How In-House Counsel Can Protect Themselves from SEC Enforcement Actions and Criminal Prosecutions

6 Min Read By: Ryan Scarborough

See the first article in this series, on protecting financial institutions from enforcement actions.

Financial institutions face significant risks from enforcement actions by prudential regulators as well as agencies charged with protecting consumers, investors, or the public at large, such as the Consumer Financial Protection Bureau (CFPB), Securities and Exchange Commission (SEC), and Department of Justice (DOJ).  I recently published an article about what steps in-house counsel can take to mitigate those risks for their  financial institution clients.  This article has a different perspective.  Rather than focusing on threats to the institution, it focuses on threats to in-house counsel in their personal capacity.  At the outset, it is important to recognize that enforcement actions against in-house counsel are extremely rare.  They are not, however, non-existent. 

This article draws in part on an unpublished analysis prepared by one of my partners at Williams & Connolly that examines non-insider trading SEC action and DOJ criminal prosecutions against corporate in-house counsel over the past two decades.  The analysis focuses on threats that in-house counsel may face personally from government agencies, and what lessons can be drawn from prior enforcement actions and criminal prosecutions against individuals.  While not all of the lessons are drawn from actions involving in-house counsel specifically at financial institutions, the lessons are equally applicable to them. 

Common Factors in Actions Involving In-House Counsel

Factor #1 – The top lawyer is nearly always the target, either in their own right or to undermine an ‘advice of counsel’ defense for other top executives

When the SEC or DOJ takes action against in-house lawyers, they almost always focus on the General Counsel or Chief Legal Officer.  There are two overarching reasons for this.  First, the top lawyer indisputably had the power and the mandate to address issues, and—rightly or wrongly—the failure to do so is often laid at the feet of the General Counsel or Chief Legal Officer.  Another reason why General Counsel or Chief Legal Officers may find themselves in the crosshairs, particularly in criminal actions, may be to undermine the advice of counsel defense for other executives.  When the government threatens civil or criminal claims against in-house lawyers, self-preservation instincts may surface.  It is not uncommon for lawyers to disavow or distance themselves from certain positions being advanced by other targets of the investigation as a way to protect themselves. 

Factor #2 – Big losses to the institution bring unwanted scrutiny to in-house counsel

Another common factor in SEC enforcement actions and criminal prosecutions against in-house counsel is when the institution itself suffers substantial losses.  The bigger the failure of the institution, the greater the risk of exposure for the in-house counsel.  When the institution is handed a large judgment or damning indictment,  there is incredible pressure from consumers, politicians, and the media to hold someone accountable and actions may be second-guessed with the benefit of hindsight.  The in-house counsel often becomes the scapegoat.  

Factor #3 – In-house lawyers can insulate themselves by consulting outside counsel

Inside lawyers who relied upon outside lawyers are rarely, if ever, the targets of SEC enforcement actions or criminal prosecutions.  The advice of counsel defense is a real deterrent to prosecution or enforcement.  But to mount a viable defense, the consultation with outside counsel must be meaningful and – ideally – documented.  Outside counsel needs to be apprised of the material facts and their advice should be memorialized contemporaneously; by extension, in-house counsel should act in a manner that is consistent with outside counsel’s advice to clearly demonstrate reliance on the advice. 

Factor #4 – Complex or debatable problems are rarely a basis for individual enforcement action or prosecution, whereas perjury or obstruction are much easier cases

Enforcement lawyers and prosecutors prefer to pursue cases where there is a clear legal violation.  SEC enforcement counsel and prosecutors will vigorously pursue claims of perjury or obstruction against in-house counsel because these actions tend to be straightforward and easy to prove.  SEC enforcement proceedings against in-house counsel most commonly arise from disclosures, particularly omissions in disclosures.  Self-dealing or other actions to line one’s pockets is not necessary for the SEC to bring an enforcement action.  By contrast, when the violation itself is unclear or complicated, there is less risk to in-house counsel even if the SEC or DOJ decides to pursue an action against the institution.  It is much easier to fault somebody when the violation is unambiguous.  A corollary to this is that mere knowledge of conduct later deemed to be criminal is usually not enough to warrant prosecution against an in-house lawyer, unless the conduct was so egregious as to be unambiguously improper. 

Factor #5 – Generalist lawyers cannot insulate themselves from liability by claiming ignorance

Do not get in over your head.  In-house lawyers are expected to have the knowledge and experience necessary to discharge the responsibilities of their role.  It is not uncommon for in-house lawyers in smaller institutions to wear several hats, such as also serving in a compliance function (or at least overseeing the compliance function).  No matter how many hats they wear, in-house counsel will be held responsible for shortcomings, particularly when those shortcomings impact consumers or the institution in a material way.  Neither the SEC nor DOJ are moved by arguments that the individual charged with these roles lacked the sophistication to discharge those responsibilities. 

Practical Tips for In-House Counsel at Financial Institutions

These observations lead to some practical tips for in-house counsel for minimizing the enforcement profile of their institution and, by extension, themselves. 

  1. Ensure that your institution’s risk management function is well-resourced and appropriately staffed with competent personnel. An enforcement action is almost always far more costly (both as a matter of reputation and penalty) than maintaining a well-functioning compliance team.  These staffing and resource investments can pay big dividends in terms of smooth regulatory relationships and the early identification and remediation of problems. 
  2. Establish and maintain a close working relationship with the Chief Risk Officer. Most institutions have three lines of defense (line of business, compliance, and audit) and the Chief Risk Officer should have clear visibility into each one.  The Chief Risk Officer ideally should be not only a peer, but also a partner for in-house counsel.
  3. Make sure that your institution is taking proactive steps to identify and address issues as they arise. Problems that fester or recur are more likely to provoke regulatory attention on in-house counsel’s action (or perceived inaction).  Being proactive will help establish that in-house counsel (and the institution as a whole) exercised appropriate business judgment.
  4. Be on high alert if your institution’s CAMELS ratings start to slip, as this may signal deeper issues with institutional controls or management. This also signals greater regulatory scrutiny, particularly when a bank or credit union is operating under a consent order or memorandum of understanding, and an increased likelihood of second-guessing. 
  5. When faced with particularly thorny questions: (1) consult with outside counsel; (2) make sure that their advice is memorialized in an appropriate fashion; and then (3) act on that advice. While there will invariably be a marginal cost associated with engaging outside counsel, the long-term benefits are almost always worth it. 
By: Ryan Scarborough


Connect with a global network of over 30,000 business law professionals


Login or Registration Required

You need to be logged in to complete that action.