Safety Norms: Private Equity and Venture Capital

1Purpose, scope, and safety principles

These norms protect the capital, people, and reputation of firms and funds that invest in private companies, including buyout funds, growth equity, and early-stage venture vehicles. They apply to general partners, investment professionals, operations and finance staff, fund administrators, advisers, and temporary staff with system access. They cover deal sourcing through exit and wind-down.

This is educational guidance. It does not replace legal advice, licensed compliance support, approved firm policies, or supervision by qualified senior staff. Where a norm says MUST, it is a mandatory control the firm should adopt. Where it says SHOULD, it is a recommended practice that can be adapted to firm size and strategy.

• Money moves only through authorized channels.
• No single person controls both an investment decision and the payment that funds it.
• Doubt is escalated, not resolved privately.

2Roles, competence, and accountability

The managing partner or chief executive is accountable for setting the control environment and funding the compliance function. The chief compliance officer or designated compliance lead owns the policy register, monitoring program, and analysis of regulatory obligations. The chief financial officer or finance controller owns capital calls, distributions, fund accounting, and bank mandates. Deal teams own investment memos and diligence but may not approve their own payments or valuation changes.

Competence comes before authority. Staff must complete training on firm policies before receiving bank portal access, valuation responsibilities, or access to investor data. Anyone who cannot demonstrate training works under supervision. Contractors and fund administrators must be bound by written service agreements covering confidentiality, control standards, and audit rights.

• Maintain a current authority matrix listing who may approve which amounts and transaction types.
• Revoke bank and system access on the same business day that a person changes role or leaves.
• Require attestation of conflicts of interest and personal investment restrictions at least annually.

3Activities, people, and risk assessment

Typical activities include sourcing and screening opportunities, conducting financial, legal, tax, and operational due diligence, negotiating term sheets and shareholder agreements, issuing capital calls, recording valuations, approving distributions, reporting to limited partners, and overseeing portfolio company boards. Relevant people include investment staff, operating partners, outside lawyers and accountants, valuation specialists, placement agents, co-investors, portfolio company management, and administrators. Tools include deal databases, data rooms, email, shared drives, fund accounting platforms, wire portals, and financial models kept in spreadsheets.

Risk is rated as low, medium, or high by combining likelihood and impact. The compliance lead reviews the firm's top risks at least quarterly. Realistic hazards include business email compromise seeking wire changes, fabricated financial statements from target companies, inflated valuations built on unsupported projections, undisclosed conflicts of interest, misuse of material non-public information gained in diligence, leakage of confidential deal terms, misallocated fund expenses, inaccurate investor reporting, and sanctions or anti-money laundering failures involving counterparties.

• High: a wire instruction changed by email without callback verification.
• Medium: a valuation relying on management projections with no independent support.
• Low: a late diligence checklist entry with no financial effect, which still requires correction.

4Financial control and segregation of duties

Financial control safety means no single person can initiate, approve, record, and reconcile a payment or valuation. Capital calls, distributions, fee transfers, and portfolio investments MUST require at least two independent approvers from the authority matrix. Each approver MUST verify payee, account, and amount against source documents before release. Bank account changes MUST be verified by calling a number obtained independently of the request, never a number supplied in the request itself.

Segregation separates deal approval, payment initiation, payment release, general ledger entry, bank reconciliation, and valuation sign-off. Where headcount is small, compensating controls are mandatory, such as review by a partner outside the deal team, periodic reconciliation by a second person, and review of bank activity by the chief financial officer or an independent accountant. Exceptions should be reviewed at a regular meeting and recorded.

• MUST: no payment is released on the basis of an email instruction alone.
• MUST: wire templates and beneficiary lists are locked and changed only through a documented request.
• MUST: fund expenses are allocated under written policy and reviewed for related-party or personal items.
• SHOULD: hold valuation committee meetings with minutes and independent valuation input where practical.

5Fraud prevention, due diligence, and suspicious activity

Fraud in this sector often looks like legitimate deal activity. Diligence MUST include identity checks on key counterparties, beneficial ownership review where required by law or prudent, confirmation of bank details through independent sources, and reconciliation of key financial figures to bank statements or audited accounts where available. Staff MUST NOT rely solely on documents supplied by a seller or target without independent confirmation.

Suspicious activity includes urgent wire requests, requests to bypass normal approvals, sudden changes to payee details, unexplained valuation adjustments, pressure to close before compliance review, use of personal accounts for deal money, and refusal to provide source documents. Staff who see these signs MUST stop the transaction, preserve records, and report to the compliance lead the same business day. They MUST NOT tip off the counterparty, investigate alone, or contact the suspected party about the concern. The compliance lead decides with counsel whether and how to report to authorities under jurisdiction-specific procedures.

• Verify every payment change by callback to an independently sourced number.
• Record all diligence red flags in the deal file even when the deal proceeds.
• Check the conflicts register before each investment committee decision.

6Data confidentiality, information security, and privacy

Deal information, portfolio company financials, investor identities, and executive personal data are confidential. They are often covered by non-disclosure agreements and privacy rules that vary by jurisdiction. Access MUST be limited to people who need it for their role, recorded in the data room or document system, and reviewed when deals close or staff change. Firm-approved storage must be used, not personal email or consumer file sharing services.

Security controls include multi-factor authentication on email, bank portals, and fund platforms, encrypted laptops and mobile devices, and screen locks in shared spaces. Material non-public information MUST be restricted to a documented insider list and handled under the firm's insider trading policy. Recommended practice includes periodic access reviews, phishing awareness exercises, and security checks on vendors before data is shared.

• MUST: no investor or target data is sent through unapproved personal accounts.
• MUST: wall-crossing and restricted list entries are logged with reasons.
• SHOULD: personal data is redacted in drafts when full detail is unnecessary.

7Regulatory compliance and accurate records

Fund advisers, managers, and their staff operate under securities, tax, anti-money laundering, sanctions, marketing, and reporting rules that vary by jurisdiction and fund type. This guidance does not determine which rules apply to a specific firm. The compliance lead MUST maintain a current obligations register, confirm applicable rules with qualified counsel, and track filing and disclosure deadlines. Marketing materials, track record claims, and fee disclosures MUST be reviewed by compliance before use.

Accurate records are a safety control. Investment files MUST contain the investment memo, approvals, diligence evidence, valuation support, and executed legal documents. Changes to records MUST be made with time-stamped audit trails and stated reasons. Deleting or overwriting records is prohibited except under the retention schedule. Retention periods depend on applicable law and must be verified locally.

• MUST: valuations are documented with methodology, inputs, and sign-off.
• MUST: side letters and fee arrangements are recorded in the fund system before the first fee calculation.
• SHOULD: investor statements are reconciled to the general ledger each reporting period.

8Incident escalation, response, and review

Report any suspected fraud, control failure, data breach, misdirected payment, compliance breach, or near miss to the designated compliance lead and the chief financial officer immediately, and no later than the same business day. If the concern involves a senior person, report it to the managing partner or an independent board member. Anonymous reporting channels must exist and must protect reporters from retaliation. Near misses, such as a payment stopped at verification, are logged and analyzed because they reveal control gaps.

For suspected payment fraud, the first actions are to hold the release, contact the bank fraud team using a number from the bank's official website or prior records, preserve emails and system logs, and involve legal counsel and, where relevant, cyber specialists. Threats to personal safety must be reported to local police, not handled internally. Incident records are kept in writing, root causes are reviewed, and controls are tested at least annually and after significant incidents, with results reported to senior management.

• Hold and verify: stop any transfer until the request is independently confirmed.
• Preserve evidence: do not alter, delete, or forward suspicious files outside approved channels.
• Escalate: report findings to counsel and senior management with a written timeline.

Implementation checklist

• Confirm the authority matrix requires two independent approvers for every payment type.
• Verify every new or changed bank account by callback to an independently sourced number.
• Keep investment, valuation, and fee records complete, reviewed, and time-stamped.
• Limit deal information access to named people and log every restricted list entry.
• Review conflicts of interest before each investment committee decision.
• Report suspicious requests to compliance the same business day without tipping off the counterparty.
• Confirm applicable securities, tax, and anti-money laundering rules with qualified counsel.
• Test controls, review incidents, and revise these norms at least annually.