Author: Doug Cornelius

To the extent you are managing risk at your firm, are you managing the risks at your underlying investments. The SEC has been asking about this topic in exams.

The most obvious area is cybersecurity. Many of those requirements are not dependent on the company, so cybersecurity compliance carries over.

Compliance can create value to the portfolio by helping them navigate cybersecurity risk. With that risk monitored and a compliance program in place, the portfolio company may be more valuable to future buyers.

The challenge is that many private fund CCOs barely have (or don’t have) the knowledge/background to fully tackle cybersecurity risk.

There is also the problem of portfolio company liability being passed up to the fund if there is a cybersecurity problem. The fund manager could be blamed for the problem instead of the portfolio company. It’s hard to make that go away. The key would not be scaling back the cyber program. You are probably better off showing that you increased the effectiveness of the cyber program even if it was not enough to prevent the problem.

(This session was subject to the Chatham House Rule so I have not identified the participants and have not attributed any of the statements to anyone.)

Volume of secondary sales is dramatically higher this year, compared to last year. $58 billion.

One of the key aspects that secondary purchasers like is avoidance of the blind pool. Usually, the fund is far along in allocating capital. To some extent, it avoids the J-curve problem. Secondaries are able to return capital back to their investors faster.

It has become less of an ad hoc investment strategy only targeting distressed positions. There has been a development for liquidity in the market and an investor demand for secondary positions, directly or trough investment funds. It has become an active strategy.

There has been an increase in GP-led transactions to lengthen a fund life or change the structure/strategy of the fund. As much as 20% of the transaction volume is GP-led. GP needs to be careful of the conflicts that come with the GP being involved in the sales transaction. If the GP is setting the pricing, there is a concern that the GP is underpaying the existing investors, or causing the new investors to overpay. Disclosure is very, very important.

There are two levels of diligence: the fund interest and the underlying investments. For a primary investment as part of fundraising, there is little or no portfolio to review. It’s all operational/GP diligence. Of course, the secondaries buyer wants the GP to consent to the deal. A GP may not want a secondaries purchaser who the GP considers to be a pain in the neck based on excruciating diligence.

GPs need to be cautious about injecting themselves into an LP trying to market an interest to avoid broker-dealer issues. However, the GP may know which LPs are interested in acquiring interests. In particular, the GP should avoid taking compensation in consideration of facilitating the transaction.

The GP buying the interest for itself may be considered a principal transaction requiring consent of the client (i.e. the fund).

(This session was subject to the Chatham House Rule so I have not identified the participants and have not attributed any of the statements to anyone.)

What is the compliance officers’s role in fees and expenses policies and procedures?

Compliance may not make the decision, but will be responsible for documenting the agreed-upon allocation. Compliance will be responsible for monitoring.

Some allocations can be based on the compliance manual or desktop accounting processes. The SEC wants to make sure you document any allocation. It does not have to be as formal as the compliance manual.

Think about flexibility in allocation or default rules that can be overridden to more equitably allocate the expenses properly.

Allocation of D&O insurance? Perhaps allocate to funds based on AUM. Perhaps the retainage sits with the management to take the risk. Some just split it 50/50. Some split it based on risks based on the different risk profiles with some to the management company. There is definitely a wide range of allocations. The emphasis is on consistency.

Dealing with business travel when a single trip involves multiple meeting with multiple purposes. For example, meeting with a potential LP, meeting with an investor, meeting on an investment. Equitably pro-rate the expenses. With investor meetings, it’s common to over-allocate to the current fund because that is where the investment action is occurring.

How to deal with co-investments. If you can get LPs to commit to co-invest up front, they should take the burden of the some of the broken deal expenses. If co-investors come in at the end and get solicited after the investment decision has been made, it does not seem right to allocate broken deal expenses. Of course, if the deal fell through after committing to the investment, perhaps there is an open issue. Several firms that do lots of co-investments stated that they cannot any instance of paying broken deal costs for prospective investments. However, a poll indicated that broken deal expenses are allocated to co-investors at least in some instances by 20% of the responding attendees.

Be cautious about mixing business and personal trips. Focus on the right way to allocate and not let personal expenses leak into the investor costs. A spouse on a business trip is a problem.

Annual meeting expense allocations. The SEC staff has dug into these allocations. Some split equally to the active funds. Some split based on AUM. Fund service providers or non-investors should be charged to the management company.

How to make sure fees are being properly allocated. Make sure there is process for the calculation and a procedure for approval. Generally, private funds will have the fees audited as part of the audit for compliance with the custody rule.

(This session was subject to the Chatham House Rule so I have not identified the participants and have not attributed any of the statements to anyone.)

A panelists of fund compliance officers was moderator by a lawyer.

The regulatory landscape is changing rapidly, so the compliance function needs to be able to change rapidly.

Compliance should have a seat at the table and be embedded in key functions with conflicts and regulatory concerns. Bolted on compliance will be less effective. It’s better to get compliance in the decision-making process to avoid later problems.

The difficult part is balancing the strategic approach to compliance with the day-to-day requirements. It can be a struggle to stay on top of the issues.

Running the machine.
Advisory judgments to the business units
Strategic initiatives

There are particular challenges that come from being an SEC regulator coming into a business, with the change in decision-making.

CCO liability is not in the forefront of concerns. You are operating way outside the norm if you are worried about this. It’s about being reasonable and thoughtful about the issues and the business.

Strategic initiatives includes a focus on staffing the compliance department and the technology you use to handle the compliance load. And also how much you outsource compliance functions to third parties. You need to prove to management that you need more resources and how the resources need to be deployed. You need to build a use case.

Think of compliance as a business unit, not merely a cost center.

How do you stay on top of substantive issues, especially where you may not have the expertise? Aspects of cybersecurity and GDPR are beyond the skill set on many compliance officers. Peer groups are incredibly useful. (One reason to attend this conference.) Identify internal expertise. That means a strong relationship with IT to understand the IT issues around cyber, data security and privacy issues. It’s also important to understand when compliance should be at the front of issues and when compliance should be supporting another business function.

Law firm newsletters are a good source of upcoming issues. There is lots of channel of inbound information. But it’s often better to hear from peers about issues. It’s better stay focused on internal changes in the firm business.

When to outsource? Repeatable tasks are ripe for being outsourced. Substantive items are harder to outsource. If there is a business judgement to be made, it should be made by internal people, not outsourced. Look for manual processes that could be automated. The more the complexity, the better to keep it internal. Look at your staff’s expertise. You should look to outsource if you lack the expertise. Privacy and sensitivity of the underlying task is another factor. It’s hard to outsource trading review if your people are sensitive to that information being more widely reviewed.

Multi-point reporting is common. The CCO often works under the GC, but has escalation channels and multiple points of contacts with other business units and firm leadership. A compliance oversight committee is common. It obviously provides oversight to compliance and also a reverse feature of making the business units aware of compliance issues.

(This session was subject to the Chatham House Rule so I have not identified the participants and have not attributed any of the statements to anyone.)