In June, four blockbuster court decisions were issued that will reshape the U.S. Securities and Exchange Commission’s (the “SEC” or “Commission”) exercise of its authority in important ways. At the same time, regular business continued at the SEC as it brought a number of enforcement actions spanning several hot-button areas, including cybersecurity, artificial intelligence, and the registered investment adviser Marketing Rule. In this alert, we briefly summarize the top seven securities enforcement and litigation developments from the last month, including:
- Two seismic Supreme Court decisions overruling Chevron deference and reshaping administrative law;
- The Supreme Court’s recent decision in SEC v. Jarkesy;
- The Fifth Circuit’s ruling vacating the SEC’s new private fund rules;
- A novel action applying Exchange Act Section 13(b)(2)(B) in the cybersecurity context;
- An action targeting misstatements made by issuer regarding its use of artificial intelligence;
- A Marketing Rule action arising from misleading performance advertisements; and
- The $4.5 billion penalty agreed to by Terraform Labs and its founder following their April fraud verdict.
1. Pair of Supreme Court Opinions Overturns Chevron Deference, Invites Fresh Challenges
On June 28 and July 1, the Supreme Court issued a pair of decisions in Loper Bright Enterprises v. Raimondo[1] and Corner Post, Inc. v. Board of Governors of the Federal Reserve System,[2] respectively, which together rein in the administrative state with a paradigm shift in the review and challenge of administrative agency actions. The effect of both decisions will likely be an increase in challenges to agency actions across the country and, accordingly, divergent interpretations of the relevant statutes or regulations at issue as district and circuit courts engage in their own analyses.
With Loper Bright, the Supreme Court directly overruled Chevron U.S.A. Inc. v. Natural Resource Defense Council, Inc., a hallmark decision of administrative law which lent its name to the concept of Chevron deference. Chevron deference was the 40-year-old governing framework which instructed courts to defer to administrative agencies’ interpretations of their respective governing statutes when Congress had not spoken to the precise question at issue.[3] Now, courts facing an issue requiring interpretation of an ambiguous statute must, rather than defer to an agency’s “permissible” interpretation, use every tool at their disposal to determine the “best” meaning of the statute and resolve the ambiguity themselves. This is a significant transfer of interpretive authority away from administrative agencies to the judiciary.
Corner Post, in turn, significantly lessened the temporal and procedural barriers for litigants seeking to challenge a final agency action under the Administrative Procedure Act (“APA”). Previously, courts had interpreted 28 U.S.C. § 2401(a) to require claims brought under the APA to be brought within six years of the final agency action becoming effective—and thus, the plaintiff being injured—or else be barred by the statute of limitations.[4] One effect of this interpretation was that many older regulations were effectively unassailable, considered safe from challenge behind a lapsed statute of limitations. Corner Post dispensed with this. Now, a claim under the APA does not accrue until the plaintiff is actually injured by the final agency action. While would-be litigants who were injured by a final agency action more than six years ago may still be out of luck, Corner Post opens the door for new entities to form, become regulated and injured by a final agency action, and bring a suit challenging that action.
With Corner Post significantly lessening the procedural bars to challenging final agency actions, and Loper Bright lessening the deference owed to administrative agencies defending their interpretations in court, the authority of the administrative state continues to wane and an uptick in challenges to agency actions across the board appears likely. Corner Post may also spur a general deregulatory effect. Agencies may take longer to bring any particular action or promulgate a rule as they gather support for such action or rule, solicit additional input from regulated entities to lessen or mitigate potential challenges, and pare back the scope of rules so that they may withstand increased judicial scrutiny. These effects, in the aggregate, may diminish the ability of the Executive Branch to effect policy changes through administrative actions, as such actions are now subject to federal courts scrutinizing such actions within the courts’ “best” reading of the operative statute.
Click here to read this Willkie Client Alert analyzing the Supreme Court’s overruling of Chevron, along with the Court’s reasoning and the decision’s potential implications, in greater depth.
2. Supreme Court Curtails SEC’s Use of Administrative Proceedings with Jarkesy Decision
On June 27, the Supreme Court held in a 6-3 decision in SEC v. Jarkesy that the Seventh Amendment entitles a defendant to a jury trial when the SEC seeks civil penalties for securities fraud, unless the “public rights” exception applies.[5] With Jarkesy, the SEC’s ability to maintain securities fraud cases—for which civil penalties are frequently sought—before the SEC’s administrative law judges (“ALJs”) has been curtailed. It remains to be seen what impact Jarkesy will have on the bulk of the SEC’s securities enforcement docket, as the SEC has ceased bringing matters seeking civil penalties before its ALJs for some time.
Essential to the Supreme Court’s ruling was its interpretation of the Seventh Amendment to guarantee that a defendant has a right to a jury trial in suits at common law. The Court reasoned that the right to a jury trial includes all claims that are “legal in nature,” and is not cabined to common law causes of action which were recognized at the time of the Seventh Amendment’s ratification. To determine whether a suit is “legal in nature,” the Court instructed that courts must consider whether the cause of action resembles a common law cause of action, and whether the remedy sought is the sort traditionally obtained in a court of law. The Supreme Court found the SEC’s antifraud provisions were sufficiently analogous to common law fraud, and the civil penalties sought by the SEC were sufficiently similar to tort remedies traditionally imposed by Article III courts.
The Supreme Court also considered whether the “public rights” exception to Article III was applicable to Jarkesy’s case, ultimately holding that it was not. The “public rights” exception has previously been interpreted to permit Congress to assign certain adjudicatory matters to administrative agencies, rather than Article III courts, even though these administrative proceedings do not afford the right to a jury trial. Matters applying the “public rights” exception have previously included disputes regarding the collection of revenue, customs law, immigration law, relations with Native American tribes, and the granting of public benefits. The public rights exception did not apply to Jarkesy’s securities fraud action because the action “did not fall within any of the distinctive areas involving governmental prerogatives where the Court has concluded that a matter may be resolved outside of an Article III court, without a jury.”[6]
Click here to read this Willkie Client Alert addressing, in detail, the legal and procedural background, reasoning, and potential implications of the Jarkesy decision.
3. Private Fund Adviser Rules Struck Down by Fifth Circuit Panel
On June 5, a unanimous panel of judges on the United States Courts of Appeals for the Fifth Circuit vacated, in their entirety, major rules changes for private fund advisers adopted by the SEC in August 2023 following a vigorous challenge by a coalition of private fund adviser trade groups.[7] Had they been upheld, the private fund adviser rules (the “Final Rules”) would have substantially modified existing regulatory requirements and created new, significant, compliance obligations for advisers to private funds.
Central to the Court’s opinion was its finding that the SEC exceeded its statutory authority under the Investment Advisers Act of 1940 (the “Advisers Act”) in promulgating the Final Rules. The Court’s analysis focused on whether Sections 211(h) and 206(4) of the Advisers Act endowed the SEC with authority to promulgate the Final Rules, finding that they did not, and that in promulgating the Final Rules the SEC exceeded its statutory authority. The Court did not reach the other arguments challenging the Final Rules, which included arguments that the Final Rules were not a logical outgrowth of the previously proposed rules, were arbitrary and capricious under the APA, and that, with the Final Rules’ adoption, the SEC had failed to consider the Final Rules’ impact on efficiency, competition, and capital formation.
The holding that the SEC lacked statutory authority to promulgate the Final Rules under Sections 211(h) and 206(4) may have important implications for certain other proposed SEC rules. These other rules concern a variety of topics, including the use of predictive data analytics and outsourcing by investment advisers, and the proposed Safeguarding Rule that would amend the Custody Rule, Rule 206(4)-2.[8] The SEC has yet to decide whether to withdraw similarly proposed rules, modify them, or reopen the comment period for the proposed rules. Similarly, this ruling could implicate current SEC rules established under the authority of Sections 211 (h) and 206(4).
Click here to read this Willkie Client Alert breaking down the Fifth Circuit’s holding, its reasoning, and its implications in further detail.
4. Issuer Settles Disclosure and Internal Control Failure Charges Following Cybersecurity Incidents and Alerts
On June 18, the SEC settled charges against R.R. Donnelley & Sons Company (“RRD”), a provider of business communications services and marketing solutions, for disclosure and internal controls failures relating to a ransomware attack RRD suffered in late 2021.[9] According to the SEC’s Order, RRD’s “assets” included its information technology systems and networks hosting sensitive business and client data, which were compromised during the intrusions and their data exfiltrated.[10] The SEC found that RRD’s failure to mount a timely response to the intrusion was the result of insufficient cybersecurity-related internal accounting controls, constituting a violation of Exchange Act Section 13(b)(2)(B). RRD paid over $2.1 million to settle the charges.
This action is the latest instance of the SEC’s relatively novel use of Section 13(b)(2)(B)’s internal accounting controls provision to enforce cybersecurity disclosure and controls compliance. The SEC previously sought to enforce Section 13(b)(2)(B) in a similar manner in SEC v. SolarWinds Corp., though this claim, along with several other claims asserted by the SEC, was recently dismissed on July 18.[11] In SolarWinds, the SEC asserted SolarWinds’ failure to implement adequate cybersecurity controls for its key “assets,” its information systems, ran afoul of the internal accounting controls provision. Prior to the SolarWinds action, the internal accounting controls provision had not been employed to enforce cybersecurity controls.
The Court described the SEC’s interpretation of Section 13(b)(2)(B) extending to cybersecurity matters as “untenable.” The Court reasoned the historical application of the statute to internal financial accounting—rather than operational—matters, the sweeping implications such a reading would necessarily infer, and the history and purpose of the statute, which were enacted as part of the 1977 Foreign Corrupt Practices Act, well preceding any enterprise cybersecurity concerns, all weighed against the SEC’s interpretation.[12] As of the time of this alert’s publication, the SEC has yet to indicate whether it will seek to appeal the Court’s Order, in whole or part.
The Commission is not united regarding the application of Section 13(b)(2)(B) to cybersecurity matters. In a statement also issued June 18, Commissioners Hester M. Peirce and Mark T. Uyeda criticized the action against RRD essentially as an overbroad application of Section 13(b)(2)(B) to cybersecurity controls.[13] In their joint statement, they critiqued the Commission majority for having come to treat the “internal accounting controls provision as a Swiss Army Statute to compel issuers to adopt policies and procedures the Commission believes prudent.”[14]
Notably, the settled charges come years after RRD was no longer a publicly traded company. Though RRD was publicly traded at the time of the ransomware attack, RRD ceased being publicly traded mere weeks after the attack. This settled action comes nearly two and a half years after the company ceased being subject to various disclosure and controls obligations imposed under the federal securities laws.
The SEC’s Order also referenced RRD’s cooperation and remedial efforts, signaling the Commission’s commitment to considering and crediting such behavior when assessing penalties.[15] The Order noted RRD’s prompt notification to the staff of the ransomware intrusion, voluntary revisions of incident response procedures, adoption of new cybersecurity technologies, controls, and personnel, and cooperation throughout the SEC’s investigation.
Click here and here to read Willkie Client Alerts addressing the SEC’s settled action against RRD and its novel use of Section 13(b)(2)(B), as well as the recent SolarWinds decision rejecting this use, in further detail.
5. Startup Founder Charged With Securities Fraud in Latest AI-Washing Action
On June 11, the SEC filed charges against artificial intelligence (“AI”) recruiting startup founder Ilit Raz for making false and misleading statements regarding her company’s revenue, number of users, quality of customers, and most notably, the company’s use of AI in its core business operations.[16] This is the SEC’s latest action concerning a market participant’s statements regarding its utilization of AI in its business operations. It is also the SEC’s first AI-related action not brought against an investment adviser.[17]
Raz marketed her company, Joonko, as a tech platform that utilized AI to help match companies seeking to hire diverse, underrepresented candidates with such candidates. Raz allegedly solicited investors with claims that Joonko had over 120 client companies, tens of thousands of candidates, and over $500,000 in annual revenue, when none of this was or had been true. When probed by an investor regarding Joonko’s financials and customer contracts, Raz allegedly presented the investor with falsified documents that corroborated her prior misstatements. However, following additional investor pressure to validate Joonko’s financial figures and an investigation by Joonko’s board of directors, Raz allegedly admitted to falsifying the documents. Raz has been charged with violating Section 17(a) of the Securities Act and Section 10(b) of the Exchange Act and Rule 10b-5 thereunder. Raz is also facing a parallel criminal action in the Southern District of New York.
With this action, the SEC signals that its scrutiny of issuers’ AI-related statements is only picking up steam, and that initial enforcement efforts will not be limited to large, publicly traded issuers or tightly regulated investment advisers. Market participants of all sizes should take care to ensure that their AI-related statements and disclosures are accurate, and do not inflate or exaggerate their capabilities.
6. Latest Marketing Rule Action Charges Investment Adviser with False Advertisement of Fund Performance
On June 14, the SEC settled its latest Marketing Rule[18] action against a registered investment adviser for publishing misleading advertisements regarding the performance of a private fund the adviser served.[19] The advertisements, presented to prospective investors in the private fund, highlighted performance returns experienced by a single investor in the fund which, at times, differed substantially from and were significantly higher than, the overall performance of the fund and the returns experienced by other investors. The adviser agreed to pay a $100,000 penalty as a result of the misleading advertisement.
The SEC’s Order emphasized that the returns advertised and experienced by the particular investor were unavailable to other investors in the private fund.[20] Specifically, the advertised returns were obtained by an investor eligible for all of the fund’s investments, including several successful IPO investments. These successful IPO investments were not available to all other investors in the private fund due, in part, to the fact that several of the other investors were restricted from purchasing securities offered in IPOs under the Financial Industry Regulatory Authority Rules 5130 and 5131. The advertisements also contained no qualifications or disclaimers that the advertised returns had only been experienced by and were available to particular investors, and exceeded the private fund’s overall performance.
With this action, the Commission’s Marketing Rule enforcement efforts continue to gain momentum, building upon the second Marketing Rule sweep in April 2024. This action, which comes outside of a sweep, also indicates that market participants can expect additional standalone Marketing Rule actions to become more common.
Click here to read this Willkie Client Alert regarding a Risk Alert released earlier this year by the SEC’s Division of Examinations addressing Marketing Rule compliance.
7. Terraform Labs and Founder Agree to Pay Over $4.5 Billion Following Civil Fraud Verdict
On June 13, Terraform Labs PTE, Ltd. (“Terra”) and its Founder and CEO, Do Kwon, reached a settlement with the SEC to wind down Terra’s operations and pay over $4.5 billion in disgorgement, prejudgment interest, and civil penalties. The settlement comes two months after a jury found Terra and Kwon guilty of securities fraud.[21] Terra agreed to pay nearly $3.6 billion in disgorgement, over $466 million in prejudgment interest, and a $420 million civil penalty, while Kwon agreed to pay $110 million in disgorgement and over $14 million in prejudgment interest on a joint and severable basis with Terra, as well as an $80 million civil penalty. Kwon also agreed to transfer at least $204 million to Terra’s bankruptcy estate. The verdict and penalty arise from Terra and Kwon’s misrepresentations regarding the promised returns and stability of Terra’s flagship crypto asset and algorithmic stablecoin, UST.
While the penalty is substantial, it is unclear what portion of it will ultimately be paid. On January 21, 2024, months before the verdict and agreeing to the penalty, Terra voluntarily filed a Chapter 11 petition in the U.S. Bankruptcy Court for the District of Delaware.[22] Prior to reaching the above-discussed settlement, Terra estimated in an April 30 bankruptcy filing that it had approximately $430 million in assets against approximately $451 million in liabilities.
Click here to read this Willkie Client Alert addressing the SEC’s jury trial victory and initial penalty request.
Click here to download this article.
[1] No. 22-451.
[2] No. 22-1008.
[3] 467 U.S. 837 (1984).
[4] 28 U.S.C. § 2401(a) establishes a six-year statute of limitations applicable to suits brought against the United States.
[5] SEC v. Jarkesy, No. 22-859, Slip op. (S. Ct., Jun. 27, 2024).
[6] Jarkesy at 13-17.
[7] Nat’l Ass’n. of Private Fund Managers v. SEC, 5th Cir. No. 23-60471, available here.
[8] Conflicts of Interest Associated with the Use of Predictive Data Analytics by Broker-Dealers and Investment Advisers, Exchange Act Rel. No. 97990 (Jul 26, 2023), 88 Fed. Reg. 53960 (Aug. 9, 2024); Outsourcing by Investment Advisers, Advisers Act Rel. No. 6176 (Oct. 26, 2022); 87 Fed. Reg. 68816 (Nov. 16, 2022); Safeguarding Advisory Client Assets, Advisers Act Rel. No. 6240 (Feb. 15, 2023); 88 Fed. Reg. 14672 (Mar. 9, 2023).
[9] The SEC’s press release is available here.
[10] Section 13(b)(2)(B) requires issuers “devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that…(iii) access to assets is permitted only in accordance with management’s general or specific authorization…” (emphasis added). Similarly, Rule 13a-15(a) requires, inter alia, that issuers “provide reasonable assurance regarding the prevention or timely detection of unauthorized acquisition, use or disposition of the issuer’s assets that could have a material effect on the financial statements.” (emphasis added). Codified at 15 U.S.C. § 78m(b)(2).
[11] Opinion and Order, ECF 125, No. 1:23-cv-9518-PAE (S.D.N.Y. Jul. 18, 2024), available here.
[12] Supra Note 11 at 94-101.
[13] The Statement from Commissioners Peirce and Uyeda is available here.
[14] Id.
[15] The SEC’s Order is available here.
[16] The SEC’s press release is available here.
[17] In March 2024, the SEC brought settled actions against two investment advisers relating to false and misleading statements each adviser made regarding its use of AI in various investment processes. Click here to read this Willkie Client Alert discussing these actions in greater depth.
[18] The Marketing Rule refers to Section 206(4) of the Advisers Act and Rule 206(4)-1(a) thereunder.
[19] The SEC’s press release is available here.
[20] The SEC’s Order is available here.
[21] The SEC’s press release is available here.
[22] In re Terraform Labs PTE. Ltd., Ch. 11 Case No. 1:24-bk-10070 (BLS) (Bankr. D. Del. Jan. 21, 2024).
