On March 12, 2018, the US Securities and Exchange Commission (SEC) brought an action against Credit Karma, Inc., a Silicon Valley-based fintech company, for issuing stock options to its employees in violation of US securities laws. The action resulted in a cease and desist order and settlement imposing a $160,000 penalty on the company. Like so many other private companies, Credit Karma sought to rely on Rule 701 promulgated under the Securities Act to provide equity-based compensation to its employees. However, in this case, the company failed to comply with certain disclosure requirements (out of confidentiality concerns) including providing financial statements and risk disclosures after the aggregate sales price of the stock options issued exceeded $5 million in a 12-month period. This latest action by the SEC is significant given the prevalent use of and reliance upon Rule 701 by private companies to retain employees. The SEC began an investigation into Rule 701 option practices of private companies in mid-2016, and we suspect that this may be just one of many enforcement actions that the SEC may bring with respect to other late-stage private companies relating to their failure to fully comply with the requirements of Rule 701 in connection with the issuance of equity-based compensation to employees.

Rule 701 Background

A company cannot offer or sell securities to the public without first registering the offering with the SEC or having a valid exemption from registration. Rule 701 provides an exemption from registration for private companies offering and selling securities to employees, officers and directors, as well as certain consultants and advisors, under compensatory benefit plans. Under Rule 701, offerings are exempt from registration requirements if the aggregate sales price of securities sold during any 12-month period does not exceed the greater of $1 million, 15% of the issuer’s total assets or 15% of all the outstanding securities of the class, and a copy of the relevant compensatory plan, such as a copy of the equity plan and related award agreements, is provided to recipients of the securities. However, Rule 701(e) further requires that any company issuing more than $5 million in options or other securities over a 12-month period provide, in a reasonable period of time before the date of the sale, detailed financial statements and risk disclosures to the recipients of the securities issued. Rule 701 provides that for options to purchase securities, the aggregate sales price for such options is determined when the option grant is made (without regard to when the option becomes exercisable).

The Credit Karma Settlement

According to the SEC, Credit Karma issued approximately $13.8 million in stock options to its employees from October 1, 2014 through September 30, 2015. The SEC found that Credit Karma granted options and allowed employees to exercise options of $550,535 for the next 11 months without providing the required financial information and risk disclosures even though Credit Karma was aware of the requirement. The company received an inquiry from the SEC regarding its Rule 701 disclosures in July 2016 and thereafter began providing the required disclosure to its employees. Therefore, in the absence of an ability to rely on Rule 701 for the grants in the period prior to providing appropriate disclosure, Credit Karma was deemed to have issued the options without a valid exemption from the registration requirements of the Securities Act. Credit Karma settled the charge with the SEC, consenting to the cease-and-desist order and a civil penalty of $160,000.

Rule 701 Dilemma – Confidentiality of Sensitive Material

The case at hand demonstrates one of the key concerns of many private companies when issuing equity-based compensation in reliance upon Rule 701. The SEC found that although the company was aware of the disclosure requirements and had the financial and other disclosure information available, the executives at Credit Karma did not disclose the required detailed financial information to its employees given the sensitive nature of such information.

Private companies should take note that the SEC does not excuse disclosure violations on account of confidentiality concerns. The SEC, however, has recognized these concerns and accordingly provided guidance on how companies may protect their sensitive information and yet still comply with Rule 701. Standard electronic safeguards, such as user-specific login requirements to access documents via a virtual data room are permissible. The use of other safeguards such as a dedicated physical disclosure room are also allowed as long as the safeguards do not prevent recipients from effectively accessing the required disclosures. For example, a designated physical disclosure room should be accessible during regular business hours upon reasonable notice and, once access is provided, recipients should be allowed to either retain the information or have ongoing access that is substantially equivalent to personal retention.

Conclusion

The enforcement action against Credit Karma is a demonstration of the SEC’s commitment to its close scrutiny of certain late-stage private companies, known as the “Silicon Valley Initiative” announced by the SEC in March 2016. The Silicon Valley Initiative focuses on regulatory compliance of pre-IPO companies with high valuations in areas including accuracy of company information and transparency with investors, controls on financial reporting and corporate governance.

When examining compliance with Rule 701, companies should be wary of some common pitfalls. A company may be required to provide the additional disclosure prior to the date on which it actually exceeds the $5 million threshold during a 12-month period. When the $5 million threshold is exceeded, the additional disclosure requirement applies retroactively to all of the issuances made during the entire 12-month period. Because the additional disclosure must be provided prior to the issuance of securities, if the company believes that sales will exceed the $5 million threshold in the coming 12-month period, the company must begin to provide additional disclosure to all recipients of securities sold in reliance of Rule 701 (i.e., not only to those who purchase securities after the issuer exceeds the $5 million threshold).

The Credit Karma action sends a warning that companies using equity compensation should be cognizant of the various rules on an ongoing basis and put in place controls and procedures to monitor the aggregate sales price of securities sold against the statutory sales limits and the corresponding disclosure obligations.