Compliance Officer Liability in SEC Investigations.

On October 24, 2023, Gurbir Grewal, the SEC’s then-Director of Enforcement, addressed the New York City Bar Compliance Institute. During his remarks, he described enforcement actions against compliance officers as “exceedingly rare,” and commented on the SEC’s approach to enforcement actions against compliance personnel. He also noted that, generally, the SEC wants to maintain relationships with compliance officers that allow them to bring in information that the SEC might find useful, and, as a result, he “committed to treating compliance personnel that are not at fault for securities law violations differently” than those who are at fault.

Mr. Grewal also noted that, “reasonable good-faith compliance work should not attract enforcement, and the vast majority of people will be in the good-faith category.” However, Grewal did not completely rule out personal liability for compliance officers, and instead listed three scenarios that may warrant enforcement action:

• “where, however, the SEC staff have reason to believe that the compliance officer has made statements to the SEC staff, or to others that are deliberately deceptive;”
• “or where it is apparent that the compliance officer has just essentially abandoned his or her duties, or in others words has not done anything;”
• “or where the SEC staff has reason to believe that the individual has intentionally committed misconduct in other capacities outside of his or her compliance responsibilities.”

Mr. Grewal indicated that, as of October 24, 2023, the SEC had not yet issued any formal inaction standard for compliance officers, although he noted that the SEC was considering doing so in the future.

For most compliance officers, being held personally liable by the SEC should be a remote concern. However, it remains imperative that compliance officers work closely with their law firms to protect themselves, and we can provide you with the insights you need.

When Does Poor Compliance Work Become SEC “Abandonment”?

Grewal’s October 24, 2023, remarks leave open a critical question: when do imperfect decisions or poor performance rise to the level of actionable inaction by a compliance officer? The SEC’s stated “inaction threshold” is a total failure to fulfill compliance responsibilities rather than merely making imperfect judgments or decisions in good faith. However, a key question is whether a compliance officer’s inaction can be judged in light of what the compliance officer knew (or should have known). As a result, an allegation of a compliance officer’s knowing or reckless (or sometimes even negligent) ignorance of deficiencies within his or her firm’s compliance program can support personal enforcement exposure for inaction. In practice, the SEC has often alleged compliance officer inaction as a result of ignoring compliance deficiencies and/or failing to pursue remediation of such deficiencies, and it has specifically addressed “failure to take any action” in both of the scenarios discussed below.

Scenario 1: Ignoring Compliance Policy Deficiencies

In May 2021, the SEC filed a complaint against an adviser firm and its Chief Compliance Officer alleging, among other things, that the firm’s compliance program failed to comply with the Investment Advisers Act’s custody rule. The complaint alleged, in part, that “the adviser’s CCO failed to take any action to correct the advisory firm’s custody rule violations for over two years-2) after their initial diagnosis, and the adviser’s CCO took no action to correct these rule violations even after the SEC has already issued an order demanding that the advisory firm rectify the deficiencies.” This scenario clearly reflects the “inaction” that Mr. Grewal indicated warranted enforcement actions in October 2023.

Scenario 2: Omitting Compliance Inquiry or Analysis

In August 2021, the SEC issued an order against a registered broker-dealer alleging, among other things, that the firm omitted from its compliance manual all statements regarding third-party custodians and omitted appropriate inquiries and analyses of those entities as well. The SEC’s order alleged that the firm’s “compliance officer did not undertake any inquiry into third-party custodians’ handling of broker-dealer customers’ assets or conduct any analysis of these custodians’ financial condition.” Again, the “omitted” and “did not undertake any inquiry” and “conduct any analysis” constitute clear examples of inaction that, together with other factors, can result in personal enforcement exposure for compliance officers.

Other Legal Defenses Against Personal SEC Liability

Compliance officers may have other defenses against personal liability for violations of the federal securities laws as well. For example, while there are allegations of inaction in many cases, documented escalation efforts can also be key to rebuting allegations of knowing or reckless (or sometimes even negligent) inaction. Additionally, compliance officers’ limited authority in certain circumstances can be a key factor to determining whether a compliance officer substantially assisted another person’s violation. Delegation is another critical compliance officer defense, and while it can not eliminate duties expressly assigned by statute, regulation-7), or the Commission’s order, it can limit personal liability under some circumstances.

What Laws Can Make a Compliance Officer Personally Liable?

To date, compliance-officer liability has predominantly arisen out of direct violations by a compliance officer, aiding and abetting the violation of securities laws by an entity or individual, or (albeit rarely) professional practice sanctions. However, Mr. Grewal’s three-category framework is not an exhaustive list of scenarios in which a compliance officer can potentially face personal liability for a federal securities law violation, but is instead “just examples of where the SEC staff might recommend that the Commission seek charges.” It is also important to remember that Mr. Grewal’s “framework” does not constitute formal Commission guidance or an official agency rule; rather, the three scenarios discussed in our preceding section came from Mr. Grewal’s October 24, 2023, speech. Compliance officers should focus on the underlying law to determine their potential personal liability and their corresponding exposures and obligations, rather than solely relying on a speech that may not reflect the same depth and nuance as the substantive federal securities laws.

Aiding and Abetting Liability

Aiding and abetting is a very common theory used by the SEC to pursue liability against compliance officers. The Exchange Act’s Section 20(e) prohibits knowingly or recklessly providing “substantial assistance” to others’ commission of a violation. For substantial assistance to lead to SEC liability for a compliance officer, however, the compliance officer must knowingly or recklessly provide substantial assistance in connection with the commission of a primary violation. While Section 209(f) of the Advisers Act also separately authorizes an SEC enforcement action for knowingly or recklessly providing substantial assistance in connection with the commission of an underlying primary violation, and Section 21C of the Exchange Act does not specifically authorize an SEC action for knowingly or recklessly providing substantial assistance, it does permit the SEC to seek liability where an individual “caused” an entity’s violation. In such cases, the SEC can seek liability against individuals where it shows that (i) the individual knew or should have known his or her conduct contributed to the underlying primary violation, and (ii) the individual’s conduct contributed (or contributed significantly) to the underlying primary violation.

Negligence-Based Liability

Generally, allegations of negligence can only support liability if the underlying statutory or regulatory provision expressly authorizes negligence-based liability. For most, this includes but is not limited to statutes or rules adopted under the Exchange Act and the Advisers Act.

Inaction as “Abandonment”

When Mr. Grewal spoke of inaction amounting to “abandonment,” that is an evidentiary characterization. As we explained in our previous section, the SEC has used inaction to support allegations of knowing and/or reckless violations of the Exchange Act and Advisers Act. However, “abandonment” itself does not provide an independent statutory cause of action to pursue against a compliance officer or any individual. As a result, the inaction mentioned in Mr. Grewal’s speech must meet the requisite level of culpability to qualify as an independent or additional cause of action. Again, that is important because a speech cannot create liability on its own; liability requires an underlying statute, rule, order, regulation, or binding undertaking.

What Happens After the SEC Begins Investigating Me?

The SEC’s enforcement staff recommends charges, and then the Commission decides whether to authorize an enforcement action. SEC investigations can include informal inquiries, formal investigations, interviews, and/or testimony, and can result in a Wells submission before Commission approval.

Informal Inquiries and Closures

In many cases, the SEC’s enforcement staff may investigate a particular matter without initiating a formal inquiry. As a result, SEC staff may then close these investigations without recommending that the Commission initiate enforcement actions against any individuals or entities.

Formal Investigations and Subpoenas

A formal investigation involves the SEC’s issuance of a formal investigation order. Once the SEC issues a formal investigation order, designated SEC officers can issue subpoenas under Section 21(b) of the Exchange Act. However, in a formal investigative proceeding, subpoenaed witnesses have certain rights. For example, under 17 C.F.R. § 203.7, subpoenaed witnesses are entitled to (among other things):

• to be shown the Commission’s formal order of investigation upon request
• to be accompanied, represented, and advised by counsel during their testimony
• to have counsel advise them before, during, and after the examination, briefly question them at its conclusion to clarify their answers, and take summary notes for their use, and
• where the record of a public formal investigative proceeding contains implications of wrongdoing by them, to appear on the record and have a reasonable opportunity for cross-examination and for the production of rebuttal testimony or documentary evidence.

Interviews, Testimony, and Wells Submissions

As a result of a subpoena or otherwise, witnesses may undergo interviews and testimony during the course of SEC investigations. The SEC also permits targeted individuals to make written submissions, in what is known as a “Wells submission,” before staff members make a recommendation to the Commission to pursue an enforcement action (17 17 C.F.R. § 202.5(c)).

Deadlines for SEC Investigations

While federal law does not establish a universal deadline for completing an SEC investigation, 28 U.S.C. § 2462 generally bars an action to enforce a civil penalty unless it is commenced within five years after the claim first accrued. However, a compliance officer’s exposure to personal liability for a violation of the federal securities laws can still exist regardless of whether any specific statute of limitations has expired.

This is the point at which most people call a lawyer. Spodek Law Group takes federal criminal defense cases nationwide from its New York and Los Angeles offices.

When Should a Compliance Officer Hire Separate Counsel?

If you are facing parallel inquiries from the SEC and the DOJ, you have simultaneous civil and criminal exposure. As a result, you need to understand defenses for each of these cases in order to protect yourself in each case. This can be especially difficult when you face your company’s legal representatives. As we discuss in our explanation of the attorney-client relationship, just because your company’s attorney communicates with you does not necessarily mean that the attorney has established a personal attorney-client relationship with you. In fact, most lawyers who represent organizations only represent the organization and not individual employees of the organization.

Additionally, if you and your company’s counsel have established an attorney-client relationship, for communications covered by the attorney-client privilege, the organization generally controls the privilege. This means that if the organization’s legal representatives think that it is in the organization’s best interests to disclose these communications to the SEC, the organization can do so, and you will generally not be able to stop the organization from doing so.

As a result, you are not entitled to representation by your company’s attorneys unless you and your company agree to joint representation. However, even then, joint representation is constrained by Model Rule 1.7, which prohibits attorneys from jointly representing clients when there is a significant risk that those clients’ interests are materially divergent.

If you have personally intervened in the company’s compliance program (or what the company calls a “remediation effort”), you may have also made substantial representations to the SEC staff. However, if you were personally involved in the issues that led to the SEC’s inquiries, then you have the right to invoke your Fifth Amendment privilege against compulsory testimony in cases involving potential criminal prosecution. It is important to remember, however, that the Fifth Amendment privilege generally does not protect the contents of documents, but may protect the testimonial act of producing them in some circumstances.

On the other hand, corporations and other collective entities subject to the federal securities laws generally cannot invoke the Fifth Amendment to resist producing their records. As a result, if the SEC staff’s inquiry identifies any compliance issues in relation to documents the entity possesses, these issues are not protected against subpoenas from the government.

Additionally, while invoking the Fifth Amendment privilege can prevent an SEC witness from facing criminal exposure, civil factfinders can draw adverse inferences from witnesses’ invocations of the privilege.

Finally, the SEC also has the authority to transfer evidence and potentially relevant records to the DOJ, and, as a result, the SEC can potentially make cases that may be criminal in nature refer to the DOJ for potential criminal charges. For example, Exchange Act Section 21(d)(1) specifically permits the SEC to transmit to the Attorney General any “information or reports” regarding evidence that the SEC believes may constitute evidence of a “criminal offense.”

What Financial and Employment Risks Follow an SEC Investigation?

While fines, penalties, and other monetary sanctions can take up a significant portion of an SEC enforcement action’s consequences, other consequences can prove equally or more burdensome. Among these are the licensing and debarment consequences, which can end careers.

Indemnification and Advancement of Defense Costs

When facing an SEC enforcement action, the individual and entity concerned can seek indemnification from the company. Under Delaware General Corporation Law Section 145, companies can indemnify individuals when they are faced with SEC enforcement action. However, if indemnification is proven to be unavailable under these circumstances, Delaware General Corporation Law Section 145(e) permits companies to advance legal defense costs upon receiving a written undertaking that the recipient will repay the advanced costs if it appears that indemnification is not permitted. This reflects the fact that advancement is legally distinct from indemnification.

D&O Coverage

In many cases, companies provide coverage for directors’ and officers’ liability. However, D&O coverage is only applicable in circumstances meeting the policy’s definition of “covered loss.” Additionally, D&O coverage may be denied due to exclusions, lack of timely notice, or allocation between policy limits.

Clawbacks and Shareholder Lawsuits

If an individual is an “executive officer” of a publicly traded company, the individual may also be subject to clawbacks under Exchange Act Rule 10D-1. Importantly, the definition of “executive officer” can include compliance officers in many circumstances. Finally, SEC investigations and enforcement actions can prove to be the genesis of related securities class actions, and individuals and entities targeted can also be subject to private enforcement litigation that may have its own specific requirements and risks.

What Sanctions Can the SEC Impose on Compliance Officers?

The inaccurate-memo case discussed above (In the Matter of James G. Harris, SEC No. 34-94212, 2020) produced a Rule 102(e) legal-practice suspension. Rule 102(e) proceedings can target lawyers, auditors, accountants, and other professionals that a company engages or employs.

Generally, SEC enforcement actions against compliance officers present the risk of various penalties. These can include, but are not limited to:

• Civil Monetary Penalties: Exchange Act Section 21(d)(3) gives federal courts the authority to impose civil monetary penalties in cases involving willful violations, such as securities fraud, as well as other misconduct and violations that cause losses to persons in securities transactions.
• Cease-and-Desist Orders: Under Exchange Act Section 21C, the SEC can seek cease-and-desist orders against violators of the federal securities laws as well as those whose actions helped cause others to violate these laws.
• Censures, Limitations, Suspensions, and Bars: For associated persons, the SEC has authority under Advisers Act Section 203(f) to pursue censures, limitations, suspensions, and permanent bars from the securities industry.
• Professional Practice Sanctions: In addition to Rule 102(e) proceedings, C.F.R. § 201.102(e) allows the SEC to seek sanctions including censure, suspension, and denial of the privilege to practice before the Commission.
• Disgorgement of Ill-Gotten Profits: Exchange Act Section 21(d)(8) provides a ten-year statute of limitations for disgorgement of ill-gotten profits in cases involving scienter-based violations, including fraud and other forms of intentional misconduct.
• Other Sanctions.

Should I Self-Report and Cooperate with the SEC?

SEC examinations can produce referrals to the SEC’s Enforcement Division. When these referrals are made, any internal investigation findings that were uncovered prior to the referral can then be presented to the government when seeking cooperation credit. In 2001, the SEC issued the “Seaboard Report” which outlined various factors that the Commission considers when evaluating cooperation. The factors mentioned in the Seaboard Report include, among others:

• Self-policing
• Self-reporting
• Remediation
• Cooperation
• The extent of the wrongdoing
• The harm to investors
• Recurrence
• Unjust enrichment
• The efficacy of a company’s compliance program

However, disclosing privileged internal investigation materials to the SEC in order to receive credit can create risks of waiver that can lead to disclosures in later private litigation.

While most compliance officers will avoid personal liability, the SEC’s willingness to target compliance officers (though certainly rarely) is exemplified by cases that target individuals’ personal misconduct and deception in areas that are not related to their role as compliance personnel. For example, the SEC recently charged a payment-company CCO for illegal trading after the CCO allegedly received information about the company’s pending acquisition from his girlfriend who worked at the target. This case shows how compliance personnel’s personal misconduct and deception can be a factor in a compliance officer’s risk of facing personal liability in SEC investigations.

Speak With a Federal Defense Lawyer

If you are dealing with any part of what this article describes, the next step is a conversation with a lawyer who handles these cases. Spodek Law Group is a second generation criminal defense firm practicing since 1976, representing clients nationwide from offices in New York, Brooklyn, Queens and Los Angeles. Call 212-300-5196 to speak with our team.