Private Equity Origination Approval Packet and Suppression Check

Executive Summary

A private equity (PE) origination approval packet is a single, versioned record that answers one question before anyone contacts a business owner: may this specific person at this specific company be submitted for human-approved contact, at this time, through this channel? This report treats the packet as an internal contact authorization gate, distinct from a general diligence handoff, and it does not generate messages, advise sending, or claim that any completed packet is legally compliant or will be delivered. Counsel must confirm applicable law by recipient location and entity type.

The case for a per-contact record rests on how little the law and the mailbox providers leave to chance. The US Federal Trade Commission (FTC) states that the CAN-SPAM Act (which concerns commercial messages; whether an owner approach is commercial is a question for counsel) "makes no exception for business-to-business email" ^[1], requires opt-outs to be honored within 10 business days ^[1], and says hiring another company does not remove the sender's responsibility ^[1]. Canada's anti-spam statute ties implied consent from a published address to the absence of a refusal statement ^[2] and to relevance to the recipient's role ^[2]. In the United Kingdom, the Information Commissioner's Office (ICO) classes sole traders and some partnerships as individual subscribers ^[3], and says the UK General Data Protection Regulation (UK GDPR) can apply to a named person's details taken from a company website.

Mailbox-provider rules are a separate layer. Gmail applies its stricter requirements to senders of more than 5,000 messages per day ^[4], and Google says one-click unsubscribe is required only for marketing and promotional messages ^[5]. Yahoo publishes no numeric volume threshold ^[6]. These are technical sender conditions, not statements of law, and they do not apply uniformly to every one-to-one message.

The recommended packet has ten fields (Table 2) and three decision outcomes (approved, held, suppressed) plus an expired state that is reported separately. Approval is valid only for the named person, channel, purpose, owner and window; any change returns the packet to review. After a response or objection, the contact is suppressed with the minimum data needed to honor it, which the ICO describes as "just enough information" to respect preferences ^[7]. A fictional audit shows how to report complete-field rate, suppressed, held, approved and expired counts separately, without calling them deals or proof of compliance.

Context matters for scale. Bain reports 2025 global buyout deal value of $904 billion across 3,018 deals ^[8], and describes competitive processes with "dozens of PE firms kicking the tires" ^[9]. Duplicate or unsupported contacts are therefore a cost to the sponsor's own reputation with owners, not only a regulatory question. The hardest unresolved points are jurisdiction-specific interpretation, the changing UK penalty regime, and the absence of any public benchmark for packet completeness.

Introduction and Background

This report examines how a PE origination team can decide, record by record, whether a proposed owner contact is ready for a named human to approve, must be held for verification or legal review, or must be suppressed. It is written for origination heads and for research and operations staff who prepare the evidence. It is an internal workflow analysis, not legal advice, and it makes no claim about response rates, conversion or inbox placement.

The topic sits between two bodies of content that rarely meet: sales-tool pages on list hygiene and deliverability, and fund-compliance pages on what a registered adviser must document. Neither describes the layer in between, the evidence an analyst attaches to one proposed contact and the checks an approver reviews. The search phrase "private equity owner outreach compliance" is itself ambiguous, because it can mean fund-level regulatory compliance as easily as the lawfulness of a message. This report addresses the second meaning, and refers to fund-level duties only where they bear on policy and records.

Proprietary origination, meaning sourcing a target before or outside a banker-run auction, is an established strategy. Bain's 2026 global PE report says the firms that stand out will have a "repeatable model for sourcing deals" ^[8]. A 2017 Bain article, citing a 2016 analysis of 110 firms, reported that a typical firm sees only 18% of the relevant intermediated deals ^[10]. That figure is dated and covers intermediated deals, so it is a historical indicator, not a current share. The same article estimated that only 1 or 2 of every 100 funnel targets close ^[10]. A funnel that thin creates pressure to contact widely, which a contact authorization gate is designed to manage.

Three terms recur. Candidate is the company under consideration. Contact is the individual proposed for approach. Suppression is the retained record that a candidate or contact must not be approached through a given channel. The packet keeps candidate identity and contact identity separate, because the evidence for each is different and errors in one are easily mistaken for confirmation of the other.

Docket, the publisher of this report, provides sourced target research for PE origination teams through Triage, Scout and Audit agents, with self-serve and managed delivery. The publisher benefits from teams adopting evidence-backed research workflows, so its perspective is not independent. No factual claim relies on the publisher's own materials; the sourced statements rest on regulators, standards bodies, filings, research originators or vendors documenting their own rules. Readers can find the publisher's offering at docket.capital.

Key Changes: From a Contact List to a One-Record Approval Gate

The packet changes six things about how an origination team handles a proposed contact. Each is described as a change from common list-driven practice, with the supporting source material.

Change 1: Start with the decision, not the data

A list-driven process begins with a spreadsheet of names and ends with a decision by whoever sends. The packet inverts this: its first line is the decision question, its last line is one of three decision outcomes with a named approver, and everything between is evidence.

The three decision outcomes are narrow:

• Approved: all required fields are complete, no disqualifier or suppression hit exists, counsel-approved policy covers the jurisdiction and channel, and a named human has signed with an expiry date.
• Held: a required field is missing, evidence conflicts, or a legal review branch applies. A held packet is not rejected, and it carries a reason code and an owner.
• Suppressed: a prior objection, opt-out, conflict, or exclusion applies. A suppressed packet blocks the channel it names until the suppression record is lawfully and deliberately lifted.

A fourth state, expired, is reported separately: an approval whose window closed without the approved contact occurring.

Change 2: Resolve candidate identity and person identity separately

Candidate identity means the canonical legal entity, not a brand. The Legal Entity Identifier (LEI) is a useful anchor where one exists: GLEIF states that "every LEI is unique and can represent only one entity" ^[11] and that the code is based on the ISO 17442 standard ^[11]. GLEIF's baseline record holds the official name as recorded in official registers ^[12], and its "who owns whom" layer shows a parent only if the parent itself holds an LEI ^[13]. An absent parent in an LEI record therefore proves nothing about ownership.

Names alone are weak keys. In the United Kingdom, GOV.UK says a new company name cannot be the same as another registered company ^[14], yet the page's "same as" names section allows near-identical names where the applicant is in the same group ^[14] or holds written no-objection confirmation from the existing holder ^[14]. It also notes a name can be changed after a complaint ^[14]. Near-identical names across different legal entities are therefore possible by design, which is why the packet records a registry identifier and registry source with a retrieval date. In the United States the Securities and Exchange Commission (SEC) assigns a unique Central Index Key (CIK) only to filers ^[15], while company registration sits with state offices ^[16], so private owner-managed companies will usually have a state record, not an SEC one.

Person identity is recorded separately: name, stated role, the source URL and date of the role claim, a corroborating source where available, and an ambiguity note. The packet never records an inference about the owner's willingness to sell. A role claim is a fact with a source and a date. Intent is a hypothesis for the research notes, labeled as such.

Change 3: Attach mandate-fit evidence, and keep it distinct from a diligence handoff

The packet differs from the research-to-deal-team handoff. A handoff transfers understanding: market, financials, thesis, open diligence questions. The packet authorizes one act: contact. It therefore carries only the evidence needed to decide whether the act is justified now: the mandate criteria matched, the source and date of each, unresolved questions, any disqualifier found, and the date of the latest freshness check.

Freshness is a real risk because business and role data age. The US Bureau of Labor Statistics (BLS) reported median tenure with the current employer of 4.1 years in January 2026 ^[17], and 20.6% of wage and salary workers had a year or less of tenure ^[17]. These figures cover employees broadly, not owners, so they are an indicator of role-data churn rather than a decay rate for owner records. For owners the better indicator is the business itself: the US Small Business Administration (SBA) Office of Advocacy reports that the five-year survival rate of new employer establishments was 49.2% ^[18]. A role claim captured months ago on a company website should be re-checked before approval, and the packet records when.

Change 4: Run pre-send checks as explicit questions

Seven checks precede any approval request:

• Prior relationship: has anyone at the firm or its portfolio dealt with this person or company?
• Firm or client conflict: does a fund, client or portfolio company have an interest that changes whether contact is appropriate?
• Duplicate outreach: is another team already in contact, or has it been recently?
• Suppression and objection lists: does any list, in any tool, hold a match?
• Geography: where is the recipient, and which policy applies?
• Contact-channel eligibility: is the proposed channel permitted for this recipient type?
• Counsel-approved policy: does a current, versioned policy cover this jurisdiction and channel?

The first four are internal facts. The last three depend on law and are covered in the next section. The packet does not publish a universal legal rule. It asks the jurisdiction question and routes to a mandatory legal review branch whenever the answer is uncertain.

Internal conflicts deserve the same discipline as external law. The SEC's 2003 compliance rule release said an adviser's policies should address allocation of investment opportunities among clients ^[19], and a 2020 SEC examination staff alert said an adviser must eliminate conflicts or make full and fair disclosure of them ^[20]. These are adviser-level duties, cited only for the principle that the conflict check belongs before the contact.

Change 5: Make human approval specific and perishable

Approval is a signed act with five attributes, stored as a versioned record:

• Named approver: one accountable person, never the preparer.
• Approved scope: the person, channel and purpose, and nothing broader.
• Expiry date: the approval lapses on a stated day.
• Allowed follow-up count: a fixed number, which may be zero.
• Exact outreach owner: one named person who carries out the contact.

A change to the recipient, a material fact, or the channel does not amend the approval. It voids it and returns the packet to review.

Separating the preparer from the approver is a familiar control design: the person who assembles the evidence is not the person who authorizes the act, and the record shows what was approved, when, by whom and with what outcome.

Change 6: Treat response and objection as a propagation problem

After a response, objection or opt-out, three things happen in order:

• Stop: halt contact on every channel the sender controls.
• Record: write a suppression entry with minimal matching data.
• Propagate: push the entry to every vendor and tool that can send on the firm's behalf, and confirm receipt.

The ICO advises suppressing rather than deleting in most cases ^[7], because a suppression list lets a team check any new list against it ^[7]. The ICO says neither data protection law nor the Privacy and Electronic Communications Regulations (PECR) require a suppression list, so the packet treats it as an operating control.

Responsibility does not move to the tool: the FTC says hiring another company to handle email marketing does not remove the sender's legal responsibility ^[1]. The audit step therefore compares approved contact against actual contact and confirms that the objection reached every system.

Jurisdiction Questions Counsel Must Answer

The packet asks questions, not answers. Law and guidance differ by recipient location, entity type and channel, and this report does not state a universal rule. Table 1 summarizes what the primary sources say and the question each raises for the packet.

Table 1. Jurisdiction and channel questions, with source statements (as of October 2026)

Table 1 should be read as a prompt list, not a rule set. Three patterns stand out:

• The public business email shortcut is unsafe in several regimes. Canadian law conditions implied consent on both the absence of a refusal and role relevance, and the ICO says an individual's personal data being public does not mean agreement to direct marketing ^[3].
• Entity type changes the answer. In the UK, a sole trader receives individual treatment, so the same business-looking address can call for a different answer than it would for a company.
• The guidance itself is in motion. The ICO's business-to-business page carries a notice that it is under review because of the Data (Use and Access) Act.

The higher PECR fine ceiling of £17.5 million or 4% of global turnover is announced on one ICO page ^[26] while another ICO page still lists £500,000 ^[27], an inconsistency this report does not resolve. A packet that points to a dated, counsel-approved policy, instead of reciting a rule, survives that kind of change.

Mailbox-provider requirements sit beside the law. Google's FAQ says transactional messages are excluded from the one-click requirement ^[5], and that bulk-sender status, once reached, is permanent ^[5]. It recommends fulfilling unsubscribe requests within 48 hours ^[5], while Yahoo's published guidance says to honor unsubscribes within 2 days ^[28]. Because Gmail's one-click rule is conditioned on volume and on message category, it does not apply as a blanket rule to every one-to-one email. A team that sends low volumes of individually written mail still faces the law, and still benefits from authenticated domains ^[4], but should not describe provider thresholds as legal requirements.

Implementation Considerations and Process Changes

The packet fields

Table 2 lists the fields of the one-contact packet. The structure is intended to be copied into a spreadsheet, a case-management tool or a research platform. Each field has a blocking rule, meaning the condition under which the packet cannot advance.

Table 2. One-contact approval packet fields

Table 2 is the reference asset: a record in which every blocking rule can be evaluated by a person other than the preparer. The structure follows the logic of record-keeping duties that already exist for advisers. The SEC's books and records rule requires registered advisers to "make and keep true, accurate and current" specified records ^[29] and generally to preserve them for not less than five years ^[29]. A separate rule requires written compliance policies ^[30] reviewed at least annually ^[30]. Whether a given firm is a registered adviser, and which records the rules cover, are questions for counsel. The cited text shows the pattern to match: current, accurate, retrievable, reviewed.

Retention and minimum necessary evidence

A tension runs through the workflow. The packet should retain enough to prove why a contact was or was not approved, and the suppression list should retain enough to honor an objection, but data protection principles push the other way. The ICO says held personal data should be reviewed regularly, with data that is no longer needed deleted or anonymised ^[31]. The UK GDPR sets no fixed retention periods, so the organization must decide and document them. Suppression entries should hold just enough to match future lists ^[7]. The ICO's absolute right to object to direct marketing, stated without grounds to refuse ^[3], means an objection from a named individual is never a judgment call.

In practice this yields two retention tiers:

• Full packet: retained under the firm's records policy for the period counsel specifies.
• Suppression entry: retained as a minimal matching key (normalized address or number, candidate ID, date, channel, reason code).

The retention periods themselves are policy decisions that this report does not set.

Decision table

Table 3 maps conditions to outcomes. It is the quick-reference version of the gate, and it includes the five failure cases examined later.

Table 3. Decision table and failure cases

The table is deliberately conservative: ambiguity produces a hold, and a prior objection produces suppression with no discretionary override at the preparer level. A hold is cheap to resolve, and an unsupported contact is not.

Process changes

Four operating changes make the packet workable:

• Split the roles. The analyst who prepares the packet does not approve it, and one named approver signs each packet.
• Make suppression a gate, not a report. The check runs at approval time and again at contact time, because lists change in between.
• Version everything. A change creates a new version, and the audit compares actual contact to the approved version.
• Keep counsel on policy, not every packet. Counsel approves country-specific policy and the legal review branch, and the packet records the policy version.

Data Analysis and Evidence

The evidence for a per-contact gate is indirect. No public benchmark measures packet completeness, and no regulator publishes a rate at which outreach is approved or suppressed. What exists is context on deal volume, owner demographics and business churn, plus the statutory parameters that make errors costly.

Market context

Bain reports that 2025 global buyout investments climbed to $904 billion, a 44% increase over 2024 ^[8], while the number of deals fell 6% to 3,018 ^[8]. Bain also puts global dry powder (committed but uninvested capital) at $1.3 trillion ^[8]. McKinsey, using PitchBook data, reports that PE deal value rebounded 19% to $2.6 trillion in 2025 ^[32]. The two series use different scopes, so the figures should not be compared directly. Bain's mid-year 2026 report adds that investment committees have pulled back ^[33]. Capital is plentiful relative to the number of deals, so origination teams are under pressure to find targets early, which is when contact discipline either holds or erodes.

Owner and business population

The SBA Office of Advocacy counts 36,207,130 small businesses in the United States, of which 6,395,635 (about 17.7%) have paid employees ^[18]. These counts are from 2022 data published in February 2026. Most small businesses have no employees, so a broad contact list will include many entities that are not plausible acquisition candidates, and the mandate-fit field exists to screen them. The data say nothing about whether any individual owner intends to sell, which is why the packet forbids inferring intent.

Data-age indicators

The BLS reports median employee tenure of 4.1 years ^[17], and new employer establishments survive two years at an average of 67.7% ^[18] and five years at 49.2% ^[18]. Neither is an owner-record decay rate, and no public source supplies one. They justify a freshness date on every role claim.

Statutory parameters

Penalty ceilings explain why counsel review is part of the gate. The FTC page states a CAN-SPAM maximum of up to $53,088 per separate email ^[1], with a page note that the amount was edited in January 2024 for inflation, so the current figure should be confirmed. Canada's statute sets a maximum penalty of $1,000,000 for an individual and $10,000,000 for any other person per violation ^[34]. The ICO announces PECR fines of up to £17.5 million or 4% of global turnover, though another ICO page still states £500,000. These are statutory ceilings, not typical outcomes, and they are cited only to show the stakes that policy review addresses.

Audit calculation

The optional audit uses simple ratios. Hypothetical Example: over one quarter, a firm reviews 40 packets. The reported figures are:

• Completeness rate: 34 of 40 packets have every required field, so 34 / 40 = 85.0%.
• Approved: 18 packets (45.0% of reviewed).
• Held: 12 packets (30.0%), including the 6 incomplete packets.
• Suppressed: 10 packets (25.0%).
• Expired: 3 of the 18 approved packets lapsed unused (3 / 18 = 16.7%), reported separately.
• Approved versus actual contact: of the 15 approved packets that were used (18 less the 3 that expired), 14 contacts matched the approved person, channel and window (14 / 15 = 93.3%), and one contact outside the window was flagged for process review.

Outcomes are reported as separate counts, not as one score. These are fictional illustration numbers, not benchmarks. They are not conversions and not evidence of legal compliance, and no outcome should be described as a deal or an indicator of owner interest.

Case Studies and Real-World Examples

No public case study documents a PE firm's per-contact approval record, and this report does not describe any real engagement. The examples below are fictional and labeled as such.

(Hypothetical Example) A complete packet that is approved

Fictional candidate: Harbor Ridge Fabrication Ltd (internal ID TGT-0001), a metal fabricator. Registry check finds one matching company number and the registered name matches the brand on the company website. The proposed contact, Dana Whitfield (fictional), is listed as managing director on the company's own site and in the registry's officers list, two dated sources captured 12 days earlier. Mandate fit lists three matched criteria, each with a source and date, and no disqualifier. The suppression check against the firm's list and the vendor tool list returns no match, time-stamped. The company is a limited company, the recipient is in a mapped jurisdiction, and counsel-approved policy version 3 covers the channel. The named approver signs for one channel, one purpose, a 30-day window and one follow-up, and assigns a named outreach owner. The packet is marked approved. It makes no statement that the contact will be lawful in every respect, delivered or welcomed.

(Hypothetical Example) Five failure cases

• Same-name owner. The research finds "J. Marlow" described as owner of a fictional packaging firm. A second person with the same name owns a different firm in the same region. The packet is held until a second independent source ties the person to the legal entity.

• Acquired brand. A fictional brand, Bluegate Coatings, appears on a site that still shows the founder as owner. The registry shows the operating company now has a different parent. GOV.UK's group condition for registering a "same as" name ^[14] shows only that near-identical names can legitimately belong to related entities, which is one reason the packet resolves brand and legal entity separately. The packet is held, and the mandate-fit claim is restated against the current owner.

• Past opt-out. A fictional contact, Priya Anand, objected to a prior approach two years ago on a different team's campaign. The suppression check finds a minimal entry: normalized address, candidate ID, date and channel. The packet is suppressed. The minimal-data principle applies, and the preparer cannot lift the entry.

• Wrong jurisdiction. A fictional candidate has a US head office but the proposed contact is a sole trader based in the United Kingdom. UK guidance classes sole traders as individual subscribers ^[3], and the policy on file covers only US corporate recipients. The packet is held for the mandatory legal review branch.

• Conflicting ownership. Two fictional sources disagree: a trade directory names one owner, a registry filing names another with a different share. The registry's significant-control rule counts direct or indirect holders above 25% ^[35], so a holding structure could explain both. The packet records both claims with sources and is held. The preparer does not pick one.

Implications and Future Directions

For origination teams, contact discipline is an evidence problem before it is a messaging problem. A firm that can show, for each contact, the entity resolved, the dated role source, the suppression result and the approver is better placed than one that cannot, whatever the law in that jurisdiction requires. The packet does not remove legal risk. It puts a named person's judgment on the record.

Regulatory direction is uneven. UK direct-marketing guidance is under review following the Data (Use and Access) Act, and the ICO says separate guidance on the higher PECR fines is in development. The FinCEN beneficial ownership page states that a final rule, effective August 14, 2026, made the exemption of US-created entities permanent ^[36], and that reporting companies need not report beneficial ownership for US-person owners ^[36]. The practical consequence is that a US owner's identity cannot be looked up in a federal beneficial ownership filing, so identity evidence must come from registries, filings and the company's own statements, with corroboration. Teams should expect the legal question to keep moving and keep policy versioned, so that a change in guidance changes the packet's policy field, not the whole process.

Two operational directions follow. First, entity identifiers will matter more as sources multiply. The LEI is free to search ^[12] but is held only by entities that obtained one, so it will anchor larger candidates and leave many small private companies to state registries. Second, suppression will need to propagate across tools, and the integration between suppression storage and every sending or enrichment tool should be tested like any other control.

Limits remain. No public data measures how often per-contact gates prevent duplicate or unsupported outreach, so claims for the approach should be modest, and the audit ratios are management indicators for one firm, not benchmarks. Counsel must verify applicable law and message classification by recipient location and entity type at the time of use, and must recheck regulator and mailbox-provider pages, since several cited pages carry review notices or lack update dates.

Frequently Asked Questions (FAQs)

What belongs in a private equity owner outreach compliance checklist?

A checklist for one contact has seven pre-send items (listed under Change 4), each a question with a recorded answer and a date. The checklist supports a human decision and is not a statement that compliance has been achieved.

What is a PE deal sourcing suppression list, and what does it hold?

It is a retained record of contacts and companies that must not be approached on a given channel. The ICO describes keeping just enough information to respect preferences and notes that a suppression list lets a team screen new lists against it ^[7]. The firm decides the matching keys, which should include company and person identifiers, not only email addresses.

What does a private equity proprietary deal origination process look like with an approval gate?

Research identifies a candidate, resolves entity and contact identity, attaches mandate-fit evidence, runs pre-send checks, and submits one packet to a named approver. Bain's emphasis on a repeatable sourcing model ^[8] is consistent with recording each step. Approval authorizes contact only and does not substitute for a diligence handoff.

How should a do-not-contact list for PE outreach be maintained?

Treat it as a control with owners, timestamps and propagation: check it at approval and at contact, apply it across every vendor tool, and honor objections promptly. The FTC's 10 business day opt-out standard ^[1] and Canada's equivalent ^[2] are regime-specific limits, and Google recommends 48 hours ^[5].

Is target approval before outreach required by law?

No source reviewed here requires an internal approval step for contact. The SEC rule requires registered advisers to adopt and implement written compliance policies ^[30], which is the closest regulatory analogue, and its applicability to any firm is a question for counsel. The packet is an internal governance choice.

What should an investment committee origination memo contain about contact?

This report found no institutional primary source that prescribes a memo structure for contact authorization, so none is cited. A reasonable minimum, consistent with Table 2, is the resolved entity, dated evidence of fit, open questions, conflicts and approval status. Practice varies by firm.

What does evidence-backed acquisition target research add?

It supplies the dated, sourced fields the packet requires: registry identity, role claims and mandate evidence with retrieval dates. It supplies no legal conclusion and does not predict owner interest.

Is cold outreach to business owners compliant if the email is public?

A public address does not by itself establish permission. Canadian law conditions implied consent on no refusal statement ^[2] and on role relevance ^[2], the ICO says public availability is not agreement to marketing, and CAN-SPAM has no business-to-business exception ^[1]. Counsel should classify the message by recipient location and entity type.

Conclusion

A per-contact approval packet turns a vague permission question into a record that another person can check. It asks whether one named person at one resolved entity may be submitted for human-approved contact now, and it answers with approved, held or suppressed (with an expired state reported separately), plus expiry and ownership. Law and provider rules vary by location, entity type and channel, a public business email is not blanket permission, and responsibility stays with the sender when a vendor acts.

The evidence also limits the claims. The sources describe rules and context, not the effect of any approval workflow, and no public benchmark exists for packet completeness or suppression rates. The fictional audit ratios illustrate method only. Several regulatory pages are under review, one UK penalty figure is inconsistent across ICO pages, and mailbox-provider thresholds do not apply uniformly. Counsel must verify applicable law and message classification at the time of use.

Used well, the packet is modest: a record, a gate and a log. It does not guarantee lawful or welcome contact, delivery, response or a transaction. It makes duplicate, unsupported or objected-to contact more likely to be caught by a named person before it happens.