Richard W. Porter, P.C.

Data analytics technology has now matured to a point where companies should consider how to harness it for enhancing compliance around their corporate financial and sustainability disclosures.~~I.  INTRODUCTION AND SCOPE~~As computing technology develops at a mind-boggling pace, companies are thinking more creatively about how to leverage data science and analytics, including through the use of artificial intelligence (AI) (collectively, data analytics technology) across their operations. This alert provides guidance and recommendations regarding one specific area where clients should consider this technology: managing and mitigating compliance risks associated with the company’s public financial and sustainability disclosures.~~We first provide some background on data analytics and artificial intelligence. Second, we provide a brief overview of the extent to which large market capitalization (large-cap) companies are using data analytics technology. We also discuss how companies are leveraging AI for specific objectives and how regulators are thinking about and employing data analytics technology. Third, we highlight specific risks associated with public disclosures, filings, and other statements, and present some ideas for how companies can use data analytics technology to mitigate those risks. We also discuss the risks companies may face through activism and litigation because of how third parties are using these technologies.~~We provide four recommendations for companies to consider—or consider further—as they seek to better manage disclosure risks by using data analytics technology. These recommendations include ways in which companies may leverage both traditional data analytics tools[1]—which often require data scientists manually to compile and examine reports—and tools incorporating machine learning and AI capabilities[2] such that portions of the analysis may be automated.[3] Broadly, these recommendations are centered around using data analytics technology to more proactively:~~These recommendations are intended at a high level and many of them may be implemented using either traditional data analytics tools or AI capabilities. Moreover, AI and the legal frameworks governing its development and use are rapidly evolving, and, while the information in this alert is accurate as of the date of its writing, we are confident that subsequent developments will warrant continued evaluation of the relevant factual, technological, and legal landscape. Ultimately, the purpose of the discussion and recommendations below is to assist companies as they consider how to use these tools to enhance compliance around the company’s public financial and sustainability disclosures.~~II.  RELEVANT TECHNOLOGY AND RELATED CONSIDERATIONS~~Data analytics (sometimes referred to as “data science” in the technology and academic sectors) involves the collection, transformation, and organization of data in order to draw conclusions, develop predictions, and support informed decision-making. Data analytics relies on data mining, data cleansing, data transformation, and data modeling to describe, predict, and improve performance. In the business context, data analytics has become an increasingly important tool for analyzing and shaping business processes, improving decision-making, and driving business results.~~Broadly speaking, data analytics is commonly used in several ways:~~Data analytics can be manual or automated, with automated processes relying on computers to generate results more efficiently, cost-effectively, and with minimal need for human intervention.~~A recent example of non-AI data analytics tools that impact public companies is the Securities and Exchange Commission’s (SEC’s) Earnings Per Share Initiative, which uses “risk-based data analytics to uncover potential accounting and disclosure violations caused by, among other things, earnings management practices.”[8] Unlike other initiatives that focus on re-running financial data, the EPS initiative is using data analytics and other tools to uncover evidence of manipulation in reporting.[9] Although relatively simple compared to generative artificial intelligence (GAI), these data-based approaches can reveal large-scale manipulation due to human error (e.g., investigators review data to ensure that the proper ratio of the numeral “4” appears in data, as human manipulation tends to leave out the number 4, due to a tendency to round up or down).[10] Academic research on earnings management and accounting fraud has applied such methods or concepts to detect fraud by, for example, drawing correlations between CEO/CFO driving records and propensity for ostentatious lifestyles.[11] Regulators and analysts are using the methods developed in these papers to detect accounting fraud earlier and, according to the SEC’s latest budget request, it plans to put even more effort into developing its AI capabilities.[12]~~AI is a technology through which various computing and analytics tasks can be automated. “An AI system is a machine-based system that is capable of influencing the environment by producing an output (predictions, recommendations or decisions) for a given set of objectives. It uses machine and/or human-based data and inputs to (i) perceive real and/or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (e.g., with machine learning), or manually; and (iii) use model inference to formulate options for outcomes. AI systems are designed to operate with varying levels of autonomy.”[13] For example, AI systems can be used to automate any of the four types of data analytics described above. AI systems can be designed to automatically analyze data, identify issues, propose solutions, and predict how a solution will work. With that information in hand, human decision-makers can decide whether or not to take a proposed course of action. AI systems can also be designed to be fully automated. That is, once an AI system has identified a problem and proposed and tested a solution, it can decide whether to implement the solution without human intervention.~~To be able to propose and test solutions to complex problems—and even take independent action—an AI system relies on training models that consume and process vast amounts of data. The lifecycle of an AI system involves several phases: “i) ‘design, data and models’; which is a context-dependent sequence encompassing planning and design, data collection and processing, as well as model building; ii) ‘verification and validation’; iii) ‘deployment’; and iv) ‘operation and monitoring’. These phases often take place in an iterative manner and are not necessarily sequential.”[14]~~III.  GENERAL USE CASES FOR ANALYTICS IN THE COMPLIANCE SPACE~~Although companies are rapidly adopting data analytics technology, its use for managing risk and compliance has lagged somewhat. Deloitte conducted a recent study of large-cap companies by surveying members of the Society for Corporate Governance.[15] The study found that nearly half of all respondents reported that the use of AI tools was neither expressly permitted nor prohibited within their company. However, among large-cap respondents, only 25% reported that the use of AI tools is simply not addressed by company policies, with 36% of large-cap respondents reporting that they allow for AI use for specific purposes, and 14% of large-cap respondents permitting use for any purpose.[16]~~Among large-cap respondents, 17% reported that they do not currently have any AI use framework, AI policy, or AI code of conduct in place, while 47% are “currently considering” implementing such policies and frameworks.[17] Notably, among all respondents (including mid- and large-cap), only 13% have specific AI-related policies or frameworks in place.[18] However, 57% of large-cap respondents are currently considering revising corporate policies (including privacy, cyber, risk management, etc.) to address the use of AI.[19]~~Although AI use cases span many industries, the current focus of AI-related attention (including usage, strategy, impact, disruption, competitive advantage, and risk) for large-cap respondents was focused primarily on sales/marketing (55%), product development (48%), legal (42%), human resources (36%), risk (30%), and finance/accounting (21%).[20]~~With respect to internal company management of AI, responsibility is primarily delegated to IT/tech (56% of large-cap respondents), a cross-functional working group (47% of respondents), and legal (34% of respondents). At the board level, 25% of large-cap respondents reported not expressly delegating authority for primary oversight of AI, 19% reporting that the topic has not yet been addressed at the board level, 19% placing responsibility with the audit committee (or similar), 13% of respondents place responsibility with the technology committee, another 13% placing authority with the full board, and notably only 3% placing responsibility with the risk committee.[21]~~There is a risk that at least some employees are using AI in a way that is not on the companies’ radar. A recent survey by the Conference Board found that “56% of workers are using generative AI at work but only 26% of those respondents said their organization has a policy related to its use.”[22] This use of AI presents risks, but it also shows the promise that AI presents across a wide variety of corporate functions.~~Despite a relatively low rate of adoption of data analytics technology by large companies, smaller companies and organizations are already building such tools, especially to push for additional environmental and sustainability measures. These tools are not just novelties. They pose potential risks to companies because governments across the world are requiring the disclosure of increasingly large amounts of environmental and sustainability data. Environmental activists and large, especially European, investors are likewise demanding the disclosure of sustainability data, including human rights, supply chain, and human capital information. This disclosure of ever-larger amounts of data combined with increasingly powerful computing technology creates an ever-more-risky disclosure environment for public companies.[23]~~Some examples of tools that are publicly known include Climate TRACE, which tracks and inventories companies’ emissions in real-time;[24] GreenWatch, which compares companies’ green claims to emissions performance;[25] Datamaran, which reviews and analyzes corporate governance data to assess a company’s ESG performance and identify areas for improvement;[26] Manifest Climate, which compares companies’ data to reporting frameworks, regulations, and peers;[27] and JUST Capital, which uses AI to rank companies on the basis of “just” business behavior, emphasizing ESG factors.[28] BreezoMeter offers real-time air quality data, promoting environmental transparency and awareness.[29] ClarityAI provides sustainability data to allow users to invest, shop, and benchmark based on that data.[30] These tools create risks but also present opportunities.~~Of course, companies could consider using some of these tools, such as Datamaran or Manifest Climate, to their own advantage, especially to evaluate their compliance with complex regulations and ESG rules, and to compare their disclosures and metrics to other peers. Additionally, companies could consider using tools such as SustainLab, which provides a comprehensive platform for sustainability data management and reporting;[31] Ecogain, which uses AI to assist companies in setting and achieving sustainability goals;[32] and Turntide Technologies, which uses AI to optimize energy consumption in buildings.[33] Such tools could, for example, help companies ensure they comply with their state and federal reporting requirements.~~As companies have increasingly begun to deploy AI, the SEC has begun to consider how AI can be used to enhance its compliance and enforcement efforts. The agency describes several uses of AI in its most recent budget request to Congress, which describes the SEC’s “broader undertaking to initialize and integrate machine-learning and artificial intelligence-supporting technology, with the ultimate goal to innovate and develop usable tools for the staff that deploy predictive and information visualization models to create data analytics efficiencies, particularly in the rulemaking context, where the staff routinely receives significant and diffuse feedback from market participants during open comment periods.”[34]~~In a September 10, 2023 speech to the annual meeting of the North American Securities Administrators Association (NASAA), SEC Commissioner Mark T. Uyeda discussed some of the potential benefits of AI use, including decreased operational costs for companies and expanded access to investors.[35] Importantly, Commissioner Uyeda also discussed how AI can be used to improve compliance efforts by both companies and regulators. For companies, Commissioner Uyeda noted that they will be able to use AI to detect fraud, monitor data, flag risk indicators, and identify patterns in data much faster.[36] Such uses might reduce costs for companies, result in more accurate determinations of compliance violations, and inform decisions about whether findings need to be escalated, including to regulators and law enforcement.[37] For regulators, AI can help sift through the large volumes of data included in Exchange Act filings, for example. Regulators can use AI to evaluate those filings and identify areas of potential risk.~~IV.  RISK MANAGEMENT STRATEGIES AND RECOMMENDATIONS~~The growing use of data analytics technology by activist organizations and regulators to challenge companies’ business practices and regulatory disclosures puts pressure on companies to consider what actions they might take to implement tools of their own to respond to and preempt such efforts. We discuss four risk areas below: public disclosures and statements, activism and litigation, fraud and non-compliance with corporate policies, and misinformation about the company in news and media coverage. These risk areas intersect and impact one another. Accordingly, companies should consider how to leverage the tools discussed below across risk areas where appropriate.~~However, it is important to take all the recommendations below as intended: Not as a promotion of any particular method or product but as an encouragement to consider how data analytics technology can help a company mitigate the risks created by the increasingly data-driven scrutiny of corporate financial and sustainability disclosures.~~Public companies are required and urged to disclose large amounts of information, and those disclosures must comply with an increasingly complex array of regulatory and third-party oversight. These disclosures create the potential for hundreds of opportunities for simple human error and intentional or reckless misstatements or omissions that are always judged in hindsight. Ensuring compliance with these requirements can be challenging, even under established, longstanding regulatory regimes.~~Existing disclosure requirements present sufficient compliance risks because as noted above, the SEC has already begun proactively using data analytics technology to identify non-compliance.[38] Compliance is even more challenging when regulators adopt new disclosure requirements, which has been happening at a torrid pace. Without a clear interpretation, an enforcement track record, or guidance from courts, new disclosure rules can create significant regulatory uncertainty, increasing risk for companies required to file under the new rules. For example, the SEC’s new rules on cybersecurity disclosures for public companies significantly changed the status quo—imposing a substantial burden and introducing complexity to incident response for all public companies.[39]~~Additionally, in the coming months, the SEC is expected to finalize new rules that would require public companies to disclose in their 10-Ks a potentially expansive amount of data relating to environmental and climate risks.[40] Not to be outdone, the California Legislature recently passed two bills that will impose significant and mandatory climate-related reporting requirements for large public and private companies doing business in California.[41] The bills require annual disclosure of audited Scope 1, 2, and 3 greenhouse gas emissions and biennial disclosure of certain climate risks.[42] The European Union is also implementing several directives over the coming years that will require multinational companies to disclose environmental, social, and governance data[43] and extensive human rights impacts across their value chains.[44] These directives and rules collectively will result in significantly more disclosures and could—indeed, are intended to—heighten the compliance, investigation, and litigation risks for companies.~~There are several ways companies could use data analytics technology to assess and mitigate the risks posed by current and coming disclosure requirements. As an initial matter, companies could use some of the third-party tools described above to test their data and disclosures.[45] Companies could use existing data sets of SEC comment letters and enforcement actions to develop their own lists of SEC hot topics and trends. Companies could use data analytics technology to compare the disclosures of peer companies and compare those disclosures against their own. This type of analysis could help companies identify whether peers are handling their disclosures differently and inform changes to their disclosures if the analysis identifies gaps. Especially in uncertain or new regulatory environments, such as the SEC’s new cybersecurity reporting rules and its proposed emissions reporting rules, evaluating and learning from the disclosures of peer firms is an important way to mitigate risk. Data analytics technology can make that process more efficient and dynamic.~~Companies could also employ data analytics technology to learn from the mistakes peer companies have made with their disclosures. For example, companies could analyze SEC or Environmental Protection Agency (EPA) enforcement actions and identify the issues that triggered regulatory scrutiny. Data analytics technology could enable analysis of a vast number of relevant enforcement actions to discern key compliance errors or patterns of enforcement. Companies could also cross reference the disclosures of peer companies against SEC or EPA enforcement actions to identify which disclosures triggered investigation and enforcement.~~Looking inward to the company’s own data, data analytics technology could be used to evaluate internal controls and monitor and analyze hotline or whistleblower complaints. Similarly, companies could employ data analytics technology to analyze their own historical disclosures and compare them against current enforcement priorities and new regulations to determine what the potential risks are and what, if any, sections of the disclosures need to be updated or modified.~~Companies also can learn from financial analysts and academics, who have devised ways to identify fraudulent activity in financial statements. None of these methods are proven, but combined, analytical methods like pattern recognition, Benford’s Law,[46] textual analysis of disclosures,[47] and ratio analysis can be proactively employed to test the company’s own information. The requirement by the SEC that companies disclose much of their data using XBRL (eXtensible Business Reporting Language) format means that much of the companies’ key data is reported in machine-readable, structured data format. This makes it easier for investors and third parties to analyze,[48] but also for companies to perform their own analyses.~~Caution is warranted as companies begin to incorporate the use of these tools. Recent reporting has highlighted the shortcomings of AI when it comes to analyzing disclosures such as SEC filings.[49] Indeed, researchers have found that as of this writing, AI models are only able to answer relevant questions about an SEC filing with 79% accuracy.[50] However, the use of AI for discrete tasks that have been shown to produce accurate results and the use of non-AI data analytics on larger tasks, like the methods described above, may be valuable ways to improve a company’s disclosure review process. Moreover, it will be important to continue to monitor AI’s capabilities as the technology in this space is developing quickly.~~Companies may also be able to use data analytics technology to mitigate activism and litigation risk. Increasingly, activists and other organizations are using data analytics technology to evaluate companies’ advertisements, press releases, and disclosure documents and to compare them against actual performance, regulatory frameworks, and desired policy goals. This analysis can often result in shareholder activism, litigation or regulatory scrutiny, and reputational damage to the company.~~Climate activist organizations have taken a particular interest in this approach, leveraging a growing number of data analytics technology tools to evaluate and report on companies’ climate change and environmental activities. For example, Datamaran reviews and analyzes corporate governance data, including ESG risks and opportunities, to assess a company’s ESG performance and identify areas for improvement.[51] Climate TRACE independently tracks companies’ emissions in real time, and has been described as the “world’s first global emissions inventory.”[52] GreenWatch contrasts companies’ green or sustainability claims against their actual emissions performance, and has been advertised as AI to detect “greenwashing.”[53]~~Another existing tool is provided by Manifest Climate, which compares company data to reporting frameworks and regulations, as well as to peers. Using a dashboard format, Manifest Climate promises to employ AI to help companies with sustainability compliance and strategy. Specifically, the tool is designed to help companies “identify their climate-related risks and opportunities, track peer action and market trends, and provide better disclosures aligned with global reporting standards and frameworks including TCFD, SEC, CSA, ISSB and more.”[54] It promises to allow companies to compare themselves to peers, identify sustainability actions the company is taking that it is not disclosing, and serve as a climate risk management solution. These offerings are examples of ways companies may benefit from AI applied to sustainability reporting. The tool, and the others discussed throughout this memo, show some of the early capabilities that third parties are likely to apply against companies’ data.~~Companies can likewise use AI to evaluate activists’ claims, employing their own analytics to evaluate and respond to allegations regarding inaccurate or misleading statements in their marketing materials, on their websites, and in their public filings and statements. This is a useful defensive tool, not just to respond to claims made in activist campaigns or shareholder engagements, but also to claims made in the media that may affect corporate reputation, trigger shareholder proposals or proxy fights, or draw regulatory scrutiny.~~Data analytics technology can also play a role in mitigating risk in specific litigation. For example, in support of claims based on misleading statements and or deceptive marketing, plaintiffs often pull statements from particular documents at particular times and use them out of context. Companies facing such a lawsuit could consider using data analytics technology to analyze those statements, support responsive filings, and build a more complete and accurate narrative. But it is critical that companies comply with court orders and any other applicable rules and requirements, including rules of professional conduct, when using AI in the litigation context and strictly avoid relying on AI-generated content for filings or strategy.[55]~~That said, the proactive use of data analytics technology is becoming more important in light of the increasing government focus on sustainability disclosures. In addition to the SEC’s efforts discussed above, the Federal Trade Commission (FTC) provides another example of increasing government scrutiny that creates risk. Under section 5 of the Federal Trade Commission Act, the FTC has the authority to “prevent persons, partnerships, or corporations” from using “unfair or deceptive acts or practices in or affecting commerce.”[56] There is a risk that a company’s public sustainability statements may come under scrutiny for being allegedly unfair or deceptive.~~For example, activists are placing particular emphasis on so-called “greenwashing” statements and are pressuring the FTC to step in. In fact, the FTC has taken some action in this area, requesting public comment on its Guides for the Use of Environmental Marketing Claims (Green Guides).[57] First issued in 1992 and most recently revised in 2012, the Commission’s Green Guides, 16 C.F.R. part 260, address the applicability of section 5 of the FTC Act to environmental advertising and labeling claims.[58] The Green Guides outline general principles applicable to all environmental marketing claims, and provide specific guidance regarding many common environmental benefit claims.[59]~~The EU proposed Green Claims Directive likewise will expand the regulatory scrutiny over sustainability claims. The directive lists actions “which are to be considered misleading if they cause or are likely to cause the average consumers to take a transactional decision that they would not have otherwise taken” and expands the lists of “commercial practices which are considered unfair in all circumstances . . . to four practices associated with greenwashing.”[60] It also imposes detailed substantiation requirements on sustainability claims.~~With respect to FTC requests for comments about rulemaking, companies could employ AI to mine the comment submissions for keywords or themes. AI may help identify instances where the company’s interests are specifically mentioned and in what context. It could also recognize patterns in the comment submissions that hone in on the issues most addressed by commenters to help focus the company’s responses on the key issues. Moreover, companies could use this approach with respect to analyzing any large agency docket or action in which they are interested, understanding the critical issues, and formulating a responsive strategy. Regardless, companies should monitor the market because these types of tools are improving in quality and sophistication.~~As a more general matter, companies can use data analytics technology both proactively and defensively to ensure that their public statements do not run afoul of these developing rules and standards. As described above, companies could employ data analytics technology to analyze and learn from the public statements of other companies, especially those of competitors. Companies could use the results to evaluate whether their public statements conform to standard practice and whether any similar statements have drawn regulatory scrutiny. More defensively, in an environment where third parties are using AI tools to analyze a company’s public statements, companies can use AI tools to run their own internal analyses of public statements prior to publication to identify and remediate any potential issues likely to be seized on by regulators, plaintiffs, or activists.~~Fraud and non-compliance with corporate policies and procedures are not new risks for companies, but as regulators increasingly employ new tools to detect fraud—as noted above—it is imperative that companies leverage data analytics technology internally to mitigate risk. Using basic structured query (“SQL”) language tools, for instance, companies are already using data analytics technology to continuously monitor and audit vast and complex data streams, looking for anomalies or behavioral patterns that may indicate fraud. SQL queries can compare data across tables and use statistical functions to identify discrepancies or outliers in data. SQL can be used to generate summary reports, which can be used to identify trends and patterns in data. Queries can also be used to analyze trends in data over time by comparing data across audits performed in different time periods.[61] Major banks already use data analytics technology to identify credit card and banking fraud and to maintain compliance with anti-money laundering and other rules, so this is an area that is relatively advanced in terms of the availability of off-the-shelf tools.[62] Some companies have been using data analytics technology to identify employee fraud and monitor for anti-corruption compliance.[63] The results can be used to guide internal investigations and to inform recommendations on how to improve internal policies and controls.~~News media reports about a company’s substantive business and compliance efforts may pose significant potential risks. News reports can serve as a trigger for government investigations, regulatory action, and lawsuits, and regulators and plaintiffs’ attorneys have been known to leverage information contained in such reports. They can also significantly impact corporate reputation and stock prices. Data analytics technology offers an efficient and automated method to comb the internet for relevant reports, articles, or statements, identify any misstatements or inaccuracies, and flag issues for decision. Such information could enable a company to quickly correct the record on inaccurate news pieces, publish responses, or address misleading statements through its public disclosures.[64]~~V.  CONCLUSION~~Data analytics technology has now matured to a point where companies should consider how to harness it for enhancing compliance around their corporate financial and sustainability disclosures. There is far more growth to come, but there are opportunities for assessing regulatory filings and public disclosures; understanding and responding to activism and litigation; addressing fraud and non-compliance with corporate policies and procedures; and identifying and combating misinformation in news and media coverage about the company and its business. As regulators, activists, and others ramp up their data-driven scrutiny of corporate financial and sustainability disclosures, companies may want to stay ahead of those efforts.~~__________~~[1] As generally understood in the technology sector, data analytics (also known as data science) is a technology-agnostic discipline in which the data collected, generated, and maintained by an organization is subjected to statistical analysis for the purposes of providing the organization with insights relevant to its operations and objectives such that it can guide decision-making and help solve other organizational problems. Data analytics can be used, for example, in product development, supply chain management, and financial modeling. Data analytics also may help to identify and mitigate legal and compliance risks, which are the focus of this memorandum. For more information, see generally, e.g., Thor Olavsrud, What is data analytics? Analyzing and managing data for decisions, CIO (June 7, 2022), https://www.cio.com/article/191313/what-is-data-analytics-analyzing-and-managing-data-for-decisions.html.~~[2] In the context of this alert, we discuss the capabilities of AI only as related to the analysis and mitigation of compliance risks, such that companies may consider that AI is not entirely distinct from data analytics.~~[3] “An AI system is a machine-based system that is capable of influencing the environment by producing an output (predictions, recommendations or decisions) for a given set of objectives.” OECD.AI Policy Observatory, OECD AI Principles overview, https://oecd.ai/en/ai-principles (last visited Oct. 2, 2023).~~[4] See Olavsrud, supra note 1.~~[5] Id.~~[6] Id.~~[7] Id.~~[8] Securities and Exchange Commission, SEC Charges Gentex and Chief Financial Officer in Connection with EPS Initiative (Feb. 7, 2023), https://www.sec.gov/enforce/34-96819-s.~~[9] See here. Silver Law Group, What To Know About The SEC’s “EPS Initiative” (June 16, 2023), here.~~[10] See Dave Michaels, SEC Probes Whether Companies Rounded Up Earnings Per Share, Wall St. J. (June 22, 2018), https://www.wsj.com/articles/sec-probes-whether-companies-rounded-up-earnings-1529699702?mod=article_inline.~~[11] David Woodcock, Accounting Fraud: Down, But

Jan 17

27 min

I.   Introduction~~In our prior update, we noted that the Division of Enforcement has maintained its aggressive, heightened enforcement agenda through an escalation of existing remedies, including increased penalties, individual bars and admissions.  That trend continued in the first half of 2023.~~A.   Active Enforcement Continues~~The Commission has so far not slowed its enforcement strategy, and is unlikely to do so in the months ahead.  In the Consolidated Appropriations Act of 2023, Congress agreed to give the Commission $2.2 billion in funding for the current fiscal year, a $210 million increase over the prior fiscal year.[1]  The Commission is planning to use the increased funding to hire 400 more staff members, including 125 new personnel for its Enforcement Division.  Of those 125 new hires for the Enforcement Division, 33 will be joining the Crypto Assets and Cyber Unit, a sub-unit of the Commission that has already seen heightened activity this year.  With a rapidly expanding workforce, the Commission could end up filing even more enforcement actions this year than the 760 it filed in fiscal year 2022—a 9% increase over the prior year.[2]~~With the funding to accomplish its goals, the Enforcement Division is bringing actions across the entire range of its jurisdiction, with special focus on some areas.  It is clear, for example, that the SEC will do all it can, short of new rulemaking, to tamp down the development of cryptocurrency markets and investments.  The SEC also continues to use broad sweeps involving technical violations against registered entities as a way to send deterrent messages and extract large fines—and then repeat those sweeps on a new round of registrants.  In the area of financial reporting and accounting, this Commission has brought a number of technical accounting and disclosure cases against issuers and individuals, and has pushed the boundaries of its own jurisdiction to bring charges relating to harassment and workplace misconduct under the guise of non-disclosure and internal controls failures.  As all administrations do, the SEC has maintained a steady diet of insider trading cases, and used some of those cases to send a message tied to its rulemaking.  The same is true in the cybersecurity area, where we now have final rules that will no doubt provide additional bases for the SEC to bring new cases.  Finally, the SEC recently awarded its largest whistleblower bounty in the history of the program—greater than the entire amount awarded in all of 2022—that evinces a program that has been wildly successful at attracting more and better tips from individuals with first-hand knowledge of potential wrongdoing.~~B.   Focus on Cryptocurrency~~Under Chair Gensler, the SEC has undertaken an aggressive enforcement campaign focused on crypto assets and platforms.  The current enforcement posture breaks with past Commission statements and is premised on the recently articulated view that it is “clear” the securities laws already apply to the cryptocurrency industry.  Underscoring that viewpoint, Gensler has discussed the importance to the Commission of “rooting out noncompliance [in crypto markets] through investigations and enforcement actions.”[3]  Industry participants, members of Congress, and an SEC Commissioner have criticized the SEC’s approach, so it remains to be seen whether the Commission will ultimately prevail in its current enforcement efforts.  While Chair Gensler points out that the Commission has “successfully brought or settled more than 100 cases against crypto intermediaries and token issuers,” that success has generally been in the form of settled orders.[4]  Litigated matters have sometimes had different outcomes.  For instance, in the SEC’s ongoing litigation against Ripple, the District Court for the Southern District of New York ruled that the SEC could not establish as a matter of law that a crypto token was a security in and of itself[5]—a ruling that has widely been considered a “landmark legal victory for the cryptocurrency industry.”[6]  Judge Rakoff’s recent decision in SEC v. Terraform Labs agreed with this aspect of the Ripple ruling, although that decision rejected Ripple’s distinction between institutional and secondary-market purchasers in assessing whether a securities offering took place.[7]  There is no doubt this area will develop further in the coming months.~~C.   Rulemaking Barely Slows Down~~The last six months have also seen a continuation of this Commission’s rapid pace of rulemaking.  Over the past year, the SEC has promulgated new rules at a scale and breadth that is close to last year’s record-breaking pace.  The proposed and final rules have significant implications for registrants, issuers and market structure.  Each new rule or proposal typically exceeds 200 pages in length.  Many are explicit in their goal to increase potential liability and compliance costs.  Most remarkable about this rulemaking effort is that it lacks any Congressional imprimatur.  Notably, almost every new rule is approved over the dissent of the Republican Commissioners.  Even the Public Company Accounting Oversight Board, which is overseen by the SEC, has gotten into the act and recently issued a 140-page proposal that would drastically change current audit approaches and result in a significant expansion of auditor obligations.  The SEC’s rulemaking frenzy shows no sign of abating, and from an enforcement standpoint, each new rule is yet more fertile ground for future enforcement action.~~D.   Is Everyone Overworked?~~Putting aside the quantitative metrics of enforcement actions and rulemaking proposals, there are voices among Commission leadership arguing that the agency is trying to do too much—overregulating, over-enforcing, and overworking the staff—without taking the time to be thoughtful about its agenda.  For example, two Commissioners recently dissented from a fairly routine decision to file an amicus brief because they and their staff were not given enough time to engage in a “robust deliberative process.”  As the dissent put it: “Because the Commission has limited resources, it . . .  cannot pursue every item on its wish list all at once, but instead it must prioritize.  It is not clear to us that such prioritization is taking place.”[8]  The SEC’s frenetic pace increases not just the short-term risk of potential enforcement investigations, but also longer-term expenses and risks as increased regulation raises the burden on legal and compliance infrastructures.  More regulation and more enforcement begets higher costs of compliance and greater risks of compliance foot-faults.~~E.   Challenges to the SEC’s Home Court Advantage~~Another issue that could have lasting consequences for the SEC’s agenda:  successful challenges to the SEC’s ability to bring enforcement actions in its home court before administrative law judges (“ALJ”).  Over the past few years, the agency has seen challenges to its authority—statutorily expanded by Dodd-Frank—to bring any enforcement matter in an administrative proceeding before an ALJ.  With the simultaneous expansion of the SEC’s view of existing enforcement tools and the significant increase in new, highly technical rules and regulations, the SEC’s ability to bring all manner of claims before an ALJ ratchets up the risks for registrants, issuers, and individuals.  But as things stand right now with challenges to ALJs, the SEC is filing contested matters only in federal district court.  So for now, those who are willing to litigate against the SEC will have the right to an Article III judge, a jury, greater access to discovery, and the Federal Rules of Civil Procedure—if they challenge the SEC in court.~~II.   Commissioner and Senior Staffing Update~~As reported in our 2022 Year-End Alert, the Commission was back to its full strength with five commissioners as of July 2022, and that remains unchanged through the first half of 2023.  That said, there continued to be significant changes in the senior leadership of the regional offices, as well as several changes at the national level.~~III.   Aggressive Enforcement~~A.   “Attention-Grabbing” Sweeps~~The Commission has increasingly favored enforcement sweeps over the course of the last few years—i.e., tackling multiple similar enforcement actions at the same time, and not in a piecemeal fashion.[14]  In fact, the Commission has carried out at least 65 enforcement actions since 2021 that first arose out of an enforcement sweep, imposing over $1 billion in penalties in the process.  Most of the offenses targeted in these sweeps share a few common characteristics: (1) investment advisers or broker-dealers (i.e., the institutional actors that the Commission directly regulates) allegedly committed the targeted offenses; (2) the targeted offenses were all strict liability or simple negligence violations; (3) the alleged facts were all relatively uncomplicated in nature; and (4) the Commission primarily sought “uniform remedies such as censures, cease-and-desist orders, penalties, and undertakings,” and not individualized remedies such as disgorgement.~~Gurbir Grewal, the Director of the Commission’s Enforcement Division, has repeatedly emphasized the Commission’s commitment to an enforcement strategy based on conducting enforcement sweeps.  Calling the sweeps a “powerful tool,” Grewal has said that the Commission often uses the sweeps because they have “much more of an attention-grabbing deterrent effect than doing these cases serially.”[15]  Quickening the pace of investigations through the use of sweeps is, according to Grewal, an important aim of the Commission, and the number of sweeps is therefore likely only to grow in the months and years to come.~~B.   Sweeps Can be Repeated~~As we wrote in our 2022-year end update, the Commission obtained over $1 billion in settlements from fifteen broker-dealers and one affiliated investment advisers last year for not retaining business related communications on personal devices.  As foreshadowed, the Enforcement Division’s subsequent sweeps included a focus on investment advisers.~~Early this year, the Commission began asking some of the country’s largest investment advisers to undertake a self-review of whether their employees had communicated about firm business using unapproved channels.[16]  The category of records that investment advisers are required to maintain is narrower than the broker dealer communications that were the main target of Commission’s first sweep.  (Certain records required under the Commodity Exchange Act were also implicated in the 2022 sweeps.)  Under Exchange Act Rule 17a-4(b)(4), broker dealers have to retain “all communications . . . relating to [their] business as such” while Investment Advisers Act Rule 204-2(a)(7) generally requires investment advisers to retain only communications recommending investments, recording a receipt or disbursement of funds or securities, or placing orders.  It remains to be seen how the Commission intends to apply the record-keeping requirements of the Advisers Act to the subject communications.~~Separate from the second sweep targeting investment advisers, in May 2023, the Commission announced twin settlements with two dual registrants (broker dealers and investment advisers) who had self-reported—in response to the Commission’s publicly announced encouragement in December 2021.  The firms agreed to pay penalties of $15 million and $7.5 million, respectively—well below the fines in the first sweep, but still well above the fines in prior recordkeeping settlements.[17]  More important, the settlements provide no visibility into the benefits the firms received from self-reporting.~~In June 2023, the Commission settled with a dual registrant for violation of the recordkeeping regulations when it mistakenly deleted almost 50 million communications that the registrant’s archive vendor said would be maintained.  The firm agreed to pay a $4 million fine.[18]  According to the Order, the firm self-reported the violation to the Commission in January 2020.~~Meanwhile, FINRA fined a registered representative $15,000 and banned her from working with any FINRA member for fifteen months on allegations that she sent client documents by text using a personal device and then made false statements to investigators from her employer and FINRA.[19]~~Putting aside the risks of enforcement investigations, registrants should also anticipate questions about electronic recordkeeping and off-channel communications by employees in the context of routine compliance examinations.  The Examination Priorities Report for 2023 foretells a concentration this year on registrant compliance and supervisory programs about electronic communications related to firm business.[20]~~C.   Focus on Cryptocurrency~~As previewed above, Chair Gensler has discussed the importance to the Commission of “rooting out noncompliance [in crypto markets] through investigations and enforcement actions.”  These actions typically involve alleged failures to register as broker-dealers, exchanges, or transfer agents and as to products with the Commission, and/or for allegedly misleading investors.[21]~~Industry participants, members of Congress, and an SEC commissioner have criticized the SEC’s approach.  In April, members of the House Financial Services Committee questioned Chair Gensler about the SEC’s impact on the crypto industry.  The Committee’s Chairman, Rep. Patrick McHenry (R-NC), noted that Gensler’s “[r]egulation by enforcement is not sufficient nor sustainable.”  The problem, according to McHenry, is that Gensler is “punishing digital asset firms for allegedly not adhering to the law when they don’t know it will apply to them.”~~Commissioner Hester Peirce has expressed similar sentiments.  In her April statement titled “Rendering Innovation Kaput,”[iii] she said: “[a] commission serious about regulating — and not destroying — [the crypto] market would reflect on this near unblemished record of regulatory failure and do something about it.”  She added that “the Commission dismisses the possibility of making practical adjustments to our registration framework to help entrepreneurs register, and instead rewards their good faith with an enforcement action.”  Among other things, critics of the current enforcement approach question the extent of the Commission’s statutory authority in this area and object to its failure to first adopt rules setting forth clear standards and feasible registration requirements.~~It remains to be seen whether the Commission will prevail in its current enforcement efforts.  While the Commission has touted its enforcement success—according to Gensler, the Commission has so far “successfully brought or settled more than 100 cases against crypto intermediaries and token issuers”—that success has generally been in the form of settled orders.~~During the first half of 2023, the Commission brought cases against two prominent crypto platforms, alleging that they failed to register as securities exchanges and broker-dealers.[22]  It also filed complaints against various other crypto exchanges, all for allegedly not registering with the Commission.[23]  In addition, the Commission charged a handful of individuals in connection with alleged schemes which raised more than $45 million in sales of unregistered crypto assets.[24]  In particular, the Commission alleged the respondents “falsely claimed that investors could generate extravagant returns by investing in a blockchain technology.”  The Commission has brought similar charges against high-level former FTX employees,[25] as well as others.[26]~~Litigated matters have not always gone the SEC’s way.  In June, the SEC filed settled actions against two of the country’s largest crypto platforms in the District of D.C. and the Southern District of New York.  On the immediate heels of these actions, though, the District Court for the Southern District of New York in the SEC’s ongoing litigation against Ripple ruled that the SEC could not establish as a matter of law that a crypto token was a security in and of itself—a ruling that has widely been considered a “landmark legal victory for the cryptocurrency industry.”[27]  Judge Rakoff’s recent decision in SEC v. Terraform Labs agreed with this aspect of the Ripple ruling, although it rejected Ripple’s distinction between institutional and secondary-market purchasers in assessing whether a securities offering took place.[28]~~D.   Insider Trading~~As in prior administrations, the Commission has maintained steady attention on insider trading, bringing a handful of cases in the first half of 2023.  In addition to standard tippee/tipper cases, and in a nod to the continuing work-from-home environment, the SEC announced charges against a registered representative at a New York-based broker-dealer and a compliance officer for an international payment processing company who allegedly obtained material nonpublic information from his girlfriend’s laptop when she was working from home during the COVID-19 pandemic.[29]  The girlfriend was an employee of an investment bank.  Both the broker and the compliance officer traded on this information and made combined profits of more than $750,000.  The broker also recommended the stock to his customers, resulting in profits for customers and commissions for the stockbroker.  The SEC and DOJ filed parallel actions in federal courts.~~The SEC also brought insider trading claims against a CEO for allegedly trading on the basis of material nonpublic information even though he had traded in accordance with a Rule 10b5-1 plan.[30]  Rule 10b5-1 provides an affirmative defense to insider trading where a person demonstrates that, before becoming aware of the MNPI, the person adopted a written plan for trading securities that specified the amount of securities to be traded, the price, and the date on which the sale was to occur.[31]  The Rule 10b5-1 plan must be entered into in good faith, and not as part of a plan or scheme to avoid the securities laws.  The SEC’s complaint alleges that the CEO was aware of MNPI when entering the plans and adopted the plans as part of a scheme to evade insider trading prohibitions because he knew that the company was likely to lose one of its largest customers at the time he entered the trading plans.  This case was filed shortly after the SEC issued final rules governing the use of Rule 10b5-1 plans[32] and may be another instance in which the SEC was sending a message designed to buttress its rulemaking efforts.~~IV.   Investment Adviser Industry Actions~~A.   Disclosure Failures~~The Commission continues to increase regulation of Investment Advisers, with an increased focus on the private fund market as it grows to a more than $25 trillion industry with tens of thousands of funds in operation.[33]  In May, the Commission adopted new amendments to Form PF for hedge fund and private equity advisers.[34]~~Private funds have come under intense scrutiny as the Commission pursues ever increasing levels of disclosure from funds in order to more closely regulate the market.~~In February, the Commission settled against a large religious organization and its asset management firm for disclosure failures.[35]  According to the settled order, in order to obscure the total assets under management, the asset management firm formed separate entities, allocated the religious organization’s assets among the entities and filed individual Forms 13F on behalf of the separate entities, all while maintaining control over all the equity investments.  The asset management firm and the religious organization both agreed to pay a $4 million and $1 million penalty respectively for violations of the Exchange Act for misstating information.~~The Commission’s asset management docket also included perennial Advisers Act themes, such as inaccurate valuations, erroneous fee calculations, and failure to fully disclose and mitigate conflicts of interest:~~In late May, the Commission charged an advisory firm for failure to adopt and implement adequate written policies to value assets in the managed funds.[36]  The Commission alleged that the firm’s written policies were not reasonably designed to value client holdings and assess fees leading to incorrect calculations of fees and inaccurate performance reporting.  The case was settled without admission or denial of Commission findings with a civil penalty of $275,000 and other sanctions.~~In mid-June, the Commission announced and enforcement action against an investment advisory firm for its failure to disclose material information to investors, failure to waive required advisory fees, and inadequate policies to ensure sufficient oversight of fee waivers.[37]  The firm agreed to a cease and desist order and a combined $9 million in penalties.  (For a previous Gibson Dunn alert offering more detailed analysis on this topic, please click here.)~~The Commission also brought an action against a former investment adviser for failure to disclose a conflict of interest arising from his personal relationship with a film distribution company in which the adviser’s fund had invested millions of dollars.[38]  In the course of his employment, the company allegedly helped his daughter secure an acting opportunity in a 2018 film production.  He consented to entry of the order and payment of a $250,000 penalty.~~The Commission instituted a settled action in May against two registered investment advisers for breach of fiduciary duty and compliance failures after they allegedly invested client funds in leveraged exchange traded funds (“ETFs”), despite the unique risks posed by those types of products.[39]  According to the settled order, the advisers misunderstood the riskiness of these particular products, and as a result, were unable to evaluate whether investing in them was in their client’s best interests.  The advisers settled without admitting or denying the Commission’s findings, and agreed to disgorgement, civil penalties, and other sanctions.~~The SEC also instituted a settled action against a New Jersey asset management firm and its founder for alleged improper trading of certain fixed income securities.[40]  The order found that the firm’s rebalancing trading in bonds among advisory clients resulted in an increase in the prices of such bonds at a higher rate than other similar securities.  Over time, the increase in bond values resulted in higher net asset valuation of portfolios and increased fees to the adviser.  The company and founder agreed to pay approximately $19.3 million in combined fees and penalties to settle the matter.~~B.   New Liquidity Rule~~In early May, the Commission instituted its first enforcement action against a mutual fund adviser and certain officers of the adviser and trustees of the mutual fund for violation of the Liquidity Rule.[41]  The Liquidity Rule prohibits mutual funds from investing more than 15 percent of net assets in illiquid investments.  The Commission alleged, among other things, that the parties ignored restrictions and disregarded advice to decrease the fund’s exposure to illiquid assets.  All parties resolved the allegations with the SEC, and paid a range of civil penalties and other sanctions.~~V.   Retail Wealth Management – Reg BI~~The Commission adopted Regulation Best Interest (“Reg BI”) in the first half of 2019.[42]  Reg BI sets a standard of conduct for broker-dealers and associated persons when they make recommendations to retail clients.  It requires broker-dealers to: act in the best interest of the retail customer at the time the recommendation is made, without placing the financial or other interest of the broker-dealer ahead of the interests of the retail customer, and address broker-dealer conflicts of interest with those clients.  Reg BI is understood as being composed of four component obligations: the (1) care obligation; (2) disclosure obligation; (3) conflict of interest obligation; and (4) compliance obligation.[43]~~There has been a dearth of Commission enforcement actions relating to Reg BI thus far.  By contrast, FINRA has recognized Reg BI as an enforcement priority for 2023.  Indeed, FINRA brought its first Reg BI case last September in an action alleging that a registered representative recommended an inappropriate series of transactions to one of his retail customers in order to generate commissions and trading costs.[44]~~The trend of FINRA bringing Reg BI cases has continued thus far in 2023.  In May, FINRA expelled a New York broker-dealer, and suspended and fined its CEO for Reg BI violations, among other things.[45]  FINRA found that the firm made material misrepresentations to customers in connection with the sale of risky pre-IPO securities.  In announcing the case, FINRA said “Firms . . . must reasonably surveil for, and respond to, red flags of excessive trading and churning.  When firms, particularly those with significant disciplinary histories, commit egregious sales practice and supervisory violations, expulsion from FINRA membership may be warranted.”  In the first five months of 2023, FINRA served over 150 breach of Reg BI arbitrations, representing a nearly five-fold increase compared to the same time last year.[46]~~The Commission has not brought any high-profile Reg BI cases since the one case it brought last year.[47]  However, it is expected that there will be more coming down the pike as the Commission’s Staff has now published multiple Staff Bulletins setting forth the Staff’s opinions on implementation of Reg BI.[48]  In many respects, the Bulletins depart, sometimes substantially, from the guidance issued by the Commission in the Adopting Release for Reg BI.  This Staff’s deviation from the Adopting Release heightens the ambiguity about the proper scope of a registrant’s compliance and supervisory programs that were designed to be consistent with the guidance in the Adopting Release.~~VI.   Cybersecurity~~Cybersecurity is top-of-mind at the Commission, at least in part due to high-profile data breaches and ransomware attacks that have exposed sensitive consumer information into the hands of bad actors.[49]  In February 2022, the Commission proposed new rules for cybersecurity risk management for investment advisers, registered investment companies, and business development companies.[50]  The proposals suggest a new cybersecurity risk management regime designed to both prevent attacks in the first instance and respond to them with additional disclosures.  In March, the Commission reopened the comment period on the rules and amendments.[51]  The Commission has indicated it does not plan to approve the new cyber rules until at least October 2023.[52]~~The Commission finalized and adopted a cybersecurity risk governance rule for public companies in late July 2023.[53]  The final rule imposes new reporting requirements on companies that suffer material cybersecurity incidents, raises questions concerning the scope of materiality, and requires new Reg S-K disclosures about how companies govern cybersecurity risks.  Commissioner Pierce criticized the final rule as being overly broad and reading “like a test run for overly prescriptive, overly costly disclosure rules covering a never-ending list of hot topics.”[54]  (For a previous Gibson Dunn alert offering more detailed analysis on this topic, please click here.)~~Enforcement actions relating to cybersecurity risk have continued in parallel with and in support of the rulemaking.  In March, 2023, the Commission instituted a settled action against a public company that manages donor data for non-profits, for allegedly misleading disclosures with respect to a cyber-attack that occurred in 2020.[55]  Shortly after the attack, the company publicly announced that donor bank account information had not been compromised.  The Commission alleged that the company’s quarterly statement omitted the full extent of the attack by categorizing it as a mere hypothetical possibility after they were already aware of the full impact.  The company agreed to a $3 million civil penalty to settle the charges.  The SEC settled this matter before its proposal on cybersecurity disclosure and governance for public companies had been finalized, but the message sent by the settlement was in line with many of the requirements that were proposed and could be seen to buttress those requirements, especially the governance-related aspects.[56]  We expect more cybersecurity enforcement, especially now that new rules are in place for public companies.~~VII.   Financial Reporting and Disclosure~~A.   Financial Reporting and Accounting Cases Remain Steady~~Public company financial reporting and disclosure failure cases, long seen as the bread-and-butter of SEC enforcement, have continued at a similar pace as in previous years.  There were several notable cases in the first half of 2023.~~1.   Fraud and Financial Manipulation~~The SEC filed an action against three executives at an Alabama-based shipbuilding company for engaging in a fraudulent revenue recognition scheme by manipulating cost estimates in order to allow its parent company to meet or exceed expectations.[57]  The complaint alleged that the executives artificially decreased the cost of specific shipbuilding projects by tens of millions of dollars in order to aid the parent company’s estimates for earnings before interest and tax (“EBIT”).  The case remains ongoing.~~The SEC filed an action against the founder of a student loan assistance company that was acquired by, and subsequently dissolved by a large financial services firm.[58]  The SEC alleged that the founder fraudulently enticed and sold her company after misrepresenting the amount of student data that she had.  The founder benefited from the $175 million acquisition, receiving roughly $9.7 million in stock, millions in trusts, and a $20 million retention bonus as a new employee of the financial services firm.  In addition to the SEC’s charges, parallel criminal charges were announced and are pending as well.~~The SEC filed and settled complaints against a health supplement company’s former executives with charges ranging from improper revenue recognition practices to fraud and improper disclosures.[59]  The Commission alleged that the executives inflated their quarterly revenues and gross profits.  Several executives settled charges with a range of sanctions and civil penalties, while charges against other executives remain pending.~~2.   Disclosure Failures~~The SEC settled with a leading financial news organization in connection with alleged misleading disclosures related to its subscription service.[60]  According to the order, the organization failed to disclose to customers that valuations for certain fixed-income securities could be based on a single data input despite being aware that their customers used it to decide fund asset valuations and could be inappropriately impacted.  Without admitting or denying the SEC’s allegations, the organization agreed to pay a $5 million penalty and make improvements to the subscription service.~~The SEC settled charges against a transportation company and its former CEO for their failure to disclose perks provided to the former CEO and other executives, as well as compensation the CEO received for using his own private plane for travel by company executives.[61]  The company and CEO agreed to pay $1 million and $100,000 in civil penalties, respectively.~~B.   Increasing Market Focus on Environmental, Social, and Governance (“ESG”) Strategies for Fund Managers and Public Companies~~Stakeholders and investors have increasingly incorporated ESG into their investment strategies.  Many large investment managers have committed themselves to considering ESG factors in their voting and investment decisions.[62]  Public companies have also begun to address ESG at their annual general meetings at record-high rates,[63] such as by hosting “Say on Climate” votes and votes on diversity, equity, and inclusion.[64]  Companies have also increased their voluntary reporting on ESG matters.  In fact, in 2021, nearly 100% of the S&P and 81% of the Russell 1000 published a sustainability report.[65]~~Opposition to ESG has also grown.[66]  When a large investment manager announced a position on energy investments in state pension funds, 19 state attorneys general wrote to the CEO in dissent,[67] some states issued rules limiting such investments, and other states refused to even meet with certain investment managers.  Other opponents have expressed concerns about so-called greenwashing, whereby companies allegedly overstat

Aug 7

49 min

The decision could effectively blunt the SEC’s ability to seek disgorgement for a wide range of alleged regulatory violations that do not result in financial harm to any investors.~~In a case with potentially far-reaching implications for the SEC’s enforcement program, the Second Circuit recently held that the SEC is not entitled to disgorgement unless it can show the allegedly defrauded investors suffered pecuniary harm.  The case, Securities and Exchange Commission v. Govil,[1] provides important limitations on the SEC’s ability to seek disgorgement, especially in circumstances where the allegedly violative conduct does not result in obvious “victims.”  The case provides defense counsel with persuasive authority to oppose an SEC claim for disgorgement absent proof of any harm to investors especially if all the SEC alleges is a benefit to the defendant.  The decision could effectively blunt the SEC’s ability to seek disgorgement for a wide range of alleged regulatory violations that do not result in financial harm to any investors.~~Factual Background~~Aron Govil founded and served as CEO of Cemtrex, Inc., an industrial and manufacturing technology company.  In 2016 and 2017 Govil caused Cemtrex to issue new securities based on misrepresentations concerning the expected use of the funds that were raised, which Govil then transferred to his own accounts to pay for unrelated personal expenses.  After he was caught, Govil entered into a settlement agreement with Cemtrex, which he no longer ran, and agreed to repay $7.1 million to the company by returning $5.6 million of Cemtrex securities and issuing a promissory note for $1.5 million.  In addition, Govil also entered into a consent agreement with the SEC in which he agreed not to contest a civil enforcement action that would be brought by the SEC but which left the remedy unresolved.~~After bringing an enforcement action, the Commission asked the district court to order disgorgement of approximately $7.3 million.[2]  The district court did so over Govil’s objections, concluding that disgorgement was appropriate because Cemtrex’s defrauded investors were Govil’s “real victims” rather than Cemtrex itself, and that the $5.6 million in securities that Govil returned to Cemtrex would not offset what he owed as “Cemtrex shareholders received nothing” from that transfer.[3]  Critically, however, the SEC offered no proof—and the district court made no findings—that Cemtrex’s shareholders suffered any pecuniary harm resulting from Govil’s fraud.  Govil was ordered to disgorge approximately $6 million, from which he appealed.~~The Second Circuit’s Decision~~On appeal, the Second Circuit vacated the relief ordered by the district court and remanded the matter for further fact-finding.  Applying the Supreme Court’s teachings in Liu that disgorgement “is permissible” as equitable relief only where it “is awarded for victims,”[4] the Second Circuit held that disgorgement under both 15 U.S. §§ 78u(d)(5) and 78u(d)(7) requires a finding that there were victims who suffered some financial loss.  Noting that Liu “did not explain straightforwardly what a ‘victim’ is for the purpose of awarding ‘equitable relief,’” the Second Circuit held that “a ‘victim’” is “one who suffers pecuniary harm from the securities fraud” because allowing disgorgement to benefit investors who had not suffered any damages “would be conferring a windfall on those who received the benefit of the[ir] bargain” rather than “restoring the status quo for those investors.”[5]  In doing so, the Court expressly rejected a presumption that investors have “suffered economic harm by definition when capital they invested in the company for corporate purposes [is] looted,” explaining that determining whether investors “actually suffered pecuniary harm” requires an analysis of “the type of securities held, the terms of those securities, and when those securities were sold” because defrauded investors might earn a profit on their investment notwithstanding a defendant’s wrongdoing.[6]  As the Second Circuit reasoned, Liu “emphasized” that disgorgement as “an equitable remedy is about ‘returning the funds to victims,’” which necessarily “presupposes pecuniary harm” as funds “cannot be returned if there was no deprivation in the first place.”[7]~~In reaching this conclusion, the Second Circuit also drew an important analogy between SEC enforcement actions and securities fraud actions brought by private plaintiffs.  Although the SEC need not show loss causation or economic loss to prevail in litigation, the Court noted that private plaintiffs bringing securities fraud claims under Rule 10b-5 must prove that they “have suffered ‘economic loss’” and, similarly, that “pecuniary harm is an element” of common-law fraud claims.[8]  Accordingly, the Court rejected the notion that investors who have not been shown to have suffered pecuniary harm should be allowed to receive “proceeds of disgorgement,” which otherwise “would allow the SEC to . . . circumvent the limitations on private claims under § 10(b) and the common law.”[9]  Because there was no showing that Govil had caused any such pecuniary harm to Cemtrex’s investors, that relief was vacated to allow the district court to determine in the first instance if there was any such harm, a necessary prerequisite for disgorgement to be available.~~In addition, the Second Circuit also held that the district court erred in not offsetting its disgorgement award by the value of the Cemtrex shares surrendered by Govil.  Rejecting the SEC’s arguments, the Second Circuit reasoned that “a wrongdoer returns ‘value’ for the purpose of disgorgement whenever he returns property that holds value in his own hands” and that “a defendant need not return more than the amount by which he was unjustly enriched” because disgorgement is intended “‘to prevent wrongdoers from unjustly enriching themselves’” rather than “‘to compensate victims.’”[10]~~Implications of Govil~~Going forward, by limiting disgorgement and more closely aligning it with the relief available in private securities fraud actions in which economic loss and loss causation must be proven, the SEC will be forced to more clearly identify and prove the harm suffered by alleged “victims” in many of its enforcement actions.  Although this analysis is relatively straightforward in more traditional securities fraud cases, Govil will likely result in serious questions being raised concerning the SEC’s ability to seek disgorgement in other aspects of its enforcement agenda. As the SEC moves ahead, both the SEC and those against whom disgorgement is sought will need to wrestle with Govil in areas where it is more difficult to identify victims who have suffered pecuniary harm resulting from the alleged securities law violations.~~There is a wide range of regulatory enforcement actions in which the SEC has sought disgorgement despite the absence of identifiable victims who incurred a financial loss.  Govil puts the SEC’s ability to seek disgorgement in such cases in serious question.  Consider, for example, enforcement actions alleging the offering of securities without registration.  In such cases, the SEC does not even allege that investors have been defrauded, let alone harmed.  Going forward, it would seem that Govil precludes a claim for disgorgement.  In Foreign Corrupt Practices Act cases, the SEC has historically sought disgorgement of profits allegedly earned by a company through business obtained or retained by virtue of an improper payment to a foreign official.  After Govil, the SEC likewise would be challenged to identify a victim who has suffered a financial harm.  In insider trading matters, the SEC routinely seeks disgorgement of imputed profits or avoided losses from defendants based on a differential between a trade price and a post-disclosure market price.  However, the SEC has never undertaken, nor been required, to prove that there was an identifiable victim in the sense of a defrauded counterparty to the allegedly offending trade.  And if required to meet such a burden of proof after Govil, one doubts that it could.  Suffice it to say that the SEC likely did not foresee that the aggressive pursuit of disgorgement in a case in which Aron Govil had stipulated to liability would lead to such a potentially significant adverse impact on its broader enforcement program.~~____________________________~~[1] — F.4th —, 2023 WL 7137291 (2d Cir. 2023).~~[2] The SEC sought disgorgement pursuant to 15 U.S.C. § 78u(d)(5) and § 78u(d)(7).  Although the equitable remedy of disgorgement has been used by the SEC since the 1970s, see, e.g., SEC v. Manor Nursing Ctrs., Inc., 458 F.2d 1082 (2d Cir. 1972), it was not until 2002 that Congress expressly authorized the SEC to “seek . . . any equitable relief that may be appropriate for the benefit of investors” in § 78u(d)(5).  The Supreme Court then clarified in Liu v. SEC that “a disgorgement award that does not exceed a wrongdoer’s net profits and is awarded for victims is equitable relief permissible under § 78u(d)(5).”  140 S.Ct. 1934, 1940 (2020).  Congress enacted 15 U.S.C. § 78u(d)(7) six months after Liu narrowed the circumstances in which disgorgement is permissible, expressly authorizing the SEC to “seek . . . disgorgement” without reference to any limitations that might otherwise apply to relief already available under § 78u(d)(5).  Although others courts have disagreed, the Second Circuit has previously held that the enactment of § 78u(d)(7) did not serve to undo the limitations that Liu imposed on the SEC’s disgorgement remedy.  See SEC v. Ahmed, 72 F.4th 379 (2d Cir. 2023) (“We read ‘disgorgement’ in § 78(u)(d)(7) to refer to equitable disgorgement as recognized in Liu.”)~~[3] SEC v. Govil, 2022 WL 1639467, at *3 (S.D.N.Y. May 24, 2022).~~[4] 140 S.Ct. at 1940.~~[5] 2023 WL 7137291, at *9.~~[6] Id. at *10 n.16.~~[7] Id. at *10 (quoting Liu, 140 S.Ct. at 1948, cleaned up).~~[8] Id. at *11.~~[9] Id.~~[10] Id. at *12-13 (quoting SEC v. Cavanagh, 445 F.3d 105, 117 (2d Cir. 2006)).~~The following Gibson Dunn lawyers assisted in preparing this alert: Reed Brodsky, Richard Grime, Mark Schonfeld, David Woodcock, Michael Nadler, and Peter Jacobs*.~~Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Securities Enforcement practice group, or the following authors:~~Reed Brodsky – New York (+1 212.351.5334, rbrodsky@gibsondunn.com) Richard W. Grime – Washington, D.C. (+1 202.955.8219, rgrime@gibsondunn.com) Mark K. Schonfeld – New York (+1 212.351.2433, mschonfeld@gibsondunn.com) David Woodcock – Dallas (+1 214.698.3211, dwoodcock@gibsondunn.com) Michael Nadler – New York (+1 212.351.2306, mnadler@gibsondunn.com)~~*Peter Jacobs is an associate working in the firm’s New York office who is not yet admitted to practice law.~~© 2023 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.~~Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.~~Download PDF~~

Nov 16

8 min

Lawdragon~~Thirty-two Gibson Dunn lawyers have been named to the inaugural Lawdragon 500 Global Leaders in Crisis Management list, which recognizes the “rising convergence in law practice and strategy of increased oversight in a global environment.”~~Kudos to partners Matthew S. Axelrod, Amanda M. Aycock, Matt Benjamin, Ryan T. Bergsieker, Barry H. Berke, Robert C. Blume, Michael D. Bopp, Reed Brodsky, Stephanie Brooker, David P. Burns, John W.F. Chesley, Jina L. Choi, Collin J. Cox, Lee R. Crain, M. Kendall Day, Stuart F. Delery, Mylan L. Denerstein, Michael H. Dore, Patrick Doris, Theane Evangelis, Douglas Fuchs, Brian W. Gilchrist, Richard W. Grime, Nicola T. Hanna, Sacha Harber-Kelly, Dani R. James, Christopher M. Joralemon, Michael Martinez, Karin Portlock, Orin Snyder, Maurice Suh, and Debra Wong Yang.~~~~Download PDF~~

Jun 17

1 min

The Patent Trial and Appeal Board has found that an Entropic Communications LLC television receiver patent challenged by Comcast is invalid, about a month after the board found that claims in two other patents were also unpatentable. In a Monday decision, the PTAB ruled in favor of Comcast in its challenge to all 20 of the claims in U.S. Patent No. 9,210,362. The board said that half the claims were invalid as both obvious and anticipated over an earlier patent application called Zhang that relates to digital circuitry, saying that piece of prior art alone covered the elements of those claims. As for the other claims of the '362 patent, they were invalid in light of Zhang in combination with additional prior art, including an earlier patent, a communications magazine article and two other patent applications. Monday's decision comes after two other decisions from early September where the PTAB ruled on two other communications network patents owned by Entropic. In one of those final written decisions in an inter partes review, the board agreed with Comcast that all 18 claims of Entropic's U.S. Patent No. 8,792,008 were invalid as obvious. In the second decision, the board found that Comcast had shown that 16 claims of another patent — U.S. Patent No. 8,284,690 — are invalid as anticipated or obvious, but it upheld eight other claims. Entropic has accused Comcast and Cox Communications of infringing these patents and others in separate suits in the Central District of California. The judge has agreed to stay the Comcast case until the PTAB proceedings are over, but Cox did not agree to be bound by estoppel provisions that are applicable to Comcast, so its case remains active. Entropic has asserted the two patents-at-issue in the decisions against several other TV companies in cases that have been resolved, including Charter Communications, DirecTV and Dish Network, according to the PTAB documents. The board has noted that Comcast also has challenged numerous other Entropic patents at the board. In recent months, Deputy U.S. Patent and Trademark Office Director Coke Morgan Stewart has denied many of Comcast's petitions, citing the fact that the company filed multiple petitions on the same Entropic patents. Counsel for the parties did not immediately respond to requests for comment from Law360 on Tuesday. The patent-at-issue is U.S. Patent No. 9,210,362. Administrative Patent Judges Michelle N. Wormmeester, Jon M. Jurgovan and Frederick C. Laney sat on the panel. Comcast is represented by Frederic Meeker, Michael S. Cuviello, Harry W. Porter, Paul T. Qualey and Joshua L. Davenport of Banner & Witcoff Ltd. Entropic is represented by Jason A. Engel, Erik J. Halverson, Kyle M. Kantarek and Nolan R. Hubbard of K&L Gates LLP and Kenneth J. Weatherwax, Parham Hendifar and Nathan Lowenstein of Lowenstein & Weatherwax LLP. The case is Comcast Cable Communications LLC v. Entropic Communications LLC, case number IPR2024-00432, before the Patent Trial and Appeal Board.

Oct 7

2 min