In short: Once an allocator’s investment team likes an emerging manager, operational due diligence sends a data request. The first half asks for data: AUM over three points in time, headcount, transaction volume, service providers, insurance, ownership and the manager’s own money in the fund. The second half asks for documents under nine risk areas, only one of which is about how you invest, and more than two dozen of the items ask for evidence rather than a policy. The investment team meets you several times. ODD meets you once or twice, and the documents are most of what they see. Most emerging managers have almost none of it ready, and how long they take to produce it is a filter in its own right.

By Cláudia Quintela and Lewis Kilroe, Managing Director of East Emblem.

Lewis spends his days inside due diligence documents. He sent me one of his data requests a few weeks ago, the kind an allocator sends a public markets manager once diligence has properly started, and asked what I made of it. His covering note:

“This is by no means everything but makes up a decent core of the expectations. You’ll notice a lot of these docs are absent from a large number of emerging managers, and this list is probably a little bit more than the bare minimum.”

I had seen it before, or near enough. I sent one of my clients something very similar months ago and it took several rounds before they understood that their answers were not answering anything. Engineers at heart, they had built the portfolio and were writing from inside its systems, without ever asking themselves what an investor was supposed to get out of the document.

Why this issue now? The schools are back, everyone is back at their desk, and managers and investors are in a go-go-go mood. If you want operational due diligence meetings in the first quarter of 2027, the first meetings that lead to them are happening now, and this is what you need to have ready by the time they do.

Those first meetings are with the investment team. The documents also go to a different team. Lewis’s answer to my question about what happens after the DDQ puts it bluntly: The investment team meets you several times. Operational due diligence meets you once or twice, and the documents are most of what they ever see of you. The investment team liked you. The DDQ is where you meet the people who can say NO.

What follows below names the risk areas you should focus on and leaves the line items out. I will take the timing and what the delay costs you. Lewis talks about the documents, because he reads these for a living and I do not.

Nothing on that list belongs in a first meeting

A full data request turns up after somebody has met you two or three times, likes the people, and is now willing to pay, with their time or their money, for the diligence.

What you need before then is smaller, and almost nobody has that ready either. Lewis puts the floor at a fund deck and a strategy deck. Then the track record, which gets asked for in Excel, in SMA space usually gross of fees and net of trading costs, because investors want to compare trading talent like for like and taking the fees out is the only way to do it. Many will ask for dailies too.

Send a fact sheet instead and you have added a week to your own process.

Then there is the answer I hit most often: “Available upon request”. If somebody has asked you for a policy, that was the request. Saying it is available on request tells them the document does not exist, or that nobody at your firm has read it since it was bought. This usually happens when there is an external provider who will not release their policy, so the manager passes that back rather than pushing. It was asked. That was the request.

Lewis puts it more bluntly. If you are not providing items, another manager is, and the allocator does not have enough information to justify spending more time on you.

What is in one of these data requests, and why most answers fail, is his territory. Over to him.

What is actually in an institutional data request

First, the sequence. The allocator’s investment team screens managers against their parameters on the track record and the pitch book. Get through that and they bring in operational due diligence, in-house or external, and that is when the DDQ and the data request go out. ODD reads what comes back, then does the full review. Investment consultants run it differently, some doing the ODD first on behalf of a client, others only the investment due diligence with the operational work left to someone else.

The first half of the request is data.

Firm AUM at the latest valuation point and at the same point one and two years back. We are reading the direction. If it is flat or falling, the reason needs to be in the document.

Headcount with a full time and part time split. Transaction volume by instrument type, daily, monthly and annually. Every service provider with the date you appointed them.

Together that is a snapshot of how the firm has grown and where it is heading. If the optics are against you, put the reasoning front and centre, because this is where you get to tell the story yourself. Leave the gap and it is very easy for an allocator to say “we will pass this year, they are not ready”, or “I am not confident they will still be here in twelve months to manage our money”.

Insurance gets forgotten, and it is non-negotiable. Managers who defer it to $500m AUM defer the allocation with it. Broker cover, errors and omissions, directors and officers, cyber, each with the coverage value written in, at firm level and again at fund level, because each entity needs to be insured.

Then ownership, and your investor concentration in dollars and as a percentage of firm AUM. And most of all, how much of your own money is in the fund. Investors want to see skin in the game. If you will not put a decent part of your own net worth behind the strategy, the allocator has to wonder why they should. Saying you cannot afford to invest in your own fund does not fill that gap.

The second half is documents, under nine risk areas.

1. Governance and Ownership Structure
2. Employees
3. Fund Structure and Terms
4. Compliance and Regulatory Monitoring
5. Risk Management, firm and fund
6. Investment Process and Due Diligence
7. Operations, Valuation and Cash Controls
8. IT, Cyber Security and Business Resilience
9. Oversight of Service Providers

Only one of those nine is about how you invest. The other eight are asking whether there is a firm here, or a talented person with a Bloomberg terminal and some ambition.

Allocators are buying the firm as much as the returns. Performance matters, and it will not carry a firm with no infrastructure underneath it. If the capital cannot be safely managed, the investor will find a firm where it can. Look like an amateur operation and you will be treated as one. Every document you hand over should add to their confidence that you can hold their money.

The granularity is the part managers underestimate

Conflicts of interest reads like one policy and is at least five: personal dealing, material non-public information, gifts and entertainment, external directorships, expert networks.

Operations procedures break into ten separate processes covering the full life of a trade, from idea generation and execution through matching and reconciliation to NAV sign-off.

IT and cyber security runs to at least nineteen items on its own, and it is increasingly where allocations die. No annual penetration test and no phishing test, no allocation. A firm running Google Workspace on its default settings, with no enforced access control, is the quickest thing to pass over whatever the returns look like. Workspace can be made institutional. Most managers do not do it, or do not realise it needs doing. If you cannot protect the business or the client data, investors will invest with a firm that can.

There is a line for an alternative data policy, which most emerging managers have never written and now need. Web scraping, and whether any of it could be construed as material non-public information. Nobody takes chances with that one.

You can provide every item on the request and still write answers that fail. Most are written as a chore. The good ones use the space to show how the firm runs. Treat it as a clear look through into your firm, written to leave the allocator confident that you know what you are doing.

Evidence

A standard data request will include more than two dozen requests for evidence.

A policy says what you intend to do. Evidence is what the process produced when it ran. You can buy a policy in an afternoon. The evidence shows you are doing what you say you are doing.

The trade error policy is asked for alongside the errors log. The investment guideline breaches log is a line of its own. The penetration testing policy comes with the results of the most recent external test. Compliance training wants proof the training happened and proof your staff certified afterwards. Disaster recovery wants the results of the last test and the report that went to senior management about them.

A policy you never test is a claim. Testing it proves the operating environment works, and that your staff have read the thing and can follow it.

The governance section asks for charters documenting purpose, composition, frequency and decision-making mechanisms, then the minutes and board packs from the last four meetings. A manager who set up a board because a lawyer said to, met once, and did not follow the responsibilities written into his own charter, cannot produce four.

Five years of audited financial statements for the firm, not the fund. The last three years of regulatory review findings with the remediation plan and the open and closed items. The most recent internal controls report for the fund administrator.

Run the firm as a firm and most of this is already in your files. Otherwise you are writing it from scratch, at speed, while somebody waits. And while they wait, another manager is sending them what they asked for and their diligence moves on.

The template problem

Templates are the obvious place to start, and there is nothing wrong with starting there.

Some of them are a headache to complete. A standard DDQ template covers every strategy in every jurisdiction, so a decent chunk of it will have nothing to do with your business. You cannot delete those sections, because deleting them looks evasive. So you write N/A. Eighty pages of DDQ, twenty of them N/A.

The reader has set aside an hour and spends twenty pages of it on nothing. It is a boring read, and boring the buyer is a strange way to sell. And it leaves investors wondering whether you could tell the difference between what mattered and what did not.

Managers fail on contradictions more often than gaps. Your valuation policy says one thing and your investment policy says another. A business continuity plan bought in a different year describes a firm you are no longer running.

The DDQ is the spine and everything hangs off it, so every document has to agree with every other document, and four templates bought at different times will not agree. One contradiction and confidence in the whole data room goes with it. If the allocator cannot tell which number is current, they will assume none of them are. And if the attention to detail is missing from your own documents, why would they trust it with their money?

Write your own, on top of the template or instead of it. Ten bespoke documents, current and specific about how your firm operates, are worth more than fifty generic ones, because the reader has a fixed amount of attention and every N/A page wastes some of it. If you have no documents yet, the absolute minimum is a pitch deck and a DDQ, with the OM alongside them.

Treat the DDQ as a living document. The more documents you hold, the heavier the review and update becomes, which is real when four people are wearing every hat in the firm. In practice it moves when the AUM moves or the people change, which for an emerging manager is most quarters. I reviewed one recently that was three years old. It was a tough read, and it told me more about the culture than it did about the fund.

And the template is not the form you will be handed. The request that started this piece is ours. Every allocator has their own.

What a good DDQ answer looks like

A DDQ answer is a summary of what you do, not the policy pasted in.

Take AML, where most emerging managers outsource. The answer is: outsourced to a named provider, who run the initial checks and escalate to enhanced due diligence on defined triggers. Four lines. Investors will ask for the underlying policy if they want to validate it.

It goes wrong most often in the fund structure section, where people paste the legalese out of the OM about management fees or the investment objective. We have the OM. We want the sentence that shows you understand your own structure well enough to describe it.

I read every DDQ and every OM that crosses my desk, and I can tell which ones went through a chatbot from the flatness of the phrasing. Lately I can tell which model too. Claude writes shorter, snappier, more abrupt sentences than ChatGPT. Some allocators are not permitted to run your documents through a model at all, so somebody is reading it properly whether you wrote it for a human or not.

Think of a market stall. Fruit polished and looking fresh, clear signs, and you buy an apple. Same apples in a box looking a bit mouldy and you keep walking. Make it look good, then make it digestible.

Back to Cláudia, to close:

I get roughly five inbound approaches a week and I take a first call with about one in ten. Some of that is fit, but a lot of it is that the materials have stopped being distinguishable from each other. Pages filled to the edges with no white space, and language with no author anywhere in it. Black backgrounds on fact sheets and websites, which I find harder to read. I open a document now and my first reaction is oh, another one of these, made by ChatGPT or Claude.

If somebody sent me a pink presentation I would remember it, and I do not like pink.

If you run managed accounts, subtract

If you are raising through a platform/SMA rather than a fund, some of what Lewis has just described comes off the list. Fund structure goes, and the directors and the PPM with it. Service provider selection largely goes too, because the platform/investor has already appointed the custodian and the administrator, and you inherit them.

Execution stays. You still trade with your own brokers, and platforms usually approve two or three rather than mandating one. On the large platforms, custody is mandated, fund administration has more give, and the prime brokers sit on rates negotiated at group level. Managers get cheaper stock borrow than they could have got alone, then go back to their own PB and ask to be looked after on the strength of it.

When I see a very early stage manager already on a tier one prime, I want to know what the catch is. Long prior relationship, or what am I missing about their deal flow?

The clock is ticking

If onboarding drags, that is time you are not trading, and in a good market you will feel it.

I have been onboarding one manager for three or four months. I started talking to another at the same time and they were done in six weeks. The first group still have not sent the contract back. At some point the question stops being about the contract and becomes: if you cannot do this properly, what else can you not do?

Something standard should go out the same day, or the next. A set of documents should already exist, finished, before anyone asks. The decks and the track record. The policies that do not change from one request to the next. None of that is bespoke, so a delay there has no honest explanation.

Something that needs work can take a few days. Your dailies might be missing a fortnight. An exposure cut you do not normally produce has to be built. That is fine.

Missing your own date is a problem. If it will take you a week, say you will send it on Thursday, and send it on Thursday. That is better than promising two days and taking a week. Whatever you say you will do is what you do.

As a manager, you are losing momentum every day you sit on documentation follow up. How long you take is a filter that is running whether you know it or not.

Open the last DDQ you sent, or the one you would send tomorrow, and find one number in it that is no longer true. There will be one. Go and fix it.

Lewis and I are turning the full request into a working document, with the reasoning against each section rather than the line items on their own. If you want it, reply to the newsletter and tell us roughly where you are with your own: what you already have, and what you were last asked for that you could not produce. It will take a while, and it may come as a live session rather than a file, but everyone who replies gets it.

In the next issue I will go through the example of a manager who has gone through all these hurdles to secure his first large institutional allocation. Stay tuned for that issue.

Cláudia and Lewis

Frequently asked questions

What is in an allocator’s data request to an emerging manager?

Two halves. The first is data: firm AUM at the latest valuation and at the same point one and two years back, headcount split full and part time, transaction volume by instrument type, every service provider with its appointment date, insurance cover with values at firm and fund level, investor concentration, and how much of the manager’s own money is in the fund. The second is documents under nine risk areas: governance and ownership, employees, fund structure and terms, compliance and regulatory monitoring, risk management, investment process, operations and valuation and cash controls, IT and cyber security and business resilience, and oversight of service providers.

When does the data request arrive?

After the allocator’s investment team has met the manager two or three times and decided to spend time or money on diligence. The investment team screens on the track record and the pitch book, then brings in operational due diligence, in-house or external, and that is when the DDQ and the data request go out. The investment team meets the manager several times through the process. ODD meets them once or twice.

What is the difference between a policy and evidence in a DDQ?

A policy says what the firm intends to do. Evidence is what the process produced when it ran. The trade error policy is asked for alongside the errors log, the penetration testing policy with the results of the most recent external test, compliance training with proof it happened and that staff certified afterwards, and disaster recovery with the results of the last test and the report that went to senior management. A standard request carries more than two dozen requests for evidence.

Is “available upon request” an acceptable DDQ answer?

No. If somebody has asked for a policy, that was the request. Answering “available upon request” tells the allocator the document does not exist, or that nobody at the firm has read it since it was bought. If one manager is not providing items, another is.

What should an emerging manager build first?

Before any data request, a fund deck, a strategy deck and the track record in Excel, usually gross of fees and net of trading costs, with dailies if asked. For the data room itself, the absolute minimum is a pitch deck and a DDQ, with the offering memorandum alongside them. Ten bespoke documents that are current and specific about how the firm operates are worth more than fifty generic ones.

Does a manager on a managed account platform need the full request?

Some of it comes off. Fund structure goes, and the directors and the PPM with it. Service provider selection largely goes, because the platform or investor has already appointed the custodian and the administrator. Execution stays, since the manager still trades with their own brokers.

How quickly should a manager respond to a data request?

Anything standard should go out the same day or the next, because it should already exist before anyone asks. Anything that needs work, such as dailies missing a fortnight or an exposure cut that is not normally produced, can take a few days. The failure is missing your own date. If it will take a week, say Thursday and send it on Thursday.

Key takeaways

• The people who liked you in the meetings are the investment team. The DDQ goes to operational due diligence, who will meet you once or twice, and the documents are most of what they see of you.
• One of the nine risk areas is about how you invest. The other eight are asking whether there is a firm here at all.
• Evidence outranks policy. More than two dozen items in a standard request ask for the log or the test result, and a policy that has never been tested is a claim.
• Contradictions cost more than gaps. Four templates bought in different years will disagree with each other, and one disagreement discredits the whole data room.
• How long you take to respond is a filter that runs whether you know it or not. Standard documents go out the same day. Whatever date you give is the date you hit.

This publication is provided for educational and informational purposes only. The views and opinions expressed are those of the author and do not necessarily reflect those of any third party.

Nothing contained in this publication constitutes investment, legal, tax or other professional advice, nor should it be relied upon as such. Nothing in this publication constitutes an offer, invitation, recommendation or solicitation to buy or sell any security, fund or other financial instrument, or to engage in any investment activity.