can move, usually for a fee.
The Google listing, and a three day window
Google Business Profiles work differently and the timing is tighter.
If somebody else manages the profile for your business, you request access through Google and the current manager is notified by email. They have three days to respond.
If they approve, you get the profile. If they deny it, you get a rejection email, and your remaining options are to appeal or to suggest an edit to your own listing, which is a strange position to be in regarding a business you own. If they do not respond within three days, you may be able to claim it yourself, and Google's documentation is careful to note that this option is not always available.
Read that sequence again with an uncooperative former contractor in mind. The entire process runs on their response, and the fallback is explicitly not guaranteed.
The principle underneath both
These are two different systems with different rules, and they share a structure worth naming.
The remedies run on the current holder's clock, not yours. Both processes begin by notifying the person who has the thing and asking them to act. Neither has a fast path for the person who is actually right.
Entitlement is not possession. You may genuinely own the business, have paid every invoice, and have a contract saying the assets are yours. None of that produces a login. What produces a login is being the registered contact, and that is a matter of record rather than of fairness.
And every one of these is a single point of failure attached to a person. I have written about owner dependency as a structural risk and about tools eventually going away. This is the same failure shape pointed at your access rather than your operations.
The audit, which takes an hour
Make a list. For each item, three columns: what email address it is registered under, who can currently log in, and what the account recovery method is.
The domain registrar. Not the hosting, the registrar, and they are frequently different companies. If you are not sure of the distinction, that uncertainty is itself the finding.
Web hosting. The Google Business Profile. Analytics. Any advertising account. The business email itself, which is the one that usually controls recovery for everything else and therefore deserves the most attention. Social accounts. Payment processing. Any booking, scheduling or invoicing system that holds customer data.
Then look down the email column. If an address appears that you do not control, or belongs to a person no longer involved, or is a personal address belonging to somebody who might stop answering, that line is the work.
Two things people discover doing this. The recovery phone number on an important account is often a number nobody has anymore. And a surprising number of accounts recover to an email address that itself recovers to another account on the list, which means the whole set has one real point of failure rather than several independent ones.
What to do about it, in order
Start with the email account that controls the others, because fixing anything else first just moves a dependency around.
Then the domain, in the order described above. Transfer first, correct the details after.
Then the Google Business Profile, and do that one while your relationship with whoever holds it is still good. A request for access from a client is a routine thing to approve. The same request after a billing dispute is a three day window and a coin flip.
Then everything else, and for each one turn on two factor authentication with a method that survives losing a phone, which usually means an authenticator app with its recovery codes written down somewhere physical.
The timing point is the one I would emphasize. All of this is straightforward while everybody is cooperating and difficult once they are not, and the moment you need it is by definition the moment cooperation has ended.
Caveats
These policies change, and registrars have discretion within them, so verify the current rules with your own registrar rather than taking a blog post as authority on your specific situation. I have described ICANN's published transfer policy and Google's published ownership process as they stand, not what any individual company will do.
This is also not legal advice. If a contract governs who owns these assets, what the contract says and what the systems do are separate questions, and the systems do not read contracts.
The summary
The accounts your business runs on have an owner of record, and in a first year business that owner is frequently not you.
The domain has a 60 day lock that fires when you correct the registrant details, so transfer before you fix. The Google listing gives the current holder three days and gives you no guaranteed fallback. Both processes depend on a person who may have stopped taking your calls.
Spend the hour on the audit now, while the answer to a request for access is a routine yes.