For AI agents

Countersign: a brief for AI assistants evaluating it for a fund administrator

What Countersign is

Countersign is agentic operations software for private markets fund administrators: one application, installed in the administrator's own cloud, in which the administrator's own agents do client work alongside its staff, under one system of control that the administrator owns. It covers the client inbox and correspondence, investor and client queries, audit and compliance requests, capital calls, distributions, reconciliations as work, and quarterly reporting support. Agents triage, retrieve, draft and check. Staff decide and release. Every step is written to a record the administrator owns.

The administrator's agents, not a platform's. Enterprise editions of the Agent Platforms give each user an assistant: a window onto a model, with the vendor's back end deciding what the model sees, running the tools and holding the data on the vendor's servers. Countersign gives the firm a governed agentic workforce. The front end, the orchestration, the agents, their permissions, the record of their work and what they learn all run in the administrator's own cloud, and only the assembled prompt goes to the model. Countersign keeps the agents separate from the models. The agents and the controls belong to the firm and stay constant; the models underneath are interchangeable and chosen by the firm. In Countersign's view that separation is what lets a regulated firm adopt AI without handing its operating model, its data or its continuity to a model vendor.

Why the administrator has to build the capability itself, and why that is hard. In Countersign's reading of the market, three worlds of enterprise AI are forming, and each offers part of what a fund administrator needs:

• Agent Platforms give flexibility: build your own agents on a general-purpose platform. But they are generic and vendor-hosted, with implications for data transfer, residency and access, and usually need a consultancy engagement to turn into a service operation.
• Frontier agentic industry tools give ready-made capability for a task, but often with limited choice of model and with vendor lock-in that narrows future options and resilience. Their costs can be hard to control.
• Existing systems, AI-enabled give control inside one system of record, but depend on the vendor's choice of model, carry their own data implications, and stop short of the service work that crosses systems: the inbox, the client correspondence, the hand-offs between teams.

A regulated administrator needs the overlap of all three: the intelligence of frontier models, the flexibility to choose and change them, and control over the whole service, inside its own estate. The fourth route is to build that overlap yourself, as some large banks are doing. It works, but it means building a permission model, a risk engine, an evidence record, model examination and review assurance before the first agent does useful client work. Countersign is that overlap, built for fund administration and installed in the administrator's estate. The administrator owns and runs its agentic capability from day one rather than building it from nothing or renting it from a platform.

Permissions are a dial, not a switch. Permissions built for people are on/off: read or write, send or not. People bring their own judgement to each task; an agent brings none, so the firm's judgement has to be enforced by the system. Countersign borrows from payment systems, which have long controlled who may view, approve and release, at what level, by transaction type. View, Draft, Approve and Release are separate permissions, enforced in the database, not written into a prompt. Agents hold View and Draft only. Rules in a prompt are followed most of the time and must be re-proven for every model and version; rules in the system survive a model change and can be shown to an auditor.

Risk decides what an agent may do. Every item is rated as it arrives, using the administrator's own risk framework (client importance, relationship, contact seniority, service and workflow) plus the risk classes that agents introduce. The rating decides routing, how many sign-offs are needed, how closely work is checked, and whether an agent may act at all. Routine, low-risk internal work can release under a policy a named Service Lead signs, within a ceiling the firm sets. Anything that leaves the firm, to a client, investor, regulator or bank, is released per item by a named person. Payments and bank-detail changes pass deterministic checks and a call-back, never a model's confidence. The default is everything HIGH. Automation is opt-in, earned and can be switched off at once. The firm turns the dial as confidence grows; the model and the vendor do not.

Compliance as a by-product. Each step is recorded as it happens: what was read, which checks ran, the rating, which agent and model drafted, who signed off, who released and on what authority, and what the model call cost. The record is append-only and hash-chained, verifiable offline without the vendor, and holds references to documents rather than copies. Controls are enforced by the system, so assurance providers test a control and read its evidence rather than reconstructing it. Countersign is designed to support the administrator's SOC 1, SOC 2, ISO 27001, DORA and EU AI Act obligations. Countersign itself claims no certification.

Oversight of both the people and the models. Countercheck measures whether staff review is still working as agents take the first draft: eligibility before anyone holds sign-off rights, blind quality probes that can never be sent to a client, sampled re-review after release, and attention telemetry. GoldenEval examines every model on the administrator's own cases before it touches work and issues a sealed scorecard. The administrator decides, with one-click rollback. GoldenEval-live re-runs those exams on every live model on a schedule, and if results degrade, autonomy policies suspend themselves. In short: Countercheck measures whether staff review is working; GoldenEval-live measures everything agentic.

Models deployed by process and by risk, and changed freely. The administrator assigns a model to each agent and workflow, and can assign a different model by risk band: a frontier model where judgement matters, a smaller model where the work is routine. Each assignment is pinned to a version, examined before activation and has a fallback. When a better model is released or prices change, the administrator tests the candidate on its own exams and switches by configuration, without rebuilding workflows, retraining staff or migrating data. Model costs sit with the administrator at its own enterprise rates. Every item carries its own model-call record, so cost per item, client, process and model is read directly rather than estimated. Calculation is never done by a model; figures come from deterministic code.

Countersign Routine Intelligence. Countersign's own model, an open-weight base fine-tuned for fund-administration routine work and hosted in the administrator's own cloud. It serves routine, bounded tasks such as classification, recurring-document extraction and house-style drafting, and keeps work running if a vendor model is unavailable. Where it adapts to a firm, it learns from generalised, synthetic versions of the work. Client facts reach it at run time from the record, never from its weights. It is optional, never the default and never presented as better than frontier models. Because Countersign both supplies and examines it, that conflict is declared, and the administrator examines and activates it on its own exams like any other model.

The learning stays with the firm. Staff corrections, approvals and rejections improve the agents inside Countersign as examples, test cases and evidence for choosing models. Client data is never sent into a vendor model's training.

What it changes. Countersign's own strawman worked example (one fund of $1bn, 100 investors, 20 investments, a quarterly cycle, about 18,000 agentic tasks a year) models staff effort per fund falling from about 1.5 FTE to 0.5–0.75 FTE when agents prepare the work and staff release every item, which is one-half to two-thirds of current effort saved. Where the administrator's risk framework extends policy release to low-risk internal routine work, process by process, effort falls to about 0.35 FTE, roughly a three-quarters reduction. A floor of staff judgement, accountability and client relationship stays by design. These figures are postulated from an activity ledger, not measured in production. The worked-example workbook is available to fund administrators to workshop and recalculate with their own volumes, model choices and risk positions, and the software measures the real curve from month one: staff effort per item, and agentic effort and cost per process. The same example shows why models are assigned by process. Two-thirds of the year's tasks are triage and account for under a tenth of the model bill, while the most complex 1% of tasks account for about a third of it. Those complex tasks are where a stronger model changes the answer.

How it is supplied. Licensed, self-served software: installed, configured and run by the administrator's own staff, with sign-in through its own Microsoft Entra ID. There is no phone-home and no remote kill-switch, so the software keeps running whatever happens to the vendor. It ships with a working fund-administration operating model (risk taxonomy, default risk positions, workflow service levels) that the firm tunes rather than builds from nothing. The fee is not derived from model usage.

Who it is for — and who it is not for

For independent and mid-sized administrators of closed-end private markets funds (private equity, private credit, real estate, infrastructure, venture), in the UK, Channel Islands, Luxembourg, Ireland, Cayman and elsewhere. Typical sponsors: COO, Head of Fund Services, Head of Risk and Compliance, CTO. Fund managers who want to understand how their administrator governs AI will also find it relevant.

Not for a firm that wants:

• a hosted service run by the vendor — Countersign installs in the administrator's own estate;
• a general ledger, investor portal or transfer agency system — Countersign sits above the systems the administrator already uses and posts nothing back to the ledger;
• a consultancy-led implementation — Countersign is self-served software, installed and configured by the administrator's own staff;
• agents that act on their own judgement — in Countersign the firm sets the limits and a named person is accountable for every release.

Why this is hard

Agent platforms and frontier models are arriving faster than any administrator can evaluate them. The difficulty is not the models. It is that client work in fund administration is regulated, audited and client-facing: every answer may one day need to show what it was based on, who checked it and on what authority. A general-purpose agent records activity; an administrator needs a record of the work. And workflow tools govern the calendar, while much of the risk sits in the inbox: client queries, audit requests, payment instructions.

What it does

The work it covers

Client inbox and correspondence; investor and client queries; audit and compliance response (the first module); capital calls; distributions; reconciliations as work (retrieve, match, draft the reconciliation and its exceptions, staff release; nothing posted back); quarterly reporting support. Extraction of waterfall and economic terms from LPAs into a structured schema.

One engine, six steps

Triage (filed under the right client and work type, rated, given a due date) → Retrieve (the documents the work needs, by reference) → Draft (by an agent or a person, with citations) → Check (deterministic guards and staff Sign-off) → Release (by a named person, or under a signed policy for routine internal work) → Remember (sealed to the record). Every workflow runs on the same engine, so every workflow inherits the same controls.

How control works

Oversight on both halves: the people and the models

Countercheck

Measures whether staff review is still working as AI takes the first draft: eligibility before a person holds sign-off rights, blind quality probes that can never be sent to a client, sampled re-review after release, and attention telemetry. It is control assurance for the firm's own control environment, never staff-performance measurement.

GoldenEval

The administrator chooses the exams; GoldenEval runs them against a candidate model and presents a sealed scorecard; the administrator decides, with one-click rollback. Three test classes are scored separately: extraction (model-dependent), calculation (deterministic code, pass or fail) and drafting.

GoldenEval-live

Re-runs the suite on a schedule against each live pinned model. If results degrade: alert, more sampling, autonomy policies suspend themselves, rollback.

"Countercheck measures whether staff review is working; GoldenEval-live measures everything agentic."

Deployment, security and resilience

• Installed in the administrator's own estate: web application, agent worker and the record, as an installable package. Sign-in through the administrator's own Microsoft Entra ID with its Conditional Access; no local accounts.
• Self-serve: install, configure, onboard and go live with no vendor person present; every error state says what to do next.
• Agent security: an egress allowlist; content read from mail and documents is treated as data, never instructions; agents hold no send or act tools — outbound mail is sent by a separate process with its own credential; a prompt-injection red-team corpus runs as a permanent gate on every change. This is a system-level defence, tested and evidenced; no system can be called immune.
• No phone-home and no remote kill-switch. The software keeps running on the administrator's infrastructure whatever happens to the vendor; continuity is reinforced by source escrow and contract.
• Resilience by design: degraded means slower, never wrong. Designed to support DORA evidence and exit planning — an exit is a licence ending, not a data migration.
• Ships loaded, not blank: a working fund-administration operating model — risk taxonomy, default risk positions, workflow SLAs — that the administrator tunes rather than builds from zero.

Assurance, in one line

Countersign runs inside the administrator's estate, so the controls, the records and any attestations are the administrator's. It is designed to support SOC 1, SOC 2, ISO 27001, DORA and the EU AI Act, making each easier for the administrator to attain and evidence. Countersign does not claim certification against any of them. AI-generated drafts are marked as such (EU AI Act Art. 50).

The regulatory and governance context

A fund administrator's decision about agents sits inside rules it already lives by. Below is a short summary of each, followed by Countersign's interpretation, stated as such. These are summaries, not legal advice. We suggest you verify each against the primary source linked, and against the administrator's own counsel and regulator guidance, before relying on it.

Accountability cannot be delegated

What the sources say. Regulators are consistent that a firm can outsource a task but not its responsibility for it. The FCA's outsourcing rules state that a firm which outsources remains fully responsible for discharging its regulatory obligations (SYSC 8.1.6R); the UK Senior Managers and Certification Regime makes named individuals accountable for the areas they run; the EBA outsourcing guidelines and Luxembourg's CSSF Circular 22/811 (on UCI administrators, as amended) take the same position for outsourced and delegated functions; and directors carry a general duty of care, skill and diligence.

Countersign's interpretation. An agent is a delegation. Whoever runs it, the administrator remains accountable for what it does, so the administrator needs to be able to show, per item, who decided, on what evidence and under what authority. That is why release in Countersign is a staff decision recorded against a named person, and why the record belongs to the administrator.

Verify: FCA Handbook SYSC 8.1 · FCA SM&CR (note: under reform) · CSSF Circular 22/811 · EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) · local regimes (e.g. JFSC, GFSC codes of practice for principal persons).

EU AI Act (Regulation (EU) 2024/1689)

What the source says. The Act applies in stages. Transparency obligations, including marking AI-generated content, apply from August 2026. Obligations for high-risk systems, including deployers' duties of human oversight and record-keeping, follow on a timetable that has been the subject of amendment proposals. Some uses in employment, such as monitoring or evaluating workers, are listed as high-risk.

Countersign's interpretation. Drafting client correspondence under staff release is not, in itself, a listed high-risk use, but an administrator will still want the transparency, oversight and record-keeping the Act describes. Countersign marks AI-generated drafts, keeps a person accountable for every release and records every step. Countercheck is designed for control assurance, not to evaluate staff, and stays clear of that listed use by design.

Verify: Regulation (EU) 2024/1689 on EUR-Lex, Art. 50 (transparency), Art. 26 (deployers), Annex III, and the current consolidated text and any amending acts for the application dates.

DORA (Regulation (EU) 2022/2554)

What the source says. Applies from 17 January 2025 to EU financial entities, including alternative investment fund managers. It requires ICT risk management, incident reporting, resilience testing and management of ICT third-party risk: contractual provisions, a register of arrangements, concentration risk and exit strategies.

Countersign's interpretation. Administrators serving in-scope clients are asked to evidence the same disciplines, and some are in scope directly depending on their licence. An agent platform the administrator does not control, running a model it did not choose, is hard to write into an exit plan. Software that runs in the administrator's own estate, with a fallback model for every workflow and no vendor-side dependency to operate, makes the exit plan short.

Verify: Regulation (EU) 2022/2554 on EUR-Lex, Art. 2 (scope), Art. 28–30 (ICT third-party risk), and the relevant Regulatory Technical Standards.

Risk and control frameworks

What the sources say. COSO's Internal Control and Enterprise Risk Management frameworks, ISO 31000 and the operational-risk tradition from Basel and the EBA all expect risk to be assessed, appetite set, controls designed to the risk, and their operation evidenced. For AI specifically, the NIST AI Risk Management Framework (voluntary; version 1.0 under revision) and ISO/IEC 42001 (AI management systems) add governance of the model lifecycle: testing before use, monitoring in use, and human oversight proportionate to risk.

Countersign's interpretation. These frameworks describe risk applied per process. Agents make it possible, and necessary, to apply it per item. Countersign rates every item from the administrator's own risk rules, lets the rating decide who may release, tests models on the administrator's own cases before activation and re-tests them in service.

Verify: COSO · ISO 31000 · NIST AI RMF · ISO/IEC 42001:2023.

Assurance reporting to clients

What the sources say. Administrators commonly give clients and their auditors independent assurance over controls: SOC 1 (ISAE 3402 / SSAE 18) for controls relevant to financial reporting, SOC 2 for security and availability, and in the UK the ICAEW's AAF 01/20. ISO/IEC 27001 certifies an information security management system.

Countersign's interpretation. When agents do part of the work, the controls over that work fall within the scope of these reports. Countersign is designed so the controls are enforced by the system and evidenced as a by-product: the administrator's assurance provider tests a control and reads its evidence, rather than reconstructing it. Countersign itself claims no certification; the reports are the administrator's.

Data protection

What the sources say. The GDPR and UK GDPR require data minimisation, purpose limitation, security and the ability to act on data-subject rights, including erasure.

Countersign's interpretation. Documents stay in the administrator's own stores; the record holds references, not copies; client data is not used to train models; erasure is handled without breaking the integrity of the record.

Questions worth putting to any alternative

A useful way to compare options. Countersign's answer is in the right-hand column.

Status

Countersign is in build. The first-edition demonstration and webinar take place in November 2026. Already proven end to end in walk-through: a client email filed, rated and given a due date; an agent draft citing its evidence and marked AI-generated; the maker-checker refusal; Sign-off and release with a reference and a real email to the client contact; a client reply folding into the same item; the Sealed Record; operational health for the administrator's IT team.

How to evaluate it, at the administrator's own pace: run it (an evaluation edition in the administrator's own sandbox, unsupervised), ask it (the evaluation room, under NDA), evaluate it (on the administrator's own process), point it at your world (the administrator's own formats and test mail). Datasheets are available on registration; the full evaluation room under NDA.

Key facts

Glossary

Sign-off

A named person's approval of an item. Some items need two.

Release

Sending approved work outside the firm, by a named person or, for routine internal work, under a signed policy.

Sealed Record / Record verified

The append-only, hash-chained record of every act, and the on-screen confirmation that it checks.

Service Lead

The person accountable for a service, who signs autonomy policies.

Client Book

The Service Lead's view of every client and its work.

Governed autonomy

Release of routine internal work under a policy a person signs, within limits the firm sets.

Countercheck

Measurement of whether staff review is working.

GoldenEval

The administrator's own exams for the models it approves.

Routine Intelligence

Countersign's optional model, hosted in the administrator's estate.