SEC Enforcement: Year in Review

During Chair Gary Gensler’s and Director of Enforcement Gurbir Grewal’s second year of leadership, several key enforcement priorities came into focus that will impact businesses across sectors. In this year in review, we highlight important takeaways for business leaders and in-house counsel from the Division’s activities in 2022, and what these activities mean for the Division’s priorities for the year ahead.

Highlights:

• Aggressive Positions Leading to Increased Penalties and Other Prophylactic Remedies: The SEC obtained a record $4.2 billion in penalties.[1] These figures were significantly bolstered by investigative “sweeps,” including enforcement actions against broker-dealers relating to the use of “off-channel” communications, such as text messages, resulting in more than $1 billion in penalties.[2] The SEC also required admissions and engagement of compliance consultants in a number of high-profile matters.
• Untested Positions Regarding Cryptocurrency: The SEC continues to take untested positions that various forms of digital assets are securities subject to, among other things, the registration requirements of the securities laws. A series of enforcement actions pursuing digital assets with novel enforcement theories has resulted in an increase in litigated cases, including litigation concerning whether particular cryptocurrencies are in fact securities.
• Increase in Climate and ESG Disclosures: The past year featured significant rulemaking concerning required disclosures by ESG funds as well as anticipated significant new rulemaking regarding human working capital. The Division also filed several ESG-related enforcement actions in 2022 foreshadowing areas of focus for 2023 and beyond.
• Trends in Insider Trading, Cybersecurity, SPACs and Other Critical Areas: There were a number of other notable developments in enforcement activity and significant rulemaking activity relating to cyber disclosures, SPACs and insider trading.

The Year in Review

It was a busy second year under the leadership of Chair Gary Gensler and Director of Enforcement Gurbir Grewal. The SEC brought a total of 760 actions in fiscal year 2022, including 462 new “standalone” actions, an increase of 6.5% from the prior year.[3] The SEC also obtained a record $4.2 billion in penalties.[4]

Policy Shifts in Action: Increased Penalties, Required Undertakings and Admissions and Curtailment of the Wells Process

As we discussed in detail in our 2021 SEC Enforcement Year in Review Memorandum,[5] Director of Enforcement Grewal spoke frequently in 2021 about the Enforcement Division’s intention to require admissions of wrongdoing in certain enforcement actions, and to reduce involvement by senior leadership in the Wells process. In 2022, we saw both of these policies play out, along with increased penalties for certain securities violations and expanded use of prophylactic remedies in several high-profile matters. Below we highlight some significant enforcement actions from the past year that reflect these policy shifts and offer some observations about what these policy shifts will likely mean moving forward.

These enforcement tools were on display in multiple high-profile enforcement actions in 2022. The SEC brought a series of enforcement actions against 16 broker-dealers and one investment adviser for “widespread and longstanding failures to maintain and preserve work-related text message communications conducted on employees’ personal devices.”[6] The penalties in those matters totaled more than $1 billion. Each of the firms also agreed to undertakings requiring the retention of a compliance consultant to oversee the enhancement of related policies and controls. The SEC also required admissions of wrongdoing from all 17 defendants.

Increased penalties, admissions and undertakings were also included in the SEC’s June 2022 action against a well-known auditing firm in which the firm admitted that a significant number of audit professionals cheated on the ethics component of CPA exams and various continuing professional education courses required to maintain CPA licenses. In addition to requiring an admission of wrongdoing, the SEC imposed a record $100 million penalty and required the firm to retain an independent compliance consultant to, among other things, examine and report to the SEC on enhancements to the firm’s “quality controls, policies, and procedures relevant to ethics and integrity and to responding to Information Requests.”[7]

In another high-profile matter, on May 17, 2022, the SEC announced that a global investment management firm agreed to pay more than $1 billion to resolve fraud charges. According to the allegations in the complaint, the firm and three former senior portfolio managers marketed and sold a complex options trading strategy to institutional investors while “concealing losses and downside risks of a complex strategy, and failing to implement key risk controls.”[8] This included manipulation of risk reports and performance data sent to investors through changing data contained within the reports.[9] Ultimately, “they lost over $5 billion in investor funds when the market volatility of March 2020 exposed the true risk of their products.”[10] As with several of the cases discussed above, the SEC required an admission of wrongdoing as part of the settlement, although there were no undertakings (perhaps because this arm of the business was shut down).

Reflecting on Chair Gensler’s reinstitution of former Chair White’s policy of requiring admissions in appropriate actions, to date, admissions have been required in only a few dozen matters and generally have not been utilized in the types of matters in which requiring admissions would be likely to significantly enhance collateral exposure to the defendant and, as such, risk jeopardizing the settlement. For example, admissions have generally not been required in fraud claims — which could have significant consequences for public companies in, among other things, private securities class actions, and could have severe consequences for individuals in parallel criminal investigations. While an admission was required in the $1 billion options trading fraud action recounted above, the defendants in that case had pleaded guilty in parallel criminal proceedings so the admission did not cause any harm that had not already been inflicted by virtue of their guilty pleas.

Director Grewal also indicated in 2021 that senior leadership of the Enforcement Division may not participate personally in meetings with counsel during the Wells process to the same extent as has been traditionally expected, particularly in cases that do not “present novel legal or factual questions, or raise significant programmatic issues.”[11] Instead, the Director and Deputy Director generally plan to deputize Wells meetings to direct reports and SEC staff.[12] The stated goal of this policy is to make the Wells process “more streamlined and efficient”[13] by not having the Director or Deputy Director regularly participate in these meetings.

There are no public metrics by which to measure implementation of this policy, but anecdotal evidence and public comments suggest that the Enforcement Division has in fact cut back on the number of Wells meetings. As Deputy Director of Enforcement Sanjay Wahdwa stated in public remarks in September 2022, “we have declined requests for Wells meetings in cases where we did not see novel legal issues, significant policy questions, or other considerations that weighed in favor of our participation.”[14]

While these changes to the Wells process may have increased the speed at which settlements were achieved in certain actions, decentralizing the process risks reducing programmatic consistency, increases the risk that similar matters may reach inconsistent results and reduces opportunities for discussion about the practical significance and consequences of enforcement actions.[15]

Greater Reliance on Sweeps and Analytic Tools

Broad investigative sweeps of categories of actors for specific types of misconduct significantly contributed to increased enforcement activity this past year and, in particular, contributed to the record amount of fines collected during the past fiscal year.

For example, as mentioned above, an investigative sweep led to claims against more than a dozen broker-dealers and investment advisers and over $1 billion in penalties for internal control and recordkeeping violations related to the use of “off-channel” communications, such as text messages.[16] Enforcement activity to date has focused on bulge banks and other significant financial institutions that failed to retain “off-channel communications.” However, this remains an area of heightened SEC interest even in the absence of suspected underlying misconduct. It has been publicly reported, and the SEC itself has indicated that the SEC is actively pursuing additional potential enforcement activity in this space, including against funds and advisers.[17]

Another recent sweep conducted by the Enforcement Division’s Asset Management Unit focused on custody obligations to secure client assets and to protect investors, which resulted in charges against nine registered private fund advisers for failing to comply with the Custody Rule and/or update their Forms ADV to accurately reflect the status of their private fund clients’ financial statements.[18] Director Grewal has publicly stated that firms should “expect to see us employ these strategies more frequently moving forward.”[19]

Finally, the SEC continued in 2022 to bring accounting fraud actions against public companies under its years-long sweep into “EPS rounding,” aided by analytical tools designed to identify potentially irregular financial reporting.

SEC Chair Gensler’s Areas of Focus

As we reported in last year’s enforcement round-up, Chair Gensler has repeatedly emphasized his plan to focus increased resources and attention on issues related to cryptocurrency, special purpose acquisition companies (“SPACs”) and climate and Environmental, Social and Governance (“ESG”) issues. Below we check in on significant enforcement activity and rulemaking in each of these spaces over the past year and also look at other significant matters from the past year.

Cryptocurrency

Cryptocurrency continues to be a major area of focus for the SEC. On May 3, 2022, the SEC announced the addition of 20 new Division of Enforcement positions to the Crypto Assets and Cyber Unit (formerly known as the Cyber Unit).[20] Chair Gensler asserted that “nearly doubling the size of this key unit” will enable the SEC to “police wrongdoing in the crypto markets while continuing to identify disclosure and controls issues with respect to cybersecurity.”[21] Director Grewal stated that the “bolstered Crypto Assets and Cyber Unit will be at the forefront of protecting investors and ensuring fair and orderly markets in the face of these critical challenges.”[22]

As discussed in our 2021 Year in Review, the question of which digital assets qualify as securities continues to be debated. The seminal 1946 Supreme Court case SEC v. W.J. Howey Co. provides that a transaction is an investment contract and, therefore, is subject to the securities laws when it is (1) an investment of money; (2) in a common enterprise; (3) with the expectation of profit; and (4) to be derived from the efforts of others.[23] The past year did not provide significant clarity on the question of whether digital assets qualify as securities, and we anticipate it will continue to be a hot button issue in the year ahead.

As a result, some of these matters have resulted in contested litigation throughout the country, risking for the SEC, and the market in general, a case-by-case weighing of what digital assets are and are not securities and risking different judges reaching inconsistent conclusions and applications of the Howey test.

Significant crypto-related enforcement actions in 2022 include the SEC entering into a consent order with a crypto lending platform in February 2022 for failing to register the offers and sales of its retail crypto lending product and thus violating the registration and antifraud provisions of the Securities Act and the registration provisions of the Investment Company Act of 1940. The lending platform agreed to pay a $50 million penalty, cease its unregistered offers and sales of digital assets and attempt to become Investment Company Act compliant within 60 days. The lending platform also agreed to pay an additional $50 million in fines to settle a group of parallel investigations — arising from the same conduct found by the SEC—initiated by 32 state attorneys general.[24]

Also of note, in 2022, the SEC also brought its first-ever insider trading action relating to trading in digital assets. The SEC complaint alleges that a former employee of a digital asset trading platform provided tips ahead of listing announcements on the platform, in violation of company policy restricting the use of confidential information.[25] The SEC’s complaint was also noteworthy in that it was a rare instance in which the SEC has specified that certain digital assets qualified as securities under the securities laws.[26] The SEC also brought claims against a celebrity “crypto influencer” for promoting certain digital assets without disclosing her compensation.[27] In December, the SEC charged several former executives with allegedly defrauding equity investors in a crypto trading platform.[28]

Proposed Amendments to Rule 3b-16

In addition to enforcement activity, the SEC proposed amendments to Rule 3b-16 that would expand the definition of an “exchange” to include “systems that offer the use of non-firm trading interest and communication protocols to bring together buyers and sellers of securities,” which the SEC terms “Communication Protocol Systems.”[29] Communication Protocol Systems function similarly to registered exchanges and Alternative Trading Systems (“ATS”), and have increased in popularity as trading venues.[30] However, they are not currently subject to the same requirements as registered exchanges and ATS, and do not fall within the definition of exchange under the statute.[31] While the SEC does not specifically mention cryptocurrencies, blockchain or DeFi in its proposed amendments, it states that it includes Communication Protocol Systems that “make available for trading any type of security,” and there has been much speculation that this could be a powerful tool to expand regulation over digital assets (emphasis added).[32]

Under the proposed amendments, Communication Protocol Systems would have two options for registration. First, they could choose to register as an exchange and be subject to the requirements of Section 6 of the Exchange Act.[33] Second, they could choose instead “to comply with the conditions of the Regulation ATS exemption, which includes registering as a broker-dealer.”[34] The latter option requires “establish[ing] written safeguards and procedures to protect confidential subscriber trading information,” compliance with the Fair Access Rule and oversight by the Financial Industry Regulatory Authority.[35] This is an area that will be worth monitoring in 2023.

ESG

As Chair Gensler previewed in 2021, ESG was a top priority for the Enforcement Division in 2022, highlighted by significant proposed rulemaking and several novel enforcement actions.

Proposed Rulemaking on ESG Disclosures

As companies and investment managers increasingly offer products, including investment funds, whose strategies incorporate ESG factors, the SEC has repeatedly emphasized its intent to combat “greenwashing”—i.e., false or misleading claims by companies and advisers relating to their ESG bona fides or the extent of their products’ or practices’ positive impact on the environment and society. Greenwashing has appeared as an enforcement priority on the agenda of the SEC’s Division of Examinations since March 2021. And on May 25, 2022, the SEC released for notice and comment two proposed rules aimed squarely at the practice.[36]

The first of the proposed rules would create enhanced disclosure requirements for three categories of registered funds that use ESG factors in investment strategies: “ESG-impact” funds (funds that seek to achieve specific ESG impacts); “ESG-focused” funds (funds for which ESG factors are a significant or main consideration); and “ESG-integrated” funds (funds that consider ESG factors, but without treating them as more significant than other non-ESG factors). The proposed rule would also generally require ESG-focused and ESG-impact funds to include greenhouse gas emissions disclosures associated with their portfolio company investments. The second proposed rule would expand the scope of the Investment Company Act’s “Names Rule,” which requires that a fund whose name suggests a certain focus invest at least 80% of the value of its assets accordingly. The expanded Names Rule would now cover funds with names that suggest that their investment decisions incorporate ESG factors.

Potential Rulemaking on Human Capital Disclosures

One area that we expect to see increased rulemaking and/or enforcement activity in 2023 is human capital. In 2020, the SEC amended Item 101 of Regulation S-K to require that public companies disclose “the number of persons employed by the registrant, and any human capital measures or objectives that the registrant focuses on in managing the business (such as, depending on the nature of the registrant’s business and workforce, measures or objectives that address the development, attraction and retention of personnel).”[37] Since that time, there has been much discussion about enhancing those disclosure requirements, particularly with respect to how public companies value their investments and expenses in human capital. In June of 2022, a Working Group on Human Capital Accounting Disclosure, composed of academics, market participants and former SEC officials, submitted a petition for rulemaking asking the SEC to develop rules requiring human capital accounting disclosure requirements.[38] The petition requested that the SEC “develop rules to require public companies to disclose sufficient information to allow investors to assess the extent to which firms invest in their workforce,” and recommended enhanced accounting-related disclosure to reflect that human capital-related costs are deemed expenses as opposed to investments.[39] Chair Gary Gensler indicated on several occasions in 2022 that he is seriously considering acting on this petition and/or otherwise revisiting the human capital disclosure requirements.[40] While there has been public reporting of SEC enforcement investigations into human capital-related issues, to date, no enforcement activity has been brought under Item 101 or otherwise. We expect to see increased enforcement activity in this space in the coming years.

Recent Enforcement Actions

Since the formation of its Climate and ESG Task Force, the SEC has been actively probing companies for potentially mispresenting the ESG metrics that they employ and market to their investors.[41] As predicted in our prior update, 2022 has shown increased enforcement against companies relating to ESG issues.

In 2022, the SEC charged an investment bank with making material misstatements and omissions to investors by “represent[ing] or impl[ying] in various statements that all investments in the funds had undergone an ESG quality review,” which, in fact, did not always occur.[42] The SEC alleged that the bank was aiming to “hold investment advisers accountable when they do not accurately describe their incorporation of ESG factors into their investment selection process.”[43] To settle the charges, the investment bank agreed to (1) a cease-and-desist order, (2) a censure and (3) payment of a penalty of $1.5 million in order to settle the charges, but did not admit or deny the SEC’s findings.[44]

The SEC announced on November 22, 2022, that it charged a major financial institution with policy and procedures failures involving funds and accounts marketed as ESG investments.[45] The SEC’s order found that the financial institution did not consistently maintain written policies and procedures related to ESG designation, and that where such policies and procedures existed, the institution failed to follow them consistently.[46] The financial institution did not admit or deny the SEC’s findings, but settled the charges by agreeing to a cease-and-desist order, a censure and a $4 million penalty.[47]

In other notable SEC enforcement actions, the SEC charged a Brazilian mining company with making false and misleading claims about the safety of its dams before one collapsed,[48] and a New York-based robo-adviser with making misleading statements about its compliance with Shari’ah—Islamic law.[49]

SPACs

There was significant SPAC-related rulemaking proposed in March 2022. In an effort to address concerns relating to, among other things, investor protection, disclosure and statutory applicability, the SEC proposed new rules this year designed to achieve four main goals:

1. “Enhance disclosures and provide additional investor protections in SPAC initial public offerings and in business combination transactions between SPACs and private operating companies (de-SPAC transactions);
2. Address the treatment under the Securities Act of 1933 of business combination transactions involving a reporting shell company and amend the financial statement requirements applicable to transactions involving shell companies;
3. Provide additional guidance on the use of projections in SEC filings to address concerns about their reliability; and
4. Assist SPACs in assessing when they may be subject to regulation under the Investment Company Act of 1940.”[50]

The proposed rules are intended to protect investors by requiring additional disclosure in a variety of contexts related to SPAC IPOs and de-SPAC transactions. Broadly, this group of proposed rules is designed to ensure that “investors are better informed about the complexities of this method for accessing public markets, and the factors that impact the value of their SPAC investment.”[51] These proposals also bring SPACs more in line with Congressional requirements for traditional IPOs that “companies raising money from the public should provide full and fair disclosure at the time investors are making their crucial decisions to invest.”[52]

The proposal also redefines “blank check company” to include SPACs for the purposes of the Private Securities Litigation Reform Act of 1995 (“PSLRA”). The effect of this change is that the “safe harbor for forward-looking statements under the PSLRA would not be available to SPACs, including with respect to projections of target companies seeking to access the public markets through a de-SPAC transaction.”[53] The underlying rationale is that “parties to the transaction shouldn’t use overly optimistic language or over-promise future results in an effort to sell investors on the deal.”[54]

As SPAC activity has significantly quieted over the past year, so too has the enforcement activity targeting SPACs and de-SPAC transactions. In 2022, the SEC charged an investment adviser with failing to disclose conflicts of interest when advising clients to invest in certain SPACs whose sponsors were owned by the investment adviser’s personnel.[55] The investment adviser agreed to a cease-and-desist order, a censure and a $1.5 million penalty to settle the charges without admitting or denying the SEC’s findings.[56] Otherwise there were no settled or contested actions formally filed this year. That said, there has been reporting of several active SPAC-related investigations, and it seems likely that there will be increased enforcement activity in this space in 2023.

Other Important Developments in 2022 and Areas to Keep an Eye on in 2023

Cybersecurity and Customer Information

Recent enforcement actions, proposed rulemaking and increased staffing reflect the SEC Enforcement Division’s expanding focus on cybersecurity incidents and corresponding disclosures of such incidents. While the Enforcement Division has historically focused its resources in this area on highlighting failures to disclose internal control deficiencies, the Enforcement Division is beginning to cast a wider net in its investigations and enforcement actions. In March 2022, the SEC announced a new slate of proposed cyber incident-related disclosure rules that would significantly increase disclosure obligations for public companies.[57] The SEC’s recent enforcement activity, increased staffing and proposed rulemaking will have significant implications for public companies, which will also be required to expend resources and attention to ensure they are complying with inconsistent disclosure obligations at the state and federal levels.

More broadly, in 2022, the Enforcement Division made clear that safeguarding customer information is a focus area for enforcement activity. The SEC charged three different financial services firms for failure to adequately prevent customer identity theft in violation of Regulation S-ID, alleging that the firms lacked reasonable policies and procedures to detect and respond to identity theft red flags.[58] The specific facts alleged related to failure to exercise effective oversight over service provider arrangements; failure to adequately train staff to implement identity theft protection; and failure to adequately involve the board of directors in the oversight, development and implementation of identity theft protection programs.[59] In addition, a U.S.-based broker-dealer and investment adviser firm settled with the SEC for charges related to its alleged failure to properly dispose of hard drives and servers containing the personal identifying information (PII) of approximately 15 million customers.[60]

Payment for Order Flow

As we previewed in our 2021 Year in Review, the SEC continued to focus on Payment for Order Flow (“PFOF”) in 2022. While it appears unlikely that it will ban the practice outright, the Commission has considered several proposals which could significantly impact the way in which National Market System (NMS) orders are executed and reported, as well as PFOF.[61] For example, the “Order Competition Rule” requires certain retail investor orders for NMS stocks to be exposed to competition in a “qualified auction” prior to being executed internally by a trading center, potentially limiting or preventing PFOF. And the proposed “Regulation Best Execution” would also apply heightened standards on broker-dealers to use reasonable diligence to secure the most favorable price for customer orders, and require those broker-dealers that engage in “conflicted transactions,” including those where it provides or receives PFOF, to document their compliance with the best execution standard.[62] These proposals are currently open for public comment until March 31, 2023.

Insider Trading: The SEC Adopts Rules Re: 10b5-1

On December 14, 2022, the SEC adopted final rules amending Rule 10b5-1, which provides an affirmative defense to insider trading liability where the trading person can show that a trade is made pursuant to a contract, instruction or plan (a “10b5-1 plan”) entered into at a time when the person was not in possession of material nonpublic information, that specifies the amount of securities to be sold and the pricing and timing parameters of such sales, and over which the person does not exercise any subsequent influence.[63] The amendments also address areas where the SEC sees the potential for abusive practices: They impose mandatory cooling-off periods, eliminate the use of multiple or overlapping 10b5-1 plans and require significantly more disclosures regarding trading by issuers and insiders.[64]

Uncertainty around the SEC’s Continued Use of Administrative Courts in Certain Proceedings

The SEC suffered a potentially significant setback in 2022 that puts into question the extent to which the Commission can use administrative courts to litigate disputed actions. The Fifth Circuit in Jarkesy v. Securities and Exchange Commission held that the SEC’s use of an administrative law judge to preside over civil fraud claims brought under the Exchange act was unconstitutional.[65] The court explained that Congress may only assign an action to administrative adjudication if the proceedings involve “public rights.” This is determined by, among other things, whether the claims are akin to matters that incorporate a constitutional right to a jury trial and whether requiring jury trials would “go far to dismantle the statutory scheme” or “impede swift resolution.”[66] In Jarkesy, the Fifth Circuit held that Section 10b claims were sufficiently analogous to criminal fraud prosecutions and that ensuring that a defendant is entitled to a jury trial would not cause undue disruption to the swift administration of SEC enforcement activity.[67]

On October 22, 2022, the Court of Appeals denied the SEC and DOJ petition for en banc review by the Fifth Circuit. However, weeks later, on November 7, the Supreme Court heard oral argument in Securities Exchange Commission v. Cochran, which centers upon questions of when and where constitutional objections to agency power may be pursued.[68] The decision in that case could go a long way in clarifying when the SEC is allowed to proceed via an administrative law judge and when and how a defendant can object to such a proceeding on constitutional grounds.

However, until the core issue of whether fraud and analogous claims can constitutionally be tried before an administrative law judge is decided, it would be a high-risk strategy for the SEC to pursue contested claims in that forum. And as a practical consequence of that, and because litigating contested fraud claims in Article III courts typically take more time and resources, the SEC may have to be more judicious in determining which contested fraud claims it will pursue to litigation.

We look forward to providing you with further updates on these and other developments throughout the year ahead.

Endnotes