by Joel Cohen, Ladan Stewart, Tami Stark, Marietou Diouf, Gabriella Klein, and Robert DeNault

Introduction

2024 marks the final year of Gary Gensler’s term as Chair of the U.S. Securities and Exchange Commission (“SEC”).  The Gensler SEC has been aggressive on both the enforcement and rulemaking fronts.  In response, the financial industry has fought back in sometimes unprecedented ways, including through legal challenges to the SEC’s rulemaking and enforcement programs.  While questions remain about what the SEC will prioritize under the leadership of presumptive incoming Chair Paul Atkins, it seems likely that many of Chair Gensler’s enforcement priorities will be rolled back in the coming years.  We can expect, for example, to have neared the end of the SEC’s years-long off-channel communications sweep.  And the Gensler SEC’s intense focus on the crypto industry will very likely shift significantly under Chair Atkins.

We provide here an overview of the SEC’s enforcement program in 2024 and end with additional thoughts on how the agency’s enforcement priorities will likely change in 2025 and beyond. 

Measured by the number of matters, 2024 saw a decline in enforcement activity at the SEC.[1]  The agency brought 583 enforcement actions in fiscal year (“FY”) 2024, compared with 784 actions in FY 2023—a 26% decrease.  431 of those were original, or “stand-alone,” actions—also down from 501 in FY 2023.  And while the SEC obtained a record $8.2 billion in financial remedies, over half of that amount is attributed to a single matter (a $4.5 billion judgment against the crypto project Terraform Labs and its founder Do Kwon).  Despite the lower numbers, the final year of the Gensler SEC proved no less interesting on the enforcement front, with the SEC asserting itself in new areas like artificial intelligence (“AI”) and continuing to focus on areas like crypto and enforcement of the marketing rule.

Topics of Focus and Notable Matters

Marketing Rule Sweep

The SEC continued to enforce compliance with the marketing rule, which regulates how investment advisers can market their services.  In FY 2024, the SEC settled charges against more than one dozen investment advisers for violating the marketing rule.  Firms were charged with a variety of alleged violations, including for advertising hypothetical performance to the public without implementing policies and procedures to ensure the relevance of that hypothetical performance to the advertisement’s intended audience.  Other firms were charged with alleged violations tied to advertisements including untrue or unsubstantiated statements of material facts, testimonials, endorsements, or third-party ratings that were not accompanied with the required disclosures.  One firm was charged in connection with misleading performance advertising.

Disclosures of Holdings and Transactions by Insiders and Investment Managers

As discussed in our client alert published earlier this year, the SEC has intensified its focus on beneficial ownership reporting under Sections 13(d), 13(g), and 16(a) of the Securities Exchange Act of 1934, which impose certain reporting requirements on public companies and their insiders as well as institutional investment managers.  In 2024, the SEC continued to focus on compliance with beneficial ownership reporting requirements.  In September, one public company and 11 institutional investment managers were charged with failing to timely file reports on Form 13F.  Just weeks later, the SEC instituted settled enforcement actions against 23 public companies and public company investors, including individuals, in connection with alleged untimely Section 13(d), 13(g) and/or 16(a) beneficial ownership filings.[2]  Two public companies that were part of this enforcement sweep were also charged with contributing to their insiders’ late or missed Section 16(a) filings and failing to disclose the delinquent filings as required by Item 405 of Regulation S-K in their Form 10-Ks/proxy statements.

Off-Channel Communications

The SEC continued its onslaught of off-channel communications settlements—resulting in over $600 million in civil penalties against more than 70 firms—including its first enforcement actions against stand-alone registered investment advisers with no ties to a broker-dealer.  The SEC’s off-channel communications sweep, which began in 2021, has now resulted in over $2 billion in penalties against more than 100 firms.

In  a wave of enforcement actions earlier in the year, and as previously discussed in our client alert, the SEC highlighted benefits of self-reporting, noting that the firms that self-reported their violations faced lower civil penalties.  The benefits of self-reporting were recently exhibited in a settled action against investment adviser Atom Investors LP, where Atom avoided civil penalties altogether.[3]  In announcing the charges, Gurbir Grewal, Director of the SEC’s Division of Enforcement, stated that “this resolution shows that the full benefits of cooperation are available in recordkeeping matters. Atom Investors’ self-reporting and prompt remedial efforts weighed heavily in the Enforcement Division’s decision to recommend that the Commission not impose a penalty, which the Commission accepted. This resolution should serve as a model for other investment advisers that are not currently in compliance with federal recordkeeping requirements.”[4]

Whistleblower Protection

In September, as we previously discussed in our client alert, the SEC settled charges against seven public companies for violating the whistleblower protection rule in connection with employment, separation, and other agreements.  The SEC charged each entity with violating the rule prohibiting interference with an individual’s communications with SEC staff about possible securities law violations.  All of the charged companies had included in their employee documents provisions requiring waivers of monetary awards for participation in whistleblower programs.  Civil penalties ranged from $19,500 to $1.3 million.  Notably, none of the settling entities were accused of actually enforcing the provisions at issue.

Pay-to-Play Rule/Custody Rule

The SEC continued to charge investment advisers with violations of Rule 206(4)-5 under the Investment Advisers Act of 1940, also known as the “pay-to-play” rule.  The “pay-to-play” rule restricts political contributions by investment advisers and their covered associates and is intended to prevent investment advisers from seeking to influence the awarding of advisory contracts by making political contributions to officials in a position to influence those awards.

The SEC also continued its enforcement of the custody rule, bringing several actions against investment advisers for failures to comply with requirements designed to safeguard client assets from loss, theft, misuse, or misappropriation, in violation of the custody rule.  This included the SEC’s first action against a crypto-focused investment adviser for alleged violations of the custody rule.[5]

Insider Trading

The SEC continued its long-running focus on insider trading and market abuse cases, including cases involving alleged “block trades” and “cherry picking” schemes.  In March, the SEC announced insider trading charges against the founder of a Silicon-Valley based technology company.  According to the complaint, the CEO misappropriated material non-public information regarding an impending acquisition of the company he led by trading in the accounts of a close relative and an associate.  Without admitting or denying the charges, the CEO agreed to pay a civil penalty of $1 million to settle the case.

In April, the SEC obtained its first ever trial win premised on a “shadow trading” theory of insider trading in SEC v. Panuwat.[6]  The shadow trading theory is an extension of the oft-used “misappropriation theory” of insider trading adopted by the Supreme Court in 1997.  Under the misappropriation theory, an individual can be liable for insider trading when that person lawfully comes into possession of insider information, and then breaches a duty of confidence by conveying that information to a third party for the purpose of using it to trade.  The shadow trading theory extends liability one step further, where the third party uses the non-public insider information to trade in the securities of a different company, to which the original insider did not owe any such duty.

In Panuwat, the SEC successfully proved that the defendant was liable for insider trading when he came into possession of material non-public information that a company would be acquired by a larger pharmaceutical company, and then passed that information to a third party who traded in the securities of a separate company whose shares would likely increase as a result of the merger.  According to the SEC, the information about the acquisition was material to both companies, because they were peers and a reasonable investor would view the information about the merger as having significantly altered the total mix of information available about the stock.  The District Court rejected Panuwat’s efforts to dismiss the case and his motion for summary judgment, explaining that a jury could find that the acquisition of one company was material to the other, and that non-public insider knowledge of the acquisition could logically apply to an insider trading charge relating to the other company’s securities.

Crypto

The SEC continued its intense scrutiny of the crypto industry, though it did not make the same waves in 2024 in its enforcement cases as it had in prior years (for example, when it charged Coinbase, the largest U.S. crypto trading platform, with operating an unregistered securities exchange).  Some of the most high-profile of the SEC’s potential crypto enforcement cases, for example, against the decentralized trading platform Uniswap Labs (which announced it had received a Wells notice in April), have not been brought to date—though a few weeks still remain in the Gensler administration.

Some of the SEC’s noteworthy crypto enforcement cases include settled charges against Barnbridge DAO,[7] a purportedly decentralized autonomous organization, for allegedly failing to register its offerings of securities, and a litigated action against Consensys in connection with its MetaMask product—the first case involving liquid staking tokens.[8]  The SEC also charged Silvergate Capital and its former executives with misleading investors about the strength of their Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance program and monitoring of crypto customers.[9]  In addition, the SEC charged the bank and an executive with misleading investors about the company’s losses stemming from the FTX collapse.  Without admitting or denying the allegations, Silvergate agreed to a final judgment ordering it to pay a $50 million civil penalty and imposing a permanent injunction to settle the charges.  Separately, the former CEO and former Chief Risk Officer settled charges for misleading investors about the strength of the compliance program and agreed to five-year bars and civil penalties of $1 million and $250,000, respectively, while the former CFO was also charged and continues to litigate the charges.

The SEC obtained an important victory in its first-ever crypto trial—against Terraform Labs and its founder Do Kwon. 

After a nine-day trial in the Southern District of New York, the jury found that Terraform and Kwon were liable for securities fraud and for offering and selling securities in unregistered transactions.[10]  The SEC alleged that Terraform and Kwon misled investors about the use of the Terraform blockchain to settle transactions, and that in May 2022, when the stablecoin UST de-pegged from the U.S. dollar, the price of UST and Terraform’s other tokens plummeted and wiped out $40 billion in market value.   Post-verdict, Terraform and Kwon agreed to pay more than $4.5 billion to resolve the case.[11] 

The SEC also continued to target fraud in the crypto industry. In January, for example, the SEC charged two individuals for their involvement in an alleged fraudulent crypto asset pyramid scheme known as HyperFund that raised more than $1.7 billion from investors worldwide.[12]  In August, the SEC announced charges against two individuals and their company for operating an alleged fraudulent scheme that raised more than $650 million in assets from 200,000 investors worldwide.[13] 

Finally, the SEC continued to expend significant Enforcement resources on litigating numerous high-profile and hard-fought crypto cases including its enforcement actions against Ripple Labs, Coinbase, and Binance. 

AI Washing

A more recent area of focus for the SEC has been so-called “AI washing”—purported disclosure violations relating to a company’s use of artificial intelligence.  In January 2024, the SEC’s Office of Investor Education and Advocacy issued a joint alert with the North American Securities Administrators Association and FINRA warning investors of an increase in investment frauds involving the purported use of AI and other emerging technologies.  The SEC indicated that AI would be one of its examination priorities for FY 2024. 

Weeks later, the SEC brought its first “AI washing” case, which involved alleged false and misleading statements by the founder of an online crypto trading course that a hedge fund investment opportunity would use AI and other technologies to generate returns from investors.  In March, as we previously discussed in our client alert, the SEC announced settlements with two investment advisers finding that the firms made false and misleading statements about their purported use of AI, marketing to their clients that they were using AI in ways that they were not doing so.  In October, the SEC announced charges against an investment adviser and its principals in connection with alleged false and misleading statements regarding the adviser’s purported use of AI to perform automated trading in clients’ accounts.[14]  

Cybersecurity

The SEC had a significant loss in its high-profile litigation against SolarWinds and its former Chief Information Security Officer (“CISO”).  The case—the first where the SEC charged a CISO—involved allegations that SolarWinds had made materially misleading statements and omissions about its cybersecurity practices and risks.  As previously discussed in our client alert, Judge Engelmayer of the U.S. District Court in the Southern District of New York largely granted SolarWinds’ motion to dismiss.  Of particular significance was the court’s rejection of the SEC’s attempt to impose liability under Section 13(b)(2)(B) of the Exchange Act based on allegedly insufficient cybersecurity controls.  The court held that the SEC’s authority to regulate an issuer’s internal accounting controls is limited to financial accounting controls and does not extend to cybersecurity controls.  The court also dismissed claims based on SolarWinds’ statements in press releases, blog posts, and podcasts about the incident, finding they were non-actionable corporate puffery which were too general to cause a reasonable investor to rely on them and not actionable fraud.  Further, the court found that SolarWinds’ post-incident disclosure in a Form 8-K fairly captured the known facts and disclosed what was required for reasonable investors.  The court allowed claims to proceed relating to SolarWinds’ statements about access controls and password protections, which the SEC alleges were materially misleading.

The SEC also brought a string of settled enforcement actions.  In May, the SEC charged The Intercontinental Exchange, Inc. for allegedly causing the failure of nine affiliates, including the New York Stock Exchange, to timely inform the SEC of a cyber intrusion incident.[15]  In June, the SEC charged a global provider of business communication and marketing services in connection with alleged disclosure and internal control failures relating to cybersecurity incidents and alerts.[16]  And in August, the agency brought charges against a registered transfer agent for alleged failures to ensure that client securities and funds were protected against theft or misuse, which led to the loss of more than $6.6 million of client funds as a result of two separate cyber intrusions.[17] 

In October, the SEC filed settled actions against four current and former public companies in connection with disclosures related to cybersecurity risks and intrusions.[18]  The SEC alleged the issuers negligently minimized the impacts of cyber breaches and imposed civil monetary penalties ranging from $990,000 to $4 million. 

Gatekeepers

The SEC continued its long-running focus on gatekeepers, including a settled case against the auditing firm Prager Metis in connection with its audits of the FTX crypto trading platform and for alleged auditor independence violations.[19]  The SEC also charged audit firm BF Borgers and its owner for alleged failures to comply with PCAOB standards in its audits and reviews incorporated in more than 1500 SEC filings.[20]  In addition to permanent suspensions from appearing or practicing before the SEC, defendants agreed to a total of $14 million in civil penalties.

In September, the SEC filed securities fraud charges against the former CEO of Kubient Inc., a technology company, in relation to a scheme to overstate and misrepresent revenue in connection with two public stock offerings.[21]  Notably, the SEC also charged the former audit committee chair and the former CFO for failing to act appropriately once learning about the alleged overstatements, misrepresentations, and concerns of revenue at issue.  The press release announcing the filed charges noted that “[t]his case should send an important signal to gatekeepers like CFOs and audit committee members that the SEC and the investing public expect responsible behavior when critical issues are brought to their attention.”

Jarkesy Decision

In June, the Supreme Court ruled in SEC v. Jarkesy that when the SEC seeks civil penalties from defendants for securities fraud, the Seventh Amendment requires it to bring the action in a court of law where the defendant is also entitled to a trial by jury.[22]  The decision ended the SEC’s long-running use of in-house tribunals led by Administrative Law Judges (ALJs) to adjudicate fraud actions and was part of a growing trend by courts to curtail the reach of the administrative state.

The SEC has been preparing for this outcome for years, and prior to its issuance had largely operated under the presumption that enforcement actions for fraud would be brought in federal court.  However, the scope of the Supreme Court’s decision in Jarkesy will likely be subject to further litigation.  For example, courts will likely have to determine whether the right to a jury trial attaches to all punitive enforcement actions, or just ones that resemble common law fraud.  Further, it remains to be seen whether the SEC will bring other types of administrative claims not typically brought in federal court in bifurcated administrative actions when court proceedings begin on a related charge. 

The Jarkesy ruling and its potential impact is discussed more in our client alert and in an article that members of our White Collar group co-authored and published in The National Law Journal.

Cooperation

The SEC has long emphasized the benefits of cooperation and self-reporting, but for industry players, such benefits may seem difficult to measure.  In 2024, the SEC approved multiple resolutions imposing low or no civil penalties in response to proactive compliance measures such as self-reporting, cooperation, and undertaking subsequent remedial measures.  One such case involved Cloopen Group Holding Limited, a cloud-based communications provider in China.[23]  The SEC did not impose civil penalties because the company self-reported accounting issues, meaningfully cooperated with the SEC staff throughout the course of the investigation and undertook prompt remedial measures.  In reaction to the settlement, Gurbir Grewal noted that the action demonstrated the “real benefits to companies that self-report their potential securities law violations, assist during [the] investigation, and undertake remedial measures.”[24]

Looking Forward to the Year Ahead

The recent presidential election will likely lead to significant changes in the SEC’s Enforcement priorities.  Chair Gensler will step down from the Commission on January 20, and Commissioner Jaime Lizarraga will resign on January 17.  President-elect Trump has announced his intention to nominate former SEC Commissioner Paul Atkins as the new Chair of the SEC.  While Commissioner Atkins awaits confirmation by the Senate, one of the current Republican-appointed Commissioners—Hester Peirce or Mark Ueyda—will likely be appointed Acting Chair.

While it is difficult to know where incoming Chair Atkins will choose to focus his efforts in leading the agency, it is likely that the Atkins SEC will resume the focus of the SEC under Jay Clayton during the previous Trump administration on areas like retail investor protection and “bread and butter” cases like offering frauds, insider trading, market manipulation, and accounting fraud.  We may see fewer enforcement actions, and we likely will see a more conservative approach to disgorgement calculations and more scrutiny of financial penalties especially in cases involving public companies where outsized penalties may harm shareholders.  We may also see an end to enforcement’s specialized units under the new administration, and a potential reduction in “sweeps,” which have been widely used by Enforcement staff during the Gensler years.  We also expect the SEC to pull back from enforcement cases based on alleged misstatements in non-financial disclosures like ESG and cybersecurity.  And we will likely see fewer novel legal theories (e.g., shadow trading) and a more restrained interpretation of concepts like materiality.  Commissioner Atkins published an article in 2008 titled “Evaluating The Mission: A Critical Review Of The History And Evolution Of The SEC Enforcement Program.”[25]  Although a decade old, the principles outlined in the article provide useful insight into Commissioner Atkins’ focus and possible agenda.

One area where we expect significant change is crypto enforcement.  Chair Gensler took what was widely perceived as a hostile approach to crypto, wrangling with crypto market participants large and small.  President-elect Trump has signaled a more definitively pro-crypto approach, promising to be a “crypto president.”  Commissioner Atkins has deep, long-standing ties to the crypto industry and is expected to overhaul the SEC’s approach to crypto.  Likewise, David Sacks, nominated by President-elect Trump as the first-ever White House “AI and Crypto Czar,” is a strong supporter of cryptocurrency and is likely to advocate for a less burdensome enforcement approach.  

An area of likely continued focus will be with respect to AI.  Some of the largest AI companies in the United States have drawn the attention of some of President-elect Trump’s highest profile surrogates, including Elon Musk.  We therefore expect that the SEC’s focus on AI to continue in the new administration.

Finally, while we expect Enforcement staff to take more reasonable positions in settlement discussions, it remains to be seen whether we will see a downtick in litigated cases filed by the SEC.  The Gensler SEC’s focus on crypto enforcement has led to a marked increase in the SEC’s trial resources and an aggressive docket of complex litigations. With those capabilities now in place, it will be interesting to see whether the SEC’s litigation appetite changes in the new administration. 

Footnotes

[1] Press Release, U.S. Sec. & Exch. Comm’n., SEC Announces Enforcement Results for Fiscal Year 2024 (Nov. 22, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-186. 

[2] Press Release, SEC Levies More Than $3.8 Million in Penalties in Sweep of Late Beneficial Ownership and Insider Transaction Reports (Sept. 25, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-148.

[3] Press Release, Advisory Firm Atom Investors, Charged with Recordkeeping Violations, Avoids Civil Penalty Because of Self-Reporting, Substantial Cooperation, and Prompt Remediation (Sept. 23, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-143.

[4] Press Release, U.S. Sec. & Exch. Comm’n., Advisory Firm Atom Investors, Charged with Recordkeeping Violations, Avoids Civil Penalty Because of Self-Reporting ,Substantial Cooperation, and Prompt Remediation (Sept. 23, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-143.

[5] Press Release, U.S. Sec. & Exch. Comm’n., SEC Charges Crypto-Focused Advisory Firm Galois Capital For Custody Failures (Sept. 3, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-111. 

[6] Litigation Release No. 25970, Jury Returns Verdict Finding Defendant Matthew Panuwat Liable for Insider Trading (Apr. 8, 2024), available at https://www.sec.gov/enforcement-litigation/litigation-releases/lr-25970. 

[7] Press Release, BarnBridge DAO Agrees to Stop Unregistered Offer and Sale of Structured Finance Crypto Product (Dec. 22, 2023), available at https://www.sec.gov/newsroom/press-releases/2023-258. 

[8] Press Release, SEC Charges Consensys Software for Unregistered Offers and Sales of Securities Through Its MetaMask Staking Service (Jun. 28, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-79.

[9] Press Release, SEC Charges Silvergate Capital, Former CEO for Misleading Investors about Compliance Program (Jul. 1, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-82. 

[10] Gurbir Grewal, Director, Div. of Enforcement, Sec. Exch. Comm’n, Statement on Jury’s Verdict in Trial of Terraform Labs PTE Ltd. and Do Kwon (Apr. 5, 2024), available at https://www.sec.gov/newsroom/speeches-statements/grewal-statement-040424.

[11] Press Release, Terraform and Kwon to Pay $4.5 Billion Following Fraud Verdict (Jun. 13, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-73

[12] Press Release, SEC Charges Founders of $1.7 Billion “Hy.perFund” Crypto Pyramid Scheme and Top Promoter with Fraud (Jan. 29, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-11.

[13] Press Release, SEC Charges Alleged Crypto Company NovaTech and its Principals and Promoters with $650 Million Fraud (Aug. 12, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-95.

[14] Press Release, SEC Charges Rimar Capital Entities and Owner Itai Liptz for Defrauding Investors by Making False and Misleading Statements About Use of Artificial Intelligence (Oct. 10, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-167.

[15] Press Release, SEC Charges Intercontinental Exchange and Nine Affiliates Including the New York Stock Exchange With Failing to Inform the Commission of a Cyber Intrusion (May 22, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-63.

[16] Press Release, SEC Charges R.R. Donnelley & Sons Co. with Cybersecurity-Related Controls Violations (Jun. 18, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-75.

[17] Press Release, SEC Charges Transfer Agent Equitini Trust Co. with Failing to Protect Client Funds Against Cyber Intrusions (Aug. 20, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-101. 

[18] Press Release, SEC Charges Four Companies With Misleading Cyber Disclosures (Oct. 22, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-174.

[19] Press Release, Audit Firm Prager Metis Settles SEC Charges for Negligence in FTX Audits and for Violating Auditor Independence Requirements (Sept. 17, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-133. 

[20] Press Release, SEC Charges Audit Firm BF Borgers and Its Owner with Massive Fraud Affecting More Than 1,500 SEC Filings (May 3, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-51. 

[21] Press Release, SEC Charges Former Chairman and CEO of Tech. Co. Kubient With Fraud and Lying to Auditors (Sept. 16, 2024), available at https://www.sec.gov/newsroom/press-releases/2024-131. 

[22] SEC v. Jarkesy, 603 U.S. ___ (2024).

[23] In an alert we published in February 2024, we elaborated on the settlement, lessons for public companies, and White & Case’s role in the matter.

[24] Press Release, U.S. Sec. & Exch. Comm’n., SEC Charges China-Based Tech Company Cloopen Group with Accounting Fraud (Feb. 6, 2024), https://www.sec.gov/news/press-release/2024-15?utm_medium=email&utm_source=govdelivery.

[25] Paul S. Atkins & Bradley J. Bondi, Evaluating The Mission: A Critical Review Of The History And Evolution Of The SEC Enforcement Program, 13 Fordham J. Corp. & Fin. L. 367 (2008).

Joel Cohen, Ladan Stewart, Tami Stark, are Partners, Marietou Diouf is Counsel, and Gabriella Klein and Robert DeNault are associates at White & Case LLP. This post first appeared as a client alert for the firm.

The views, opinions and positions expressed within all posts are those of the author(s) alone and do not represent those of the Program on Corporate Compliance and Enforcement (PCCE) or of the New York University School of Law. PCCE makes no representations as to the accuracy, completeness and validity or any statements made on this site and will not be liable any errors, omissions or representations. The copyright of this content belongs to the author(s) and any liability with regards to infringement of intellectual property rights remains with the author(s).