Investors refuse to pay cybersecurity and IT costs – pfm survey

While the data revolution may promise great things for the alternative assets industry, it never promised to do anything cheaply. Managing and securing that data can cost a pretty penny. But with the Securities and Exchange Commission making cybersecurity a priority, and limited partners demanding more information than ever before, few general partners are planning to cut their IT budgets anytime soon.

And GPs can’t offload those expenses to the fund, at least without clear language disclosing what IT costs end up charged to investors. Cybersecurity is considered a cost of doing business, and most management companies pay for such programs. The consensus among LPs is that all IT costs are part of the overhead, but, in practice, there are elements of the IT program that the fund does end up paying. If the GP outsources its fund administration, the cost is passed on to the fund, which includes the fund accounting systems.

But if the GP brings fund administration in-house, it will have to spell out what part of the tech solution is billed to the fund, and what is billed to the firm, as part of its overall infrastructure. But GPs should step lightly here. LPs might agree to certain terms to access top-tier funds, but these are not costs they’re happy to cover.

Careful with that IT bill

And the regulator tends to agree. “The SEC is extremely skeptical of any attempt by the investment advisor to charge its own overhead costs back to a fund or any other client,” says Greg Merz of Gibson Dunn. “In theory, if properly disclosed, the firm can bill its in-house administrative costs to the fund, but the regulator hates the practice.” And lawyers stress that costs related to cybersecurity and technology fall into the category of administrative expenses that the SEC, and many LPs, expect GPs to pay.

And in terms of cybersecurity, most GPs are paying for those initiatives. According to the pfm Fees and Expenses Benchmarking Survey, 79 percent of survey respondents pay for the implementation of cybersecurity initiatives. Only 9 percent charge the fund. “It’s a management cost,” says Nabil Sabki of Latham & Watkins. “Some advisors may negotiate to lay off some of the expenses, but LPs push back on that.”

Jennifer Choi of ILPA conducted an informal poll of members to see if any investors were willing to pay for cybersecurity programs or other technology costs. “In essence, LPs deem technology investments to be a benefit to the GP,” says Choi. “It’s an intrinsic aspect of operating as a best-in-class GP, and therefore, those costs should be covered by the management fee.”

Although the survey did find that GPs charged other technology costs to the fund: 55 percent billed investor portals; 48 percent billed fund accounting systems; and 31 percent billed valuation databases. But there’s a catch to those numbers. If the GP outsources its fund administration, the service provider has their own fund accounting and reporting software. “It’s generally not controversial to charge the costs of an outsourced administrator to the fund,” says Merz. But when GPs begin bringing administration in-house, the costs need to be itemized and clarified before being billed back to the fund.

“GPs need to be very specific in their disclosures around allocating the costs of in-house fund administration to their clients.” says Merz. “And the SEC is more likely to question those costs. They’ll test GPs on whether these costs are equal to the market rate for these types of services. Are they over-charging? Did they consider other alternatives?”

That doesn’t mean that some GPs won’t be able to negotiate attractive terms around technology costs with their LPs, even if regulators frown on the practice. But GPs headed to the negotiating table for their next fund should be wary of adding too much in tech costs to the investors’ tab.

For additional articles, go to Fees & Expenses Survey 2018 .