Safety Norms: Structured Finance and Capital Raising

1Purpose, Scope, and Safety Principles

These norms aim to prevent financial loss, investor harm, misstated offering information, unauthorized disclosure, payment fraud, and regulatory violations during structured finance transactions and capital raises. Structured finance means arranging cash flows and credit risk from pools of assets, such as receivables, loans, or leases, into tranches of securities, often issued by a special purpose vehicle (SPV). An SPV is a separate legal entity set up to hold those assets. Capital raising covers private placements, syndicated loans, and similar offerings of debt or equity.

Scope includes everyone who touches a transaction, from origination through closing and post-closing servicing. Principles used throughout are separation of money, information, and authority; evidence before belief; and early escalation. A deal can be delayed without lasting harm, but a wrong wire, a misstated yield, or a leaked pricing decision often cannot be undone.

• Mandatory: No funds move, offering document is released, or investor is solicited without the approvals recorded in the deal approval matrix.
• Mandatory: Nonpublic deal information is shared only with people on the approved access list.
• Recommended: Treat requests to skip a control, rush a sign-off, or keep a matter from compliance as warning signs.

2Roles, Competence, and Accountability

Each transaction has a named deal sponsor who owns scope and signs the approval matrix. Accountability for each output sits with the person who signs it, not with the team as a whole. Authority is delegated in writing, and no one acts beyond a stated limit. Junior staff must refuse instructions that conflict with policy and escalate them. Seniority does not waive a control, and managers must confirm that each team member understands the authority they hold.

Competence is shown through documented training, supervised experience, and written authorization. Only authorized staff may sign payment instructions, investor eligibility certifications, or model releases. Licensing for certain activities is jurisdiction-dependent and must be verified with the relevant regulator.

• Deal sponsor: approves structure, timetable, and fee arrangements within delegated limits.
• Finance controller: validates cash flow waterfall models, account reconciliations, and the funds flow memorandum.
• Compliance officer: confirms the offering exemption, investor eligibility, marketing restrictions, and conflict disclosures before release.
• Legal counsel: reviews transaction documents and confirms securities and jurisdiction-specific requirements.
• Independent reviewer: a person who did not prepare a figure checks it against source data before sign-off.

3Course-Specific Hazards and Risk Assessment

Risk is rated by likelihood and impact as high, medium, or low. Ratings are recorded in the deal risk register and reviewed at each milestone, such as term sheet, documentation, pricing, and closing. A high rating requires a named owner and a written control before the next milestone. Ratings are starting points, and local risk tolerance, deal complexity, and legal requirements may change them.

Example: an analyst discovers that a pool file includes delinquency data from a different period than the one stated in the offering summary. The analyst records the discrepancy, does not edit the summary, and notifies the deal sponsor and independent reviewer the same day. The disclosure committee decides whether the figure changes before any investor sees it.

• Payment fraud: spoofed emails change beneficiary bank details before a closing wire. Rating: high. Control: dual approval and call-back to a number taken from the original deal file.
• Misstated figures: errors in pool data, default assumptions, or waterfall formulas overstate yields or coverage. Rating: high. Control: independent model check and locked versions.
• Selective disclosure and insider trading: staff discuss pricing or pending transactions with outsiders or trade on that knowledge. Rating: high. Control: restricted list, wall-crossing procedure, and trading restrictions.
• Misleading offering material: unsupported performance claims or omitted risk factors. Rating: high. Control: disclosure committee review with source references.
• Undisclosed conflicts: sponsor retains residual interests or affiliates earn fees that are not disclosed. Rating: medium to high. Control: conflict log reviewed by compliance.
• Personal data exposure: borrower files with identifiers sent by unencrypted email or left on shared drives. Rating: high. Control: data minimization and approved transfer tools.
• Unauthorized solicitation: investor outreach before the offering exemption is confirmed. Rating: high. Control: compliance-approved distribution lists.
• Operational pressure: deadlines push teams to skip review. Rating: medium. Control: no closing without documented sign-offs, regardless of timetable.

4Preventive Controls and Safe Work Practices

Segregation of duties is the central control. The person who creates a payment instruction cannot approve it, and the person who approves a payment cannot reconcile the account it affects. The same logic applies to models, disclosures, and access rights. Where a small team cannot separate every duty, the deal sponsor must document a compensating control, such as review by a person outside the deal, and compliance must approve it in writing.

Example: a controller receives an email from a seemingly known agent asking to update the settlement account the day before closing. The norm requires the controller to stop, call the agent on the number in the original file, notify compliance, and log the attempt. The payment does not proceed until both approvals are obtained again.

• Mandatory: Payment instructions require two authorized approvers. Any change to beneficiary details must be verified by a call to a number from the original deal file, never from the email requesting the change.
• Mandatory: No one approves their own work, expense, trade, or access request.
• Mandatory: Financial models are locked after sign-off. Later changes are logged with reason, author, and approver, and the prior version is retained.
• Mandatory: Offering materials are released only after legal and compliance sign-off, and each figure is traced to a source report or workbook cell.
• Mandatory: Data room access is granted by role, set to expire on a defined date, and downloads are logged.
• Mandatory: Suspected insider information stays on the restricted list until compliance clears it.
• Recommended: Hold a funds flow call-down with all parties before closing, and read each amount and account aloud.
• Recommended: Maintain a red flag list reviewed at each milestone: urgent wire changes, requests for confidentiality exceptions, round-number adjustments without support, unusual counterparties, and pressure to close before review.

5Equipment, Environment, Information, and Protective Safeguards

Tools include cash flow modeling software, spreadsheets, data rooms, e-signature platforms, payment systems, and messaging applications. Use only tools approved by IT and compliance. Personal email, consumer messaging apps, and personal cloud storage are not approved for deal information.

Example: an analyst preparing investor materials on a personal laptop over a public network breaches the norm. The work moves to an approved, managed device, and the analyst reports the exposure to IT security so that accessed files can be reviewed.

Privacy and data protection laws, securities rules, and bank secrecy or anti-money-laundering obligations vary by jurisdiction. Confirm current requirements with qualified counsel before transferring data across borders or sharing it with third parties. In this field, protective safeguards are largely digital and procedural: access controls, logging, and secure tools.

• Mandatory: Multi-factor authentication on all deal systems and payment platforms.
• Mandatory: Confidential files are encrypted in transit and at rest using approved methods.
• Mandatory: Clean desk and locked screens in shared spaces. Deal discussions are held only in rooms where others cannot overhear.
• Mandatory: Borrower personal data is minimized, masked where practical, and kept only as long as policy and law allow.
• Recommended: Watermark drafts with the recipient name and draft version to help trace leaks.
• Recommended: Review access lists whenever a team member changes roles or leaves the deal.

6Incident Reporting, Emergency Response, and Escalation

Report suspected fraud, misstatement, leaks, or breaches immediately. Do not investigate alone, do not alter records, and do not attempt recalls or reversals unless the finance controller and compliance instruct you to. Preserve emails, files, and system logs in their current state.

Example: a team member learns that a closing wire went to a changed account after an approver signed a call-back that was never completed. The member notifies the controller and compliance at once, requests a bank recall through the controller, and preserves the call log. Escalation is required even if the error seems to be an honest mistake.

If anyone faces an immediate threat to personal safety, or a physical emergency occurs at an office, contact local emergency services first. This guidance does not replace reporting duties to regulators, law enforcement, or insurers. Those duties must be verified with counsel.

• Suspected fraudulent payment: stop the transfer, notify the finance controller and the bank's fraud contact immediately, then notify compliance. Recall requests are time critical.
• Suspected leak of nonpublic information: notify compliance the same business day and update the restricted list.
• Misstatement found after release: halt distribution, notify legal and the disclosure committee, and assess whether correction obligations apply under applicable rules.
• Data breach: notify the privacy officer and IT security at once. Breach notification deadlines are set by law and vary by jurisdiction.
• Reporting channel: staff may raise concerns through the compliance hotline or a designated contact without retaliation, as defined by company policy.

7Records, Training, Inspection, and Review

Deal files must allow an outside reviewer to reconstruct what was approved, by whom, and on what evidence. Each file contains the approval matrix, model versions, source data references, call-back logs, funds flow memorandum, disclosure review notes, and access records.

Monitoring is continuous, not only at closing. Track whether post-closing reconciliations are completed on schedule and whether restricted list entries remain open past their review dates. Trends in exceptions show where training or controls need strengthening.

• Training: staff receive documented instruction on fraud red flags, disclosure rules, and data handling before joining a deal, refreshed at intervals set by policy.
• Records: keep files in approved systems. Retention periods follow internal policy and applicable law.
• Inspection: finance and compliance sample closed deals and check call-back evidence, locked model versions, and restricted list entries.
• Metrics: track control exceptions, late approvals, rejected payment instructions, and near misses.
• Review: hold a post-closing lessons learned session for each deal and update controls based on the findings.

8Conclusion and Limits of This Guidance

These norms are a starting point for locally approved procedures, not a substitute for them. Structured finance and capital raising carry legal, financial, and reputational exposure that depends heavily on jurisdiction, deal type, and investor base. Before adopting any norm, verify it against current laws, regulator guidance, and internal policy, and obtain advice from qualified securities, privacy, and tax professionals.

Implementation checklist

• Confirm the deal approval matrix and named owners before work begins.
• Verify every payment change by call-back to a number from the original deal file.
• Obtain two independent approvals for every payment instruction.
• Lock models after sign-off and log every later change with reason and approver.
• Trace every offering figure to a source and obtain legal and compliance sign-off.
• Confirm investor eligibility and marketing restrictions before any outreach.
• Restrict data room access by role, set expiry dates, and review logged downloads.
• Keep borrower personal data minimized, encrypted, and stored on approved tools only.
• Escalate suspicious activity to compliance without waiting for certainty.
• Report suspected fraud, leaks, misstatements, or breaches the same business day.
• Review restricted list and trading restriction status before each milestone.
• Complete a post-closing review and update controls based on findings.