Research guide

Delaware Statutory Trust Sponsors (2026): What to Ask About Cybersecurity and Payment Controls

By Sequoia ResearchPublished Read as Markdown

What Is This Article About?

This article explains how to review a Delaware statutory trust (DST) sponsor's claims about online security, private records, and payment changes. It examines two public privacy policies available on October 17, 2026, while keeping each policy's own date clear. It then shows what records and answers would help an investor assess the work behind those claims. The aim is to build a useful research file, without calling a website review a security audit or treating a checklist as approval to send money.

Table of Contents

Start With the Entity and the Payment Path

Start by finding out who does each job. A sponsor's brand may appear on the offering, the portal, and the payment notice. That does not tell you who runs the website, holds a record, or approves a bank change. Write the legal entity beside each role before asking about its controls.

For this review, a control means a step meant to prevent, detect, or correct a problem. A check of a new bank account is one control. A log that shows who changed the account is another. They answer different questions, even when one staff member describes both as part of a secure process.

Map the tasks that touch your own investment. You may send identity records to one party and signed subscription papers to another. A separate firm may keep the investor register or send distributions. A qualified intermediary, which helps carry out a deferred exchange, may control the release of exchange funds. Confirm the actual roles in your file instead of assuming this example fits every offering.

Ask who owns the process at the point where the work moves between firms. If the sponsor approves a bank update and a service provider enters it, who checks that the entered record matches the approved request? If the two firms disagree, who can stop the next payment? An answer that names only the software leaves those questions open.

Draw three short paths: records going in, purchase money going out, and distributions coming back. Beside each step, note the responsible entity, the contact route, and the evidence you can retain. A completed path should show where a request starts and how its final result is checked.

Keep each claim within that path. A strong login process does not establish who may approve a payment. A bank's confirmation that it sent funds does not establish that the intended investor record was updated. The sponsor review should connect these steps without merging them.

This is useful even when the investor never sees the technical systems. The goal is to get a clear account of authority and follow-through. It is not to obtain passwords, private network details, or other clients' records.

What Two Public Sponsor Policies Actually Say

The following sample covers two public pages read on October 17, 2026. It compares the descriptions on those pages, rather than the firms' overall security. No private portal, internal policy, payment test, or client incident file was inspected.

Public source Date displayed by the source Description relevant to this review Question the page alone does not settle
ExchangeRight Real Estate, LLC privacy policy Effective May 27, 2026 Describes access controls, encryption, secure disposal, and staff training to flag suspicious requests How does a specific change to payment instructions get checked, approved, and recorded?
Capital Square Realty Advisors, LLC privacy policy at capitalsq.com Effective December 1, 2017 Describes precautions against loss and unauthorized use; lists banking and identity information collected from investors What current process applies to bank changes for the investor's particular offering?

ExchangeRight's page also identifies the affiliated entities covered by its policy. A reviewer should match that scope to the entity handling the actual record. The policy is a first-party description; it does not show an independent test of each stated control. ExchangeRight privacy policy.

Capital Square's page says security measures cannot guarantee security. Its displayed effective date remains December 1, 2017, even though the page was available during this 2026 review. Ask for the current policy and the process that applies to the account. The date alone does not establish that current systems are old or unsafe. Capital Square privacy policy.

These are different levels of public detail. More named controls on one page do not prove better outcomes. A short page may sit alongside a detailed private process; a long page may still leave the payment workflow unclear. The useful next step is to request records that address the missing questions.

Keep the original page address, retrieval date, and displayed policy date in your notes. If a later document names a different legal entity, resolve that difference before treating the two as one policy. Do not combine pages from similar website addresses into a single statement unless their scope supports it.

Turn a Security Claim Into an Evidence Request

A useful request turns a broad phrase into a small, testable question. Start with the claim, then identify the action it describes. Ask which system, entity, user group, and time period the claim covers. Finally, ask what evidence can support it without exposing sensitive details.

For example, “we review access” leaves much unsaid. Does the review include staff who have left, outside contractors, and people with the power to change payment records? How often does it occur? Who signs off on exceptions? A dated summary of the last review may help answer those questions. A statement that reviews are planned answers a different question.

Use three evidence levels in your notes. First is the policy: what the firm says should happen. Second is a record of the action: what happened in a defined case or period. Third is a review of that record: who assessed it, with what scope, and what issues remain. These levels are an original way to organize this article's review, not a formal rating system.

A sponsor may name a security framework. The National Institute of Standards and Technology (NIST) describes its Cybersecurity Framework 2.0 as guidance for managing and discussing cyber risk. Its February 26, 2024 publication explains that the framework sets out high-level outcomes without prescribing exactly how to achieve them. Naming the framework does not by itself show that a sponsor's payment process has been tested. NIST framework publication.

If an outside review is offered, ask for its title, issuer, date, covered entity, and scope. Find out whether it covers the portal host, the sponsor's own staff, or both. Check the period reviewed and any limits on the work. A report about one service cannot answer every question about another firm's actions.

You may not receive the full report. Ask whether an appropriate summary can be shared with you or your adviser. A refusal to share confidential details is not proof of weak security. It does mean your notes should show which question remains unanswered. Do not change “not provided” into “failed” or “passed.”

Avoid asking for active passwords, secret keys, detailed weaknesses, or other investors' data. A redacted example, a dated process summary, or a permitted review extract may be enough for the question at hand. Keep the request focused on evidence, rather than collecting more private material than you need.

Review Investor Portal Access and Private Records

Ask what each person can do in the portal. The ability to read a statement, upload a form, edit a profile, and change a bank account may be separate rights. A page that lists all four features does not show that every user has all four powers.

Start with your own access and any access you grant to an adviser or family member. Ask whether they receive separate logins and whether their rights can be limited to the tasks they need. Also ask how you remove access later. A read-only helper should not need your password simply to see a report.

The Securities and Exchange Commission (SEC) staff's April 23, 2026 investor bulletin recommends different passwords for different accounts and multifactor authentication when available. Multifactor authentication adds another check to the login process. The bulletin also discusses account alerts, including changes to personal details and external financial accounts, while noting that available alerts vary by firm. It is investor guidance, not a finding about either sponsor in the sample. SEC online account bulletin.

Ask what happens when the normal login method is unavailable. A lost phone should lead to a defined recovery process. Find out who may approve a reset, what identity checks apply, and whether a reset changes the right to edit payment details. Request an explanation of the process rather than testing it through a false claim.

Keep the record question separate from the login question. Find out which firm receives a tax form or identity document, where you should submit it, and how receipt is confirmed. Confirm the destination through an established contact route before sending private records. An upload receipt can support that a file arrived; it does not establish that the file was reviewed or accepted.

Consider a fictional file with eight required records. Six have upload receipts, four of those six have been accepted, and two remain in review. The other two have not been submitted. Calling the file “75% accepted” would be wrong: 6 ÷ 8 is 75% received, while 4 ÷ 8 is 50% accepted. Those counts track the file, not the strength of the portal's security.

Ask about copies after a record is replaced. Does the old version remain available, who may view it, and how is the current version identified? The answer should help prevent staff from using an outdated form. It should not promise immediate deletion where the firm must keep records under applicable rules or contracts.

Ask How Changes to Payment Instructions Are Checked

Before a transfer is pending, ask how the parties handle a change in bank details. Establish the trusted contact route while there is time to resolve it. A changed instruction should lead to a review of the change itself, even when the amount and offering name look familiar.

The Federal Bureau of Investigation (FBI) warns that business email compromise can involve messages that look like they came from a known party. It advises verifying payment changes and finding a company's phone number independently of a suspicious message. Pressure to move quickly is one reason for extra care. FBI business email compromise guidance.

Use that guidance to ask how the sponsor's process works with the other parties in your file. Who can issue new instructions? Which party must confirm them? What happens to the old version? Who may release money, and what evidence must that person receive first? These are workflow questions, not a request to disclose an actual account number in a research note.

Separate identity from authority. Confirming who answered a call does not by itself show that the person can approve new bank details. Ask how the firm establishes both. Also ask how the process handles a change to the callback number at the same time as a bank change. The contact update needs its own review; it should not silently become the proof for the payment update.

Consider Nora, a fictional investor preparing a $300,000 purchase. Her file contains payment instruction version A. A new email supplies version B, with the same dollar amount and offering name but a different destination. Nora's worksheet still balances to $300,000. That arithmetic says nothing about which destination is valid.

Suppose the agreed workflow requires three completed steps before release: confirm the source of the change, obtain approval from the authorized party, and match the final instruction to that approval. At 10 a.m., the record shows only the first step complete. One of three steps is done. Writing “33% safe” would turn a task count into an unsupported risk claim.

At 10:20 a.m., version C arrives. The earlier check concerned version B. The file should show which prior work still applies and what must be repeated for version C. A check of the sender may remain useful. Approval of B's destination cannot simply be copied into C's record.

Keep old versions with clear status labels so the change can be traced. Limit access to the actual payment details, and use references rather than full account numbers in general review notes. An investigator or authorized reviewer may later need to reconstruct the sequence. That need does not mean every person on the email chain needs a copy of the banking data.

When the final instruction is confirmed, ask how release and receipt will be recorded. Each is a separate event. A completed verification step does not mean funds have left, and a debit at the sending bank does not prove that the intended recipient has credited the correct file.

Follow Changes to Distribution Bank Accounts

A purchase may be a single large transfer. Distributions create a different review need because the destination may remain active for years. Ask how an investor changes that destination and how the first payment after the change is checked.

Find out whether a profile update changes only contact details or also changes payment instructions. Ask what signatures or other evidence the actual account requires. A trust, joint account, or entity may have different authority records. The review should follow the governing documents and the firm's applicable process, rather than inventing a universal signature rule.

Ask where confirmation of the change goes. If the same request changes the email address and bank details, a notice sent only to the new email may tell the wrong person that the change worked. Ask how the firm handles that combined request, including any notice to an existing verified channel. This is a question to resolve with the firm, not a claim that a particular method always prevents fraud.

A fictional distribution file can show why separate stages matter:

Event in the fictional file Recorded amount What the record establishes
Distribution scheduled $4,800 The planned payment amount
First payment returned $4,800 The original payment did not complete as recorded
Replacement payment sent $4,800 A second payment attempt was made
Replacement received and matched $4,800 The investor received the scheduled amount in this example

The two outgoing attempts total $9,600. After the $4,800 return, net outgoing cash is $4,800. Reporting $9,600 as the investor's distribution would count the failed attempt twice. If the return has not been confirmed, keep that difference open rather than assuming the first payment is back.

Now add a fictional $20 return fee paid by the trust, with no other charges. Net cash used becomes $4,820, while the investor receives $4,800. The fee belongs in its own line. It should not disappear inside the payment status, nor become an extra $20 of investor income.

Ask who reconciles such exceptions and who tells the investor the matter is closed. A portal that shows “sent” may still require follow-up. Useful closing evidence ties the amount, recipient, date, and payment reference to the correct investor record.

Check Vendor Boundaries and Recovery Plans

A sponsor may use outside firms for records, signatures, payment services, and online access. Ask which firm owns each step that affects your data or money. The aim is to locate the handoff, not to demand that every service be performed in-house.

Start with a small question: if the portal is unavailable, whom should the investor contact? Then ask what work can continue and what must stop. A fallback route should have a stated purpose and its own checks. Do not assume that an outage makes a new email address an acceptable place to send identity records.

Request a plain account of the recovery plan. Which records must be restored before payment changes can resume? How does the firm check that a restored record is current? Who decides that normal work can restart? Ask for the date and scope of a recent exercise or review, if a summary is available.

A target recovery time and an observed recovery time are different facts. In a fictional exercise, the firm sets a four-hour target. Its test takes six hours. The result is two hours beyond the target, or 50% longer than the target time. That figure describes one exercise. It is not a forecast of the next outage or a percentage chance that money will be lost.

The dates of restored records matter as well. Suppose a fictional system is restored at noon from a 9 a.m. copy. There are three hours of later activity to reconcile. That does not prove three hours of data were lost. Other logs or records may preserve the work. Ask how those records are compared before a payment queue is restarted.

Avoid a false choice between sharing nothing and sharing the entire technical plan. A dated summary can identify the services tested, major limits, open issues, and follow-up owner. The sponsor need not expose details that could help an attacker for the investor to understand what the review covered.

Check changes in vendors too. A new portal can alter login, document, and approval paths even when the sponsor's brand stays the same. Ask which old access rights and data copies remain. Request the date when the new process takes effect, and verify any changed contact route through a trusted source.

Know the Response Path Before an Incident

Ask for the route to report a suspected account or payment problem before there is an urgent need. Distinguish general investor service from the team that can restrict access or address a payment issue. Confirm the hours, backup contact, and information the team needs to begin work.

The FBI advises contacting the financial institution immediately after a suspected business email compromise transfer and asking it to contact the receiving institution. It also directs reports to the Internet Crime Complaint Center, or IC3. These steps are not a promise that funds will be recovered. FBI reporting guidance.

Do not wait for the sponsor's full investigation before taking those urgent reporting steps. At the same time, preserve the messages and payment references and follow the bank's instructions. Avoid sending private details to a new address merely because someone claims to be part of the response team.

For sponsor research, ask how the firm records the event, assigns responsibility, and shares updates with affected people. Ask who decides whether other accounts, vendors, or records need review. Legal notice duties depend on the entities, facts, and applicable law. This article does not set a universal notice deadline for all DST sponsors.

Separate what is known from what is suspected. A failed login is not proof that data were taken. A suspicious payment request is not proof that money left. A bank recall request is not proof that money came back. Each event needs its own status and supporting record.

In an original fictional example, a payment problem is found at 9:10 a.m., reported to the bank at 9:18, and acknowledged by the sponsor at 9:40. Those are elapsed times of eight and 30 minutes from discovery. All times use the same date and time zone. The record still says nothing about recovery, account access, or final loss.

Ask how the firm will close the issue and document any process change. A useful final note names the confirmed facts, unresolved facts, actions taken, and records retained. It should not turn a quick response into a claim that no harm occurred.

Compare Evidence Without Creating a Security Score

Compare answers by topic, scope, and evidence. A single total tends to hide the question that matters most. A sponsor could provide many useful records while leaving the payment-change approval path unclear. Ten general answers do not fill that specific gap.

Use a simple evidence table with the question, responsible entity, source date, record received, and remaining issue. Keep “policy described,” “example supplied,” and “independent review supplied” as different labels. Record the limits of each rather than forcing them into a ranking.

Consider an original fictional comparison. Sponsor Alder answers ten of 12 questions. Sponsor Birch answers eight of 12. Alder's response coverage is about 83.3%; Birch's is about 66.7%. Those percentages measure replies to that particular request list. They do not show that Alder is safer.

Suppose Alder's two gaps concern payment approval and recovery after a portal outage. Birch's four gaps concern a set of requested historical summaries. The totals alone conceal those differences. To assess the consequences, the investor needs the actual missing question, the planned task, and a qualified review of the answer.

Even an answer count can be misleading. If one question asks about both login security and payment approval, a response about login alone should not close both topics. Split the question into two rows. Keep the original reply attached to each relevant row, while noting which part it supports.

Date the evidence. A report for one year may not address a portal introduced the next year. A new statement may explain what changed, but it does not rewrite the period covered by the old report. Keep the old and new evidence connected so a reviewer can see the gap and the explanation.

Treat exceptions carefully. If a test sample has 20 records and one lacks a required approval, the observed exception rate is 5%. That is a fact about those 20 records, under the stated test rule. Without more evidence, it is not the firm's fraud rate or a forecast for all payments. Ask how the sample was chosen and what happened after the exception was found.

The final comparison can remain open. You may conclude that the received evidence supports some claims, leaves others unclear, and requires a specific follow-up before the file can proceed. That is a more useful research result than an unsupported star rating.

Build a Practical Sponsor Review File

Keep the final file small enough to use. Put the current process map first, followed by the evidence table and a short list of unresolved questions. Preserve the source documents in a controlled location and refer to them by name and date. Avoid copying private account details into the summary.

A useful request to a sponsor might ask for the current written process for bank changes, the entity responsible for approval, and the method used to confirm the final result. It can also ask how the process changes when the investor loses portal access or when two contact details change together. Frame the request around your account and offering so the answer has a clear scope.

Ask for clarification when an answer is broad. “Handled by our service provider” should lead to the provider's role and the sponsor's own review step. “Reviewed regularly” should lead to the date and scope of the latest review. “No issues found” should lead to what was checked, by whom, and over which period.

Before relying on the file, have the appropriate adviser or specialist review the questions that exceed your expertise. Technical security review, legal duties, and authority to release exchange funds are different jobs. Name the person responsible for each judgment. Do not let a general research worksheet become the payment authorization.

After a material change, reopen the affected rows. Examples include a new portal, a new payment agent, a changed investor signer, or a revised bank-change process. Keep a short note of what changed and which earlier evidence still applies. That makes the next review easier without pretending that past evidence lasts forever.

Frequently Asked Questions

Can a DST sponsor's privacy policy prove its systems are secure?

No. A privacy policy can describe what the firm collects, how it handles data, and which controls it says it uses. It does not by itself show that every control worked during a stated period. Ask for evidence tied to the entity, system, and action that matter to your investment. Keep any limits on that evidence visible.

Does a newer policy date mean a sponsor has better cybersecurity?

No. A newer date shows that the displayed document has a newer effective or revision date. It does not measure system quality. An older public policy calls for a current-version check, but its age alone does not establish that the firm's actual systems are outdated. Compare the relevant evidence, not the dates alone.

What should I ask before payment instructions change?

Ask who can issue the change, how its source and authority are checked, and who must approve it before release. Confirm the contact route independently of the changed message. Find out how the old instruction is marked and how release and receipt are recorded. A matching amount does not validate the destination.

Is multifactor authentication enough to protect a distribution change?

It adds a login check, but the review should also cover what a logged-in user can do. Ask about authority to request and approve bank changes, recovery after a lost login device, and notices of profile changes. The evidence should address the payment process as well as access to the portal.

Should investors request a sponsor's full security test report?

Start by asking what review exists and what it covers. A permitted summary or redacted extract may help without exposing confidential details. Check the entity, system, period, findings, and limits. If no suitable evidence is shared, record that limitation. It does not justify assuming either that the control failed or that it passed.

Does a returned payment count as a second distribution when it is sent again?

Track the failed attempt, return, replacement, and final receipt separately. In the fictional example above, two $4,800 attempts with one $4,800 return produce a single $4,800 receipt. Any fee needs its own line. Confirm the return and final receipt before closing the difference; do not assume that a replacement settles both records.

Can a research checklist certify a sponsor's cybersecurity?

No. It can organize claims, sources, replies, and missing evidence. A count of completed questions measures progress on that list. It does not measure a chance of loss or replace a scoped technical review. Use the checklist to identify who needs to answer the next question and which task depends on that answer.

What should the final review say if important answers are missing?

Name the missing fact, the entity asked, and the date of the request. Explain the task that depends on the answer and who will assess it. Keep the status open until useful evidence arrives. Do not describe missing evidence as proof of misconduct, and do not silently treat it as approval to proceed.

About Sequoia Research

Sequoia Research, LLC provides independent research on DSTs and other real estate investment offerings. This educational library helps readers examine source documents, compare claims, and prepare focused questions for their advisers. It does not certify a sponsor's cybersecurity or authorize payments.

Sources