Private Placement Memorandum (PPM): Sections and How to Share It Securely

Last updated: June 2026

Quick answer: A private placement memorandum (PPM) is the disclosure document an issuer gives prospective investors when raising capital through a private securities offering — almost always a Regulation D offering. It describes the company, the terms of the offering, the use of proceeds, and — most importantly — every material risk factor, so investors can decide on full information and the issuer earns the strongest antifraud (Rule 10b-5) protection. A PPM is legally optional for a Reg D deal sold entirely to accredited investors, but effectively required the moment a non-accredited investor joins a 506(b) offering. The cluster frame to keep in mind: a PPM discloses; the data room proves. The PPM makes the representations; the data room holds the evidence behind them — and, just as important, controls how the PPM itself is distributed: per-recipient access, dynamic watermark, one current version (a superseded PPM is a real liability), and a who-saw-what-version audit trail.

I'm Deqian Jia, co-founder of Peony, a data room company used by 5,900+ customers across M&A, fundraising, and private placements. A large share of the sensitive documents that move through our platform are PPMs — and the moment a PPM leaves an issuer's hands, how it was written and how it's distributed start working either for them or against them. Most of what's written about PPMs stops at "here are the sections." That's the easy half. The half that actually creates or destroys liability is distribution — getting the right (current) version in front of the right (qualified) investor, provably, without it leaking — and the financial exhibit investors most want to touch. That's where this guide goes deep.

This post is the PPM-document spoke of our private-placement cluster. For the offering-exemption decision (506(b) vs 506(c), general solicitation, accredited-investor verification) see Reg D Data Room: 506(b) vs 506(c); for building the room itself see How to Set Up a Private Placement Data Room; and the private placement data room hub ties the whole workflow together.

---

What is a private placement memorandum (PPM)?

A private placement memorandum is the disclosure document an issuer delivers to prospective investors when offering securities in a private placement — a capital raise conducted under an exemption from full SEC registration, almost always Regulation D under the Securities Act. Its purpose is disclosure, not persuasion: it tells an investor what the company is, what security is being offered and on what terms, what the money will fund, and every material way the investment could go wrong.

The scale of this market is large and almost entirely private. According to the SEC, issuers raised roughly $259 billion through Rule 506(b) offerings and about $16 billion through Rule 506(c) offerings in the agency's July 2022–June 2023 reporting window — capital that mostly never touches a public registration. Most of those deals were documented with a PPM.

Two terms worth pinning down up front, because they decide whether you need a PPM at all:

• Accredited investor — broadly, an individual with income over $200,000 ($300,000 jointly with a spouse) in each of the last two years, or a net worth over $1 million excluding their primary residence, or who holds a Series 7, 65, or 82 license. (Entities have their own tests.)
• Form D — the brief notice an issuer files with the SEC on EDGAR within 15 days of the first sale in a Reg D offering. You file it whether or not you used a PPM.

How is a PPM different from a pitch deck or a CIM?

People conflate the PPM with two documents it only superficially resembles, and getting the distinction wrong creates real problems.

A startup pitch deck is built to sell a forward vision and raise capital on optimism — it accentuates upside and is held to no securities-disclosure standard. A PPM is the opposite instrument: a sober, counsel-drafted disclosure document whose risk-factors section is designed to be exhaustive rather than flattering.

A CIM (confidential information memorandum) is the document people most often confuse with a PPM, and the difference is fundamental. A CIM is an M&A sell-side marketing document — it markets a whole company for sale to qualified buyers on proven, defensible numbers, and it carries no securities-law disclosure mandate because no new securities are being issued. A PPM is a securities-offering disclosure document — it offers securities to investors and discloses risk to earn antifraud protection. Different audience (buyers vs investors), different purpose (sell a business vs offer securities), different legal frame (none vs Regulation D and the Securities Act). If you want the full anatomy of the M&A document, we cover it in How to Write a CIM — but do not repurpose a CIM as a PPM or vice versa. The clean mnemonic: a PPM offers securities and discloses risk; a CIM markets a business for sale.

Is a PPM legally required for a Reg D offering?

This is the question that surprises most first-time issuers: for a Reg D deal sold entirely to accredited investors, a PPM is not legally required. Regulation D does not mandate a specific disclosure document for an all-accredited offering under Rule 506(b) or 506(c).

The nuance that matters: the moment a single non-accredited investor participates in a 506(b) offering, Reg D requires you to furnish specified disclosure — financial statements and offering information — to those non-accredited investors, and the PPM is the standard vehicle for delivering it. So for a 506(b) deal that includes non-accredited investors, a PPM becomes effectively required. (506(c) offerings, by contrast, must be sold only to verified accredited investors and may use general solicitation — that decision is covered in our 506(b) vs 506(c) guide.)

Even when it's optional, experienced issuers and securities counsel almost always produce one anyway, for one reason: the PPM is your strongest antifraud shield. Under Rule 10b-5 and the broader antifraud provisions, you are liable for material misstatements and material omissions in connection with the sale of a security. A complete PPM with a thorough risk-factors section is the cleanest record that you disclosed the material facts. The right way to think about a PPM isn't "a formality I might skip" — it's liability protection you write for yourself.

What are the standard sections of a PPM?

There's no single legally mandated format, but a stable section order recurs across well-drafted PPMs. Here's the canonical backbone, with what each section is for:

The front matter (the cover legends) and the risk factors carry the legal weight; the business and financial sections carry the investment case. Have your securities counsel own the cover legends, the risk-factors section, and the description of securities — those are where liability is won or lost.

Why is the risk factors section the most heavily lawyered part of the PPM?

Because it's where the PPM does its real legal work. Under Rule 10b-5, an issuer is liable not only for false statements but for material facts it fails to disclose. The risk-factors section exists to surface every material risk so no investor can later claim they weren't warned:

• Business and market risks — competition, customer concentration, execution, key-person dependence.
• Financial and liquidity risks — cash runway, leverage, the possibility of needing more capital on worse terms.
• Risks of the securities themselves — illiquidity, transfer restrictions, no public market, subordination, dilution.
• Conflicts of interest — related-party arrangements, sponsor economics, allocation conflicts.
• The blunt one — that an investor could lose their entire investment.

Securities counsel drafts this section to be specific to your company rather than generic (boilerplate risk factors are weaker protection), comprehensive rather than flattering, and consistent with everything else in the document — because a risk that's contradicted by an optimistic claim elsewhere in the PPM is worse than no disclosure at all. The discipline is the inverse of marketing: everywhere else you make the case; here, you and your lawyer imagine every way it fails and write it down.

How do you distribute a PPM securely to investors?

This is the half of the PPM story that gets neglected, and it's where issuers create avoidable exposure. Never email the PPM as a loose attachment. An emailed PDF can be forwarded to anyone — competitors, unqualified recipients, people who were never part of the offering — and you lose all visibility into where it went. That undercuts both the confidentiality the cover page promises and the controlled-offering posture Reg D assumes.

The controlled workflow is to distribute the PPM through a data room with per-recipient access. The mechanics that matter:

• Per-recipient access, not a shared link. Each prospective investor gets their own access, so you know exactly who has what — and can cut one off without affecting the rest.
• Gate before the PPM is visible. Require a signed NDA and, where you want it, a pre-qualification questionnaire and email identity verification before the document opens. This is how you collect and log the evidence of who you let in.
• Dynamic watermark on every page. Each investor's view carries their name, email, and a timestamp — a forwarding deterrent and a forensic trail if a copy ever surfaces where it shouldn't.
• Screenshot protection and instant revoke. Block desktop screenshots, and revoke a single viewer's access the instant a conversation ends or a recipient turns out to be unqualified.

On Peony, dynamic watermarking, screenshot protection, granular per-file permissions, and single-viewer instant revoke are on the Data Room plan ($52/admin/month); NDA gating, link-level revoke, e-signatures, and analytics are available from the Business plan ($30/admin/month).

One honest caveat, because it's the line issuers most often get wrong: a data room can collect and log the evidence — the signed NDA, the questionnaire responses, the verified email — and gate access behind it, but it does not verify accredited-investor status for you. That determination stays with the issuer and securities counsel. (For a 506(c) raise, where accreditation must be verified, see the verification discussion in our 506(b) vs 506(c) guide — including the March 12, 2025 SEC no-action letter that added a high-minimum-investment-plus-written-representation verification path.)

How do you share the offering's financial model without it dying in a PDF?

The offering's financial model — your projections, the sources-and-uses, the return math behind the terms — is the exhibit sophisticated investors most want to interrogate, and it's the one legacy data rooms handle worst. They flatten every upload to a static PDF, so the model arrives dead: no working formulas, nothing to interrogate. The issuer then ends up emailing the real .xlsx so an investor can "play with the assumptions" — which is precisely the uncontrolled, un-watermarked leak the data room was supposed to prevent.

Peony renders an Excel model as a live, interactive spreadsheet right in the browser — the formulas compute, so an investor can change an assumption and watch the outputs move, a Google-Sheets experience inside the room with no download and no emailed file. For a fully bespoke model you can also publish it as an HTML artifact, which Peony renders live with the JavaScript executing (the same capability that runs interactive, AI-generated artifacts in place). Both paths stay wrapped in the full control layer — dynamic watermarking, screenshot protection, per-viewer permissions, and instant revoke. Two concrete wins for a PPM:

• One version of the truth. There's exactly one current model in the room, so no investor can circulate a stale copy from their inbox.
• Show outputs, hide the secret sauce. Publish a version with the proprietary assumption tabs excluded — investors see returns and sensitivities, not your full underlying logic.

This is the clearest functional gap between Peony and convert-to-PDF incumbents, and it lands on exactly the document an investor most wants to touch before they subscribe.

How do you keep every investor on the current version of the PPM?

A quiet but real liability: if you amend the PPM mid-raise — a changed term, a corrected figure, a new risk factor — and an investor subscribes based on a superseded version still sitting in their inbox, you've effectively made an offering on outdated disclosure. That's the exact material-misstatement exposure the PPM was meant to close. Emailing PDFs makes it nearly inevitable, because every old version keeps living in every recipient's mailbox indefinitely.

Distributing through a data room fixes this structurally:

• One current PPM in the room. Swap in the amended version and every investor immediately sees only the current one — no stale copy floats around, because no file was ever emailed out.
• A who-saw-what-version audit trail. You get a per-investor, per-version record of who opened which version of the PPM, and when. If a dispute ever arises about what an investor was shown before subscribing, that log is the evidence you'll want — and it's a record an emailed-PDF process simply cannot produce.

When an investor is ready to commit, the same room captures the e-signature on the subscription agreement and the investor questionnaire, so the commit step lives inside the controlled environment too — not in a separate, unlogged email thread.

What does a PPM cost, and who should write it?

A PPM is drafted by securities counsel — this is not a do-it-yourself document. The risk-factors section, the cover legends, and the description of securities are exactly where legal liability is won or lost, and a template pulled off the internet is weaker antifraud protection than a PPM written specifically for your company and your offering.

• Cost varies widely with deal complexity and firm. A custom PPM from securities counsel commonly runs into the low five figures and up; simpler, standardized offerings sit at the lower end, while complex multi-class or fund offerings cost more.
• Timeline: the drafting itself is typically a few weeks, but the binding constraint is usually the issuer — assembling clean financial statements, the cap table, and the use-of-proceeds detail counsel needs is what stretches the calendar.

The useful way to frame the spend: the PPM is one of the highest-leverage documents in the entire raise — it's both the instrument that lets you offer the securities and your primary record of having disclosed the material facts. Under-investing in it is a false economy.

The bottom line

A private placement memorandum is a disclosure document, not a marketing one: it offers securities, sets the terms, and — through an exhaustive risk-factors section — earns the issuer antifraud protection under Rule 10b-5. It's legally optional for an all-accredited Reg D deal but effectively required once a non-accredited investor joins a 506(b) offering, and most serious issuers produce one regardless because it's the cheapest liability protection they can buy.

But writing a clean PPM is only half the job. A PPM discloses; the data room proves. Distribute it per-recipient behind an NDA and pre-qualification — never as a loose email — watermark every page, keep exactly one current version so no one acts on a stale draft, share the financial model live instead of as a dead PDF, and keep a who-saw-what-version audit trail. That's the workflow that turns a well-drafted PPM into a defensible one.

See Peony for fundraising → · Start a data room →

---

Related resources

• Private Placement Data Room (Hub) — the full private-placement workflow this PPM spoke sits under
• Reg D Data Room: 506(b) vs 506(c) — the exemption decision, general solicitation, and accredited-investor verification
• How to Set Up a Private Placement Data Room — building and structuring the room itself
• How to Write a CIM — the M&A sell-side document a PPM is often confused with (different document, different rules)
• Peony for Fundraising
• Peony Pricing