Custody rule: Flagging compliance gaps

No one ever said registration with the US Securities and Exchange Commission (SEC) would be easy. That much was proven when in March the regulator issued a risk alert highlighting that not all registered private equity firms are aware of their duty to comply with its custody rule.

The point of the rule is to prevent investors’ assets becoming misappropriated, lost or misused. Unfortunately telling SEC examiners that the fund’s cash and securities are being stored safely at head office won’t cut it; GPs with “custody” of assets must safe-keep them at an investment bank or some other “qualified custodian”. As a further safeguard the custody rule subjects registered GPs to an annual surprise examination by an independent public accountant to verify their funds’ assets. However, if a fund distributes audited financial statements to LPs within 120 days of the end of each fiscal year (180 days for fund of funds), the GP can avoid the hassle of a surprise exam (which most do).

SEC: fires a warning shot on its custody rule

All together the rule is pregnant with technical details, in other words a compliance minefield for GPs – especially the 4,000 or so private equity firms that have only entered the SEC’s remit last March, and so are less familiar with the realities of registration.

And in a post-Madoff era, the SEC is taking any compliance misstep with its custody rule very seriously, warn various sources, who say the agency is keen to avoid another scandal that could further damage its market reputation.

A Ropes & Gray client memo suggests that the SEC will take a “rigorous and painstaking” approach to examinations, especially regarding technical custody rule violations.

“Your ability to show that you know how it works and have considered it will significantly increase the likelihood that you will come out of an SEC exam quickly and without incident,” says Ropes & Gray lawyer George Raine.

Raine believes the SEC views small infractions, like those involving custody, as a breeding ground for larger problems. “In the mind-set of the SEC exam staff if you get sloppy on little things like custody then it is more likely that you will have big problems.”

TECHNICAL FOUL

So what exactly are firms getting wrong? For starters, some firms aren’t even aware when they have custody of client assets for purposes of the rule.

Essentially, the SEC interprets custody as the ability to obtain access to assets. GPs have that ability because typically money and securities are held in an account for a fund, and not in individual limited partner accounts, explains O’Melveny & Myers financial services counsel, Kris Easter.

But sources say a bigger compliance gap has been the requirement for GPs to hire auditors independent from the firm, meaning all the normal services auditors typically perform for private equity firms excludes them from verifying custody of client assets.

What makes this part of the rule challenging is that not every auditor is forthcoming about their capacity to act “independently” from the GP – as is required by both the “surprise examination” and the “audit exemption”.  Raine says some of the big audit shops have been telling private equity firms that they are perfectly able to work for the firm on its day-to-day accounting, auditing and valuation services but fail to mention their inability to verify custody of client assets for purposes of the rule.  

Part of the problem is that auditors don’t always have a huge incentive to determine their independence from a GP, warn sources. An auditor generally collects the same amount in fees, regardless if custody compliance is part of the package. The good news is that auditors are becoming more alive to the issue and do not want to suffer relationship and reputational risk as the custody rule becomes a greater point of concern for their private equity clients, sources add.

The custody rule also requires GPs to prepare their audited financial statements in accordance with US GAAP. But the alert noted that not every GP was able to demonstrate a “clean opinion” from auditors on their compliance with US accounting rules.  The alert used the example of organizational expenses being improperly amortized, rather than accounted as expenses incurred.

Foreign firms registered with the SEC, and that don’t use US GAAP, also stumbled over their requirements. The rule does allow audits to be conducted using other accounting standards, but these require firms to provide additional information in the financial statements. Unhelpfully the SEC did not specify in the risk alert what extra information was missing or specify what is required. Rather it just noted some audits “did not contain information substantially similar to statements prepared in accordance with US GAAP”.

Other deficiencies came from private equity firms not using auditors registered with accounting watchdog the Public Company Accounting Oversight Board (PCAOB), and subject to PCAOB inspection, which the rule requires them to do. GPs should also be mindful of the fact that not all PCAOB-registered accountants are necessarily subject to inspection by the board. The law authorizes the PCAOB to inspect only auditors who work for clients that are securities brokers or dealers; but finding such an auditor should not be too arduous as the PCAOB lists more than 850 on its website.

Even after an audit was over some private equity firms still struggled with the custody rule. The SEC said some GPs failed to show that copies of their audited financial statements were distributed to all investors. According to the risk alert, there were many instances where the statements were only made available “upon request”.

Firms were also rebuked for not sending the audited statements to investors within 120 days of the funds’ fiscal year ends (or 180 days for fund of funds). A source familiar with the SEC’s thinking said simply setting up a calendar noting the compliance dates would help with timeliness issues.

Lastly, the SEC warned that firms cannot escape the custody rule through investor consent.  The agency’s risk alert highlighted the practice of requesting investor approval to waive the annual financial audit of a fund. But despite gaining investor approval to nix the audit, firms failed to comply with the custody rule as they did not undergo a surprise exam in its place.

The alert goes on to remind private equity firms that even realized funds must undergo a final audit if they want to use the “audit exemption”. The SEC noted this as another area of non-compliance.
The good news is that achieving compliance with the custody rule is a strong signal of the firm’s overall culture of compliance, according to sources. That may be easier said than done, but then again registration with the agency was never promised to be without its challenges.