Welcome to Saul Ewing’s Public Companies Quarterly Update series. Our intent is to, on a quarterly basis, highlight important legal developments of which we think public companies should be aware. This edition is related to developments during the fourth quarter of 2023. 

What You Need to Know: 

• The Securities and Exchange Commission (SEC) adopts amendments to the beneficial ownership reporting rules, including accelerated filing deadlines.
• A ransomware group filed a “Failure to Disclose” complaint with the SEC when its victim, a public company, did not disclose the group’s cyberattack within four days as required under new SEC regulations regarding cybersecurity incidents.
• Charter Communications Inc. (“Charter”) and the SEC entered into a $25 million settlement on the basis of Charter’s internal controls failing to adequately prevent or detect a misalignment between board authorization and the execution of a corporate action.
• The SEC published its enforcement results for fiscal year 2023 with the following key takeaways: even though more actions were filed, monetary settlements in those actions decreased; the whistleblower program has become a key enforcement tool; and the SEC continues to be active in pursuing enforcement particularly in the areas of cryptocurrency, cybersecurity, and environmental, social and governance (ESG).
• The SEC issues new and amended compliance and disclosure interpretations (C&DIs) related to the proxy rules and Schedule 14A.
• On December 19, 2023, the U.S. Court of Appeals for the Fifth Circuit issued an order in Chamber of Com. of the USA v. SEC (23-60255) vacating the SEC’s recently adopted share repurchase rule.

Accelerated Beneficial Ownership Reporting Under Schedule 13D and Schedule 13G

In October 2023, the SEC adopted amendments to the beneficial ownership reporting rules under Section 13(d) and Section 13(g) of the Securities Exchange Act of 1934 (the “Exchange Act”). The adopting release for the new rules can be found here: Final rule; guidance: Modernization of Beneficial Ownership Reporting (sec.gov). The revised Schedule 13D deadlines and the disclosure of derivative securities requirements are effective as of February 24, 2024, and the revised Schedule 13G deadlines will become effective September 30, 2024.

Beneficial Ownership Reporting

The new rule requires an initial Schedule 13D to be filed no more than five business days (rather than the former 10 calendar days) after the acquisition of five percent or more of any class of equity securities or the loss of eligibility to file on Schedule 13G. Amendments to Schedule 13D, where necessary, are now required to be filed within two business days (rather than the former “promptly”) after a material change in the previous Schedule 13D. 

For qualified institutional investors and exempt investors utilizing Schedule 13G, the initial Schedule 13G filings are now due 45 days after the end of the quarter where the investment caused the investor’s beneficial ownership to exceed five percent of the class. For qualified institutional investors an initial report or an amendment is due five business day after the end of the month where beneficial ownership exceeded 10 percent or the beneficial ownership of the investor increased or decreased by five percent. Other amendments are now due 45 days after the end of the calendar quarter where a change occurred, rather than the end of the year as in the old rule, but amendments are now only required for material changes in the facts previously reported. 

For Schedule 13G filers filing as passive investors, Schedule 13G must be filed no more than five business days after the acquisition of five percent or more of any class of securities. The amendments that are required for passive investors when they exceed 10 percent or their beneficial ownership increases or decreases by five percent are now required within two business days of the triggering event. Other amendments are now due 45 days after the end of the calendar quarter where a change occurred, rather than the end of the year as in the old rule, but amendments are now only required for material changes in the facts previously reported. 

Although the SEC explicitly added a materiality standard to the amendment triggering events for Schedule 13G, they also signaled that that same standards currently used to assess a “material change” for purposes of Schedule 13D amendments would apply to Schedule 13G. In that respect, Rule 13(d)-2(a) provides that a change of one percent or more of a class of securities is “material” and should be considered for Schedule 13G purposes as well. 

The SEC extended the filing date cutoff time for Schedules 13D and 13G from 5:30 pm eastern time (ET) to 10:00 pm ET.

Meaning of a “Group”

The SEC also provided additional guidance related to when a “group” has formed for purposes of beneficial ownership reporting. The SEC clarified that communications by two or more investors for the purpose of acquiring, holding or disposing of securities of an issuer may be sufficient to constitute formation of a group. However, whether a group has formed depends on whether they acted together for a common purpose of acquiring, holding or disposing of securities. This is a facts and circumstances analysis, but it does not hinge exclusively on the existence or absence of an express agreement. Investors who coordinate their actions or exhibit an informal agreement could be deemed to be a group. Finding the existence of a group will require evidence of a common purpose (such as an informal arrangement or coordination among the participants). 

The SEC does not consider a group to be formed by shareholders merely communicating among themselves about an issuer or its securities or jointly engaging in discussions with management without taking further action. A shareholder merely announcing its intention to vote in favor of another unaffiliated investor’s director nominees or shareholders jointly submitting a nonbinding shareholder proposal also does not, in and of itself, constitute the formation of a group. In contrast, the SEC notes that a group may be formed if an investor intentionally tips other investors about its planned Schedule 13D filing with the intention of causing other investors to make purchases of the issuer’s securities, particularly if the other investors do, in fact, make such purchases as a result of the tip. 

Cash-Settled Derivatives

The SEC also issued guidance on existing Rule 13d-3 related to cash-settled derivatives, clarifying when a person filing a Schedule 13D is required to disclose interests in derivative securities that use the issuer’s equity security as a reference security. These revisions are important for cash-settled security-based swaps and other derivatives exclusively settled in cash.

Machine-Readable Data Language 

Beginning Dec. 18, 2024, all Schedules 13D and 13G will be required to be filed using structured, machine-readable data language. Filings will be submitted through the EDGAR platform using XML-based language. Exhibits are excluded from this requirement.

Cyberattack Blackmail: MeridianLink Faces Reporting Controversy Following AlphV Ransomware Attack

In the previous edition of the Public Companies Quarterly Update (Q3 2023), we detailed the SEC’s enactment of new disclosure requirements designed to increase investor awareness of cybersecurity threats and material cybersecurity incidents. Notably, reporting companies must promptly disclose material cybersecurity incidents on a Form 8-K within four business days of determining that the cyber incident was material. The material incident disclosure requirements became effective on December 18, 2023.

On November 7, 2023, AlphV (also known as BlackCat), a ransomware group, successfully attacked the digital lending service provider MeridianLink, exfiltrating certain of the company’s files without encrypting them. After failing to engage MeridianLink in negotiations over the stolen data, AlphV posted the stolen data on its leak site. Notably, AlphV then went a step further by filing a report with the SEC alleging that MeridianLink failed to follow the new disclosure requirements when the company did not disclose the AlphV attack within the mandated four-day reporting period.

Ultimately, the merits of AlphV’s complaint may not hold weight with the SEC as it was filed in advance of the regulation becoming effective. Additionally, MeridianLink reported that its investigation into the incident had not found that any consumer personal information had been exposed — therefore, MeridianLink may have concluded it was not a material cyber incident necessitating disclosure even if the disclosure requirements had been in effect. The SEC declined to comment. 

AlphV’s audacious and brazen move highlights a perhaps previously unconsidered potential consequence of failing to make a timely disclosure of a material cybersecurity incident. Public companies should prioritize cybersecurity infrastructure by regularly fortifying their defenses and implementing advanced security measures, such as multi-factor authentication, firewalls, encryption protocols, employee awareness and training, and the like. Companies should also develop comprehensive incident response plans that contain predefined steps to be taken in the event of a cyberattack. This includes procedures for internal investigations, cooperation with law enforcement agencies, timely notification to regulators, and implementation of disclosure controls to ensure personnel involved in making materiality determinations for disclosure purposes receive information regarding cybersecurity incidents on a timely basis. 

Strengthening Corporate Governance: Insights From Charter Communications’ $25 Million SEC Settlement

The recent $25 million settlement between Charter Communications Inc. and the SEC has brought the interplay between corporate governance, compliance and securities law into the limelight. This case serves as a reminder to both public companies and those poised to enter the public markets that governance demands rigorous attention and precision.

Charter consented to pay a substantial civil penalty to settle charges of internal accounting control violations linked to its stock repurchase programs. The SEC’s inquiry, spanning from 2017 to 2021, uncovered that Charter’s trading plans adopted to effect its repurchase programs contained “accordion provisions” that conflicted with the stipulations of Rule 10b5-1. To establish the affirmative defense under Rule 10b5-1 of the Exchange Act, Charter needed to forgo any influence over the trades once plans were enacted. The “accordion provisions” could have been used by Charter to modify the scale and timing of stock buybacks effected pursuant to a trading plan after the trading plan was established. 

Notably, however, the SEC stopped short of accusing Charter of insider trading violations. Instead the SEC’s focus was on how Charter’s board authorized the stock repurchases, which included a condition that the repurchases be effected using trading plans that complied with Rule 10b5-1.

Charter’s misstep was the inclusion of “accordion provisions” within its trading plans, which permitted post-adoption adjustments, veering from the board’s established parameters that required compliance with Rule 10b5-1. The SEC contended that Charter’s internal controls were inadequate in preventing or detecting the misalignment between board authorization and the actual trading plans.

Section 13(b)(2)(B) of the Exchange Act mandates that public companies maintain robust internal controls, ensuring transactions are executed as authorized by management. The SEC zeroed in on this requirement, alleging Charter failed to maintain internal controls that enforced strict adherence to the board authorizations for the stock repurchase plans.

The SEC’s collection of a hefty civil penalty highlights the necessity for comprehensive internal controls that validate the execution of all corporate transactions, including share repurchases, within the bounds of authorizations and in compliance with any attached conditions.

The SEC’s scrutiny of Charter’s internal controls, extending beyond financial accuracy, signals a broader regulatory interest in enforcing strict internal control environments and potentially an appetite to address compliance issues beyond the bounds of securities laws. The SEC’s expansive interpretation of Section 13(b)(2)(B) to include monitoring for compliance with transactional authorizations beyond traditional financial controls sparked dissent from SEC Commissioners Hester Peirce and Mark Uyeda, who argued that the SEC was overreaching by conflating accounting and other internal controls.

Practically speaking, the message for companies from the settlement is clear: robust governance structures are essential to prevent compliance missteps from being characterized as securities law violations. In this regulatory environment, companies should proactively reevaluate and strengthen their internal controls and governance practices. Board authorizations should be precisely formulated, and management must strictly adhere to board directives, ensuring any transactional flexibility aligns with the board’s conditions.

SEC Announces Enforcement Results for Fiscal Year 2023

On November 14, 2023, the SEC published its enforcement results for fiscal year 2023. Below is a summary of the SEC’s latest enforcement trends.

The SEC filed 784 enforcement actions in fiscal year 2023, which cover a wide array of violations. The SEC obtained orders totaling $4.949 billion in financial remedies and distributed $930 million to harmed investors, marking the second consecutive year where distributions exceeded $900 million. Still, the total monetary relief was down by more than 23 percent from 2022. Even though the SEC filed more actions against public companies in FY 2023, monetary settlements in those actions decreased to $1.3 billion, the lowest total in the last eight fiscal years.

SEC actions against public companies and subsidiaries accounted for eight percent of the total number of standalone enforcement actions filed in fiscal year 2023. Charges against public companies in 2023 arose out of a wide range of alleged misconduct including fraud, deficient controls, and materially misleading statements.

Enforcement actions this year were focused on a set of categories consistent with previous years. Cases involving investment advisers and investment companies again constituted a plurality of the actions. But the SEC also prioritized crypto actions in 2023, bringing a number of new cases, including several against high-profile trading platforms. The SEC also initiated actions related to non-fungible tokens and issuers of cryptocurrency. The SEC also targeted popular media personalities for unlawfully touting crypto without disclosing to investors that the celebrities had been compensated to do so.

One of the prominent SEC enforcement themes was encouraging cooperation by the entities under investigation to efficiently promote compliance across the securities industry. The SEC rewarded proactive self-policing, self-reporting, and remediation of potential securities law violations, as well as meaningful cooperation with the SEC’s investigations.

The SEC has increased the scope of enforcement activity in the cybersecurity space. The SEC remains vigilant in ensuring that market participants reasonably disclose material cybersecurity risks and incidents. This area of enforcement seems to be one of the foci, with the SEC finalizing recent mandatory cybersecurity disclosures for public companies and proposing several cybersecurity and information safeguard rules for regulated entities. We detailed the new disclosure requirements in a previous edition of the Public Companies Quarterly Update (Q3 2023).

The 2023 SEC enforcement results highlight the growth of the SEC’s whistleblower program. In 2023, the SEC received more than 18,000 whistleblower tips—roughly a whistleblower tip every 30 minutes. This was up nearly 50 percent from the number of whistleblower tips in 2022. The SEC paid out nearly $600 million in whistleblower awards, including its largest-ever award to a single whistleblower of $279 million. The SEC also brought several enforcement actions intended to protect whistleblowers’ rights and their ability to report.

The SEC highlighted its ongoing focus on ESG enforcement actions. Several recent ESG enforcement actions suggest that there will be more scrutiny of social and governance-related issues with cases involving workforce-related risk factors.

New C&DIs Related to Proxy Rules and Schedule 14A

On November 17, 2023, the staff of the SEC’s Division of Corporation Finance issued new and revised C&DIs related to proxy rules and Schedule 14A. Below are summaries of the C&DIs, which are available on the SEC’s website here. 

C&DI 126.03 states that, for purposes of calculating the “10 calendar day” period in Rule 14a-6, the date of filing is day one pursuant to the “10 calendar day” period. For example, if the preliminary proxy statement is filed on Friday, October 20, 2023, then Sunday, October 29, 2023, would be day 10 for purposes of Rule 14a-6. The registrant may send the definitive proxy statement to security holders starting at 12:01 a.m. on October 30, 2023. The foregoing assumes that the preliminary proxy statement is submitted on or before 5:30 p.m. Eastern Time on October 20, 2023. If the filing is submitted after 5:30 p.m., the 10-day period does not start until the next business day, which would be Monday, October 23, 2023.

C&DI 132.03 relates to Rule 14a-12, which permits solicitations before the furnishing of a proxy statement, provided that, among other things, written soliciting material includes the required participant information or a prominent legend advising shareholders where they can find that information. This C&DI states that general references in a legend to filings made or to be made by the soliciting party or participants do not sufficiently advise shareholders where they can obtain the required participant information. The SEC states that the legend should (i) clearly identify the specific filing(s) where participant information appears (including by filing date); (ii) clearly describe the specific locations of the participant information in such filings, whether by reference to the relevant section headings, captions or otherwise; and (iii) include active hyperlinks to the referenced filings, when possible.

C&DIs 139.07 and 139.08 relate to Rule 14a-19I(7), which requires a universal proxy card to prominently disclose the treatment and effect of a proxy executed in a manner that grants authority to vote “for” the election of more nominees than the number of director seats up for election (an “overvoted proxy card”) or fewer nominees than the number of director seats up for election (an “undervoted proxy card”). C&DI 139.07 states that a soliciting party cannot rely on discretionary authority to vote the shares represented by an overvoted proxy card on the election of directors. The shares represented by an overvoted proxy card can be voted on other matters included on the proxy card for which there is no overvote and can be counted for purposes of determining a quorum. C&DI 139.08 states that the shares represented by an undervoted proxy card can be voted in accordance with the shareholder’s specifications, so a soliciting party cannot rely on discretionary authority to vote the shares represented by undervoted proxy cards for the remaining director seats up for election.

C&DI 139.09 states that a soliciting party may use discretionary authority to vote the shares represented by a signed but unmarked proxy card in accordance with that party’s voting recommendations because the shareholder has not specified any choices. This C&DI notes that Rule 14a-19I(7) requires that a universal proxy card prominently disclose the treatment and effect of a proxy executed in a manner that does not grant authority to vote with respect to any nominees. 

C&DI 151.02 discusses a situation where a registrant needs to solicit security holder approval for the authorization of additional shares of common stock following an acquisition of another company in a transaction (i) that did not require security holder approval and (ii) where a portion of the consideration consists of securities that may be converted into shares of the company’s common stock. This C&DI states that a proposal “involves” another matter within the meaning of Note A of Schedule 14A when information about the other matter that is called for by Schedule 14A is material to a security holder’s voting decision on the proposal presented, which ultimately depends on all the relevant facts and circumstances. The authorization of additional shares of common stock is an integral part of the acquisition because it is necessary for the registrant to meet its obligation under the convertible securities issued as consideration for the acquisition. Therefore, the proposal to authorize additional shares of common stock “involves” the acquisition. In such circumstances, the registrant would have to include in the proxy statement information about the acquisition called for by Schedule 14A, unless such information has already been disclosed or sufficient time has passed so that the registrant’s historical filings fully reflect the acquisition.

U.S. Court of Appeals for the Fifth Circuit Vacates the SEC’s Share Repurchase Rule

On May 3, 2023, the SEC adopted rule amendments designed to enhance disclosure around share repurchases, or buybacks, by certain corporate issuers and closed-end funds. We wrote about the final rules in detail here, but in summary they would have required issuers to disclose the reasoning behind their share repurchases as well as day-to-day repurchase data on a quarterly basis.

During the rulemaking process the SEC indicated in its proposing release that there were certain instances where it was unable to quantify the economic effects of the rule, and when that was the case it “provide[ed] a qualitative assessment … and encourage[d] commenters to provide data and information that would help quantify the benefits, costs, and the potential impacts … .” The U.S. Chamber of Commerce, Longview Chamber of Commerce and Texas Association of Business (collectively, the “Petitioners”) submitted several comment letters and participated in a number of meetings with SEC staff during the comment period. The Petitioner’s comments offered feedback on methods that might be used to quantify the economic effects of the proposed rules. The SEC, however, did not incorporate any of the Petitioner’s suggestions into its analysis, and continued to maintain in the final release that many of the rule’s economic effects on competition, efficiency, and capital formation could not be quantified.

Shortly after the final rules were adopted, the Petitioners filed a petition for review with the U.S. Court of Appeals for the Fifth Circuit (the “Court”), alleging, among other things, that the SEC acted arbitrarily and capriciously in adopting the rules without considering the Petitioners’ comments, conducting a proper qualitative analysis or adequately substantiating the rule’s benefits. See Chamber of Com. of the USA v. SEC (23-60255). Where an agency is found to have acted arbitrarily or capriciously, the Administrative Procedure Act (APA) requires that a reviewing court set aside that agency’s actions.

In its analysis of the Petitioners’ arbitrary and capricious claim the Court concluded that, as a general matter, the SEC is not required to undertake a quantitative analysis to determine a rule’s economic impact. However, given that the SEC encouraged commentators to provide data and information to help quantify the rule’s economic impact, as well as the fact that the SEC indicated in both the proposing and final releases that it had attempted to quantify economic effects “whenever possible,” the Court concluded that the SEC failed to properly consider the Petitioners’ comments explaining how it could quantify the rule’s economic effects. In addition, the Court found that the SEC failed to substantiate the rule’s benefits and costs by inadequately substantiating the rule’s proposition that opportunistic or improperly motivated share repurchases were a genuine problem.

As a result, on October 31, 2023, the Court held that the SEC acted arbitrarily and capriciously in violation of the APA and issued a limited remanded directing the SEC to correct the rule’s defects within 30 days of its order. On November 22, 2023, the SEC issued an order postponing the rule’s effective date. The Court’s 30-day remand period expired on November 30, 2023, and, on December 19, 2023, the Court issued an order vacating the SEC’s share repurchase rule.

Closing Thoughts

The SEC continued to be busy on both the rulemaking and enforcement fronts on these and other matters throughout the fourth quarter of this year. This update is not intended as a substitute for individualized legal advice.