Has the Whistleblower Moment Arrived? SEC Awards Whistleblower More Than $14 Million

By Kevin LaCroix on October 2, 2013

It is not the first whistleblower award under the Dodd Frank Act’s whistleblower bounty program but the “more than $14 million” award to an anonymous whistleblower that the SEC announced on October 1, 2013 is by far the largest so far. The size of the award raises the question of what the award may mean for future awards – as well as the question whether the possibility of awards of this size may encourage whistleblowing and drive enforcement activity.

The SEC’s October 1, 2013 press release describing the award can be found here. The October 1, 2013 Order Determining Whistleblower Award Claim can be found here.

Section 922 of the Dodd-Frank Act created certain new whistleblower incentives and protections. The section directs the SEC to pay awards to whistleblowers that provide the Commission with original information about a securities law violation that lead to the successful SEC enforcement action resulting in monetary sanctions over $1 million. The size of the award may range from 10 % to 30% of the amount recovered in the enforcement action. The section also prohibits retaliation against whistleblowers.

The SEC released its rules implementing the whistleblower program in May 2011 (about which refer here), but until this most recent award, the agency had made only two prior awards as the program ramped up. The first award made in August 2012 totaled approximately $50,000. In August and September 2012, the agency made awards of more than $25,000 to three whistleblowers.

In its press release describing the most recent award, the agency said that the award was made to a whistleblower “whose information led to an SEC enforcement action that recovered substantial investor funds. The press release also states that the whistleblower does not wish to be identified. According to the agency, the whistleblower “provided original information and assistance that allowed the SEC to investigate an enforcement matter more quickly than otherwise would have been the case. Less than six months after receiving the tip, the SEC was able to bring an enforcement action against the perpetrators and secure investor funds.”

The SEC has not identified the name of the enforcement action defendants, the nature of the whistleblower information provided, the nature of the violation, or that amount recovered from the defendant.

In the whistleblower order, the Commission stated that a claims staff review determined that the amount of the award will exceed $14 million in light of the monetary sanctions already collected and “appropriately recognizes the significance of the information that the Claimant provided to the Commission, the assistance the Claimant provided in the Commission action and the law enforcement interest in deterring violations by granting awards.”

The press release quotes SEC Chair Mary Jo While as saying that the whistleblower program has “already had a big impact on our investigations” by “providing us with high quality, meaningful tips.”

If you were to stop for a moment an imagine what a difference a cash award of more than $14 million might make for your lifestyle, you will realize that this award is going to capture the imagination of many prospective whistleblowers. Indeed, that is the point. Mary Jo White is quoted in the press release as stating that “we hope an award like this encourages more individuals with information to come forward.”

It is probably worth noting that prospective whistleblowers will not only notice the size of the award, but they may also be encouraged by the lengths to which the SEC went to protect the whistleblower’s anonymity.

This latest award is huge – but the agency could just be getting started. I am going to go out on a limb here. I think that we about to see many more whistleblower awards and we could see a number of awards even larger that the one just awarded. As stated by a former SEC official quoted in an October 1, 2013 Law 360 article about the award entitled "14M SEC Award is Just the Beginning" (here, subscription required), "This is just the first of what is likely to be many significant awards coming down the pike."

It could turn out that there are not many awards approaching this size of this one, but that may not matter. With even just this one award out there, would be tipsters are going to start flooding the SEC. (Of course, as reflected in SEC whistleblower office’s latest annual report, the tips are already pouring in. This award will reinforce the phenomenon.).

The phenomenon of more whistleblowers providing more tips seems likely to result in more enforcement actions – which is of course consistent with the views of the agency’s senior leadership, who are eager to show that the agency is tough. And as this particular case shows, the involvement of whistleblowers can help accelerate the enforcement actoins, as well.

And the possibility of increased enforcement activity also implies the possibility of follow on civil litigation, as investor claimants pursue private civil actions to recover from companies and their senior management for violating the securities laws or allowing the violations to take place.

The Dodd Frank Act was enacted over three years ago but the impact of many of its provisions is only now just starting to be felt. Indeed some provisions, such as the pay ratio disclosure requirements and the conflict mineral disclosure requirements, have not yet taken effect. And the kinetic potential of the Act’s whistleblower provisions are only now being realized. Before all is said and done, the Act’s many provisions – including in particular the whistleblower provisions, could have a significant impact on the level of enforcement activity and on amount of civil litigation.

Emerging Global Regulatory Enforcement and Cross-Border Collaboration

By Kevin LaCroix on October 1, 2013

Posted in International D & O

Among two of the most noteworthy recent global regulatory trends are the spread of anticorruption enforcement and the rise in cross-border enforcement collaboration. Both of these trends were evident in the Canadian government’s recent prosecution of the first individual ever convicted after trial under Canada’s equivalent to the FCPA, the Corruption of Foreign Public Officials Act. As discussed in a September 27, 2013 memo from the Holland & Hart law firm entitled “Canada’s First ‘FCPA’ Trial & Increased International Law Enforcement Cooperation” (here), Canada has added itself to the growing list of countries more actively pursuing anticorruption enforcement. As that list extends, cross-border enforcement collaboration is becoming increasingly common.

Nazir Karigar’s prosecution arose out of an effort by a Canadian subsidiary of a U.S. technology company to win a contract with Air India (a state-owned entity) for facial recognition software and other passenger-security equipment. Karigar, hired as a consultant to help guide the company through Air India’s procurement process, allegedly orchestrated a conspiracy to pay bribes to an Air India official and to India’s Minister of Civil Aviation.

The company ultimately did not win the contract, and a compensation dispute arose between Karigar and the U.S.-based parent company. As the law firm memo put it, “in an ill-conceived plan to retaliate, Karigar apparently sent an ‘anonymous’ tip about the foreign bribery scheme” to the U.S. Department of Justice. The DoJ passed the information to their Canadian counterparts, who then charged and successfully prosecuted Karigar. On August 15, 2015 the Ontario Superior Court found that Karigar had conspired to offer bribes to foreign government officials in violation of the CFPOA.

The FCPA Blog has a more detailed description of Karigar’s prosecution in an August 27, 2013 post, here. (Among other things, The FCPA Blog notes that Karigar was convicted despite the absence of direct evidence of the payment or receipt of a bribe.)

Among other things about this prosecution, the law firm memo notes that the implication of this prosecution that “the enforcement of anti-corruption laws is no longer just a ‘U.S. thing.’” For many years, the U.S. had been sort of a “Lone Ranger” on anticorruption enforcement. The CFPOA has been on the books since 1999, but more recently that statutes provisions have been more actively enforced. Now, the Canadian authorities are, in addition to the Karigar case, pursing a criminal prosecution in a wide-ranging scheme involving multiple payments in as many as five countries (including Canada). As the law firm memo puts it, the Karigar conviction is “yet another indication that Canada has joined the United States, Germany, the United Kingdom, Switzerland and other countries in the global anti-corruption enforcement bandwagon.”

This prosecution also highlights “growing international cooperation.” The law firm memo notes that the “recent explosion in cooperation” has been facilitated “by the expansion of instantaneous international communications,” as well as “the stationing abroad of FBI and other federal agents from various U.S. law enforcement agencies” and “international consensus and cooperation in defining certain criminal conduct.”

The upshot of all of this is a growing risk of regulatory enforcement activity, both for non-U.S. companies operating in their home countries and elsewhere abroad, and for U.S. companies operating outside the U.S. The emerging global regulatory risk is an issue about which we will be hearing a great deal more in the coming months. This emerging risk pertains not just to anticorruption enforcement activity, but also, includes, among many other issues and topics, export control, trade sanctions, money laundering, banking and privacy, antitrust, environmental, and a host of other regulatory issues.

One important common thread in the trend toward increasing cross-border collaboration is the frequent involvement of U.S. regulators, which is consistent with a message I highlighted in a recent post — that U.S. regulators are actively asserting their regulatory authority outside of the U.S. In an environment where there already is a growing perception of increasing regulatory risk, the U.S. authorities’ vigorous assertion of regulatory authority outside the U.S. represents a particularly hazardous part.

I happen to think that the increasing global regulatory enforcement activity is one of the important emerging trends involving corporate liability. These developments have very important liability implications both for non-U.S. companies in their home countries and operating abroad, and for U.S. companies operating overseas. For D&O underwriters, these developments have important underwriting implications. And for policyholders and their advisors, these developments raise important and challenging questions about the availability and effectiveness of their insurance to respond to these emerging regulatory claims.

Weak Banks, Hanging On: As time has gone by since the peak of the financial crisis, the number of bank failures has declined as the economy has recovered. What is more surprising is that banks continue to fail. So far during 2013, 22 banks have failed, including two in the month of September. One reason for this continued drip of bank failures may be that the FDIC has allowed some weaker banks to stay alive, in the hopes that the troubled bank might be able to pull itself back from the brink.

An interesting September 29, 2013 Wall Street Journal article entitled “Staying Alive: Weak Banks Hang On” (here) takes a look at how the FDIC seems to be allowing troubled banks to linger for longer periods. According to the article, 13 of the 22 banks that have failed in 2013 were “significantly undercapitalized” for a least a year before they failed. That compares with just 20% of the bank failures in 2012.

According to the Journal article, on average, this year’s failed banks were significantly undercapitalized or worse for 6.3 consecutive quarters before failing, compared with 3.5 quarters last year. Of all of the banks that have sunk to significantly undercapitalized status in the last 15 years, 65% have gone on to fail, according to sources cited in the Journal article.

The article suggests there is downside to the government’s approach — that the “go-slow approach” can “prompt banks’ management to take extreme risks to survive and can lead to bigger price tags for the government if they ultimately fail.” The article goes on to note that banking regulators have been criticized for the inaction in the run up to the financial crisis, citing a Treasury department report critical of regulators because “they often didn’t take strong, quick action to address risky practices that helped lead to the bank’s failure.”

The implication of the Journal article is that despite improvements in the general economy and in the banking sector, there is still a backlog of banks that likely will fail before all is said and done. This is in fact consistent with the FDIC’s most recent quarterly banking profile. As discussed here, in the agency’s latest profile, the FDIC reported that there are still over 550 problem institutions, representing about eight percent of all banks. Not all of these banks will fail; some will be merged into healthier banks and others will be able to complete their recovery. But there will be some that will fail. If the Journal article is accurate, the closure dates for the banks that eventually will fail could be dragged out for some time.

All of this is a reminder of the challenges facing D&O insurance underwriters active in the banking sector. Even though the financial crisis is moving further into the past every day, there are still significant legacy issues.. For that reason, D&O underwriters continue to proceed cautiously with regard to banking institutions. Even healthy banks continue to face scrutiny and even increased premiums. Placements of troubled banks remain very challenging.

D&O Insurance: How Many Different Ways Can Coverage Be Precluded for a Single Case?

By Kevin LaCroix on September 30, 2013

Posted in D & O Insurance

Due to the complexity both of the D&O insurance policy and of the kinds of claims that can arise, the question of whether and to what extent a particular claim may be covered is often disputed. Sometimes though a particular claim is simply not covered. That was the case in a recent coverage dispute in Montana federal court, where a bank sought insurance coverage for losses it incurred on a customer counterclaim in a debt recovery action the bank had initiated. Magistrate Judge Keith Strong’s September 23, 2013 opinion (here) reads like a catalog of the ways that coverage can be precluded under a D&O insurance policy. As discussed below, within the court’s rulings are some noteworthy determinations that merit further consideration.

Background

In July 2007, First Interstate Bank loaned money in connection with a condominium project in Ocean Shores, Washington. The president of the borrower, Paul Pariser, provided a personal guaranty on the loan. At the same time, Pariser had a deposit account at the bank which on April 2, 2009 contained at least $2,623,396.40.

In April 2009, the bank decided to exercise certain rights it believed it had under the loan agreement and the guaranty. The bank sued Pariser, declared the loan in default, and also declared itself insecure under the loan. Acting on the declarations, the bank immediately removed $2,623,396.40 from Pariser’s personal account and applied the proceeds to reduce the borrower’s principal and interest. Pariser countersued alleging that the bank had violated the loan documents and seeking to have the funds, restored.

The underlying action resulted in a verdict that the bank has not properly exercised its contract rights and thus was entitled to no recovery. On Pariser’s counterclaim, the jury returned a verdict of $2,623,396.40, which as the court in the subsequent coverage action noted, is “the precise amount the Bank simply took from Mr. Pariser’s personal account.”

Pariser filed his counterclaim against the bank on June 25, 2009. However, the bank did not formally notify its management liability insurer of the lawsuit until October 18, 2010, more than a year after the policy period during which Pariser first made his claim had expired. In the subsequent coverage action, in order to try to show compliance with the policy’s notice requirement, the bank attempted to rely on a June 30, 2009 litigation summary letter from its outside counsel to the bank that the bank had provided to the carrier in the course of the underwriting of the company’s renewal policy.

Among other things, the June 30 letter contained the following reference to the litigation with Pariser:

This much can be summarized about the affirmative claims for damages asserted by Mr. Pariser and the borrower against the bank in both proceedings: (1) all claims involve a common nucleus of facts – the decision of the bank to deem itself insecure, made demand under Mr. Pariser’s guarantee, and setoff his deposit account in the amount of nearly $2.7 million; (2) the decision of the bank to take such action was carefully considered when made, with the full knowledge of the litigation likely to follow, including the associated liability that could arise; and (3) the actions taken by Mr. Pariser and the borrower have been predictable and entirely consistent with those known (and fully anticipated risks).

After the bank submitted its formal notice of claim, the insurer denied coverage for the claim and filed an action in the District of Montana seeking a judicial declaration that it owed no duty to indemnify the bank for any loss or expense incurred in the bank’s litigation with Pariser. The bank countersued seeking a declaration that the insurer had a duty to indemnify and also seeking contract and tort damages. The parties filed cross motions for summary judgment.

The September 23 Opinion

In his September 23, 2013 opinion, Magistrate Judge Keith Strong granted summary judgment in the insurer’s favor, finding that the insurer had no duty to defend and no duty to indemnify the bank under its policy.

The Magistrate Judge first determined that the insurer was entitled to judgment as a matter of law because, he found, the bank had “failed to meet an express condition precedent to coverage by providing notice of a claim first made as soon as practicable during the policy period or within 60 days after expiration.” He noted that the bank’s formal notice for a claim that was first made in June 2009 was not given until October 2010. He noted that “no reason for the delay appears of record.” At the same time, however, he noted that the June 30, 2009 letter from bank’s outside counsel shows that it would have been “practicable” for the bank to notify the insurer of the claim at that time, which “supports a judgment that the Bank did not give notice as soon as practicable.”

The court also noted that even though the June 30, 2009 letter had been provided to the insurer as part of the bank’s insurance renewal, the letter did not provide notice of claim to the insurer within the policy’s requirements. As the Magistrate Judge noted, the letter “lacks any suggestion even to [the bank’s] management that the Bank could, would, should or even might seek insurance coverage for any aspect of the Pariser litigation.” The letter “did not give [the insurer] notice that the Bank considered the Pariser loss covered by a policy of (the insurer’s] insurance.” The court added the observation “that a commercial bank is involved in a number of litigated matters does not give notice that insurance coverage is claimed under any specific one.”

Though the court’s determination that the bank had not provided timely notice of claim was sufficient to find that coverage was precluded under the policy, the court then went on to consider and reject other grounds on which the bank sought to rely in trying to establish coverage under the policy.

He rejected the bank’s argument that the insurer had breached its duty to defend, noting, among other things, that the policy expressly stated in bold, capitalized text on the policy’s first page that “The Insurer has not duty under this policy to defend any claim.”

Magistrate Judge Strong also rejected the bank’s argument that the $2,623,396.40 the jury awarded Pariser represented covered loss under the policy. In its verdict, “the jury simply made the Bank return what the Bank wrongfully took.” The verdict “was for the return of money wrongfully taken as principal and interest payment and … all the litigation arose from the wrongful taking and application to principal and interest.”

The court went on to conclude that coverage for the claim was also precluded under both the improper profit exclusion and under the contract exclusion. With respect to the improper profit exclusion, the court noted that the June 30, 2009 litigation letter makes it indisputable that “all the litigation centered on the question whether the Bank took money it was not legally entitled to take.” The amount for which the bank seeks coverage is “excluded because it arises from the Bank taking and trying to keep money to which it was not legally entitled. “

The court determined that coverage is also precluded under the policy’s contract exclusion because “the dispute was a contract dispute and one that the Bank deliberately started under the guise of its own contract rights. If there had been no contracts there would have been no dispute.”

The Magistrate Judge also rejected the bank’s argument that the jury verdict of $2,623,396 should be considered a covered loss because the verdict included a jury finding that the bank had breached the implied covenant of good faith and fair dealing. The bank argued that the breach represented a tort loss, rather than a contract loss, and therefore is not excluded from coverage. The Magistrate Judge rejected this argument based on Montana case law holding that the breach of the implied covenant is a contract breach only, not a tort.

In his conclusion, the Magistrate Judge summarized the case this way:

First Interstate Bank deliberately exercised what it believed were its loan and guaranty contract rights to seize money from Mr. Pariser’s account and apply the seized funds to principal and interest on the loan. First Interstate Bank was not entitled to do so. It was held liable to return the money it had taken. First Interstate deliberately started [the litigation] all flowing directly from its decision to take Mr. Pariser’s money. For well over a year all of First Interstate Bank’s actions relevant here were consistent with this court’s interpretation: the Pariser litigation did not trigger coverage under [the insurer’s] liability policies. The first litigation summary letter almost seems a summary of exclusions under the policy. The notice was late but there was no coverage under the policy in any event.

Discussion

In the end there should be little surprise that a management liability insurance policy does not cover a jury verdict award representing an amount the bank wrongfully took from its customer and was obliged to return. Seriously, was the bank proposing that it should be allowed to keep the wrongfully taken funds and simply pass the bill to the insurer? Though some policyholder side advocates vigorously dispute the principle that a D&O insurance policy provides no coverage for disgorgement amounts or for the return of ill-gotten gains, I suspect that even these advocates would find it hard to argue that this bank could pass off to its insurer the bank’s obligation to restore the funds it had wrongfully taken from its customer.

At the same time, the bank had a serious late notice problem – which its own counsel expressly acknowledged when the bank provided notice to the insurer. According to the Magistrate Judge’s opinion, counsel for the bank reportedly said in the email accompanying the notice that “They won’t be happy with the late notice, but these cases have been very well defended and there has been no prejudice.” Readers of this blog know I am no friend of attempts to preclude coverage based on supposed late notice, but here where a sophisticated party has counsel involved throughout and only belatedly provides notice without any apparent excuse or explanation, the arguments against enforcing the notice requirements are more difficult to sustain. (Moreover, counsel’s e-mail comment about late notice evinces awareness that the prior provision of the litigation letter during the renewal underwriting process did not satisfy the policy’s notice requirements, about which see more below.)

But if the possibility of coverage here was always going to be remote, the opinion nevertheless incorporates some important determinations that are worth noting.

First, the Magistrate Judge determined that the bank’s provision of the June 30, 2009 letter as part of the renewal underwriting process did not constitute notice. The question whether provision of information about a claim to the underwriting department is sufficient to satisfy a D&O insurance policy’s claims notice requirements is a recurring issue (as discussed most recently here). In this case, the magistrate judge rejected the argument because there was nothing about the June 30, 2009 letter to suggest that the bank was submitting the referenced litigation as a claim or that it expected coverage under the policy. The magistrate judge did not address the larger issue whether information provided in the underwriting process could ever constitute notice of claim, but he did at least determine that in this case under these circumstances the provision of the litigation letter did not constitute notice under the policy.

The magistrate judge’s rejection of the bank’s argument that the policy provided coverage for the breach of the implied covenant of good faith and fair dealing is also noteworthy. Many corporate and business disputes have a contract at the center. Many D&O insurance policies (particularly those issued to private companies) contain an exclusion precluding coverage for contract disputes. However, in these kinds of corporate and business disputes, the complaint often asserts claims other than those specifically arising out of the contract. Policyholders often argue that these other claims are not precluded by the contract exclusion. These kinds of allegations often include a claim based on an alleged breach of the implied covenant of good faith and fair dealing. Carriers often argue that the alleged breach of the good faith covenant is precluded from coverage under the contract exclusion, while policyholders argue that the alleged breach of the implied covenant sounds in tort and therefore is not excluded.

The Magistrate Judge’s determination that the breach of the implied covenant represented a contract claim and therefore is precluded from coverage under the policy’s contract exclusion is interesting and relevant to this recurring coverage issue – although it should be noted that his determination in that regard expressly relied on Montana law and a recent decision by the Montana Supreme Court. In other contexts, the law applicable in the relevant jurisdiction might lead to a different result

Finally, the Magistrate Judge’s ruling presents the relatively rare occasion where the improper profit exclusion operates to preclude coverage. Although insurers often invoke this exclusion, it is relatively rare that there is an actual determination that the amount for which the insured was seeking indemnity represented a profit or advantage to which the insured was not legally entitled. While this application of this exclusion here is a reflection of the peculiar circumstances of the case, the circumstances do provide an illustration of how the exclusion operates and of the kinds of circumstances to which it would apply.

Special thanks to Mark Johnson of the Gregerson, Rosow, Johnson & Nilan law firm for sending me a copy of the opinion.

More About State and Local Government Securities Litigation Risk: In recent posts, I have noted the increasing involvement of state and local governments as defendants in securities enforcement actions and even in private securities litigation. In a September 27, 2013 Law 360 article entitled “Municipal Underwriters On SEC’s Fraud Radar” (here, subscription required) William E. White and Jeffrey A. Lehtman of the Allen & Overy law firm take a look at what they describe as the “notable uptick in municipal securities actions” by the SEC’s enforcement division against state and municipal government entities, as well as against municipal underwriters.

According to the authors, the SEC has “increasingly dedicated attention and resources to the municipal securities market, and there has been a corresponding uptick in enforcement actions involving municipal securities market participants.” The authors cite five cases the agency has launched since March 2013, including, among others, actions against the state of Illinois; South Miami, Florida; and Harrisburg, Pa.

The authors state that “there is every reason to believe that these cases are not a blip.” In addition to specific features of the Dodd-Frank Act (including the whistleblower provisions), the authors cite the increased public scrutiny that has filed in the wake of a number of high profile municipal bankruptcies. The authors conclude that “the public pressure for regulators to examine municipal finances, including the underwriting of municipal bonds, is greater than ever.”

In other words, though there may as yet still be a low level of awareness of the risk, there may well be further enforcement actions against state and local governments to come.

Court Preliminarily Approves a Mostly Stock Class Settlement: On September 26, 2013, Northern District of California Judge William Alsup preliminarily approved an unusual proposed securities class action settlement. The parties to the Diamond Foods securities class action had proposed to settle the case for a combination of $11 million in cash and the issuance to the class of 4.45 million shares of the company’s common stock.

The cash component of the settlement represented the amount of the company’s remaining D&O insurance. The stock component was worth about $85 million as of the date the plaintiffs moved for approval of the settlement. The parties explained the inclusion of the stock in the settlement as owing to the company’s poor financial condition. As Judge Alsup noted in his order preliminarily approving the settlement, “Given Diamond’s strained financial state and the uncertainty (over) lead plaintiff’s ability to collect on any judgment,” the decision to enter a settlement consisting mostly of stock was justified.

As Alison Frankel notes in a September 27, 2013 post on her On the Case blog (here), Judge Alsup did insist on a number of tweaks to the settlement, but “on the big question of whether it’s OK to compensate allegedly deceived shareholders with more stock in the company that supposedly lied to them, Alsup answered with a reluctant yes.”

My own concern when I first learned of this settlement was that the cash portion of the settlement would all go toward payment of the plaintiffs’ attorneys’ fees, while the class members would get stuck with only stock. However, Frankel notes that class action activist Ted Frank is arguing that the lead counsel fees ought to be paid in the same cash-to-stock ratio as the class’s recovery. As Frankel notes, “Knowing what they know about Diamond’s prospects, lawyers for the class probably aren’t thrilled about that. But considering who the judge is, they probably won’t have much of a choice.”

Can You Detect the Pattern?:

3. A season after losing 94 games, the Cleveland Indians win 92 games — including their last ten regular season games in a row — to clinch a wild card playoff berth.And the Cleveland Browns win their second game in a row, winning both with their third string quarterback. (Admittedly, this entry is here for the benefit of those few sports fans who may not follow Cleveland sports as closely as the rest of us do.)

Assessing U.S. Public Company Cyber Risk Disclosure Practices

By Kevin LaCroix on September 27, 2013

Posted in Cyber Liability

It has been nearly two years since the SEC Division of Corporate Finance issued its Disclosure Guidance on cybersecurity risks. During this period reporting companies have had the opportunity to incorporate disclosures in their reporting documents about the cybersecurity risks they face. To develop a picture of what companies are disclosing and what the disclosure suggests, the insurance brokerage firm Willis reviewed the cyber disclosures in the SEC filings of the Fortune 1000 companies. The August 2013 report based on that review can be found here.

As readers will recall, the SEC Division of Corporate Finance issued its Disclosure Guidance on cybersecurity in October 2011 (about which refer here). Among other things, the Guidance suggested that appropriate risk factor disclosures might include:

Discussion of aspects of the registrant’s business or operations that give rise to material cybersecurity risks and the potential costs and consequences;
To the extent the registrant outsources functions that have material cybersecurity risks, description of those functions and how the registrant addresses those risks;
Description of cyber incidents experienced by the registrant that are individually, or in the aggregate, material, including a description of the costs and other consequences;
Risks related to cyber incidents that may remain undetected for an extended period; and
Description of relevant insurance coverage.

Willis reviewed the 10-Ks and annual reports of the Fortune 1000 companies in order to assess the extent of cyber risks and exposures identified and the steps being taken to reduce the risks and exposures. The firm also compared disclosure practices between the largest 500 companies with the Fortune 501-1000 companies.

Among many interesting things, the report notes that a large number of companies have chosen to remain silent in their filing documents about cybersecurity risks – the filings of 12% of the companies in the Fortune 500 contained no cyber disclosures and the filings of 22% of companies in the Fortune 501-1000 contained no cyber disclosure. On the other hand, the majority of companies in both groups reported either that cybersecurity risks could “impact” or “materially impact” their businesses, or that they could “materially harm” or “seriously harm” their businesses.

Though many companies are now disclosing their concerns about cybersecurity risks, few of the companies disclosed that they had in fact been the subject of an actual cyber event. Only 1% of the Fortune 1000 disclosed a cyber event in their reporting documents. As the Willis report notes, this is “a seemingly low number given the number of attacks that appear in the press on a regular basis.” The report notes further that none of the companies that disclosed actual attacks included the associated cost, even though the SEC’s Guidance requests the dollar costs of the attacks that have occurred.

The report groups the kinds of cybersecurity risks that reporting companies specifically identified, noting that the most frequently used terms to describe the cyber exposures facing companies include “privacy/use of confidential data” and “reputation risk.” Interestingly, given recent prominent publicity, relatively few companies identified either cyber terrorism (less than 20% overall) or loss of intellectual property (less than 12% overall) as among the cybersecurity risks the companies face.

Even the SEC’s disclosure guidance specifically references the availability of insurance for cyber security exposures as among the appropriate topics for companies to address, only about 6% of reporting companies referenced insurance in their disclosures. The Willis report notes that based on the firm’s own informal survey of companies that many more companies purchase cyber insurance than the disclosure reports would suggest; for example, their survey of life and health insurance companies suggests that more that 60% of companies in that sector purchase cyber insurance, but only 1% of companies in that industry in the Fortune 1000 mentioned purchasing it in their SEC filings. The report observes that “many companies may be under-reporting insurance covering cyber-risks.”

The report interestingly analyzes by industry how different companies have characterized their cybersecurity risks, as well as the number and type of different kinds of cyber exposures the company faces and the loss control measures the companies have taken.

The SEC has not just received the companies’ filings, but, according to published accounts, the SEC has sent comment letters to approximately 50 companies asking them to supplement or amend their filings. As discussed here, the kinds of things on which the SEC has requested further elaboration include: that companies disclose whether data breaches have actually occurred and how the companies have responded to such breaches; that cybersecurity risks should be broken out separately and stand alone from disclosure of other types of risks because of the distinct differences between the risk of cybersecurity attacks and the risk of other types of disasters or attacks; and for companies that have suffered cyber breaches, additional information regarding why the public company does not believe the attack is sufficiently material to warrant disclosure.

By focusing only on the companies large enough to be included in the Fortune 1000, the report does not include any analysis of smaller companies’ disclosure practices. Just the same, the report does note perceptible differences in reporting and disclosure between the companies in the Fortune 500 and the Fortune 501-1000, which suggests that a review of companies outside the Fortune 1000 would likely find that disclosures are even less robust.

However, regardless whether companies are larger or smaller, the SEC has made cyber disclosure remains a priority item for the SEC. Indeed, in May 2013, Mary Jo While, the SEC’s new Chairman reported that she had asked her staff to evaluate the SEC’s current guidance for cybersecurity exposures and to consider whether more stringent requirements are necessary.

The likelihood is that cybersecurity disclosures will remain a priority. The one area that seems likeliest to receive attention is the issue of disclosure of actual breaches. The low level of reported breaches that the Fortune 1000 disclosed: the focus on the issue in the SEC’s comment letters; and the importance of the issue to shareholders and other constituencies all suggest that this will be an area of continued focus and scrutiny.

As always whenever there are disclosure requirements, there is always room for allegations that the disclosures are misleading or incomplete. Whether or not plaintiffs’ attorneys target companies for their cybersecurity disclosures, there is the possibility that the SEC may target a company for its cybersecurity disclosures as a way to highlight the importance of the issue and as a way to encourage other companies to focus more on their cybersecurity risk disclosures.

While the way that all of this will play out remains to be seen, it seems likely that the issue of cybersecurity disclosure will only become more important in the months ahead.

Special thanks to Jim Devoe at Willis for sending me a copy of the report.

InSights: What to Watch in the World of D&O

By Kevin LaCroix on September 27, 2013

Posted in Director and Officer Liability

Every fall, I put together a list of the current hot topics in the world of Directors and Officers (D&O) Liability Insurance. In the latest issue of InSights (here), I review the critical issues to watch now in the world of D&O. This year’s list includes several key regulatory and litigation developments as well as the latest evolving D&O insurance coverage issues. Readers of this blog will be particularly interested in the final entry in the article discussing the current state of the D&O insurance marketplace.

A prior version of the latest InSights article appeared in expanded form on this site, here.

Enough Said Yet?: Say on Pay Litigation May Have Had Its Day

By Kevin LaCroix on September 26, 2013

Posted in Executive Compensation

As I have noted in prior posts (most recently here), plaintiffs’ lawyers have rushed to file “say on pay” lawsuits, either after a negative advisory shareholder vote on executive compensation, or more recently before the vote occurs based on alleged deficiencies in the proxy materials related to the vote. In the latest in a lengthening string of cases, yet another court has now rejected the plaintiffs’ “say on pay” claims. As discussed below, a California state court judge has rejected plaintiffs’ claims pertaining to the executive compensation proxy disclosures at Clorox Corporation. While this ruling and the other prior decisions could discourage plaintiffs’ lawyers from pursing these kinds of say on pay cases, it seems likely that executive compensation-related litigation will continue.

A special hat tip to Jordan Eth and Mark R.S. Foster of the Morrison & Foerster law firm, who discussed the Clorox decision in a September 25, 2013 memo, here.

The plaintiff first filed his lawsuit in California (Alameda County) Superior Court on October 10, 2012, seeking to enjoin the shareholder vote on compensation issues schedule to take place at the company’s annual shareholders meeting. The plaintiff alleged that that Proxy Statement Clorox filed in advance of the shareholders’ meeting omitted material information related to executive compensation. On November 13, 2013, Superior Court Judge Wynne Carvill denied the motion for preliminary injunction, concluding that the plaintiff had failed to show irreparable harm if the vote went forward, and finding that the plaintiff’s “evidentiary showing with respect to the merits of his claim was meager, at best.” The shareholder vote took place the next day.

The plaintiff subsequently filed an amended complaint seeking to have the shareholder vote set aside. The parties then filed cross-motions for summary judgment relying on expert witness statements and deposition testimony. On September 23, 2013, Judge Carvill entered judgment in the defendants’ favor in reliance on his August 21, 2013 tentative statement of decision in the case. (A copy of the tentative decision can be found here.)

In concluding that the defendants did not have a duty to say more in the proxy statement, Judge Carvill noted that

What the Plaintiff has done is simply discovered what additional information was presented to the [compensation committee] and not included or summarized completely in the Proxy and then described why such information would be “helpful.” Were this court to find on this record that material information was withheld, it would be a license to file suit when anything was withheld, for any information can always be labeled as potentially “helpful.” Delaware law provides no such license.

The Court’s decision in the Clorox case follows on several other recent cases in which the courts have dismissed plaintiffs’ claims based on alleged deficiencies in the proxy statements, including the August 2013 California state court decision in the Symantec case and Northern District of Illinois Amy St. Eve’s April 2013 decision in the proxy disclosure-related say on pay case involving AAR.

As the MoFo attorneys noted in their recent memo, these courts rejected the plaintiffs’ proxy statement disclosure claims and recognized “that the asserted claims were trying to impose new obligations.” The memo’s authors comment that the defendants’ recent track record in these cases “should deter plaintiffs counsel from bringing disclosure claims against public companies.”

Just the same, executive compensation remains, as the authors note, “a hot topic for shareholders, for proxy advisory firms, and for the SEC.” For that reason, companies can “expect continued scrutiny of their executive compensation decisions and disclosures.” Even if lawsuits related to say-on-pay disclosures “abate in light of recent rulings,” it can be expected that “plaintiffs’ counsel will continue to look for and find ways to target companies and their directors in this type of litigation.”

One place that plaintiffs’ lawyers may turn next as they continue to agitate on executive compensation issues is the SEC’s new pay ratio disclosure requirements. As I discussed in a post earlier this week, the SEC’s proposed new rule will not be finalized until after the comment period, and are unlikely to go into effect until 2015 or 2016. Nevertheless, the very existence of disclosure requirements creates an opening for plaintiffs’ to allege that companies did not follow the pay ratio disclosure guidelines or used calculations and comparisons that made the disclosure misleading.

The current round of say on pay litigation may or may not have finally played itself out. Either way, it seems likely that we will continue to see plaintiffs’ lawyers attempting to pursue compensation related claims.

Portions of the JOBS Act are Now in Effect, But Crowdfunding is Still a Long Way Off: An important provision of the JOBS Act went into effect earlier this week, but there has been some confusion in the mainstream media that what went into effect was the Act’s crowdfunding provision. However, as discussed in detail in a November 24, 2013 post on the New York Times You’re the Boss blog (here), “equity crowfunding – as most people understand it – remains a long way off.”

What went into effect earlier this week is a new rule lifting the longstanding ban on “broadly advertising a private stock placement,” a restriction that has been in place since Congress enacted the Securities Act of 1933. The important thing to understand is that, with a few exceptions, this type of private offering can only be sold to an institutional investor or an accredited investor – someone meeting the specified net worth requirements. Under the new rules, companies may now advertise their private offerings widely, but they may only sell the stock to accredited investors.

The elimination of the general solicitation ban is something different than what is commonly known as crowdfunding. The JOBS Act crowdfunding provisions were meant to provide a way for ordinary people to make small investments in small companies. The law “limits how much investors can put into these stocks and restricts issuing companies to raising $1 million in a year.” The law also specifies the types of financial disclosures the company seeking to conduct a crowdfunding offering must provide investors.

None of these provisions apply to companies conducting a private placement offering. The company can “raise as much capital as they wish, [qualified[ investors can sink as much as they would like, and no financial disclosure is required.”

As the blog post points out, some of the confusion may have arisen from crowdfunding’s boosters, who are growing impatient that the SEC has not yet released its rules implementing crowdfunding. The SEC has “not yet even proposed these regulations, much less finalized them.” As a result, some of the platforms that were organized to try to facilitate crowdfunding are “attempting to turn themselves into platforms to facilitate private placements.” But if these would-be crowdfunding process participants are growing impatient, they may yet have much further to wait. It could be some time yet before the SEC releases its proposed crowdfunding rules.

In any event, if you have read this far, now you know that the recent implementation of the rules lifting the solicitation ban for private placements did not institute crowdfunding. It may be some time before crowdfunding gets off the ground. Now that you know, you have to make sure to point this out when you are around somebody that thinks that the recent JOBS Act provision implementation had anything to do with crowdfunding.

The SEC’s Proposed Pay Ratio Disclosure Requirements: Another Fine Mess

By Kevin LaCroix on September 23, 2013

Posted in Executive Compensation

Among the many measures Congress included when it enacted the sweeping Dodd-Frank Act in 2010 was a provision directing the SEC to require companies to disclose the ratio of CEO compensation to median employee compensation. The statutory provision, incorporated into Section 953(b) of the Act, reflected a perception that CEO compensation had gotten out of line and a hope that increased disclosure might encourage greater pay equity. Now, more than three years later, the SEC has finally gotten around to proposed rules to implement the statutory requirement.

The pay ratio disclosure requirements have produced a great deal of controversy and seem likely to be cumbersome and costly to implement. Whether the disclosure requirements, which will not take effect until 2015 or 2016, will produce any of the intended benefits seems uncertain at best.

Background

At an open meeting on September 18, 2013, and by a vote of 3-2, the SEC approved for the new proposed pay ratio rules for public comment. The SEC’s proposed pay ratio disclosure rule can be found here. The agency’s September 18, 2013 press release about the proposed new rules can be found here. Statement by the two dissenting Commission members, Michael Piwower and Daniel Gallagher, can be found here and here, respectively. The dissenting Commissioners’ comments make for interesting reading. The proposed disclosure requirements would apply to most public companies but will not apply to Emerging Growth Companies as defined under the JOBS Act; smaller reporting companies; and foreign private issuers.

In coming up with rules to specify how companies should calculate and disclose the compensation ratio, the SEC had to decide who does and doesn’t count as an employee, and how median employee compensation is to be calculated.

With respect to the question of who counts as an employee, the SEC’s proposed rule takes an all-inclusive approach. Because Congress required the pay ratio to express the ratio CEO compensation to the compensation of “all employees,” the proposed SEC rule includes all individuals employed by a company and any of its subsidiaries – including any “full-time, part-time, seasonal or temporary worker” as of the last day of the company’s prior fiscal year. Non-U.S. workers are included in the definition. The proposed rule also makes it clear that companies are not permitted to make full-time equivalent adjustments for part-time workers or annualizing adjustments for temporary or seasonal workers.

With respect to the method of calculating median employee compensation, the SEC opted not to mandate a specific methodology but to allow companies the discretion to use the most appropriate method of calculation base on the size and structure of its business and the way it compensates employees. This approach, which has been applauded by larger multinational employers, is intended to provide companies with greater flexibility in complying with the disclosure requirements. Whatever methodology a company uses, it must include in its pay ratio disclosure a brief narrative description of the methodology employed.

The pay ratio disclosure will be required in a company’s annual filing on Form 10-K and any proxy or information statement required under Regulation S-K to include compensation disclosure. Companies will have to comply with the rules in the first fiscal period after the effective date of the rules. Because of the period required for public comment and the likely volume of comments, it seems unlikely the agency will adopt a final rule before the end of 2013. If the rule is adopted in 2014, the earliest that companies with calendar year end fiscal years would have to report the pay ratio would be in their 10-K or proxy statement filings in 2016.

Discussion

While the pay ratio disclosure requirement may have derived from a belief that greater transparency might help to rein in CEO compensation and encourage pay equity, in the end, the pay ratio disclosure may prove to be of at best limited value. As the Troutman Sanders law firm noted in its September 19 2013 memo about the SEC’s new proposed rule (here), “the SEC’s decision to provide a flexible approach to the calculation means that there will not be any meaningful way to compare the pay ratios of peer companies.”

In addition, the ways that different companies staff their operations will also make company to company comparisons difficult. As discussed in a September 20, 2013 Wall Street Journal article entitled “It’s Hard to Slice and Dice CEO Paychecks” (here), companies’ pay ratios “will vary based on differences in how companies deploy their workforces and how they’ll crunch the numbers.” Among other things, the ratios at companies with predominantly U.S. employees will be lower than the ratios for companies with more lower-paid workers overseas. A study cited in the Journal article concludes that larger, more global companies will likely report “significantly higher pay ratios” than smaller, domestically focused firms. Ratios will also be skewed for companies that outsource work or that rely heavily on part-time and seasonal employees.

In other words, reported pay ratios will likely say as much or more about the size and business approach of the reporting company than it will about the company’s executive compensation practices. Indeed, there is every possibility that attempts to discern meaning from the pay ratio disclosure could, as the SEC itself said in its proposal, lead to “potentially misleading conclusions and to unintended consequences.” At best, as Commissioner Daniel Gallagher said in his dissenting statement, “the pay ratio computation that the proposed rules would require is sure to cost a lot and teach very little.”

As the Covington & Burling law firm noted in its September 19, 2013 memo about the proposed rule (here), the pay ratio disclosure requirement in the Dodd-Frank Act is “yet another example of Congress using the SEC to advance public policy goals not squarely rooted in the SEC’s historic mission of protecting investors.”

However, it is not as if there are no winners here; as Covington notes in its memo, the new rule will “certainly increase the costs and time required for companies to accurately prepare executive compensation disclosure” and will likely include the need “for many companies to retain outside advisors to assist in the statistical sampling and compilation process.”

So in the end, the congressionally mandated disclosure requirement is unlikely to produce meaningful information for investors to use in comparing companies but is likely to prove a boon for costly outside consultants. And I am just guessing here, but I suspect among the groups that will manage to extract a profit from the new requirements are plaintiffs’ attorneys.

Any time something is required to be disclosed there is an opportunity for plaintiffs’ lawyers to allege that the disclosure was incomplete or out of compliance with requirements. I think you can set a watch on it – during the first year after the disclosure requirements go into effect, there will be litigation in which plaintiffs’ lawyers contend that the pay ratio disclosure misled investors or was implemented in a way intended to deceive investors about the company’s executive compensation.

Along with “say on pay” and conflict minerals disclosure, the pay ratio disclosure requirement is yet another burden that Congress imposed on U.S. reporting companies in the Dodd-Frank Act. Somewhere along the line there needs to be some objective assessment of whether the putative value of these requirements that Congress is piling on to companies justifies the burdens the requirements impose on companies.

And Now — A Word About K&R: As part of my work in the management liability insurance arena, I am frequently called upon to help with the placement of kidnap and ransom (K&R) insurance. Despite my frequent involvement with placement of the insurance, and notwithstanding my more than three decades in the business, I have never actually been involved in a K&R claim. Frankly, other than as is required for the placement of the insurance, I generally don’t think about the product much at all.

I had my consciousness raised about K&R insurance earlier this year when I attended an educational event sponsored by one of the leading global insurers. The insurer was in the process of rolling out a new K&R insurance product and had invited to the session the security consultants whose services they would use for any K&R policyholder that experienced a kidnapping or hostage incident. The consultants’ description of their role – particularly their role in communicating with captors and negotiating the amount and process for payment of the ransom – was absolutely fascinating.

I had occasion to think about K&R insurance again while reading this past week’s issue of the Economist. An article entitled “A Holy Mess” (here) describes the September 6, 2013 kidnapping of Nigeria’s Anglican archbishop. The article goes on to explain that these kinds of abductions have become all too common in the country. During the first half of 2013, Nigeria had the most kidnap attempts in the world, accounting for 26% of all incidents globally. Mexico was second with 10% and Pakistan third with 7%.

The abductors obviously hope to be able to use the hostage as a means to extract a ransom payment. One of the things that the security consultants had said in the presentation I attended earlier this year is that while the captors’ initial demands may be outlandish, the amount of the actual ransom payments often is quite modest. The magazine article confirms this point, noting that “Captors usually start with huge demands before being haggled down. Settlements of $12,000 to $30,000 are standard, though there have been instances of people getting away with as little as $600.”

The services available under the provisions of the K&R policy, including in particular the services of security consultants to manage an abduction crisis, may well prove to be indispensable for the company and for the individuals involved. This is also an area where a more general risk mitigation approach can be helpful. As the magazine article notes, “a flashy car and swanky suit can enough to catch a villain’s eye.”

In any event, K&R insurance may not be a product that often attracts a significant amount of attention, but in certain situations it can prove to be critically important. Though, as the magazine article highlights, there are countries where the risks are particularly great, a K&R policy should be a part of every company’s insurance program, even for those companies whose personal do not travel to the riskiest countries.

Of Thee I Sing: I travel a lot for work. Fortunately, my extensive work-related travel does not require me to journey to any of the more notorious kidnapping hotspots. Those who follow this blog regularly know that I have enjoyed the opportunity over the last 24 months or so to visit some pretty great places – including, for example, Amsterdam, Barcelona, Munich and Beijing. However, I wouldn’t want to leave readers with the impression that my travel itineraries only include these kinds of glamorous destinations. My work requirements much more frequently require travel to many notably less glitzy locales.

Much of my day-to-day business comes from the Great Lakes and Ohio River Valley regions. I am much more likely to be in Ohio, Michigan, Pennsylvania and Indiana than I am in some foreign spot. Just this past week, I found myself in Elkhart, a surprisingly pleasant town in northeastern Indiana. The town went through some rough times during the economic downturn, but the local manufacturing businesses are definitely rebounding. The two-story brick storefronts that line the main street have been well-preserved. Parklands protect both banks of the St. Joseph River as it rolls through the center of town. I had lunch one day while there on the terrace of an upscale restaurant overlooking the river and the park. The town overall has a feel of friendly, slower-paced prosperity. My overall impression was that Elkhart would be a very nice place to live.

I have learned to be more attentive to the virtues of places like Elkhart. In part this is just the result of having lived a long time and gained perspective on life. But in part it is a result of a conversation I had a few years ago while I in a taxi cab trying to make my way into Chicago from O’Hare airport. The traffic was particularly heavy and my cab was barely moving. As we inched along, I struck up a conversation with the cab driver, who turned out to be a naturalized U.S. citizen of Pakistani origin. The cab driver told me about how he had left his home country and traveled to the U.S. some two decades before and how he had made a life for himself here.

The conversation took an unexpected turn when the cab driver asked me where I was from. When I told him I live in Ohio, he said to me that Ohio is the most beautiful state in the entire country. Now, I am a pretty big Ohio booster, but not even I am going to try to claim that Ohio is our country’s most beautiful state. I asked him why he thought Ohio was so beautiful, and he said that all you have to do is travel around the western part of the state. I asked him what he meant, and he said you have to understand that he comes from a crowded, hot and dry country. He said that when he travels to Ohio, he sees big, green, open, fertile, prosperous fields stretching all the way to the horizon. What could be more beautiful, he asked, than rich, fruitful, bountiful fields producing food that will feed thousands of people?

The cab driver was just getting started. He went on to say that he thought that a lot of Americans have no idea how fortunate they are to live in their country. He said the thing that he values the most is that people treat each other with dignity and respect. He said that of course there are people who have said hateful things to him because of his appearance or his accent. There are, he noted, ignorant fools everywhere. But generally everyone else is respectful. He described in tones of wonder how, when he visits his sons’ school, the teachers – the teachers! – say to him “Yes, sir “and “No, Sir.” He said that the teachers say to him that they want his sons to get the best education they can get – and they mean it. He added that it is the same if you go into a store. The store clerks are courteous and ask if they can help you. They say “yes, sir” and “no, sir” and they thank you for coming into their store.

It has now been several years since my ride with the talkative cab driver, but I reflect on his comments frequently. When I travel though Ohio’s and Indiana’s farmlands now I make a point to notice that the fields really are quite beautiful – particularly in late September when the trees lining the fields are starting to show their fall colors. And when I travel to places like Elkhart now, I do notice that in fact just about everyone is very friendly and courteous.

We are, after all, a nation of immigrants. Just about everyone’s family is from somewhere else. My wife and I each have a grandparent who immigrated to this country (in my case, two). Just the same, it does take some perspective to see how fortunate we are to be here. I am grateful that I had the chance to talk to the cab driver. I still am not prepared to argue that Ohio is the most beautiful state in the country, but I am glad I had a chance to see Ohio and this country through his eyes. It isn’t just that I learned what it means to him to be an American. It is that I learned a little bit more about what it means for all of us to be Americans.

I have, upon reflection, developed a theory about the cab driver. I now suspect that he tells every passenger that their state is the most beautiful state in the country.

Coincidentally, there was an article about Elkhart in the Saturday Wall Street Journal magazine supplement, WSJ Money. The article (here) describes how a reclusive resident who recently passed away unexpectedly left a fortune worth over $150 million to the town.

A Closer Look at JP Morgan’s $920 Million “London Whale” Regulatory Settlements

By Kevin LaCroix on September 20, 2013

Posted in Securities Litigation

As part of its September 19, 2013 entry into a total of $920 million in regulatory settlements related to the “London Whale” trading loss debacle, and as part of the SEC’s new policy requiring admissions of wrongdoing in certain “egregious” cases, JP Morgan provided the SEC with an extensive set of factual admissions. The company’s provision of the admissions could have significant implications for the continuing regulatory and litigation proceedings against the company related to the London Whale losses. The company’s admissions also have important implications for other companies about the SEC’s new policy requiring admissions of wrongdoing.

The SEC’s September 19, 2012 press release about the company acceptance of a $200 million penalty can be found here. The September 19, 2013 Cease and Desist Order entered in the SEC administrative proceeding against the company – to which the Annex with the company’s admissions is attached – can be found here. A September 19, 2013 statement from George Canellos, the co-Director of the SEC enforcement division about the settlement can be found here.

The Office of the Comptroller of the Currency’s September 19, 2013 press release announcing the agency’s entry of a $300 million civil money penalty against the company for “unsafe and unsound practices related to derivatives trading activities” can be found here. The Federal Reserve’s September 19, 2013 press release announcing its entry of a $200 million penalty against the company for “deficiencies in the bank holding company’s oversight, management, and controls” can be found here. The U.K. Financial Conduct Authority’s September 19, 2013 press release announcing its entry of a $220 fine for “serious failings” can be found here. JP Morgan’s own September 19, 2013 press release about the settlements can be found here.

The settlements relate to extensive trading losses that the bank incurred losses at its London trading desk in early 2012. The London traders’ positions had previously been profitable but as the gains turned to losses, the traders sought to hide the magnitude of the losses by deviating from prior practices in “marking” the value of their positions. The changes hid the existence and size of the losses – for a time. The company ultimately reported losses of greater than $6 billion and was forced to restate its previous published financial statements for the first quarter of 2012.

The Company’s admissions in the Annex to the Cease and Desist Order make for interesting reading. Among other things, the Annex admits (in paragraph 10) that the London traders “intentionally understated mark-to-market losses.” The Annex also shows that the bank’s own internal control processes to evaluate traders marks was inadequate, built on flawed processes, and compromised by dependence on input from the traders themselves. Concerns about the processes and about the valuations became apparent as counterparties began demanding collateral.

The Annex details a sequence of events showing that the concerns about the valuations were not sufficiently elevated to senior management, and then once management became aware of the concerns and began putting remedial steps in place, were not sufficiently elevated to the Audit Committee of the company’s board of directors.

Among other things, in the Annex J.P. Morgan acknowledged “that its conduct violated the federal securities laws.” The Cease and Desist Order recites a finding that the company violated the books and records provisions under Section 13 of the ’34 Act.

In his statement about the settlement, the SEC enforcement co-director said:

In addition to failing to keep watch over how the traders valued a very complex portfolio, JP Morgan’s senior management broke a cardinal rule of corporate governance: inform your board of directors of matters that call into question the truth of what the company is disclosing to investors. Here at the very moment JP Morgan’s management was grappling with how to fix its internal control breakdowns and disclose the full scope of its trading disaster, the bank’s Audit Committee was in the dark about the extent of these problems.

By not sharing these troubling facts with its directors, JP Morgan deprived them of information they vitally needed to make proper judgments about how to address the company’s problems – including what information could be relied upon as accurate and what information needed to be disclosed to investors.

While the various regulatory settlements resolve a host of proceedings against the company, other proceedings continue. Among other things, the CFTC’s enforcement proceeding is continuing, as is the DoJ’s investigation and the criminal proceedings against London colleagues of the “London whale” trader who allegedly participated in efforts to cover up the losses. In additional, the shareholder class action lawsuit filed against the company and certain of its directors and officers is also ongoing.

Though the Annex to the Cease and Desist Order contain extensive admissions from the company, the document is as noteworthy for what it does not contain as for what it does contain. Thus, while the company acknowledges that its conduct “violated the federal securities laws,” the company itself does not specify which laws it violated. The Order does state the conclusion that the company violated the books and records provision of the federal securities laws, but as Wayne State Law Professor Peter Henning points out in a September 19, 2013 column on the New York Times Dealbook blog (here) , this conclusion is of limited value outside the context of the administrative proceeding, since there is no private right of action for a violation of the books and records provision.

While the Annex details various failings by a group of persons described generically as “Senior Management,” the document does not specify which specific individuals where responsible for which misconduct. By using the rather vague group description, the Annex avoids saying that any specifically identified individual acted improperly or failed to act properly. Simply put, the Annex – and by extension – the settlement, does not hold any one member of the company’s senior management responsible.

Perhaps even more significantly, while the Annex contains extensive factual admissions, the Annex does not contain any conclusive language; there are no admissions, for example, that the company and of its senior officials acted with an intent to deceive or that they acted fraudulently or even recklessly.

As a result, the Annex, while undoubtedly useful to the regulators and claimants in the ongoing proceedings against the company, may not prove to be all that helpful in the end. For example, the Annex will support the plaintiffs in the ongoing shareholder action, but there do not appear to be admissions in the Annex that would in and of themselves establish liability under Section 10(b). There do not appear to be admissions that establish that the company or its senior officials acted with scienter.

As Professor Henning noted in the Dealbook blog, the admissions “will be of very limited utility to private parties suing the bank for violating the federal securities laws.” Indeed, in a September 19, 2013 post on her On the Case blog entitled “Don’t Get Too Excited About JP Morgan’s Admissions to the SEC” (here), Alison Frankel says that “JP Morgan has shown that it is possible to give the SEC an admission that will permit the agency to look tough without conceding much, if anything, in private litigation.”

Now that we have the JP Morgan settlement, with it admissions of wrongdoing in hand, along with the prior settlement the SEC reached with Harbinger (about which refer here), we can begin to assess what the SEC’s new policy requiring admissions of wrongdoing may mean for other companies going forward. It appears it will be sufficient to satisfy the SEC’s admissions wrongdoing requirement to provide extensive factual admissions without accompanying descriptive admissions about the factual misconduct and even without specific admissions of what laws the misconduct violated. It apparently will also be sufficient – at least to settle an administrative proceeding – for the company to admit wrongdoing without any specific member of senior management admitting misconduct or responsibility.

The SEC’s new policy requiring admissions of wrongdoing in certain cases is still new and it will undoubtedly evolve. Just the same, other companies facing an SEC requirement of admissions wrongdoing will be studying the JP Morgan settlement to see what will be sufficient to satisfy the requirement. As Alison Frankel put it on her blog post, “I suspect that future SEC defendants are going to look the JP Morgan settlement as a model for how to quench regulators’ thirst for blood without spilling a drop in parallel shareholder litigation.”

Context matters here. In a civil enforcement proceeding, a federal district court judge’s approval would be required to finalize the settlement. A judge might require more specific admissions or more direct admissions of individual wrongdoing. Because JP Morgan negotiated the settlement in an administrative action rather than a civil enforcement proceeding, no court approval is required. Based on this important context consideration, I would say that other defendants in administrative proceedings might try to use the JP Morgan settlement as a model; defendants in civil enforcement actions may have to be prepared to make more extensive concessions.

In my prior post about the Harbinger SEC settlement, I expressed concerns that the SEC’s requirement of admissions of wrongdoing could create significant D&O coverage issues and potentially could trigger the conduct exclusion typically found in most D&O insurance policies. While that concern still remains, admissions of the type JP Morgan entered could prove to present less of n insurance coverage concern. The JP Morgan admissions arguably contain no specific admission of criminal or fraudulent misconduct. There would appear to be less of a basis for an insurer to contend in reliance on the conduct exclusion that coverage is precluded. So if the JP Morgan settlement were to become a “model” it at least would appear to present less a D&O insurance coverage concern.

Background regarding the securities class action lawsuit arising out of the London Whale disclosures can be found here.

A Disaster Full of Durable Images: Whales, Teapots and Hedges: One of the aspects that has always made this situation interesting to me is the colorful name given the London trader whose losses cause all of these losses. As early as April 6, 2012, the Wall Street Journal was reporting that trading markets were buzzing about the outsized positions that a London trader was taking; the article itself noted that others in the market were referring to the trader as the "London Whale" in reference to the size of the trader’s positions.

The invocation of the Leviathan is not only the only colorful and enduring image from this debacle. In an earniing confernce call on April 12, 2012, JP Morgan CEO Jamie Dimon tried to downplay the publicity surrounding the London trader’s positions by describing the controversy as a "complete tempest in a teapot."

Yet less than a month later, on May 10, 2012, when the company was forced to admit that the London trader’s positions had caused the company what it then thought was only $2 billion in losses, Dimon said that the trading strategy was "flawed, complex, poorly reviewed, poorly executed and poorly monitored. The portfolio has proven to be riskier, more volatile and less effective an economic hedge than we thought.”

The D&O Diary

More and More Readers’ Mug Shots