The widespread practice of forming customer profiles represents an enormous potential market for alternative data, but also presents new compliance challenges deeply rooted in privacy that may hinder conventional buysiders and corporates alike.

We are concerned that the answer may now be "yes," given the recent spike in data localisation actions this summer.

As with diligence in other contexts, it's not a good idea to assume that competitors have done their homework, or that the risks applicable to your business are the same.

Alternative data platforms represent an increasingly common source of data, as entrenched market participants such as Bloomberg acquire smaller vendors or rights to redistribute their data. Regardless of the differences in business models across platforms (e.g., AWS, Bloomberg, FactSet, etc.), each platform represents a challenge for buyside compliance teams, given the open-ended nature of the data these platforms provide. This challenge is likely to grow as data providers consolidate proven data.

Generally, two kinds of vendors refuse to respond to DDQs: entrenched vendors and new entrants that are unfamiliar with buy-side regulatory requirements.

This is an almost universal problem for legal and compliance teams. Fortunately, there are several levers to pull.

Buying alternative data means taking on a new counterparty in a vendor relationship, with broader risks than insider trading and personal data, which tend to dominate the risk assessment.

We believe that, as a practical matter, buyers who regularly engage alternative data vendors reject a small but meaningful percentage of vendors for compliance reasons and that vendors may underestimate the frequency of such rejections.

Many buyers emphasise legal and compliance tasks at the outset of an alternative data deal, with a lengthy diligence and contracting process. But what happens in the weeks and months after the contract is signed? Buyers remain subject to ongoing compliance requirements, products break, contractual terms are triggered, etc. Legal and Compliance teams should periodically re-assess vendors – before they show up in the news.

As transactional data providers expand into new geographies such as the UK and EU with information derived from open banking, rewards apps, and email receipts, buyers should consider key concentration risks in diligence and contracting that are particular to expensive transactional data.