What compliance policies should a VC GP have before fundraising?

Why the answer depends on facts this page does not know

The same list of policies is mandatory for one manager, good practice for another, and irrelevant to a third, and the differences are not matters of degree.

• Jurisdiction. Where your manager entity sits, where the fund is domiciled, and where your investors are, which can be three different answers with three different regimes.
• Adviser status. Whether you are registered, exempt, or outside a registration regime entirely changes what is required rather than what is advisable.
• Fund structure. A single fund, parallel funds, a feeder, or a separately managed account carry different obligations.
• Investor type. Public pension money, retail-adjacent capital, and development finance capital each add requirements the others do not.
• Offering route. What you may say publicly, and to whom, is decided here, and several policies exist to enforce that boundary.
• The law firm's own caution is worth repeating: Debevoise's 2025 private funds publication, a market-practice summary rather than advice, states in its own front matter that it provides summary information only, is not intended as legal advice, and that readers should seek specific advice before acting. That is the correct posture for this page too.

The thirteen areas, and what each one is for

For each: what it governs and what an allocator is actually checking.

• Conflicts of interest. How conflicts are identified, disclosed, and managed. This is the area allocators probe hardest for a first fund, and it has its own page in this library.
• Code of ethics. The standard of conduct the firm holds itself to, and how breaches are handled.
• Allocation. How investment opportunities are allocated between the fund, co-investors, and any other vehicle you manage. The policy matters most where you have run special purpose vehicles before.
• Valuation. Who values, on what basis, how often, and who reviews. Covered separately on the valuation page.
• Cybersecurity. Controls over investor and portfolio information, with an incident plan.
• Privacy and data protection. What personal data you hold, on what basis, and how long you keep it. Obligations here are jurisdictional and can apply regardless of where you are established.
• Marketing review. Who approves what leaves the firm, which is the operational control behind every performance and promotional claim.
• Pay-to-play. Political contributions and their effect on public investor relationships, which matters the moment a public pension is a target.
• Gifts and entertainment. Thresholds, records, and who approves, which is small and routinely asked about.
• Personal trading. What the team may hold and how it is cleared, particularly where public securities can intersect with portfolio outcomes.
• Whistleblowing. How somebody raises a concern and what happens next, which allocators increasingly ask about directly.
• Recordkeeping. What is kept, where, and for how long. Under the codified United States marketing rule, an adviser must be able to substantiate material statements of fact in an advertisement on demand, which is a recordkeeping obligation as much as a drafting one.
• Business continuity. What happens when a key person, an office, or a provider is unavailable.

What a policy has to be to count

Allocators distinguish between a document and a control, and the distinction decides whether a policy helps you.

• Adopted, with a date. A policy with no adoption date reads as recently downloaded.
• Owned, by a named person. In a two-person firm that person is one of the two, which is fine and should be stated.
• Specific to your firm. A template with another manager's structure inside it is worse than no policy, because it says the firm did not read it.
• Applied, with evidence. A conflicts policy with an empty register in a firm that has conflicts is a finding.
• Reviewed on a cadence, with the last review date visible.
• Proportionate. A twelve-page personal trading policy at a two-person seed fund signals the same carelessness as none at all, in the other direction.

A sequence for a first-time manager

Ordered by what blocks a raise soonest rather than by importance.

• Ask counsel which policies are required for your status, structure, and investors. Everything else follows from that answer.
• Write the marketing review policy early, because it governs the documents you are about to circulate.
• Write conflicts and allocation next, particularly if you have invested through other vehicles before.
• Adopt the valuation policy before the first investment rather than before the first report.
• Put cybersecurity and privacy in place before the data room opens, since both concern data you are about to share.
• Leave the rest until counsel confirms they apply, and say plainly in a questionnaire which are in place and which are scheduled.

What limited partners are testing

Less about the documents than about whether the firm knows what it is subject to.

• Does the manager know their own regulatory status, and can they say it without checking?
• Are the policies specific to this firm, or generic?
• Is there a named responsible person, and does that person understand the obligations?
• Where a policy is not yet in place, is there a date and a reason?
• Does the marketing review control actually operate, given what is already in circulation?

What this readiness map does not do

It does not establish compliance, and completing every item on it proves nothing legally. Compliance is a function of the rules that apply to your specific firm, and only counsel who can see your structure can say what those are.

It also states no jurisdiction's requirements as universal. Where this page names a specific obligation, it is the codified United States marketing rule and it is identified as such.

This page is educational and general. It is not legal, tax, accounting, or compliance advice, and the policy set for your firm should be determined with counsel and, where relevant, a compliance professional.