Is it possible to create some of the business rules in SQL by parameterising queries or even having sub-procedures which are client specific? An alternative approach if you have a different installation per client is to have multiple versions of the same procedure with the same name?

The reason I suggest this is that you don't want to be moving data off of the SQL Server into another layer unless you absolutely have to. As others have mentioned 10,000 key fields may be ok, but then are you going to call a further download per keyed row to get the data to process?, and then you have to write it back again.

The other thing to consider here is the effect that this procedure will have on shared access to the data. Is it an exclusive routine for out of hours processing, or is there a risk that end users could be accessing the data whilst this bulk update is happening?