By Lene Powell, J.D.
SEC Chair Gary Gensler intends to move forward in 2022 with regulations on cybersecurity and climate disclosure, but it is not clear he can get rules finalized this year, a conference panel of former SEC officials agreed. The panel also discussed prospects for other possible rulemakings including proposals relating to share buybacks, 10b5-1 trading plans, and SPACs. In addition, former Co-Director of Enforcement Stephanie Avakian also discussed current SEC enforcement trends under Director of Enforcement Gurbir Grewal.
The panel, “The SEC in 2022”, was held at the 49th Annual Securities Regulation Institute hosted by the Northwestern University Pritzker School of Law. The panel was moderated by former SEC Commissioner Robert Jackson, Jr. Panelists included four former SEC officials: MaryJo White (chair), Troy Paredes (Commissioner), Bill Hinman (director of Division of Corporation Finance), and Stephanie Avakian (co-director of Enforcement).
Cybersecurity. The panel first jumped in on the topic of cybersecurity, about which Chair Gensler had earlier delivered a keynote address. Gensler discussed the possibility of updates to Regulation SCI and Regulation S-P with the aim of improving “cyber hygiene” and data privacy practices by financial infrastructure, investment funds, investment advisers, broker-dealers, and public companies.
White noted that Regulation SCI was adopted during her tenure and requires financial infrastructure entities to comply with requirements relating to cybersecurity policies, procedures, and remediation. White believes Reg SCI has been “quite effective and important.” Updates to cyber hygiene and customer privacy for financial infrastructure, investment funds, investment advisers, and broker-dealers would all be good, said White.
However, prescriptive rules to mandate cybersecurity risk disclosures for public companies would be a “heavier lift,” said White.
“If there were to be a mandated rule on the timing of disclosure of a cyber incident for public companies, then both as an authority matter and as a policy matter, the SEC had better be careful about not doing more harm than good,” said White.
White thinks any rules would take time and might not be able to be completed in 2022.
In Hinman’s view, cybersecurity rules are on the “short term agenda” and Gensler will take this on in 2022. He observed that the subject is listed on the Regulatory Flexibility Agenda, and it is likely an area where it is easier to develop consensus than some others. Hinman recalled that the SEC reformulated guidance in 2018, and said it would be challenging to move from a principles-based approach to prescriptive requirements. He has heard there will be a focus on the timing on reporting of breaches. There has also been discussion of making breach notification a Form 8-K event and of prohibiting trading at the executive director level upon learning of a breach.
Taking a broad perspective, Paredes said it is important to think through not only what disclosure requirements should be, but also how requirements might affect companies substantively. New requirements might cause companies to examine their current controls and ask, so what do we do? How do we govern? And if we're going to have to make disclosures, do we want to reassess what we do?
Another question in any cybersecurity proposal is regulation of third-party service providers, said Paredes. He believes there are practical questions about how to regulate those entities, as well as legal questions about the limits of SEC authority.
White agreed there are questions about limits on the SEC’s authority to regulate third party providers, and said the SEC needs to focus on areas in which it has expertise.
Jackson concurred with the point about the SEC needing expertise, but observed that the SEC could draw on the expertise of fellow agencies.
On the enforcement side, Avakian pointed to two “noteworthy” cybersecurity cases brought last year. In her view, the SEC intends these cases to “send a message” to registrants. Of the two, Avakian found First American particularly interesting because the SEC did not allege that the company’s disclosures were actually wrong relating to cybersecurity vulnerabilities. Rather, the SEC alleged that controls and procedures were not reasonably designed to ensure management had all the relevant information, and that management therefore could not evaluate whether to disclose certain information. Avakian observed that the SEC order quoted extensively from the 2018 cybersecurity guidance.
The other notable cybersecurity case was Pearson, which Avakian viewed as more of a “regular way” misstatements case. The allegation was that the company discussed as a risk factor the hypothetical risk of an incident, when in fact a breach had already occurred. Avakian noted the SEC has brought a handful of other risk factor cases along these lines, including one against Facebook.
Climate disclosures. Another area where the SEC is expected to propose rules is climate disclosures. Jackson said his understanding is that there will probably be a climate disclosure proposal in the first quarter of the year. According to Jackson, all can agree that the climate crisis we face is an enormous, pressing problem. The question is what the role of the SEC is in this space and how the Commission can best execute it and serve investors.
Taking a big picture view, Paredes said that for any disclosure rule, it is important to consider whether it is workable, whether it makes sense in terms of costs and benefits, and whether it results in useful information for investors. Merely requiring more disclosure does not mean the disclosure will meet the objective it was designed for. Moreover, a disclosure potentially creates a misimpression or misunderstanding that might lead investors astray in an unintended way.
Hinman said the question is whether the existing ruleset is sufficient, adding that the approach he took as CorpFin director is narrower than what Gensler has expressed. Hinman said if he were developing a rule, he would look to more of a SASB approach. In that view, disclosures are always grounded to the question of whether the disclosure is material to the company's financial condition and results, and to what is material to investors from a financial perspective.
Hinman added that climate disclosures may be burdensome for companies to prepare. In particular, if Scope 3 carbon emissions are being considered (relating to assets and activities not controlled by a company), he hopes the SEC will take into account the resources needed and consider exemptions for smaller companies. In terms of getting the rule right, Hinman said the SEC lacks engineering expertise. On the issue of timing, Hinman said that publication in the Federal Register starts the Congressional Review Act ticking, and there may be a new Congress after the mid-term elections, opening the possibility for Congress to set a rule aside. The final rule may have to survive scrutiny by the next Congress, said Hinman.
White said that not only can the Congressional Review Act “come back to bite you,” but rules can always be challenged no matter what and will be very carefully scrutinized on a cost-benefit basis. In White’s view, the two diciest issues for a climate rule are Scope 3 and auditor attestation. Scope 3 is dicey because of how difficult it is, perhaps how meaningful it is, and certainly how costly it would be to impose a requirement on public companies to figure it out. On the attestation issue, for disclosures to be “decision-useful,” they need to be reliable. But an attestation requirement raises the difficulty level, said White.
“This is not easy to do well, to have it be sustainable and be meaningful. So it's a very heavy, heavy lift,” said White.
Jackson agreed that for disclosures to be meaningful to investors, they need to be reliable. That will require the help of auditors, he said.
Rule 10b5-1 trading plans. Turning to an area where new rules have already been proposed, Jackson raised the topic of Rule 10b5-1. He noted that an academic paper by Todd Henderson and Alan J. Linzer found that executives profit even more with 10b5-1 trading plans than they do without, because they cancel trades that turn out to be disadvantageous. He asked about reaction to the proposal.
Avakian said the issue has been kicking around for awhile and the idea of refreshing Rule 10b5-1 is fairly bipartisan, in her view. She observed that the rule is 15 or 20 years old at this point, and previous Chair Jay Clayton discussed it during his tenure, in addition to Gensler talking about it currently.
One important aspect is that the protection in Rule 10b5-1 is an affirmative defense, not a silver bullet, said Avakian. If somebody enters into a 10b5-1 plan while they have material nonpublic information and starts trading tomorrow, enforcement would consider that factor. So from an enforcement perspective, the regime does not change, said Avakian.
On the scope of the rule, Hinman said the requirements for the affirmative defense are fairly objective, even in the proposed rule. However, Hinman does suggest a couple of “tweaks.” One relates to the requirement that the plan be operated in “good faith,” which he thinks is so broad and hard to establish that it may defeat the purpose of the rule. It may cause people to stop using 10b5-1 trading plans, he said.
Another possible sticking point for Hinman is a requirement that when either the issuer or the executives enter into contracts or plans or arrangements for the purchase or sale of securities, that will trigger a quarterly disclosure requirement, regardless of whether it was meant to be a 10b5-one plan. Read broadly, almost any arrangement a company enters into to potentially sell shares that then gets modified would require quarterly disclosures. That could be a burdensome in practice, because companies might have transactions that are important strategically but do not necessarily have material impact in the market, said Hinman.
White said it is important to allow enough time for comment, and also to consider whether the rule is too burdensome. She believes market integrity is enhanced by having a good 10b5-1 trading plan rule. If the rule is unworkable, people just will not use those plans. In particular, the requirement of operating in good faith throughout the period goes beyond the idea of doing the plan right and leaving it alone, unless the person is ending it or starting a new one. It is important that the rule be workable, said White.
Jackson pushed back on the good faith element, stating that the evidence shows that people are not leaving plans alone. Instead, they are canceling trades that would be disadvantageous for them.
Jackson questioned how much time is needed for comment. Lobbyists work quickly, he said. White responded that while she sympathizes with Gensler, one of the goals of a longer comment period is to pull in comments from those who do not have highly paid lobbyists. Also, it is important to give commissioners enough time to consider the proposal and weigh in. Jackson replied that when he was on the Commission, commissioners had to to get their comments in within 30 days. And if commissioners get 30 days, then 30 days is plenty of time for lobbyists like SIFMA. White broadly concurred and said that extensions can be a delaying tactic. However, she believes it is important to give a thoughtful period for staff to analyze the proposal.
Share buybacks. Turning to the recent proposal on share buybacks, Jackson explained that the proposed rule would create a new Form SR, which would provide next-day reporting for issuers engaged in a repurchase program that is a stock buyback. Jackson added that there has been academic study of situations where companies have announced and then not finalized buybacks. So that might be part of what the Commission has in mind, said Jackson.
Hinman said he has not looked at it closely, but making it more burdensome to buy back stock is not the right idea generally. It is just one way for companies to return capital to shareholders, and a relatively efficient way, he said.
White said that greater transparency and more frequent reporting on share buybacks is a good idea. However, she thinks that, unfortunately, what has motivated the rule is a political hot button, and she worries that the net effect of the rule might be to discourage repurchases of stock. That would be bad for investors, she said.
Paredes agreed that that is the big question, whether the proposed rule would discourage stock buybacks. The answer is not clear, which is part of why it is important to have an adequate notice and comment period. He added that buybacks merely return capital to investors, which can then be recirculated throughout the economy and be put to other productive uses.
SPACs. On the subject of special purpose acquisition companies (SPACs), Jackson noted that the asset class has existed for a long time, but he does not think there has ever been this much “dry powder” before. There is more than $125 billion currently sitting in SPACs, which has to either get put to work in 2022 or get sent back to investors.
Avakian thinks the SEC will have its eye on SPACs in 2022. She agreed that there is a lot of activity in the space, with a tail resulting from a lot of transactions in the last 12 to 18 months. In particular, the SEC is looking at whether disclosures are accurate, both at the time of the SPAC IPO and regarding the acquisition of the target. She thinks we will see more enforcement in this space.
Hinman said the important question for the SEC is why have so many people chosen this way of going public? Does it say something about the public offering process? He thinks part of the answer may involve the ability to make forward-looking projections. Rather than preventing that altogether and going toward the regular IPO process, where information is not shared because of litigation concerns, perhaps staff could work to bring crazy projections back to Earth and make them actually useful, said Hinman.
Private markets. On the topic of private markets, Hinman said they are not reflected very extensively in the ruleset. One item on the Regulatory Flexibility Agenda is Rule 12G, relating to beneficial ownership of securities and holding in the name of a nominee. But generally, Gensler’s remarks have been narrow on the subject of private markets, and his focus is more on fund investment and making sure fee structures are transparent and fair, said Hinman.
Hinman thinks a number of factors are keeping companies in the private market, including the difficulty of meeting quarterly results and expensive compliance costs for public companies. Most companies that go private do it to restructure, to invest in and divest from different parts of the business, and then often come back a few years later after that sometimes painful process as a more valuable company. You do not want to make that process more difficult, said Hinman.
Hinman added that when the SEC adopted rules on harmonization of private placements, the idea was not to make it easy for big companies to raise money in the private markets. Big companies have the resources, ability, and knowledge to raise money. Rather, the issue was that the rules had gotten so complex that it was hard for small companies to go public. The reform was intended to address that.
Jackson replied that it sometimes seems the SEC is measured by the number of publicly traded companies, and he thinks that is a mistake. According to Jackson, a new paper is coming out that points to the contributing effect of the National Securities Markets Improvement Act of 1986, which allowed private companies to get much larger than they had ever been in the history of American capital markets.
Paredes said the large size of the private market raises questions about disclosure and whether investors in those markets need additional information to make informed decisions. Another question is the impact of private markets. On that point, Paredes said there is often a sense that capital formation is somehow equated with what is good for issuers. But it is important to stress that capital formation is also good for investors. It allows the company they have invested in to have the opportunity to invest in the business and grow, whether as a private or public company.
Hinman agreed that capital formation is also beneficial for investors. He also thinks it is benefits investors to be able to participate in the private markets. If they cannot invest in the private markets, does that exacerbate income inequality? Should people be able to have a 401k that grows as rapidly as the overall capital markets are growing? One way of doing that would be to allow more intermediated investments in the private space for retail investors. Many public funds have a 15 percent limit on how much they can invest in private enterprises, and that may limit portfolio performance, said Hinman.
Enforcement under Director Grewal. Jackson asked Avakian about what messages the bar has gotten from Enforcement Director Grewal about what his priorities are likely to be, and how she is counseling clients about enforcement this year. Avakian ticked off several points.
First, Grewal and Deputy Director Sanjay Wadhwa have talked about empowering Enforcement staff to make decisions independently. Grewal is making a concerted effort to push down more of the substantive decision-making to staff, on the basis that front-line staff is in a better position to consider a lot of issues, said Avakian.
For example, Grewal has said that, in many instances, potential defendants who are recipients of Wells notices should not necessarily expect to get a meeting with the director or the deputy director. Senior officers across the Division are in a better position to know the cases better, or are in a better position to make determinations about enforcement recommendations. Grewal has also said he will defer to staff on the degree and quality of cooperation credit.
Second, Avakian discussed Grewal’s approach to penalties and recidivism. Grewal has said the Division will seek higher penalties against repeat offenders. But what does that mean? Does that mean the same set of facts, same type of circumstances, same violation by the same entity? Or does it mean a laundry list of regulatory violations added up? Avakian observed that some larger financial institutions have hundreds of thousands of people, so they are always going to have regulatory violations. Given that the violations are not apples to apples comparisons, how will these be considered? Avakian said she thinks it will probably end up somewhere in the middle, but it remains to be seen.
Third, Avakian noted that Grewal has talked about the need for proactive compliance. That is, the Division is not looking for check-the-box compliance. Instead, they are looking for registrants to assess their risks and adapt.
Fourth, Avakian observed that Grewal has talked about having a greater focus on admissions and using the admissions tool more often. The first admissions case of Grewal’s tenure just came down in the JPMorgan text messaging case, in which the firm was fined $125 million for widespread recordkeeping failures in which employees regularly communicated about business matters on their personal accounts. These lapses allowed employees to avoid having their communications surveilled and retained.
Finally, Avakian highlighted that Grewal has talked about gatekeepers—lawyers, accountants, and others—and has said the SEC is going to test and push on advice of counsel.
White concurred that Grewal has touched on all the themes that make for a strong enforcement program. On admissions, White said one question is what exactly is admitted. Is a fraud charge admitted to, which may have ramifications for private civil cases? Or are they admissions of fact? How tough are the admissions?
Other areas where White foresees a possible tougher enforcement stance include greater use of officer and director bars, higher corporate penalties, and a different approach to disqualification waivers. But in general, she doesn’t expect to see any “earth-shattering” changes.
SEC under a possible Republican Congress. On the topic of how a potential congressional turnover would affect the SEC, White said that to the extent any of the agenda relies on congressional action, it probably would not happen in the event of a turnover. Congress could also affect rulemaking with a line-item budgetary limit, for example by prohibiting the SEC from expending any resources on implementing climate disclosure rules. A previous example of this was the use of riders to prevent the SEC from implementing rules on political spending disclosure.
White said she dislikes the use of congressional budgetary authority to control agency rulemaking. She believes the independent agencies should be allowed to carry out their independent function, with the expertise that underlies that. But that is not how it works, said White.
“I think Congress needs to stay in its lane. But it is a reality of Washington, that they have that power,” said White.