FTX Debacle Highlights Key Points for Investor Due Diligence

Operational risk is, all too often, the ‘Achilles heel’ of investment decision-making. Whether one is taking a direct stake in a company/asset (this case) or scrutinising an external asset manager (my own area of specialism), it can be tempting to treat the myriad of operational characteristics as something of an afterthought: a series of checkboxes to be completed after the investment case is already established and agreed. Investors may even be tempted to lean (indirectly if not directly) on others’ operational risk assessments; after all, it is natural to presume that peers—perhaps larger and better-resourced than oneself—must have examined the relevant aspects and been satisfied.

The downfall of FTX should sharpen our focus on the importance of reviewing operational risks. Sadly, investors do not have the benefit of hindsight when making investment decisions. Moreover, operational risk is not something that can be removed entirely from the picture. In the case of private equity and venture capital managers, early-stage and growth-stage companies may often lack the types of controls and processes that a due diligence specialist would prefer to see in place (although the world’s third-largest cryptocurrency exchange—with reportedly over 300 employees and 1.2 million registered users—could hardly be considered a start-up!). In the manager selection sphere, operational risk challenges are somewhat more widespread within the ‘alternative investment’ and ‘private markets’ manager segments: investors continue to increase their exposures to these areas, as shown in our latest biennial Asset Owner Survey.

Investors must be aware of the potential risks to which they’re exposed, which may be greater in certain asset classes than in others.

With operational risks proving unavoidable in (investment) life, it is more important than ever to manage and mitigate those risks effectively. Five key weaknesses have emerged in the (hindsight-dominated) dissection of FTX:

• Corporate structure

FTX’s corporate structure, according to press reports, featured more than 100 subsidiaries, companies and vehicles. When carrying out ODD on asset managers, we often see firms with affiliates providing services to their own funds/accounts. This is particularly common among ‘alternative’ or private market investment managers. The entities and the relationships between them require close scrutiny: investors must always understand the services being provided and the governance structures that firms have in place to mitigate conflicts of interest. For example, where an asset manager has an associated broker dealer entity, there must be complete separation between those related parties in order to avoid the very real risk that investors will be disadvantaged (visibility into trade flows and front running).

• Strong governance

In the case of FTX, there was a complete absence of independent representation with the firm's governance structure. The firm’s main shareholder and CEO, Sam Bankman-Fried, effectively controlled all decision making with limited or no records of actions taken. From a manager selector’s standpoint, it is not uncommon for privately-owned asset managers to lack independent directors. We firmly hold the view that independent representation can help to provide greater oversight and control of management decisions – and protect investors’ or clients’ interests.

From a manager selector’s standpoint, it is not uncommon for privately-owned asset managers to lack independent directors.

• Assessment of the senior leadership

A comprehensive due diligence process will include close scrutiny of the leaders and key operational personnel within an organisation, covering everything from their calibre to their possible conflicts of interest. Do the individuals have sufficient experience and requisite professional repute to perform their roles? While FTX's founders may have been talented technologists, they appear to have had limited professional experience. What other financial interests do these parties have? Bankman-Fried also operated a proprietary trading company called Alameda Research, which ran a quantitative investment strategy focused on crypto assets for the benefit of its owners; US bankruptcy filings to the District Court of Delaware have revealed multiple conflicts of interest between these two entities. Have thorough background checks been performed? FTX’s Chief Regulatory Officer was previously employed at Ultimate Bet, a firm that was investigated by the Kahnawake Gaming Commission ("KGC") for perpetuating a fraudulent scheme to cheat players on its online gaming platform (although there is no indication that FTX's Chief Regulatory Officer was ever investigated by prosecutors or the KGC).

• Cash management controls

FTX Group's Chapter 11 bankruptcy petition states that the group lacked formal cash management controls: there was an absence of authorised signatory lists and cash wires were approved via FTX employees via online chat platforms. From a manager selector’s perspective, effective cash transfer procedures represent one of the key safeguards for preventing the misappropriation of investor assets—and we have seen cases of asset managers where these procedures are not as robust as we may wish. The structure of the cash control framework will likely be a function of the firm's size, the instruments or assets being traded/transacted, and whether an external validator (e.g. a fund administrator) is involved in the authorisation process. Investors must be aware of the potential risks to which they’re exposed, which may be greater in certain asset classes than in others.

• Regulation

Much has been written about the absence of cryptocurrency regulation. From a manager selector’s perspective, investors should always have a clear understanding of which regulatory bodies are responsible for oversight of a manager, and potentially the funds it manages, together with the current and historical relationship the firm has with these regulatory entities.

Above all, the FTX incident should provide an opportunity to consider the overall governance and resourcing of operational risk matters. It is crucial for investors to develop a well-structured, consistent and repeatable ODD process to evaluate and mitigate operational risk over the long-term.