A view from San Francisco

Almost one-fifth of private fund managers do not allocate travel or insurance expenses to their funds, a poll of US managers found.

In total, 17 percent of delegates at the forum said these costs were absorbed by the firm.

“I’m very surprised by this, they must have some seriously hard negotiators among their LPs,” the compliance officer at a small fund said during a forum panel.

Just under two-thirds of delegates – 63 percent – and all four panelists said both of these costs were allocated to the fund. In these cases, limited partnership agreements must be explicit as investors and the Securities and Exchange Commission are focused on the matter.

“Fees and expenses policies must be laid out, and if there are ever any deviations from this, no matter how small, they must be documented alongside the reason for doing so,” a second compliance officer said.

When unexpected costs arise, the four panelists each said the decisions their firm took were made by the back office as a whole. This makes the relationship between staff all the more important.

“My relationship with my CFO is critical. Compliance can be seen as the bad guy, but I’ve got to defend the decision to LPs and the regulator,” the second CCO said, adding the process and decision have to be documented.

When new costs are incurred, such as a switch to outsourcing, firms should undertake a similar process. This is a situation encountered recently by two of the panelists’ firms.

“At first, expense allocation was clear because services were used on a deal-by-deal basis, so the fund which should bear the expense was obvious,” the first CCO said. “But now the service provider has offered us an annual subscription, so it is less clear who should be paying the costs.” While an annual subscription is ultimately cheaper for the funds, it is hard to justify each paying the same amount when they are not striking the same number of deals, the CCO added. The second CCO said his firm now has a policy on third-party costs allocation after a similar situation arose.

“These costs are automatically allocated to the fund, under our policy. But we review this annually, to make sure that it is fair and to ensure that management isn’t getting a side deal as a result of the relationship it has with the third party,” he added.

Fund managers shouldn’t be regulatory ‘yes men’

Private fund firms should not be afraid to push back on issues raised during an exam if they feel the agency reached the wrong conclusion, compliance experts say.

A panel of lawyers and compliance officers said while it’s important to not be too defensive, blindly agreeing to make changes recommended by the agency can be seen as an admission of guilt.

“Enforcement is looking at the response, depending on the circumstances, reimbursement, for example, can be seen as proof of wrongdoing. Paying back money doesn’t automatically make the situation go away,” a regulation lawyer said.

The panel said during the course of an examination the agency will keep raising new issues, and a firm is likely to pick up on the areas the regulator is unhappy with, meaning it should “have a feel” for what will be raised after the exam. If necessary, the SEC will send a deficiency letter outlining major compliance shortfalls.

“Start working on your response in advance. Once you receive the letter you have 30 days to reply, but whatever you say in that letter is effectively written in stone. Take the time to make sure you’re not promising something you can’t do,” a partner at a compliance firm said.

The lawyer repeated that any admissions of wrongdoing can be used against you.
“If you don’t agree with something the agency has said, it’s ok to say so, adding that because of ‘X’ we will make the recommended change,” the lawyer said.

‘Volatile attitude’ to cybersecurity emerges following SEC attack

A lack of exams and its own recent hack does not mean the Securities and Exchange Commission will take a softer line on cybersecurity.

Cybersecurity experts stressed firms must not become complacent in preventing cybercrime.

“A concerning volatility in attitude towards cybersecurity has emerged since the SEC attack was made public. Some firms have further ramped up their efforts, while others are saying ‘Forget it! If it can happen to the SEC, it will happen to us’. But it’s vital firms stay on top of their procedures.”

A delegate poll found just 14 percent have had, or are in the process of, an SEC exam, but the SVP warned them this number was unlikely to stay low.

“Regulators are always catching up. They issued [a cybersecurity] risk alert [in August]; it tells you what they’re looking for, and that should serve as either a warning, or the foundation of your cybersecurity policy,” the SVP said.

The panel advised anyone trying to sell senior management on the importance of cybersecurity to focus on the business and reputational risk associated with an attack, not just the regulatory risk, to get them on board.

“Regulatory risk is almost the baseline,” the CFO of a private fund firm said. “A serious attack could take the business offline for days, and compromize confidential data. It should be stressed that this is a clear risk of insufficient protection.”

Those struggling to manage cyber-risk were advised to turn to external service providers, who can help a firm craft and maintain a cybersecurity policy that’s suitable for their business and become their first line of defence.

“By collaborating with external service providers you can filter down problems much more easily,” the chief compliance officer of a private fund firm said.

Half of delegates said they have already engaged external cybersecurity support, while the other 50 percent said they haven’t considered it, were starting to explore their options or were in the contracting process.