Private Equity's New CFO Is Still Using Old Controls

On October 8, a16z published "You Need a New CFO." It goes without saying, but it's worth reading in full. The authors argue that the CFO's most valuable skill is now "designing the operating system the company runs on," which they define as "the data, workflows, agents, skills and controls that turn context into intelligence and decisions."

As AI agents take on more finance tasks, a16z says controls become "a critical feature of the product." Finance should be able to trace every number back to its source, and agents should follow approval rules that finance sets. "Having controls enables speed," the authors write. A team that trusts its checks doesn't have to redo them by hand.

‍

‍

Where verification is still manual

At a typical private equity fund, the numbers on a capital call or distribution come straight from the fund's books. Where that money should go is still checked by hand. Firms have software for LP records and for fund accounting, and neither was built to manage or verify bank details, so the job falls to people and to legacy controls like callbacks.

Manual verification takes time from small teams on every capital call and distribution, and it leaves little record of what was verified or by whom. By a16z's measure, it is a weak control.

Why firms keep doing it

If this is such a weak point, why do so many firms keep doing it? Mostly because it works. Capital calls close and distributions arrive, and after enough clean transfers the routine feels safe, even though it depends on people catching every mistake.

Firms also tend to assume someone else is checking. Their accounting software records payments and their bank executes them, and neither verifies who is on the other end. That responsibility falls back to the firm.

At a large company, a treasurer or a head of security would own it. Private equity firms move very large sums with small teams and rarely have either role, so the job lands on whoever handles the confirmations. The CFO ends up responsible for treasury and security without either title.

So firms tend to file manual verification under administrative cost, and it rarely gets attention as a security risk until something goes wrong.

‍

What AI changes

a16z points out that AI makes it easier to pull data out of different systems and make sense of it. In private equity, most of that AI arrives through vendors, built into the tools firms already use. Those tools speed up everything around a payment while verification stays manual, so a firm can end up sending money to the wrong place faster.

Legacy controls like callbacks depend on a person recognizing a voice or spotting a forged document, and generative AI has made both cheap to fake. As Todd Sorrel, 6lock's CEO, says, "Recognizing a voice or face can no longer be the basis of trust for private markets." JPMorgan's private bank now tells its own clients to "use digital verification rather than waiting for callbacks."

‍

The manual check that slows every payment down is also the one AI makes easier to fool.

‍

Where 6lock fits

The obvious fix would be to store bank details more securely and verify them more often. The firm would still hold sensitive data that someone has to keep current and keep safe. 6lock takes that data out of the firm's hands. LPs keep control of their own banking details, and firms transact with verified people, so no sensitive LP data is collected or exchanged.

That removes the manual verification work and the data attackers go after in the same move. 6lock verifies everyone involved in a payment, and the firm's team still approves it, so approvals no longer depend on recognizing a voice or trusting a document.

6lock also logs every step of a payment, from invitation to settlement, which gives money movement the same traceable record a16z wants for every number in the books.

35 South Capital has moved more than 80% of its LPs onto 6lock. Valorie Lerner, its managing director of investor relations, says the switch has improved "both the speed and security of our capital calls and distributions."

For a private equity CFO, building the controls a16z describes can start with one they already own, whether or not anyone assigned it to them. Replacing manual verification is a one-time decision, and it removes checks the team would otherwise repeat on every capital call and distribution. As David Beisner, 6lock's COO, says, when fraud is this predictable, "inertia becomes a fiduciary issue."

To see where 6lock fits in your firm, talk to the 6lock team or download the 2026 State of Wire Fraud in Private Assets report at 6lock.com.

‍