The Future of Financial Services Enforcement at the FTC

Over 25 years ago, C.K. Prahalad and Gary Hamel coined the term “core competencies,” which consists of the “collective learning” in an organization. Prahalad and Hamel contended that by identifying this intellectual core, businesses could obtain a competitive advantage by focusing on their unique strengths; firms could separate the wheat from the chaff, allocating resources away from nonessential things and towards core activities that provide substantial value to consumers.

As the acting director of the Federal Trade Commission’s Bureau of Consumer Protection, I have the privilege of managing part of an agency that has over 100 years’ worth of collective learning. That history has allowed the FTC to develop some extraordinarily effective tools to combat harmful conduct. The FTC’s core competency with regard to financial services is now civil law enforcement, with business guidance, consumer education, and research and policy development activities supporting and furthering such enforcement.

Yet even “old dogs” like the FTC need to learn new tricks. As Acting Chairman Maureen Ohlhausen observed, the FTC must evolve so that its law enforcement and other financial services work still serve the interests of consumers in a rapidly changing world. The fundamental question for the FTC is how to apply its core law-enforcement competency in light of on-going changes in law, technology, and markets. The FTC and the Bureau of Consumer Protection in the past identified some financial markets on which the agency was focusing its work. This article addresses the broader question of how, under the new leadership of Acting Chairman Ohlhausen, the FTC is likely to apply its core law-enforcement competency in light of on-going changes in law, technology, and markets. This article provides some initial thoughts on an overall FTC approach to consumer financial services enforcement. For purposes of this article, “financial services” does not include privacy and data security, which are topics best addressed separately and comprehensively.

Combating Financial Fraud

As part of her positive consumer-protection agenda, Acting Chairman Ohlhausen has emphasized generally that she will “re-focus the agency on our bread-and-butter fraud enforcement mission.” As she explained, “[t]hese cases may not forge new legal ground or prompt huge headlines, but such actions defend consumers harmed by an unscrupulous con artist and assist the legitimate business owner who loses business to the cheat. These obvious benefits explain why such efforts have long had broad bipartisan support both at the FTC and in Congress.” Fighting fraud, in short, is good policy and good politics. When it comes to allocating its scarce resources, stopping fraudulent schemes allows the FTC to get the most consumer-protection bang for its buck.

The FTC’s general refocusing on fraud enforcement applies to the financial-services context as well. Under the leadership of Acting Chairman Ohlhausen, the FTC will direct its enforcement work even more at preventing, deterring, and remedying fraudulent practices in financial services. In particular, the FTC will focus on fraud that causes harm to financially distressed consumers. Fighting fraud will be the centerpiece of the FTC’s financial-services enforcement agenda.

The FTC has a strong record of bringing cases to halt serious misconduct by providers of financial services. It has long brought actions to protect consumers from abusive debt collectors (such as “phantom” debt collectors), unscrupulous payday lenders, and fraudulent debt-relief operations. For example, the FTC recently brought an action against S&H Financial Group and its officers, alleging that they masqueraded as a law firm and used unlawful intimidation tactics in collecting debts, even going so far as to make phony claims that people would be arrested or imprisoned if a debt was not paid. In another recent action, Strategic Student Solutions, the FTC alleged that a student loan debt-relief operation bilked millions of dollars from consumers by falsely promising to reduce or eliminate the consumers’ student loan debt and offering nonexistent credit-repair services.

The FTC will continue strong and sustained enforcement against bad actors that harm consumers of financial services; however, FTC enforcement will also target entities that support the ecosystem of fraud. These include money-transfer companies, payment processors and platforms, loan lead generators, and others that directly participate in another’s fraud or provide substantial support while ignoring obvious warning signs of another’s illegal activity. For example, the FTC recently announced a $586 million settlement against Western Union for failing to maintain appropriate safeguards against fraud-induced money transfers and continuing to employ corrupt Western Union agents who were complicit in such fraud. In addition, in its action against AT&T, the FTC recently refunded the company’s customers more than $88 million in allegedly unauthorized charges for third-party subscriptions to text message services for horoscopes, celebrity gossip, and other items. When companies directly participate in another’s fraud or they provide substantial support to another while ignoring their fraud, they make large-scale financial fraud possible. Focusing FTC law enforcement even more against these actors allocates the agency’s limited resources to maximize the prevention, deterrence, and remediation of fraud.

Financial fraud is not static. Some financial frauds are of course the same frauds that the FTC has fought for many years. Scammers, however, are not only resilient, but also cunning. Fraud artists are adept at developing new schemes and locating new and vulnerable victims. What the next generation of financial frauds will look like is unclear. What is clear is that the FTC’s core competency in law enforcement, its experience in prosecuting financial fraud, and its tracking of technological changes, as discussed below, mean that the FTC is as prepared as an agency can be to combat future financial frauds, whatever they prove to be.

A critical caveat is necessary: the FTC will still bring cases against those who are not engaged in financial fraud but otherwise violate laws the FTC enforces. Some of these will be traditional cases challenging the conduct of financial service providers as unfair or deceptive in violation of Section 5 of the FTC Act, for example, challenging false or misleading claims that nonbank mortgage lenders make for their loans. Others will be traditional cases challenging the conduct of financial service providers as violating various financial services statutes and regulations the FTC enforces, such as violating the Fair Credit Reporting Act and its implementing Regulation V or the Children Online Privacy Protection Act and its implementing Children’s Online Privacy Protection Act Rule. Providers of financial services should not misinterpret the FTC’s refocusing on financial fraud as a license to violate other laws the FTC enforces.

Selection of Enforcement Targets

As the D.C. Circuit noted 30 years ago, we live in “an age of overlapping and concurring regulatory jurisdiction.” Thompson Med. Co. v. FTC, 253 U.S. App. D.C. 18, 791 F.2d 189, 192 (D.C. Cir. 1986). Such regulatory and law-enforcement overlap, which the FTC shares with agencies such as the Consumer Financial Protection Bureau, the Federal Communication Commission, the Food and Drug Administration, and the Securities and Exchange Commission, does provide advantages. For example, knowing another agency also has jurisdiction can allow an agency to focus on, and therefore gain expertise in, certain complex areas and ensure there are no enforcement gaps between agencies’ statutory boundaries.

Nonetheless, such overlap also can lead to enforcement inefficiencies and inconsistencies. To mitigate the risk of these disadvantages to regulatory and law-enforcement overlap, agencies should define their clear priorities so that sister agencies know when to act. At the same time, however, agencies should not abdicate their responsibilities in areas that may not be a priority but still fit within their statutory boundaries.

The FTC is doing just that with financial services enforcement. Although the FTC will be refocusing its enforcement on fraudulent conduct, the agency generally will be careful to select targets for which Congress has made the FTC the main federal agency enforcer or in which the FTC has extensive enforcement experience. In addition, where the FTC and another agency have concurrent enforcement authority, the Commission generally will focus on targets that are not subject to another agency’s extensive supervision, examination, or other oversight. Careful FTC target selection is instrumental in ensuring that FTC law enforcement is both efficient and effective.

The FTC will make it a priority to engage in significant enforcement where Congress intended it to be the main enforcer among federal agencies. For example, the FTC is the leading federal agency enforcer under Section 5 of the FTC Act and other financial services statutes for many auto dealers—generally dealers that routinely assign financing to unaffiliated, third-party financing institutions. Other examples include the Credit Repair Organizations Act for providers of credit-repair services and the Telemarketing and Consumer Fraud and Abuse Prevention Act and its implementing Telemarketing Sales Rule for telemarketers. Given the leading role Congress assigned to the FTC under these laws to protect consumers, the agency will remain vigilant in monitoring, investigating, and prosecuting those who violate these laws.

Even where Congress has not made the FTC the primary federal agency enforcer, the FTC still may have developed substantial expertise through many years of enforcement experience. For example, over the course of 40 years, the FTC has brought numerous actions against debt collectors for violating the Fair Debt Collection Practices Act. The FTC also has extensive experience in bringing actions against debt-relief operations for violating Section 5 of the FTC Act and the Telemarketing Sales Rule as well as against mortgage-relief firms for violating Section 5 of the FTC Act and Regulation O. The FTC’s substantial expertise with regard to these types of entities assists the agency in targeting potential wrongdoers for investigation and prosecution. It also assists the FTC in fashioning relief that is effective in remedying law violations and preventing and deterring future law violations, yet not imposing unnecessary or undue burdens on industry. Given the clear advantages of making use of its accumulated expertise, the FTC will continue to be an active enforcer over these types of entities.

Although the FTC has had concurrent enforcement with other agencies for many years in connection with a variety of financial services statutes and regulations, the Dodd-Frank Act in 2010 fundamentally reworked these schemes. In particular, under the Dodd-Frank Act, the FTC and the CFPB have concurrent enforcement authority over many nonbank financial service providers under many statutes and regulations. When faced with such concurrent enforcement authority, the FTC and the CFPB must be careful to avoid duplication and the imposition of conflicting standards. As directed by Congress, the two agencies entered into a Memorandum of Understanding (MOU) in 2012 and renewed it in 2015 to address these concerns to some extent. These MOUs fundamentally create a process by which the FTC and the CFPB can coordinate. They do not allocate financial service providers between the FTC and the CFPB where the two agencies have concurrent enforcement authority.

Nevertheless, to ensure that it allocates its enforcement resources wisely, the FTC considers the nature and scope of the CFPB’s activities. For instance, the FTC generally would not expend its limited enforcement resources to focus on types of targets where the CFPB is already devoting substantial resources or has particular expertise that could be brought to bear on a specific matter. Debt-collection enforcement is a useful illustration. For larger market participants in the debt-collection market, the CFPB not only can bring enforcement actions, but also can subject firms to on-going, extensive, and burdensome supervision and examination. Given its comparative advantage in tools relative to the FTC relating to larger participants in debt-collection markets, the CFPB in many cases will be in a better position to address the consumer protection problems those debt collectors cause, although that does not necessarily mean that the enforcement actions it may bring are necessary or appropriate. Nevertheless, there still may be circumstances in which the FTC might bring law-enforcement actions against larger market participants in the debt-collection markets. Among other things, it would be appropriate for the FTC to bring an enforcement action if: (1) the FTC is investigating a group of related firms, one of which is a larger market participant; (2) a collector is close to the larger participant threshold; or (3) the action furthers other FTC priorities, as was the case with GC Services Limited Partnership.

In contrast, for debt collectors that are not larger participants, the CFPB and the FTC both can bring law-enforcement actions, but neither can subject these debt collectors to supervision and examination. For these collectors, the FTC certainly is in a good position to address the consumer protection problems they cause, given its strong record of accomplishment in bringing cases involving these debt collectors, and the FTC will continue to bring cases against these collectors where appropriate.

Responding to Fintech

Refocusing on financial fraud and on targets where FTC enforcement will capitalize on its authority and experience is a sound approach for today, but what about tomorrow? To be effective, FTC financial services law enforcement must be flexible enough to adapt quickly to changes in markets and technology, especially so-called Fintech.

Fintech has certainly arrived. A myriad of technological developments has and will continue to rapidly transform the financial services sector to make it much more efficient. Fintech development implicates many financial products and services, such as credit scoring, peer-to-peer lending, blockchain transaction recording, smartphone payments, etc. A financial services enforcement agenda must account and prepare for the impact of Fintech on consumers of financial goods and services.

Fortunately, the FTC has vast experience in assessing technological and market developments that are likely to affect consumers, and of changing course to ensure its tools (especially law enforcement) to protect consumers remain effective. Since Congress gave it the authority in 1937 to prevent unfair and deceptive acts and practices, the FTC has applied these concepts successfully to business conduct involving a plethora of new technologies, such as communication technologies like television, faxes, cell phones, e-mail, text messages, social media, etc. The FTC has done so through combining research and policy development, business guidance, consumer education, and enforcement.

Consistent with past practice and prudence, the FTC is engaged in extensive research and dialogue with stakeholders relating to Fintech to assess how to protect consumers in connection with Fintech, while avoiding policies and enforcement that would chill or hinder Fintech or impose unnecessary or undue burdens on Fintech firms. For example, the FTC has held three forums on several Fintech topics, such as marketplace lending, crowdfunding, peer-to-peer payment systems, artificial intelligence, and blockchain. The FTC also recently announced its Debt Collection Fintech Initiative. As part of this initiative, the FTC is engaging in outreach with industry and consumer groups, conducting research, and taking other steps to continue building expertise on the use of existing and emerging technologies in debt collection. The agency will be exploring the costs and benefits to consumers and businesses of such technologies, including whether it can combat fraud and other harmful conduct, e.g., phantom debt collection.

The FTC has made institutional changes to ensure that the agency has the required expertise to consider carefully and consistently the benefits and costs of technology, including Fintech. Not only does the FTC have a chief technologist, it also has an Office of Technology Research and Investigation staffed with technologists who have the technical expertise to assess the benefits and costs of conduct relating to Fintech, and who conduct research and analysis, including a recent analysis of the online practices of large crowdfunding platforms. Maintaining this vigorous and extensive program of research and outreach to distinguish between helpful and harmful conduct is particularly valuable in Fintech because of the FTC’s broad enforcement jurisdiction over nonbank market participants (including retailers and technology companies).

The FTC’s commitment to obtaining a comprehensive understanding of Fintech to inform its work does not mean that the agency will not act where appropriate to protect consumers. The FTC’s recent work involving emerging billing mechanisms and technologies aptly illustrates the agency’s law-enforcement commitment. The FTC has brought a number of cases ensuring that basic consumer protections apply no matter what billing platform or method a company uses to do business. For example, a U.S. district court recently ordered Amazon to refund up to $70 million in unauthorized charges incurred by children in kids’ gaming apps. Although the technology was relatively new, the principle enforced in that case—that companies may not charge consumers for unauthorized purchases—is well established and straightforward.

A settlement involving Apple, Inc. further demonstrates the value of the FTC seeking and imposing order provisions that allow for technological innovation. In that case, the FTC alleged that Apple had violated the FTC Act by billing for charges that children incurred through in-app purchases without the express informed consent of their parents. To resolve this allegation, the FTC’s settlement with Apple required that the company obtain parental consent, but it did not specify what particular manner Apple needed to use (e.g., password entry) to obtain that consent. Apple, therefore, was later able to use the newer technology of fingerprint authentication to obtain parental consent in compliance with its order. When the FTC brings law-enforcement actions that involve Fintech and other rapidly developing technologies, the public interest is best served if the agency seeks or imposes order provisions that confer adequate protection on consumers without unduly or unnecessarily hindering or chilling the use of new technologies.

Conclusion

FTC financial services enforcement is beginning to change under the direction of Acting Chairman Ohlhausen. The agency will be refocusing on investigating and prosecuting fraud in consumer financial markets, building on the FTC’s strong anti-fraud program. The FTC will direct its attention to entities over which Congress has made it the leading federal agency enforcer or with which the FTC has significant long-term experience, as well as to entities where it has a comparative advantage compared to other enforcers with concurrent enforcement authority. The agency will engage in extensive research and policy development to understand Fintech developments and its impact on consumers. The FTC will apply core consumer-protection principles to providers of Fintech goods and services, with a keen recognition of the dynamic nature of Fintech and markets in crafting orders to protect consumers without stifling technological innovation.

The views expressed in this article are those of the author and do not necessarily represent the views of the FTC or any individual commissioner.

Blockchain and Beyond: Smart Contracts

Imagine a future where contracts look like this:

./peer chaincode deploy -n ex01 -c ‘{“Function”:”init”, “Args”: [“{\”version\”:\”1.0\”}”]}’

The term “smart contracts” was originally coined by cryptographer Nick Szabo in the early 1990s. Szabo saw a contract as a set of promises agreed to by a meeting of the minds. He aptly noted that computers make it possible to run algorithms. First, the contract terms are translated into code—a series of if-then functions. Once a condition is met, the smart contract will take the next step necessary to execute the contract. Thus, the term “smart contracts” refers to computer transaction protocols that execute the terms of a contract automatically based on a set of conditions.

Although the concept of smart contracts has existed for a long time, a real-world application has only recently been made possible due to developments in blockchain technology. Blockchain is commonly defined as a decentralized digital ledger in which transactions are recorded chronologically and publicly. In its infancy stages, blockchain was the mechanism that tracked cryptocurrencies such as Bitcoin. However, as the technology evolved, variations such as private, permissioned, and consortium blockchains have emerged. Ultimately, blockchain technology can facilitate many types of business transactions.

Historically, we have relied on established institutions such as banks and government to authenticate transactions—to verify that the people with whom we are transacting are really who they claim to be. The institutions act as middlemen to build trust between two parties that are transacting with each other. However, these institutions are not incorruptible. At times, they have become victims of foul play by external or internal actors. In fact, it can be risky to consolidate trust into one institution because it creates a single point of failure.

In contrast to a centralized system where only certain people can view and modify transactions, blockchain was originally developed as a decentralized ledger open to the public. A key feature of blockchain is that multiple parties can verify transactions instantaneously. Once the transaction has been properly verified, it is added as a new block on the blockchain. Thus, blockchain is a string of transactions where a new block is permanently tied to a previous block and thus immutable. By distributing trust among multiple users, it is implied that a decentralized ledger will be more reliable in exposing any faults with transactions.

Smart contracting is a disruptive advancement that will have far-reaching impact for many industries, including financial services, government, real estate, manufacturing, and healthcare. For example, in securities trading, it currently takes several days to transfer assets, thereby increasing counterparty risk. Smart contracts that use blockchain technology could shorten settlement times and mitigate such risk. In the insurance industry, certain policy agreements could be automated. A smart contract for travel insurance can be automatically triggered once a flight is cancelled. Once the cancellation is posted, the smart contract makes a payment directly to the policyholder, thereby bypassing the claims process. Governments may use smart contracts to manage title recordings, social services, and e-voting. In manufacturing, smart contracts may replace current supply-chain processes such as bills of lading, proof of origin, or quality control. Another interesting application is tying smart contracts to the Internet of Things (i.e., cars, appliances, and devices). For example, a washing machine may contain a sensor indicating when it is low on detergent and then automatically reorder it.

One of the leading platforms for smart contracts is Ethereum, which was specifically designed to be a smart contracts platform. Although traditional cryptocurrencies, such as Bitcoin, can store and transfer value, Ethereum is also capable of carrying data in the form of arguments, which means that the platform can be programmed to take a specific action once certain conditions are met. Thus, contracts can be programmed to be self-executing because the platform can send money once the specified conditions are satisfied. Theoretically, given enough time, the platform will eventually be able to solve any computable problem. However, in practice, how well the platform runs depends upon network speed and memory.

Although many advances have been made in smart contract technology, it is still in an early development stage. There are issues such as scalability, centralization risk, and usability that must be addressed before mass adoption by the general public. The issue of scalability arises because the technology is dependent on network speed. More complex transactions require much higher network speed to which only some large entities have access. This may also lead to centralization risk if power is concentrated into a small number of hands. Such concentration means that a group of bad actors may conspire together to approve malicious transactions. Finally, these “smart contracts” are still primarily written in code and not easily readable by the average lawyer. Tools will have to be developed to bridge the usability gap.

In conclusion, as smart contract technology evolves, it will surely disrupt many industries. Major industries such as financial services, government, real estate, manufacturing, and healthcare have begun testing this new technology. It is only a matter of time before the technology is fully implemented. Lawyers can play an active role by staying abreast of changes that may affect their clients. Transactional lawyers may wish to learn more about the technical aspects of their future “smart contract” to ensure that it aligns with their client’s wishes and goals. In the future, litigation attorneys may no longer be litigating the “four-corners” of the contract, but rather expanding into the intent of the code.

When Information Security Became a Lawyer’s Thang

In the case of NotPetya, it is not simply a matter of many individual enterprises being hit but rather entire supply chains being hit as well. Reckitt Benckiser Group just announced they will likely have issues hitting their quarterly numbers because they could not invoice for millions of dollars because production lines were impacted. While you may have heard about FedEx being hit, Moller-Maersk (the world’s largest sea logistics operations) will also have their top and bottom lines take a sizeable toll as thousands of shipping containers could not be off loaded due to system failures/compromises of sea ports. Understanding cyber risk is a core element of understanding today’s business risk. (Carter Schoenberg, Buying Cyber Insurance: Buyer Beware).

In May, a piece of ransomware known as “WannaCry” paralyzed businesses, government entities and Great Britain’s National Health Service in one of the largest global cyberattacks to date. The following month, it was “Petya,” another massive cyberattack that crisscrossed the globe, bringing Russian oil companies, Ukrainian banks and a mass of multi-national corporations to their collective knees. As the frequency of cyberattacks reach epidemic proportion . . . many businesses still lack adequate protection. By taking the time to understand the threats, how to prepare, and what to look for in a cyber liability policy, you can ensure that your business has the coverage it needs to survive a breach. (Evan Taylor, The Changing World of Cyber Liability Insurance).

Companies are exposed to an endless assault on their information technology (IT) infrastructure from a variety of anonymous hackers, ranging from mischievous (much less likely) to felonious (much more likely). Breaking into servers, computers, and Cloud providers in an attempt to steal valuable information has become mainstream in the last decade. It is clear today that lawyers must play an increasingly significant role in addressing information security (InfoSec) issues. Of course, managing this issue is of paramount importance because InfoSec has evolved from an IT issue to a C-Suite strategic problem, given that a company’s reputation, valuation, business vitality, and customer confidence can hinge on how it protects its information assets. This article explores how lawyers can and should play a greater role in dealing with InfoSec.

Introduction

In March 2014, the largest exploitation of government personnel data occurred when InfoSec personnel of the U.S. government’s Office of Personnel Management (OPM) detected a hacker (widely reported to be the Chinese government) trying to gain access to the OPM servers. OPM watched the hackers maneuver around the government’s IT environment for months—or longer—looking for the perfect treasure trove of information. Upon finding it, the hackers exfiltrated 22 million past and current U.S. governmental employees’ personnel files. A catastrophic event no doubt, but just one of the thousands of massive security breaches regularly impacting entities across the globe.

A common adage among technology professionals is that regardless of how much money or effort is expended to secure an IT environment, if someone wants to get in bad enough, they will. There is no perfect security. A hacker need only find one way in; whereas, the company must protect against an ever-increasing number of more sophisticated threats able to exploit the smallest technical chink in the IT armor.

As cyber defenses have become more robust over time, hackers likewise have become much more sophisticated. Whether moving undetected within a storage environment, hacking a military facility, stealing product design drawings, or holding information hostage through various Ransomware scams, we are entering the new era of information terrorism.

Vigilance in combating information terrorism is essential. Every facet of modern life is connected, and that connectedness can lead to more harm, done more quickly, with fewer ways to combat the problem. The assault on InfoSec and the fight against information terrorism will require multidisciplinary teams that enlist lawyers and legal departments to play a more active role in making InfoSec a reality for their organization. But what can lawyers do practically?

Contracting

Typically, most lawyers fail to view InfoSec as their problem. Anything related to technology is perceived as the exclusive province of the technology department. Historically, lawyers likely had only some contracting responsibility related to technology acquisition or a software license. That mindset has contributed to the InfoSec crisis and must change.

In recent years, lawyers have been negotiating (with IT help) security level agreements (SLAs) which dictate, among other things, the security requirements mandated by contract or limitations of liability for InfoSec failures. SLAs set up parameters the service provider will follow, minimum level of service requirements, and remedies if the provider fails. Given that each provider has its own SLA, lawyers should work to develop standardized requirements and language to be used on behalf of their client.

In response to a shift to the Cloud as a cost-effective, scalable, storage solution, lawyers must also proactively address information ownership, access, discovery, security, privacy, and other compliance requirements in contract when negotiating with each new Cloud vendor. Further, as there are many ways to implement a Cloud technology solution, lawyers must become more conversant in the differences between “public” and “private” Clouds to be able to negotiate adequate Cloud agreements.

Evolving Nature of Legal Advice

Traditionally, lawyers guide their business “partners” on myriad legal and regulatory issues. Helping IT and business personnel understand the legal issues and implications of security matters is standard and seemingly straightforward. In the context of InfoSec, however, satisfying the letter of the law can be different than satisfying the spirit of the law. With InfoSec, advising requires a deeper technical knowledge.

For example, the broker-dealer regulations mandate built-in, InfoSec-driven data redundancy by requiring that an organization subject to the regulations “store separately from the original, a duplicate copy of the record stored on any medium acceptable under § 240.17a-4 for the time required.” There are firms that stored two copies of their important records on different floors of the World Trade Center and satisfied the “letter” of the law; however, IT and InfoSec best practices require that the copies be at least 30 miles apart. Needless to say, when the 9/11 disaster hit, all the records were destroyed.

Similarly, Regulation S-P (an SEC privacy rule) requires “clear and conspicuous” notices regarding any privacy policy. Translating legal language into a technical reality is complex, differs from technology to technology, and again demands that lawyers, privacy, and IT professionals cooperate to better translate the law into a technical reality.

In both examples, the lawyer’s advice on InfoSec or IT issues will require not only a greater familiarity with technology, but also a means of working with technology professionals to provide a holistic solution in a way that may otherwise be foreign.

InfoSec Disclosure Responsibility

In the last two decades, an entirely new type of law has emerged to deal with InfoSec failures when personal identifiable information (PII) is exposed. Deriving from California Senate Bill 1386, most states have disclosure rules about what a “controller” of certain classes of information must do if that information is breached or exposed. Some of the laws contain disclosure provisions that provide an “out” if the information is encrypted, whereas other state disclosure laws allow victims legal and financial redress. (See The National Conference of State Legislatures state security breach notification laws database). With the passage of the General Data Privacy Regulations (GDPR) in the EU and the varying nuances of U.S. state law, lawyers must stay on top of this evolving body of law.

Litigation and Insurance

In states that allow for legal and financial redress, lawyers may have to defend the organization’s IT practices because they could be on the hook for certain harm caused by their failure to secure information. Similarly, companies may have to seek redress from others concerning the “care, custody and control” of their information. This will likely become a greater battleground as more information is moving to the Cloud.

A proposed settlement has been reached in the landmark Anthem data breach case, which saw the personal information of nearly 79 million people stolen and is being referred to as the biggest data breach in history, lawyers involved with the case announced. The $115 million settlement, if approved by a judge as scheduled next month, is the end result of the massive class action lawsuit filed after a 2015 cyberattack on insurance giant Anthem and is said to be the largest data breach settlement in history, law firm Girard Gibbs said in a statement. (See Anthem Landmark Settlement in Anthem Data Breach Suit).

Litigation regarding InfoSec failures ultimately still faces challenges when it comes to the standards for damages:

Article III standing requires that a plaintiff show an injury in fact, a causal connection between the injury and the conduct complained of, and that the injury will likely be redressed by a favorable decision. An “injury in fact” may include the invasion of a legally protected interest that is concrete and particularized, and actual or imminent (i.e., not conjectural or hypothetical). In actions for loss of personal data, a frequent issue has been whether the possibility of future injury in the absence of actual harm is enough to satisfy the Article III “injury in fact” requirement.” (See Developments in Data Security Breach Liability).

However, one apparent trend of certain courts is to be more accommodating on the issues of “proving” damages and future harm as fallout from a breach. Even with that being said, most courts and even “[p]laintiffs’ attorneys have also increasingly sought to avoid the injury restrictions of Article III by pleading the violation of federal statutes that do not have an injury requirement.” (See Corporate Legal Compliance Handbook).

One avenue organizations should consider to mitigate liability and litigation costs is identity-theft management services. Following the massive OPM breach, all those affected were given “LifeLock” for three years.

Organizations may also address InfoSec risk through cyber insurance. “According to a May 2017 survey from the Council of Insurance Agents and Brokers, 32 percent of respondents purchased some form of cyber liability and/or data breach coverage in the past six months, compared to 29 percent in October 2016.” (See Cyber Insurance: Overcoming Resistance.) Despite growth in coverage, not enough companies are ready for the worst; regardless of The Changing World of Cyber Liability Insurance, “It is not just a means of protecting against financial loss, but it is a conduit to services to restore companies.”

Lawyers in concert with risk-management and IT professionals can work together to better assess risks and insure against them.

Make InfoSec a Team Sport

InfoSec is now center stage in most board rooms because a hack can exact significant harm to the company’s systems, its ability to function, its bottom line, and its reputation. Properly managing the complex InfoSec challenges requires professionals from several parts of the organization that can address the issue comprehensively. Lawyers must be part of the team to proactively address InfoSec in conjunction with the CISO, CIO, CTO, Chief Privacy Officer, and Head of Compliance and Audit, among others.

Economic Espionage

InfoSec has become a greater concern with the exponential rise in cyber theft of company trade secrets. (See Economic Espionage). In recent years, the problem of countries, companies, and individuals misappropriating the trade secrets of U.S. companies has grown more insidious and more expensive to address. Lawyers and business executives have no choice but to deal with this increasingly complex problem. According to the U.S. Department of Commerce, intellectual property (IP) accounted for $6.6 trillion in value added, or 38.2 percent of U.S. GDP in 2014. IP alone accounts for over 45 million U.S. jobs and over 50 percent of all U.S. exports.

Getting Lawyers (More) Involved

Think Big C Compliance and Little C Compliance, Too

Lawyers must ensure that their organizations are not only complying with laws and regulations, but also helping create an environment where InfoSec is “institutionalized.” Compliance methodology (including policies, executive responsibility, delegation, communication and training, auditing and monitoring, consistent enforcement, continuous improvement—see Information Nation: Seven Keys To Information Management Compliance) based on the Federal Sentencing Guidelines can be helpful in this regard. Compliance methodology is especially important when dealing with InfoSec because failure will happen at some point. Following a compliance process may mitigate the impact to reputational harm or how a court “penalizes” the organization for the failure. Put another way, following compliance methodology helps manifest what a good corporate citizen does, demonstrates “reasonableness,” and may be the difference between winning and losing.

Help Make the Pile Smaller

Businesses are producing mass amounts of data and information. In 2017, there is a new exabyte of data created every few hours. That is the data equivalent of 50,000 years of DVD movies created several times each day. Most company’s “information footprint” doubles every year or two. Unfortunately, much of this new data has limited long-term value.

Lawyers can be instrumental in helping their organization defensibly dispose of unneeded information. By evaluating information stores and doing the requisite diligence, information can be disposed without fear of spoliation. Properly disposing of outdated and unnecessary information promotes business efficiency, reduces storage costs, mitigates privacy and InfoSec risks, and reduces costs of discovery.

Applying Simplified Records Retention Rules

Making the pile smaller demands that content is destroyed when law and policy allow. Any information that is needed for an audit, litigation, or investigation must be preserved during the pendency of the matter. Records retention schedules (RRS) have been used as a way for companies to legally dispose of information when it is no longer needed. Some have described the RRS as “a license to clean house and not fear going to jail.”

Lawyers can help dust off their company’s old-school retention rules and work towards modernization and simplification. Revamped retention rules can be more readily applied to information, which will augment disposition at the end of information’s useful life. In this way, InfoSec, IT, and privacy needs are met by applying the RRS: smaller piles make for more efficient business and better risk mitigation.

Limit Places Information Is Parked

In addition to the volume of information, organizations also have to deal with an expanding variety of locations where information may be stored. Increasingly those locations may not be within the “care, custody, or control” of the company. When the marketing department publicizes a product on Facebook, or HR advertises job openings on LinkedIn, information will be created that may or may not have ongoing business value calling for retention to satisfy legal requirements. The problem arises when managing that information pile is now in the hands of a third party. How can information stored under such circumstances be protected? Can contracts adequately address the issues of InfoSec?

More directly, lawyers must develop policies around what information is appropriate for the Cloud, the contract terms regulating the relationship with any third party in possession of the company’s information, and guidelines that map the technical requirements for any storage environment against the regulatory and legal needs of the company.

Classification

Another way to address InfoSec risk is by developing and applying InfoSec classification rules (for example, which information is “highly confidential,” “confidential,” “trade secret,” or “public”) that delineate important information requiring protection, less protection, or none at all. Good InfoSec classification rules afford more attention and protection to information that is more valuable and worthy of greater precautions. It is reminiscent of the 80/20 rule. Eighty percent of the information (maybe more) is relatively worthless, possibly requiring little protection. Applying developed classification rules, the important 20 percent of information gets the needed InfoSec attention. The smaller the pile to protect, the greater likelihood it will be protected. Making sure clear classification rules are in place and followed is essential to help address InfoSec risk.

Encryption

Another way lawyers can help address InfoSec is through reviewing existing policies regarding the handling, management, and transmission of protected information. Usually those rules, if they exist, require encryption to scramble the content to preempt its exposure. The policies often exist but are ignored. Encryption policies should make clear when “confidential” information must be encrypted, and the lawyers, compliance, and audit professionals must ensure that employees are following policy. Technology can be harnessed to automatically encrypt at the system level to remove the burden from employees.

Training and Gamification

It is clear in the InfoSec space that breaches are increasingly commonplace, not because InfoSec technology is inadequate (such technology is constantly improving), but because the employees are a weak link in the InfoSec chain. Employees are routinely and unscrupulously used to obtain, steal, and exploit company information.

Training must become part of the culture. It is not a one-off project, but rather an ongoing process requiring resources and commitment. Training can become much more effective through gamification—a unique training methodology that reinforces material to be learned through game theory and reward.

Big Data and Anonymization

Conflicts within an organization regarding how information should be managed is normal, with countless business, privacy, and legal needs that may be diametrically opposed. For example, for “Big Data” to be most effective when using analytics tools, there must be more information stored for longer periods of time. InfoSec and privacy seeks to retain less information for shorter periods of time. Anonymizing data as much as possible tends to mitigate InfoSec and privacy risk. Unfortunately, analytics tools are less efficient when working within encrypted databases—another conflict to navigate. Lawyers can help navigate the many competing interests for information in organizations.

Conclusion

Information is the corporate life blood, and it is freely flowing in the streets far too often. Technology can only do so much in terms of protecting information and the systems that create, store, and transmit it. Employees are a big part of why InfoSec fails so frequently, leading to massive information breaches. Foolproof security does not and will never exist, but things can improve dramatically. Although InfoSec failure and risk will never vanish completely, lawyers can and should aid in fighting the InfoSec and information terrorism war.

Five Things to Know About D&O

Serving as a director or officer of a company carries certain inherent risks—including the prospect of lawsuits challenging managerial actions. For that reason, companies often arrange to carry D&O insurance to attract and protect individuals who serve in such roles. Unfortunately, the first time that many officers and directors drill down into the details of coverage available to them as part of a policy is after a claim for damages is asserted against them.

Counsel for directors and officers should not allow clients to end up in that position. Rather, counsel should emphasize to clients that the time for understanding a policy’s protections is at the outset of a company’s purchase or renewal of insurance. Waiting until a claim is made is obviously not the time to attempt to redraft policy language or obtain additional protection. Counsel for individuals thinking of serving in director or officer roles can provide essential value by asking critical questions, obtaining certain answers, and securing appropriate policy provisions.

Set forth below are five essential aspects of D&O insurance that counsel should emphasize to clients in the current business environment. A recent Sixth Circuit opinion discussed below, Indian Harbor Ins. Co. v. Zucker, highlights the significance of these points. Counsel should emphasize these points to individuals serving or contemplating serving in the role of officer or director.

1. D&O Actions Commonly Arise in Distressed Situations

When a company encounters a period of distress—whether by market conditions, fraud, an overleveraged balance sheet, or other factor—it is common for the actions of the company’s directors and officers to be examined for possible causes of action. A typical scenario today is a quick sale of the company’s assets in a distressed situation. In the usual case where sale proceeds are not sufficient to satisfy all constituents, a fiduciary (such as a creditors committee or liquidating trustee) may bring litigation against the directors and officers with the goal of increasing the pool of funds available to creditors. In such a situation, the directors and officers will want to know that the company’s D&O policy will cover defense costs and satisfy any settlement or final judgement. Any indemnification rights the director or officer may have against the company are typically worthless in a distressed situation. Directors and officers most need the protection of a solid policy in the event of corporate distress, and in such circumstances, it is critical to ensure adequate policy language that will provide protection is in place. In the absence of adequate coverage, personal assets will constitute the most likely source of resources to satisfy an adverse judgement.

2. D&O Policies Are Not Uniform

It is difficult for a business person or lawyer who does not regularly work with D&O policies to appreciate potential grounds for an insurer’s denial of coverage embedded in a policy. Directors and officers with questions often will ask an insurance broker to provide an answer to a hypothetical situation. Yet, if a director or officer seeks coverage under an issued policy, the broker’s assurances will mean little to a court focused on the actual written words in the policy and how those words should be interpreted in a particular factual setting. Counsel should ensure that clients relying on a policy for risk mitigation understand the operative terms and how similar terms have been interpreted in prior disputes. Counsel should seek to obtain alternative formulations when necessary to provide greater coverage. Clients should be encouraged to actively seek out competing policies if doing so will help obtain more favorable terms.

3. D&O Policies Are Claims Made

Directors and officers must understand that D&O policies are “claims made,” meaning that coverage exists only for claims made during the time period the policy is in effect. If a company begins to encounter challenging circumstances, it is essential that the policy not lapse. If the company needs to enter into some restructuring or liquidation proceeding, the company should acquire a “tail”—an extended time period for the reporting of claims for events occurring during the period in which the policy was in effect. Claims made while no policy or extended reporting period are in effect are not covered. In the Indian Harbor case, the policy at issue had a one-year term and was extended twice by the company; thus, the policy covered the time of the alleged violations of fiduciary duties by the officers. That good news, however, was offset by rather bad news as discussed below.

4. Understand Clauses That Can Eliminate Coverage

A critical aspect of any D&O policy is understanding the clauses that can eliminate coverage. Such clauses include, but are not limited to, the list of exclusions. One key exclusion is known as the “insured versus insured”—a provision at the heart of the decision in Indian Harbor. The policy in that case included language excluding from coverage “any claim made against an Insured Person . . . by, on behalf of, or in the name or right of, the Company or any Insured Person” except for certain derivative suits and employment claims. The litigation in Indian Harbor was brought by a liquidating trustee against former officers asserting breaches of fiduciary duties and seeking $18.8 million in damages. The insurer denied coverage on the basis of the insured-versus-insured exclusion—a position upheld by a panel of the Sixth Circuit. The particular facts of that case limited any potential recovery for creditors to funds available under the policy; the confirmed reorganization plan provided that no personal assets would be available to satisfy any adverse judgment. That fact-specific aspect of the case does not detract from the larger lesson: insured-versus-insured clauses can leave directors and officers exposed unless carefully drafted to provide an exception to that exclusion.

5. Negotiate Appropriate Exceptions to Exclusions

Directors and officers who want to ensure that an insured-versus-insured exclusion will not deny coverage must have previously negotiated an appropriate exception to that exclusion. Such an exception would allow coverage for claims brought by a liquidating trustee, bankruptcy trustee, or similar fiduciary. However, the exception itself must be carefully drafted because there is no “standard” language that will easily provide comfort of coverage. A director or officer may end up as a defendant in a suit brought by any number of differently named entities depending on the ultimate fate of the company, such as a debtor in possession, a chapter 7 trustee, a chapter 11 trustee, a liquidating trustee, a creditors committee, an assignee for the benefit of creditors, a receiver, and others. The exception to the insured-versus-insured exclusion should be well drafted with input from those experienced with the current market for such exceptions and with judicial interpretation of such clauses.

Conclusion

Directors and officers should know a great deal more than the above five points concerning D&O insurance. Indeed, each defined term in a policy deserves careful scrutiny from experienced eyes. Also requiring careful analysis are provisions governing allocation, retention, policy limits, and the priority of payments for so-called Side A (protecting individual directors and officers) with Side B (reimbursement to the company for indemnification claims) and Side C (coverage for the company for certain direct damages). Counsel should help clients drill down into the details of D&O policies as early as possible—and well in advance of any sign of distress—to ensure the protection clients think exists will actually be there when most needed.

Like Great Britain, a Limited Liability Company May Have an Unwritten Constitution

Under Elf Atochem N. Am., Inc. v. Jaffari, 727 A.2d 286, 291 (Del. 1999), the operating agreement is indubitably the “cornerstone” of a limited liability company. This column examines the problems arising when that cornerstone is unwritten.

Under Most LLC Statutes the Operating Agreement Need Not Be in Writing

Almost 20 years ago, while on an ABA-ULC project, I made the acquaintance of a leading practitioner in the field. Although today he is as skilled and adept with limited liability companies as with corporations, he was then first entering the world of unincorporated business organizations. His reaction upon first hearing that an operating agreement may be oral was memorable. He was incredulous.

From a corporate perspective, his reaction made sense. Who, for example, has ever heard of oral by-laws? Generally, however, LLC law follows partnership law as to the governance of internal affairs, and the law of general partnerships has always accepted oral partnership agreements.

Although most LLC statutes require a limited liability company’s basic management template to be not only in writing, but also “of record,” with very few exceptions LLC statutes embrace the partnership approach and expressly authorize oral operating agreements. In many statutes, the authorization appears in the very definition of the concept. For example, ULLCA (2013) § 102(13) contemplates the operating agreement being “oral, implied, in a record, or in any combination thereof,” and the Delaware statute begins its definition of “limited liability company agreement” with the phrase “any agreement (whether referred to as a limited liability company agreement, operating agreement or otherwise), written, oral or implied.” Del. Code Ann. tit. 6, § 18-101(7). Consistent with the common law of contracts, these definitions also authorize terms and even entire agreements “implied in fact” (i.e., conduct of the parties). (Some statutes do not go so far. For example, the Georgia LLC statute provides: “Operating agreement, means any agreement, written or oral, of the member or members.” Ga. Code Ann., § 14-11-101(18). The Delaware statute was similarly limited until 2007, when the legislature added “or implied” to the definition. Del. Laws, c. 105, § 1 (2007).)

Unwritten Operating Agreements and the Problem of Indeterminacy

Authorized, however, is not the same as advisable; traps for the unwary abound. At the most basic level is the question of content. To what did the parties actually agree? As explained in the Restatement of Contracts, “The parties to an agreement often reduce all or part of it to writing. Their purpose in so doing is commonly to provide reliable evidence of its making and its terms and to avoid trusting to uncertain memory.” Restatement (Second) of Contracts (1981) (R.2dC), Chapter 9, Topic 3, Intro. Note. Put more colloquially, writings help avoid swearing matches.

Writings also help clarify understandings. As explained in an R. Guidon cartoon, “Writing is nature’s way of letting you know how sloppy your thinking is.” Or, as put more elaborately by various wags, “I know you think you understand what you thought I said but I’m not sure you realize that what you heard is not what I meant.”

In the LLC context, establishing content involves additional uncertainties. For example, although governance and economic relationships within limited liability companies may have similarities, none are so regular as to constitute “a usage having such regularity of observance in a place, vocation, or trade as to justify an expectation that it will be observed with respect to a particular agreement. R.2dC § 222(1) (defining “usage of trade”). “Course of dealing,” waiver, and estoppel may usefully apply in a limited liability company with only two members, but the concepts are fundamentally problematic in a company with more than two members:

When [such] doctrine[s] operate[] in the typical, bilateral situation, the benefits are confined to the party that relied to its detriment and the prejudice is confined to the party whose conduct occasioned the reliance. In contrast, such congruence will not necessarily exist in an LLC with more than two members. Estoppel and waiver may benefit parties who have not relied and prejudice parties who did directly occasion the reliance.

Bishop and Kleinberger, Limited Liability Companies: Tax and Business Law, ¶ 5.06[3][c][iii].

The “content” problem is especially acute when a limited liability company admits a new member. Under the uniform act, “a person that becomes a member is deemed to assent to the operating agreement,” ULLCA (2013) § 106(b), and any other result would produce chaos. Prudence thus demands that the existing, oral agreement be memorialized because otherwise the new member is doing worse than buying “a pig in a poke,” i.e., it, she, or he is agreeing sight unseen to whatever the existing members remember the operating agreement to be. Or, as stated less colloquially: “Given the possibility of oral and implied-in-fact terms in the operating agreement, a person becoming a member of an existing limited liability company should take precautions to ascertain fully the contents of the operating agreement.” ULLCA (2013) § 106(b).

Another Trap for the Unwary: Unwritten Agreements Authorized . . . Except Not Completely

Ironically, problems also arise because an LLC’s statute authorization of oral and implied-in-fact agreements may be incomplete. Some statutes permit unwritten operating agreements in general, but then identify particular statutory rules that may be changed only by a signed writing. For example, Ga. Code Ann. §§ 14-11-304(a) and 14-11-403, respectively, provide that “[u]nless the articles of organization or a written operating agreement [provide otherwise], management of the business and affairs of the limited liability company shall be vested in the members,” and likewise that profits and losses are allocated per capita unless provided otherwise in articles of organization or written operating agreement. Presumably, such provisions are so important that they warrant the evidentiary and cautionary protections that Professor Fuller identified as among the raisons d’étre for legal formalities. Lon L. Fuller, Consideration and Form, 41 Colum. L. Rev. 799 (1941).

The rationale is less clear for writing requirements with a narrower scope—for example, Cal. Corp. Code § 17352(c), which provides that: “Except as otherwise provided in the articles of organization or a written operating agreement, the managers or members winding up the affairs of the limited liability company pursuant to this section shall be entitled to reasonable compensation.” The provision is important in and of itself, especially considering that at one time the law of general partnerships provided the opposite result. But why is this particular provision more worthy of Fuller-type protection than, for example, the statutory rule allocating distributions among members? See Cal. Corp. Code § 17704.04(a).

Some writing requirements are sufficiently counter-intuitive as to warrant the label “trap for the unwary.” Texas law provides a good example. On the one hand, Tex. Bus. Orgs. Code Ann. § 101.001(1) defines “[c]ompany agreement” to mean “any agreement, written or oral, of the members concerning the affairs or the conduct of the business of a limited liability company.” On the other hand, Tex. Bus. Orgs. Code Ann. § 1.002(53)(A) defines “member . . . in the case of a limited liability company” to mean “a person who is a member or has been admitted as a member in the limited liability company under its governing documents.” See Perez v. Le Prive Enterprises, L.L.C., No. 14-15-00291-CV, 2016 WL 3634298, at *4 (Tex. App. July 7, 2016) (citing the governing-documents requirement in rejecting defendants’ contention that they and plaintiff had orally agreed to be members of a Texas limited liability company). (Emphasis added)

What About the Statute of Frauds?

The writing requirements just discussed could be styled as statutes of frauds, although they do not follow the template—that is, historically a statute of frauds provides that a contract pertaining to a specified subject matter is unenforceable unless evidenced by a signed writing.

The template does appear in several LLC statutes, which provide a statute of frauds for promises to make a contribution. For example, under Ohio Rev. Code Ann. § 1705.09(B): “A promise by a member to contribute to the limited liability company is not enforceable unless it is set forth in a writing signed by the member.” Given the general power of the operating agreement, this type of requirement is likely a default rule, although its override is probably subject to an implied condition—namely, that the relevant term of the operating agreement (rendering oral promises enforceable) be itself in writing and appropriately signed.

What of the generally applicable statutes of frauds? For example, may an oral operating agreement bind a member to contribute real property to the limited liability company, bind the company to employ a member as manager for three years, or obligate one member to guarantee the promised contributions of another? Does statutory authorization of unwritten operating agreements override the various written requirement imposed by statutes of frauds?

Most likely the answer is “no.” Almost by definition, a general authorization of oral agreements cannot oust generally applicable statutes of frauds. After all, Parliament adopted the original statute of frauds, 29 Charles II, c. 3, §§ 4,17 (1677), in the face of common-law rules making oral contracts generally enforceable.

The leading LLC case reflects this point. In 2009, the Delaware Supreme Court applied the statute of frauds to an alleged oral term of an operating agreement, reasoning that: “The legislative history of the LLC Act does not demonstrate the General Assembly’s intent to place LLC agreements outside of the statute of frauds.” Olson v. Halvorsen, 986 A.2d 1150, 1161 (Del. 2009) (applying the one-year provision to an alleged oral buy-out agreement).

The next year, the Delaware legislature overrode Olson, 2010 Del. Laws, ch. 287 (H.B. 372), §§ 1, 31 (putting LLC agreements outside all statutes of frauds), and Illinois has gone at least part way: “An operating agreement is enforceable whether or not there is a writing signed or record authenticated by a party against whom enforcement is sought, even if the agreement is not capable of performance within one year of its making.” 805 Ill. Comp. Stat. Ann. 180/1-46.

However, in the absence of such specific legislation, Olson’s reasoning still holds. Moreover, Olson is consistent with case law concerning oral partnership agreements: “Partnership agreements, like other contracts, are subject to the Statute of Frauds. Abbott v. Hurst, 643 So. 2d 589, 592 (Ala. 1994). (Emphasis added)

In any event, ousting the statute of frauds can cause considerable problems. For example, suppose RayandAndy, LLC (RayandAndy) is a Delaware limited liability company with four members and an unwritten operating agreement. RayandAndy owns several parcels of undeveloped land, which are to be sold to private developers “as the market matures.” However, just as RayandAndy prepares to make its first sale, Asha, one of its members, asserts a right of first refusal (ROFR).

In any other context, Asha’s claim would fall to the statute of frauds. If a lawsuit were to ensue, Asha’s failure to plead the necessary writing would entitle RayandAndy to judgment on the pleadings. In contrast, in the context of a Delaware limited liability company, Asha could avoid judgment on the pleading merely by pleading that the ROFR is part of RayandAndy’s unwritten operating agreement. In addition, unless the evidence were so one-sided as to compel a finding that no oral ROFR exists, Asha’s claim would also survive a motion for summary judgment.

For all the above-mentioned reasons, an unwritten operating agreement is “a consummation devoutly [not] to be wished.” (W. Shakespeare, Hamlet act 3 sc. 1) Transactional lawyers routinely advise their clients to memorialize “the deal,” which in the case of a limited liability company is what a good operating agreement does. However, even a well-written agreement can have an Achilles heel—namely, claimed oral modifications and separate oral agreements. The next article in this two-part series will describe these threats and suggest ways to anticipate and deflect them.

Changes in the Choice-of-Law Rules for Intermediated Securities: The Hague Securities Convention is Now Live

Lawyers working in the commercial law field are familiar by now with the choice-of-law rules for transactions in intermediated securities provided by Articles 8 and 9 of the Uniform Commercial Code (the UCC). Those rules, appearing principally in certain subsections of UCC §§ 8-110 and 9-305, have functioned well as a matter of U.S. law in international as well as domestic transactions, but they have now been augmented and partially preempted by the Hague Securities Convention (the Convention), more formally known as the Convention on the Law Applicable to Certain Rights in Respect of Securities Held with an Intermediary.

The Convention, ratified by the United States in December 2016, became effective as a matter of U.S. federal law on April 1, 2017. Fortunately, the Convention’s choice-of-law rules lead in most instances to the same results as under Articles 8 and 9.There are some differences, however, and the Convention applies even to existing transactions.

Background and Scope of the Convention

The Convention was promulgated in 2006 by the Hague Conference on Private International Law. By its terms it became effective upon adoption by three nations, and the United States is the third of those nations—the other two to date being Switzerland and Mauritius. More countries are expected to follow, and as the Convention’s choice-of-law rules become internationally widespread, the transactions to which the Convention applies will be greatly facilitated.

The Convention applies only to transactions in intermediated securities, which U.S. lawyers often call the “indirect holding system.” In such transactions, the securities’ registered owner is typically a clearing corporation (e.g., a federal reserve bank, the Depository Trust Company, Clearstream, or Euroclear); the clearing corporation maintains accounts reflecting that the securities are held for the benefit of a bank, broker, or other securities intermediary (referred to in this article as an “intermediary,” although a clearing corporation acts in this role as well with respect to their participants); and the securities’ ultimate beneficial owner may be a customer of the intermediary. When a customer says that he, she, or it owns securities issued by Social Media Corporation, the customer in the indirect holding system actually has a right to the securities against the intermediary, and the intermediary has a right to the securities against the clearing corporation. In the United States, the substantive commercial law rules governing these relationships are set forth in Part 5 of UCC Article 8. Naturally, other nations’ substantive rules can and do differ substantially.

The Convention determines the applicable law for a broad range of commercial law issues in any transaction or dispute “involving a choice” between the laws of two or more nations. In this globalized era, transactions in intermediated securities frequently present such a “choice” for purposes of the Convention, for example whenever any two of the following elements of the transaction are in different nations: the account holder; an intermediary; any party to an outright or collateral transfer; an adverse claimant; a clearing corporation; a creditor of either the account holder or an intermediary; the issuer; or the certificates held by the clearing corporation. (U.S. lawyers have generally never ignored elements such as the debtor’s location or the other elements just mentioned, for purposes of planning with respect to the likely jurisdictions of a possible insolvency proceeding, but they have also been accustomed to treating these elements as immaterial to a strictly UCC choice-of-law analysis under §§ 8-110 and 9-305.) Moreover, any non-U.S. nation in question need not be a party to the Convention in order for the Convention to apply. As a result, lawyers should keep the Convention in mind in planning virtually every intermediated securities transaction.

The choice-of-law issues determined by the Convention include all of those currently covered by UCC §§ 8-110 and 9-305, as well as a few others. The Convention’s issues, set forth in its Article 2(1), include all of the following:

  • the rights and obligations between a customer and its intermediary;
  • the perfection steps that must be taken if a customer grants a security interest to the intermediary or to a third-party lender;
  • whether the transfer of an interest in securities is characterized as a sale or a security interest;
  • the effect of a judgment creditor of the customer attaching or levying on the customer’s interest in the securities;
  • how the priority conflict among buyers, secured parties, and judgment lien creditors is resolved if more than one of them claims an interest in the securities;
  • the effect of a disposition of the securities by the intermediary, with or without the customer’s consent;
  • whether any interest in the securities obtained by a buyer, secured party, or judgment lien creditor extends to dividends and other distributions; and
  • the requirements that a secured party or other acquirer must follow in foreclosing on or otherwise realizing the value of the securities.

Several limitations on the Convention’s scope should also be noted. The Convention provides choice-of-law rules only for indirectly held securities, not for directly held ones. The Convention’s rules do not affect the rights and duties of a security’s issuer or transfer agent. The Convention also does not provide choice-of-law rules for purely contractual issues, for example, the effect of an arbitration clause in the agreement governing the account (the account agreement), or the strictly bilateral, rather than third-party, effects of attachment of a security interest.

It is important to note the differences between basic terms such as “securities” as used in the Convention and the same terms as used in UCC Article 8. The Convention defines the term “securities” as “any shares, bonds or other financial instruments or financial assets (other than cash) or any interest therein.” This definition is broader in some respects than the UCC Article 8 definition, yet the Convention’s overall reach is narrower than that of the UCC’s indirect holding system. This is because UCC § 8-102(a)(9) permits the intermediary and customer to agree that any property other than securities will also be treated as a “financial asset” to which the indirect holding system will apply. By contrast, the Convention contains no such option for expanding its scope by agreement. (The Convention uses “financial asset” as part of its definition of “security,” but does not define “financial asset.”) Similarly, the UCC’s indirect holding system clearly applies to “cash” (i.e., credit balances), either because credit balances are considered part of the securities account itself, or because the intermediary and customer have agreed to treat the cash as a financial asset, but the Convention expressly excludes cash even if the cash would otherwise have been considered a “financial asset” within the Convention’s usage of that term. Nonetheless, the Convention is designed like the UCC to be flexible and to have fluidly broad coverage that will meet the demands of market practices. An authoritative and in-depth Explanatory Report on the Convention, referring to “exchange traded financial futures and options” and to “credit default swaps” suggests that securities held with an intermediary for purposes of the Convention could encompass some assets that might be considered commodity contracts or otherwise not considered securities or other financial assets under the UCC.

The Importance of Unified Transnational Choice-of-Law Rules: An Example

Suppose that a bank operating in New York acts as an intermediary, and that one of the bank’s custodial customers is a corporation organized under Texas law. The customer wishes to invest in securities of a certain issuer located in Ruritania, so the intermediary acquires those securities through a clearing corporation and credits them to the customer’s account. A German lender extends credit to the customer, is granted a New York law security interest in the customer’s Ruritanian securities as collateral, and takes appropriate steps under New York law to perfect the security interest. Later, an Australian unsecured creditor of the customer obtains a judgment against the customer and also obtains a judgment lien on the customer’s interest in the securities.

The substantive outcome of the contest between the German lender and the Australian creditor will often depend on the choice-of-law rules of the forum in which the contest arises. In a New York forum, prior to effectiveness of the Convention—and generally now as well, although some details are discussed below—the German lender has generally prevailed if it has perfected under the substantive law made applicable by New York’s conflicts rules. Under those conflicts rules, if the account agreement designates, say, New York or New Jersey as the “securities intermediary’s jurisdiction” or, absent such a clause, provides that the account agreement is governed by New York or New Jersey law, then the lender may perfect by control under New York or New Jersey law, as the case may be. See NYUCC §§ 9-305(a)(3), 8-110(e). Also under New York’s conflicts rules, the fact that the customer is a Texas corporation means that the lender may perfect by filing a financing statement under the substantive law of Texas. See NYUCC §§ 9-305(c)(1) and 9-307(e). If perfected by either means, the German lender prevails under the applicable state’s version of UCC § 9-317(a)(2)(A).

Very different rules would likely apply if the Australian creditor brings its action in Ruritania. The Ruritanian court could very well apply a widespread choice-of-law rule known as lex rei sitae, which points to the substantive law of the asset’s situs—and Ruritanian law could very well view securities issued by a Ruritanian issuer as being located in Ruritania. Moreover, under Ruritanian substantive law, a judgment lien of the Australian creditor could very well take priority over the German lender’s security interest if the German lender had not previously taken steps to perfect under Ruritanian law, rather than New York or Texas law. A similar scenario would arise if the Ruritanian choice-of-law rules viewed the securities as being located in, say, Sylvania, where the clearing corporation were located or where certificates representing the securities were physically held.

This problem can be especially acute under insolvency law. In a Ruritanian insolvency proceeding, the lender’s security interest may not be recognized at all, if the applicable substantive law is that of Ruritania or another jurisdiction in which the lender did not take appropriate perfection steps.

A similar issue could even affect the lender if the customer becomes a debtor under the U.S. Bankruptcy Code. In such a proceeding, the bankruptcy trustee would have the status of a hypothetical creditor with a judgment lien on the customer’s Ruritanian securities, obtained at the time of the commencement of the bankruptcy case. What is the choice-of-law rule that determines the substantive effects of this hypothetical creditor’s judgment lien? The Bankruptcy Code does not expressly provide such a choice-of-law rule, nor does the case law appear to be well-settled. If the substantive effects are determined by Ruritanian law, then the bankruptcy trustee could set aside the lender’s security interest and treat the lender as a general secured creditor, even though the security interest would have been senior to the judgment lien under New York’s substantive law.

The importance of all of the foregoing is multiplied for lenders that extend credit against a portfolio of securities of issuers located, or held through clearing corporations, in numerous countries. Without a clear and widely unified choice-of-law rule in these circumstances, it could easily become cost prohibitive for a lender to investigate and comply with the substantive laws that might apply under the choice-of-law rules of each country in which litigation might be brought. Conversely, the more widely adopted the Convention becomes, the more the parties contemplating a transaction can be confident that its broad set of issues will be resolved under a single body of substantive law, known in advance, irrespective of the forum in which a dispute is likely to arise. The prospect of approaching this goal—in a manner that also harmonizes well with the sound, existing rules of UCC Articles 8 and 9—is what led the American Bar Association, the Association of Global Custodians, the International Swaps and Derivatives Association, EMTA (formerly the Emerging Markets Traders Association), the Securities Industry and Financial Markets Association, and the Uniform Law Commission all to support U.S. ratification of the Convention.

The Convention’s Strong Kinships with UCC Articles 8 and 9

The Convention’s primary rule, set forth in its Article 4(1), provides that the law applicable to all of the choice-of-law issues covered by the Convention is the law chosen by the intermediary and its customer to govern their account agreement generally or, alternatively, to govern the issues covered by the Convention specifically. The only limitation, often referred to as the “Qualifying Office” test and further discussed below, is that this chosen law must be that of a country in which the intermediary, at the time that the parties enter the agreement, has an office that is engaged in the activity of maintaining securities accounts.

Many readers will already see that by giving effect to the account agreement’s governing-law clause, the Convention is directly parallel to UCC § 8-110(e)(2). By the same token, the Convention’s giving effect to an alternative clause, in which the parties designate a body of law different from the one that governs the account agreement as a whole, is directly parallel to UCC § 8-110(e)(1). The agreement between an intermediary and its customer is always at the essence of the customer’s interest in intermediated securities, and this is the reason that the Convention, just like UCC Articles 8 and 9, looks at this agreement in determining the applicable choice of law.

We offer one word of caution, however. UCC § 8-110(e)(1) and (2) refer to “an agreement” between the intermediary and its customer governing the account, whereas the Convention’s definition of account agreement refers to “the agreement” between those parties governing the account. The Explanatory Report makes clear that this agreement may consist of more than one document. However, it is probably advisable to avoid relying on the law designated only in a free-standing control agreement, i.e., one that is not clearly a part of the account agreement per se, unless the control agreement makes clear that it is amending the account agreement.

The Convention also generally disapplies the conflict-of-laws notion of renvoi, in which a forum would have to take account not only of another jurisdiction’s substantive law, but also of the other jurisdiction’s conflicts-of-law rules. Thus, under the Convention Article 10, if the parties have designated, for example, English law, then a U.S. forum would apply English substantive law without regard to England’s own conflicts rules. This treatment of renvoi also parallels UCC Articles 8 and 9, which express the same idea by designating the “local law” of the jurisdiction in question.

Also directly paralleling the UCC, for lenders that seek to perfect a security interest by the filing of a financing statement, the Convention generally does a remarkably good job of accommodating UCC Article 9’s choice-of-law rules for perfection by filing. See Convention Article 12(2)(b), further discussed below.

Applying all of these points to the earlier example of the New York intermediary and its Texas customer owning Ruritanian securities, a New York forum will reach exactly the same results under the Convention as heretofore under the UCC alone (assuming only that the Qualifying Office test is met; see below). If the German lender seeks to perfect its interest by control, and if the account agreement designates New York or New Jersey law as either the account agreement’s own governing law or as the law governing the Convention’s Article 2(1) issues, then control will be available under New York or New Jersey law, as the case may be. Alternatively, if the German lender seeks to perfect its interest by filing, then the Convention will take account of New York’s enactment of UCC §§ 9-305(c)(1) and 9-307, which enable perfection by the filing of a financing statement in Texas.

The Convention’s Principal Differences from UCC Articles 8 and 9

There are a few minor instances in which the choice-of-law outcomes under the Convention might differ from those under UCC Articles 8 and 9 alone. The most important of these are described here, but the risk of a different outcome in any of these circumstances is manageable by sound transactional planning. In the case of transactions already in place before the Convention becomes effective, some transitional attention may be required.

Qualifying Office

The Convention’s Qualifying Office test (the thrust of which is articulated above, although further details are set out in Convention Article 4(1), second sentence) has no counterpart in UCC Articles 8 and 9. However, the Qualifying Office test is not expected to have much effect in practice because intermediaries typically provide that their account agreements will be governed by the law of a country in which they have one or more offices satisfying the test. By virtue of Article 12 of the Convention, which addresses so-called Multi-unit States like the United States, the Qualifying Office test is met for a chosen law of a U.S. state, district, or territory so long as the intermediary has an office in any U.S. state, district, or territory. The Qualifying Office test was a product of compromise in the Convention negotiations, worthwhile for the sake of helping to pave the way for eventual ratification by many nations having different legal systems.

Filing and Non-U.S. Law Account Agreements

The Convention’s accommodation of UCC Article 9’s choice-of-law rules for perfection by filing does not cover transactions in which the intermediary and its customer have contractually chosen non-U.S. law under the Convention’s primary rule. Adapting the earlier example, if the New York intermediary and its Texas customer effectively provide that their account agreement is governed by English law (or that English law applies to all of the issues under the Convention), then the Convention will cause the New York forum to look to English law, and not to any rules of UCC Article 9, for all matters of perfection, including whether and how perfection by filing might be available.

Filing and Non-U.S. Debtors

The Convention’s accommodation of UCC Article 9’s choice-of-law rules for perfection by filing also does not cover transactions in which UCC § 9-307 views the debtor to be located in a non-UCC jurisdiction; instead, perfection by filing in those cases will be governed by the law that the intermediary and its customer contractually designate under the Convention’s primary rule. Again adapting the earlier example, suppose that the customer of the New York intermediary is an Ontario, Canada corporation with its chief executive office in Toronto, and that the intermediary and customer effectively provide that their account agreement is governed by New York law. In that case, New York’s own substantive law (notably NYUCC § 9-501(a)(2) regarding filing with the New York Secretary of State) will govern perfection by filing, and not New York’s choice-of-law rules for perfection by filing, which before the Convention would have pointed to a filing under the Ontario Personal Property Security Act. This is because Article 12(2)(b) accommodates UCC Article 9’s choice-of-law rules for perfection by filing only if those rules point to a jurisdiction within the United States.

Number of Issues Covered

The Convention’s package of choice-of-law issues is more comprehensive than the package under the UCC alone. U.S. lawyers have grown accustomed to thinking of perfection, the effect of perfection or nonperfection, and priority as being all generally determined together, but the law designated under the Convention also pulls in other issues: the requirements applicable to remedies (e.g., foreclosure sales or retention of the collateral), the characterization of a transaction (e.g., as an outright sale or secured loan), and even any effects as against the intermediary or third parties of attachment of a security interest.

Certain Transition and Other Practice Tips

Beginning on April 1, the Convention began applying to already-existing transactions, as well as to new transactions going forward, so long as the transaction is one “involving a choice” between two nations’ laws, and here as well regardless of whether a non-U.S. nation involved in the choice has also ratified the Convention. In most instances, no further action is necessary to preserve the attachment, perfection, and priority of a security interest.

Clauses designating a U.S. governing law for the account agreement under UCC § 8-110(e)(2) continue to be effective under Convention Article 4(1), provided that the Qualifying Office test is met. Clauses from a pre-Convention account agreement expressly designating a U.S. “securities intermediary’s jurisdiction” under UCC § 8-110(e)(1) continue to be effective (because in this context selecting the law to govern any of the issues specified in Article 2(1) of the Convention is sufficient), at least if the governing law clause also points to U.S. law, and again provided that the Qualifying Office test is met. In both of these cases, a secured party’s perfection by control under the relevant U.S. substantive law continues to be effective. But in a pre-Convention account agreement with a non-U.S. governing law, it is advisable for U.S. lawyers to obtain advice on the effects of the Convention under that body of non-U.S. law. In certain circumstances, such a review might prompt a reconsideration of the appropriate governing law.

Account agreements for new transactions on and after April 1 should not simply rely on the UCC term “securities intermediary’s jurisdiction.” As noted, the issues governed by the Convention are broader than those governed by UCC Articles 8 and 9 alone, and accordingly in this context, such a clause would likely not meet the Convention’s requirement that the clause cover all of the Convention’s issues. Instead of such a clause (and where simply using a governing law clause will not suffice), a two-pronged clause like the following is suggested, especially if the account will include financial assets that are not “securities” as defined in the Convention:

State X [or Nation Y] is the securities intermediary’s jurisdiction for purposes of the Uniform Commercial Code, and the law in force in State X [or Nation Y] is applicable to all issues specified in Article 2(1) of the Hague Securities Convention.

A secured party of course should also confirm that the intermediary has a Qualifying Office in the chosen jurisdiction or, if the chosen jurisdiction is a U.S. state, district, or territory, in any other U.S. state, district, or territory.

Where a secured party is relying on perfection by filing, the limitations discussed above on the Convention’s accommodation of UCC Article 9’s choice-of-law rules for perfection by filing must be borne in mind. As a transition matter in relation to filing, if the account agreement designates a non-U.S. body of law, then it is advisable for U.S. lawyers to obtain advice on perfection and priority under that body of non-U.S. law in order to assess the Convention’s effects. And as another transition matter in relation to filing, if the account agreement designates a U.S. body of law, but perfection has been by filing in a non-U.S. jurisdiction, then it is advisable to employ an alternative method of perfection under U.S. law, e.g., filing in the jurisdiction designated by the account agreement.

Further Resources

This article has necessarily been limited to some of the key issues arising from the Convention. The Hague Conference on Private International Law has made available the text of the Convention and the Explanatory Report referred to above. The Permanent Editorial Board for the Uniform Commercial Code has recently published a Commentary on the Convention, including amendments to the UCC’s relevant Official Comments. The Tri-Bar Opinion Committee is expected to issue a report on related opinion practice to supplement certain prior reports in which choice-of-law rules for the indirect holding system are discussed.

Exploring the Legal Issues Unique to Small Business Lending

The United States is home to more than 28 million small businesses. The businesses are diverse and range from sole proprietorships to companies that employ workers, produce goods or services in supply chains, or serve customers on Main Street. During and following the financial crisis, bank loans to small businesses fell 18 percent, exacerbating the credit crunch felt by small businesses. Accordingly, a number of new lenders, many of which leverage advances in technology and the availability of data to operate online, burst on the scene to serve the small-business market.

The new lenders emerged along three basic models. The first model, peer-to-peer marketplace lenders, connects prime and subprime small business borrowers with capital from individuals and institutional investors that are looking for a return on their investment. The second model, borrower-driven broker marketplaces, connects borrowers with traditional and alternative financing sources, from banks and SBA-backed loans to new online lenders. Finally, the third model, balance-sheet lenders, leverages capital provided by institutional investors that they hold on their balance sheet to make loan decisions based on proprietary risk-scoring algorithms that rely largely on cash-flow data.

Regardless of the model used to originate business credit, shared key legal issues emerged. We will explore some of the key legal issues that are unique to small-business lending, which include determining the purpose of the loan, whether certain consumer laws may apply, licensing and usury issues, electronic contracting issues, and Dodd-Frank Act considerations.

What Is a Business Purpose?

Determining what constitutes a “business purpose” for a loan is important because many federal and state laws apply only to loans originated for personal, family, or household purposes (i.e., a consumer purpose). The Truth in Lending Act (TILA) and its implementing regulation, Regulation Z, is the primary federal law regulating consumer credit. The TILA requires creditors to make disclosures to borrowers concerning the cost of the financing extended when the transaction is for a consumer purpose. The regulatory intent behind the TILA is to allow consumers to understand the true cost of the credit/money they are receiving and to facilitate easy comparison of credit terms across creditors.

The TILA and Regulation Z do not apply to extensions of credit primarily for a business, commercial, or agricultural purpose. In choosing to make the TILA disclosures, business lenders incur the risk of regulatory scrutiny in that a regulator may conclude a transaction has a primary consumer purpose. However, voluntary disclosure to a borrower is not without merit. TILA compliance, specifically in the form of fee transparency, can increase borrower confidence in a creditor’s business practices and products. Given the competitive nature of the online lending space, this is a decision worth giving careful consideration.

If the borrower has characteristics of an individual consumer (such as loans to home-based businesses), determining the loan’s primary purpose can be even trickier. The Official Interpretations to Regulation Z provide that “(a) creditor must determine in each case if the transaction is primarily for an exempt purpose. If some question exists as to the primary purpose for a credit extension, the creditor is, of course, free to make the disclosures, and the fact that disclosures are made under such circumstances is not controlling on the question of whether the transaction (is) exempt” from the TILA.

Regulation Z provides additional guidance as to the factors a creditor should consider to determine whether the credit is for a business purpose. For example, the borrower’s statement of the purpose for the loan is a powerful factor that can potentially ward off claims that the transaction is for a consumer purpose. Other factors include the relationship of the borrower’s primary occupation to the transaction—the more closely related, the greater the likelihood the transaction is for a business purpose. Outside of the suggestions in the Official Interpretations to Regulation Z, lenders can and should also try to look to other factors that showcase the strength and credibility of the small-business applicant. Business longevity, industry reputation and, if plausible, on-site visits are all valuable tools to analyze loan purpose, particularly for lenders that finance sole proprietorships.

Under the TILA and many state laws, the main risk with respect to the purpose of the loan comes when a lender makes a loan to a “natural person,” including individuals and sole proprietorships. To the extent the borrower is a non-natural entity, like a corporation or a limited liability company, the TILA and many state laws do not apply.

Consumer Laws May Apply

Although consumer laws generally do not apply to business-purpose lending, significant exceptions do exist. For instance, some of the consumer laws that may apply to business-purpose lending include state consumer licensing schemes that define a “borrower” broadly to capture business borrowers. For example, some versions of the Uniform Consumer Credit Code (UCCC), such as West Virginia’s adopted version of the UCCC, capture so-called agricultural loans, which are business-purpose. In addition, some versions of the UCCC provide rate regulation for different types of commercial-purpose transactions, such as Oklahoma’s adopted version of the UCCC, which covers transactions that do not qualify as a “consumer loan” and provides that the annual percentage rate for an “other loan” (i.e., a commercial loan) cannot exceed 45 percent per year. Further, some state consumer-protection acts may define a “consumer transaction” broadly to include transactions that are personal, household, or business oriented. Finally, many substantive state laws will also apply to business-purpose loans, including state disclosure requirements.

In addition, the Equal Credit Opportunity Act (ECOA) and its implementing regulation, Regulation B, applies to business-purpose loans and includes explicit requirements for informing business applicants of adverse action when a lender denies credit and fair-lending standards. Finally, the Fair Credit Reporting Act (FCRA) may also apply in some instances to commercial credit transactions involving a consumer. Certain aspects of the FCRA, such as the requirement to have a permissible purpose to obtain a consumer’s credit report and certain adverse action notice requirements, may apply when a lender “pulls” a credit report on an individual or a guarantor of a loan. One such example when it may apply is when the consumer is a co-obligor or a guarantor on the business-purpose loan.

Licensing and Usury Issues

An online lender, like any other nonbank lender, must observe all applicable state laws in each jurisdiction in which it lends. Chief among these laws are state-specific licensing and usury regulations, which are often intertwined with determining whether the online lender can offer a particular credit product to small businesses located in a particular state.

Many states do not require a license to engage in small-business lending. Certain states, such as North Dakota and California, however, have enacted licensing schemes where small-business lending activities are directly covered or may otherwise fall within the scheme’s ambit. In those states, online lenders cannot lend to small businesses unless they obtain the appropriate license. In those cases, the online lender becomes subject to all of the requirements of a licensee; generally, the requirements may include limitations on fees, periodic reporting, surety bonds, disclosures, and/or vetting and oversight by state examiners.

Similarly, many states do not impose interest-rate limits on small-business loans (or do not impose such limits if the lender is properly licensed). In these states, lenders and small businesses are free to contract for an interest rate of their choosing. Other states, however, enforce a range of interest-rate limits. Within a single state, the interest-rate limits may vary based on certain attributes of a loan or a small business, such as loan size or small-business entity type. In addition, the interest-rate limits may provide separately for civil penalties and criminal violations, with significant differences in the consequences based on the type of violation.

A significant challenge faced by many online lenders in navigating the state-specific licensing and usury regulations is that they can often be inconsistent in scope and application. In some cases, overbroad or vague consumer finance statutes indiscriminately pick up many small-business loans where such restrictive protections are less, or not at all, appropriate. In other cases, overly restrictive interest-rate limits inadvertently squeeze credit availability by consigning local small businesses to rely entirely on credit products originated by banks, which can offer loans without the need to consider the interest-rate limits. In still other cases, outdated requirements, such as in-state, brick-and-mortar operations requirements, persist in regulations. As a result of these challenges, many online lenders have employed the following three approaches to offer a more consistent, uniform lending footprint to small businesses on a nationwide basis.

First, many online lenders originate their loans by partnering with a chartered issuing bank. The National Bank Act (NBA) and the Depository Institutions Deregulation and Monetary Control Act of 1980 respectively entitle federal- and state-chartered banks to export the laws of their home state for loans, regardless of the state in which the loan was made. Under the issuing-bank model, loans are typically originated in the following manner: (i) an online lender evaluates the creditworthiness of an applicant small business; (ii) if the loan application is approved for funding, the partner issuing bank originates the loan; (iii) the issuing bank retains the newly originated loan on its balance sheet for a minimum hold period; (iv) the online lender purchases the loan from the issuing bank for a specified fee; and (v) the online lender either holds or sells the loan, or an interest in the loan, to an investor. An online lender that purchases loans from issuing banks and their investors can, accordingly, rely on preemption of state-law claims for all loans originated and sold through the online lender. Recently, the issuing-bank model has been the subject of a number of high-profile court cases, including Beechum v. Navient Solutions Inc. and Commonwealth of Pennsylvania v. Think Finance. The model has been under additional scrutiny due to the U.S. Court of Appeals decision in Madden v. Midland Funding LLC in which the court held that non-national bank entities that purchase loans originated by national banks cannot rely on the NBA to protect them from state-law usury claims.

Second, outside of the issuing-bank model context, some online lenders rely on choice-of-law provisions to apply the law of a specific state to loans regardless of the location of the borrower. The state chosen may be the lenders’ home state or another state with less restrictive usury laws. The tests applied by courts considering choice-of-law provisions in this context have differed state-to-state, but most courts typically have been willing to enforce the parties’ contractual choice of law, unless there is no reasonable basis for adopting the laws of the chosen state, or such adoption would be contrary to a fundamental policy of the borrower’s home state.

Nevertheless, a borrower or state regulator could seek to invalidate a choice-of-law provision and argue that loans may not lawfully be made at interest rates exceeding the maximum rate permitted under the usury laws applicable in the state in which the borrower is located. Given the fact-intensive analysis applied by courts, lenders fare better when the choice-of-law provision is clearly understood and agreed to by both parties, and the chosen state bears a substantial relationship to the loan transaction. It is important to note that the existence of a state licensing scheme often demonstrates a strong public-policy interest in favor of protecting borrowers located in that state. Accordingly, state licensing authorities generally conclude that a choice-of-law provision does not affect the licensing analysis, and instead a license is required if loans are made from within the state or are made to small businesses located in the state.

Third, some online lenders have designed credit products in a manner that results in characterization as something other than loans. Most state licensing and usury regulations apply solely to loans. Many courts have taken the position that a transaction will be deemed a loan only if the principal amount is repayable absolutely and is not contingent on any future circumstance of event. Common examples of such credit products are merchant cash advances or other agreements for the purchase and sale of future receivables. Courts, however, do have the ability to recharacterize alternative financial arrangements as loans on a case-by-case basis. Consequently, a product that is successfully recharacterized as a loan ultimately will be subject to the licensing and usury laws of the governing state.

Failure to have the appropriate license could result in severe consequences, including the voiding of originated loans. Consequences of contracting for an interest rate that exceeds the governing state law when a court sets aside a choice-of-law clause and/or recharacterizes a contract as a loan include voiding of the agreement, civil and/or criminal penalties, or other fines.

As of the date of this article, the Office of the Comptroller of the Currency has continued to work on a special-purpose, nonbank charter that would offer nonbank lenders a path toward federal preemption of state licensing and usury regulations. In addition, the Conference of State Bank Supervisors recently launched a series of initiatives called Vision 2020 aimed collectively at driving efficiency, standardization, and a convergence of supervisory expectations in state-based oversight of nonbanks.

Electronic Contracting Issues

It bears little surprise that online business lenders rely on electronic means for contracting and for storing records. The Electronic Signatures in Global and National Commerce Act (ESIGN Act) grants electronic documents and signatures the same legal weight as their paper counterparts, provided they meet the criteria outlined in the ESIGN Act.

The first and most important of the criteria is borrower consent. Creditors must obtain prior consent from the borrower before utilizing electronic contracting methods. In order to obtain consent, creditors must notify borrowers of the following:

  1. the availability of paper records;
  2. whether the borrower is consenting to electronic means for one specific transaction or to a class of records that may be provided over the entirety of the borrower-creditor relationship;
  3. that the borrower can withdraw consent and any fees or conditions attached with withdrawal;
  4. whatever hardware or software capabilities the borrower will need in order to access electronic records; and
  5. how to obtain a paper copy upon request.

Borrower consent must be affirmative and not merely an opt-out.

In addition to consent, creditors must provide borrowers with post-consent disclosures of any significant changes the creditor has made to its means of storage that would change the hardware or software capabilities the borrower would need in order to access the records. Lastly, creditors must retain accurate records of the electronic transactions. Each record must reflect the information on the applicable contracts and records and must be kept for the period of time required by the applicable state and federal law for the record type.

Given that the ESIGN Act is federal law, it applies in all 50 states. The ESIGN Act does, however, permit states to modify, limit, or supersede it if the state has adopted the Uniform Electronic Transaction Act (UETA) or has created a law that is similar to it. To date, 47 states have adopted a version of UETA; only New York, Washington, and Illinois have not.

It is important to note that although many provisions of the Uniform Commercial Code (UCC) are exempt from the ESIGN Act, revised UCC Article 9 permits authentication or creation of security interests by electronic means. Under UCC Section 9-102, the UCC’s definition of “authentication” is “to sign” or “with present intent to adopt or accept a record, to attach to or logically associate with the record an electronic sound, symbol, or process.”

Section 1071 of the Dodd-Frank Act

In addition to granting the Consumer Financial Protection Bureau (CFPB) rule-making authority under various consumer-protection laws, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) also opened the door for the CFPB to extend its reach into business lending.

Enacted in 2010, Section 1071 of the Dodd-Frank Act tasked the CFPB with collecting data from “financial institutions.” This task came by way of Section 1071’s amendment to Regulation B, the implementing regulation of the federal ECOA.

The term “financial institution” is broadly defined under Regulation B as “any entity that engages in any financial activity.” By this loose definition, business lenders fall under the scope of CFPB authority. Under Section 1071, financial institutions are required to report details concerning credit applications made by female-owned, minority-owned, or small businesses (a term that is not defined in Section 1071). The specific details are:

  1. the number of the application and date received;
  2. the type of credit for which the applicant applied;
  3. the amount of credit for which the applicant applied;
  4. the amount of credit for which the applicant was approved;
  5. the gross annual revenue of the applicant; and
  6. the race, sex, and ethnicity of the principal owner(s).

Section 1071 also requires financial institutions to keep information on an applicant’s status as female-owned, minority-owned, or a small business away from underwriters and decision makers to the extent feasible. If an underwriter or decision maker must gain access to the information during the credit-evaluation process, the financial institution is required to notify the applicant concerning that access as well as the fact that the financial institution may not discriminate on the basis of that information.

As Section 1071 is written, business lenders are not only required to track the detailed data noted above, but also to maintain records of the data and report the data to the CFPB. Naturally, this will be a huge burden to many financial institutions serving the small business market that, like their clients, may be small businesses themselves. They, unlike their larger counterparts, may not have the administrative or technological resources to comply with Section 1071 demands, which places them at risk for potentially crippling penalties.

The CFPB held a field hearing on small-business lending in Los Angeles on May 10, 2017, and issued a Request for Information (RFI) Regarding the Small Business Lending Market. As stated in the RFI, the CFPB seeks to learn more about: (i) the small-business financing market, including understanding more about the products offered to small businesses (including women-owned and minority-owned small businesses), as well as the financial institutions that offer such credit; and (ii) the business-lending data that currently is used and may be maintained by financial institutions in connection with credit applications made by small businesses (including women-owned and minority-owned small businesses) and the potential complexity and cost of small-business data collection and reporting. Finally, the CFPB is also seeking comment from the public on privacy concerns related to the disclosure purposes of Section 1071. The comments to the RFI were originally due on or before July 14, 2017, but the CFPB later extended the comment period by 60 days to September 14, 2017.

As of the date of this article, the future of Section 1071’s implementation is largely uncertain. Highlighting this uncertainty are calls for legislative repeal—ranging from financial reform recommendations issued by the U.S. Department of Treasury to legislation passed by the House Financial Services Committee to public stances of several prominent trade groups—as well as broader ongoing challenges to the authority of the CFPB. As a result, the impact of Section 1071 on business lenders also remains unclear.

Conclusion

Recent years have seen rapid growth in the number of new online lenders stepping in and serving the small-business market, which had experienced a marked decline in credit availability from banks. Regardless of the model used to originate business credit, whether a peer-to-peer marketplace lender, borrower-driven broker marketplace, or balance-sheet lender, the key legal issues that are unique to small-business lending discussed above should be reviewed in detail by the business lender for possible impact on its originations and operations.

Navigating the Hazy Status of Marijuana Banking

On August 29, 2013, after Washington and Colorado voters legalized marijuana, then-acting U.S. Deputy Attorney General James M. Cole issued an enforcement memorandum (2013 Cole Memo) to address the tension between the federal Controlled Substances Act and states with regulated marijuana programs. This memo essentially provides that the federal government will tolerate robustly regulated state marijuana licensing schemes for marijuana businesses, but that the Department of Justice will continue working to prevent the following:

  1. the distribution of marijuana to minors;
  2. cannabis revenues going to criminal enterprises, gangs, and cartels;
  3. diversion of marijuana from states where it is legal to other states;
  4. state-authorized activity used as a cover for illegal activity, including trafficking of other illegal drugs;
  5. violence and the use of firearms in the cultivation and distribution of marijuana;
  6. drugged driving and exacerbation of other adverse public health consequences associated with marijuana use;
  7. the growing of marijuana on public lands; and
  8. marijuana possession or use on federal property.

The 2013 Cole Memo “rests on [the Department of Justice’s] expectation that state and local governments that have enacted laws authorizing marijuana-related conduct will implement strong and effective regulatory and enforcement systems that will address the threat those state laws could pose to public safety, public health, and other law enforcement interests.” If a state’s oversight of its marijuana industry is insufficient, those who own, operate, or even provide services to marijuana businesses may be subject to federal enforcement and arrest under federal laws.

In February 2014, the Department of Justice issued a second marijuana enforcement memorandum (2014 DOJ Memo), extending the 2013 Cole Memo’s treatment of marijuana businesses to financial institutions that provide banking to marijuana businesses. By offering services to businesses that generate revenue from marijuana sales, a financial institution could potentially violate criminal anti-money-laundering and money-transmitting statutes. The February 2014 DOJ Memo communicated that these issues would be treated as low law-enforcement priorities so long as the financial institutions were working within the confines of robust state regulation and were continuing to follow adequate, risk-based anti-money-laundering procedures.

At the same time in complementary guidance, the Financial Crimes Enforcement Network (FinCEN), an agency within the Department of Treasury, addressed the issue of cannabis business banking accounts. These guidelines set forth that banks can provide financial services to marijuana businesses without violating existing federal regulations if they do the following:

  • ensure the business is duly licensed and registered with its state regulators;
  • vet and review all license applications and related financial and background documentation the cannabis business used to secure its license to operate from the state;
  • request and receive from state regulators and law enforcement all available information about the cannabis business and its related owners and financiers;
  • develop an understanding of the normal and expected commercial activity for the business, including the products to be sold and customer profiles; and
  • monitor publicly available sources, including social media accounts, to ensure the marijuana business complies with applicable state laws and the 2013 Cole Memo.

Banks also must file Suspicious Activity Reports (SARs) at least quarterly with FinCEN for all their marijuana-business clients. There are no direct or immediate consequences arising from these SAR filings, but these SARs enable the federal government to know exactly who owns and runs the marijuana businesses and with whom they are banking.

The FinCEN guidelines increase banking costs for banks with cannabis business accounts, nearly all of which the banks push onto their cannabis clients. In turn, most marijuana businesses must pay a financial premium just to have a bank account.

Some government entities and banking institutions have tried to build marijuana-only financial institutions. The state of Colorado attempted to create its own marijuana-only cooperative banking system, which failed because of federal-law conflicts and an inability to secure insurance. A few credit unions and small banks in Colorado and Washington have developed special pilot programs to take on state-licensed marijuana businesses. Despite these efforts, there remains a significant lack of banking for cannabis businesses, and major banking institutions are not expected to take on cannabis business accounts unless and until the federal prohibition against cannabis ends. In the meantime, many marijuana businesses will no doubt continue operating on an all-cash basis, which renders them easy targets for criminal activity and complicates their business operations.

Marijuana businesses that want banking services should expect their banks and credit unions to fulfill their FinCEN due diligence requirements, which include investigating their payment account to vendors, landlords, and others to verify who is receiving the proceeds of marijuana sales. Marijuana businesses must be prepared to disclose the details of their business operations to their financial institutions in a way required of no other business.

If a bank or credit union sees too many red flags with a cannabis business, that business will not secure a bank account. Red flags under the FinCEN guidelines include anonymous out-of-state or international investors or financiers; an inability to trace money flow to investors, owners, and/or vendors; failing to secure a state and/or local license to operate; owners and/or financiers who have significant criminal histories; the business’s failure to report income and/or pay taxes to the state or the federal government; the business’s violation of state operational laws and rules; and the failure to timely renew state and/or local operational licenses.

Since FinCEN issued its guidelines, the federal government has been mostly uninterested in addressing the cannabis industry’s banking problem. But California’s recent legalization of recreational marijuana could soon render this issue too big to ignore. Once California implements legalization (expected by 2018), its cannabis industry will be significantly larger than that of any of the other seven states that have legalized recreational cannabis. The sheer size of the market may force the federal government to expand the FinCEN guidelines to facilitate banking services for cannabis businesses.

On December 2, 2016, California’s then-acting State Treasurer, John Chiang, wrote to President Trump seeking increased guidance on California cannabis and banking:

Conflict between federal and state rules creates a number of difficulties for states that have legalized cannabis use, including collecting taxes, increased risk of serious crime and the inability of a legal industry under state law to engage in banking and commerce . . . We have a year to develop a system that works in California and which addresses the many issues that exist as a result of the federal-state legal conflict . . . Uncertainty about the position of your administration creates even more of a challenge.

Chiang also wrote about how California may “exacerbate” the banking problem because of the immense size of its current and anticipated marijuana marketplace. The Trump administration has yet to respond to Treasurer Chiang.

Under former Treasury Secretary Jack Lew, the Department of Treasury defended its cannabis banking guidelines to Congress on the grounds of public safety and increased transparency. The question now is whether newly appointed Treasury Secretary Steven Mnunchin will do the same. Mnunchin has so far said nothing publicly about marijuana banking or the FinCEN guidelines, so it is difficult to know whether he supports or opposes the cannabis banking status quo or whether he considers it a priority. In the meantime, banking uncertainty for cannabis businesses remains.

Even in states where cannabis is legal, financial institutions that do not want to work with marijuana businesses consistently deny and shut down cannabis business bank accounts. This causes financial chaos across the state-legalized cannabis industry, primarily in those states without banks and credit unions willing to work within the confines of FinCEN’s 2014 guidance. Experience has shown, however, that once one or two banks or credit unions begin working with marijuana businesses within the confines of the FinCEN guidance, other banks and credit unions begin to follow suit. As more and more financial institutions choose to work with cannabis businesses, federal lawmakers, regulators, and insurance providers must grapple with the complexities of providing deposit services within an industry that is federally illegal.

Defending Fair Credit Reporting Act Class Actions in Federal Court – A Practical Approach

Over the past decade, civil litigation under the Fair Credit Reporting Act (FCRA) has surged, and putative class actions brought under the FCRA are increasing in frequency. The FCRA is a complex, highly technical statute that allows recovery of statutory damages, actual damages, punitive damages, and attorney’s fees and has resulted in significant jury verdicts. For these reasons, the FCRA has become a favorite vehicle for putative class actions and often threatens outsized liability even when a plaintiff’s chance of success on the merits is slim. The class certification battle is therefore the decisive point of the litigation in many cases.

However, the technical aspects of the FCRA that make it such an attractive vehicle for class actions also provide a basis for defendants to contend that no class should be certified, using an increasing number of judicially accepted defenses. This article explains some of those defenses, which provide a starting point for any assessment of the prospects of defeating certification in an FCRA class action.

An Overview of the Fair Credit Reporting Act

According to the Federal Trade Commission in its report, 40 Years of Experience with the Fair Credit Reporting Act, an FTC Staff Report with Summary Interpretations (July 2011), the FCRA governs the collection, assembly, and use of consumer report information in the United States. Enacted in 1970, the FCRA has since been amended several times. The two most extensive amendments were the Consumer Credit Reporting Reform Act of 1996 (the 1996 Amendments) and the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).

The FCRA regulates the practices of consumer reporting agencies (CRAs) that collect and compile consumer information into consumer reports for use by credit grantors, insurance companies, employers, landlords, and other entities in making eligibility decisions. The FCRA was enacted to: (1) prevent the misuse of sensitive consumer information by limiting recipients to those who have a legitimate need for it; and (2) improve the accuracy and integrity of credit reporting systems. Under the FCRA, CRAs are required to establish procedures to ensure accuracy and legitimacy in reporting, disclose information in their files to consumers, and investigate disputed items.

The 1996 Amendments expanded the duties of CRAs, particularly in regard to disputes, by establishing a time frame for investigations, mandating written notice of the results, and adding restrictions on the reinsertion of deleted items. The 1996 Amendments also increased the obligations of “users” of consumer reports, particularly employers. Most significantly, they imposed duties on a new class of entities by introducing requirements related to accuracy and dispute resolution by furnishers of information to CRAs. (The ensuing years brought a number of more modest revisions, the most significant of which was a 1999 amendment that specifically authorized the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Office of Thrift Supervision, and National Credit Union Administration to promulgate regulations under the FCRA.)

The FACT Act bolstered protections against identity theft and its effects. It also ordered agencies to promulgate rules governing the proper disposition of consumer report information, granted consumers the right to request free annual reports, and required businesses to provide copies of relevant records to identity-theft victims.

Under these provisions, sections 1681n and 1681o of the FCRA impose liability for willful noncompliance and negligent noncompliance, respectively. In the case of negligent noncompliance, the consumer can recover actual damages, costs, and attorney’s fees. In the case of a willful violation, the consumer can also recover statutory damages between $100 and $1,000, plus punitive damages.

Consider Challenges to Plaintiff’s Standing

The Supreme Court’s 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), provides new potential grounds for defendants to move to dismiss FCRA lawsuits, including class actions, where plaintiffs allege a procedural violation of the FCRA.

The Spokeo court considered whether Congress may confer Article III standing by authorizing a private right of action based on the violation of a federal statute alone, even if a plaintiff suffered no concrete harm from an alleged procedural violation. The court found that alleging a mere technical violation “does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” The Spokeo court cited examples of nonconcrete, statutory violations:

A violation of one of the FCRA’s procedural requirements may result in no harm. For example, even if a consumer reporting agency fails to provide the required notice to a user of the agency’s consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.

The implications of Spokeo are just beginning to be addressed by courts across the country. Based on the Supreme Court’s holding, however, purely technical claims under the FCRA (e.g., those that challenge wording of consumer file disclosures under section 1681g(a), authorization forms under section 1681b(b), etc.) appear to be susceptible to attack. See Smith v. Ohio State Univ., 191 F. Supp. 3d 750, 753, 757 (D. Ohio 2016) (finding a lack of standing: “Plaintiffs were both hired by OSU but allege that they were injured by having their privacy and statutory rights violated [under § 1681b(b)].”). Even if the claims of the named plaintiff survive a jurisdictional attack, Spokeo can likely be leveraged by defendants to challenge the standing of absent class members. See, for example, Sandoval v. Pharmacare US, Inc., 2016 U.S. Dist. LEXIS 140717, at *22 (S.D. Cal. June 10, 2016) (denying class certification under Spokeo, holding: “Whether characterized as problems with overbreadth, commonality, typicality or Article III standing . . . [t]he Court concludes that class certification is not proper to the extent that Plaintiffs raise claims and theories they do not have standing to raise, and to the extent that the class includes consumers who have no cognizable injury . . . .”). For these reasons, a defendant facing an FCRA action, and particularly a class action, should carefully review any Article III issues with respect to the claims asserted to determine whether a motion to dismiss under Rule 12(b)(1) due to a lack of standing may defeat the claim.

Consider Availability of Individual, Binding Arbitration

A threshold consideration with respect to any FCRA class action should be a thorough examination of whether the defendant has a basis to move to compel arbitration under the Federal Arbitration Act (FAA) for the claim(s) pled, either as a party to a contract with the consumer or as an assignee.

The Supreme Court’s recent holdings are consistent with the FAA’s general policy in favor of arbitration in the area of consumer law and squarely favor defendants. The landmark decision, AT&T Mobility LLC v. Concepcion, 131 S. Ct. 1740 (2011), held that state law may not invalidate an arbitration agreement solely because the agreement prohibits the use of class procedures in arbitration. Concepcion has since been cited in hundreds of opinions and has been applied broadly to uphold individualized arbitration of state-law claims.

In a more recent case, American Express Co. v. Italian Colors Rest., 133 S. Ct. 2304, 2312 (2013), the Supreme Court held that class waivers in arbitration agreements are enforceable, even if the plaintiff’s cost of arbitrating her federal statutory claim exceeds her potential recovery. Italian Colors should allow companies to compel individual arbitration—and avoid class arbitration—if the agreement at issue clearly prohibits class procedures.

Thus, defendants should assess the possibility of moving to compel binding individual arbitration at the earliest possible stage of the case to avoid any possible claim that the defendant’s right to compel arbitration has been waived.

The Standards for Class Certification

Against this perhaps unfamiliar statutory landscape lies the well-worn jurisprudence surrounding Fed. R. Civ. P. 23, the federal class-action vehicle. A class action is “an exception to the usual rule that litigation is conducted by and on behalf of the individual named parties only.” Wal-Mart Stores, Inc. v. Dukes, 131 S. Ct. 2541, 2550 (2011). Plaintiffs are required to affirmatively prove their ability to satisfy each element of Rule 23(a)—“numerosity of parties, commonality of factual or legal issues, typicality of claims and defenses of class representatives, and adequacy of representation”—and one of the three subparts of Rule 23(b) before the district court will certify a class. Thorn v. Jefferson-Pilot Life Ins. Co., 445 F.3d 311, 318 (4th Cir. 2006). Therefore, a court may not “simply . . . accept the allegations of a complaint at face value,” Gariety v. Grant Thornton, LLP, 368 F.3d 356, 365 (4th Cir. 2004), and to properly evaluate a motion for class certification, it is often “necessary for the court to probe behind the pleadings before coming to rest on the certification question.” Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 160 (1982). These standards, although no doubt familiar to experienced federal court litigators, should be continually reinforced in any opposition to a motion for class certification.

FCRA-Specific Class-Action Defenses

Various defenses exist that can be asserted against a putative FCRA class action. Although the following list of defenses is not exhaustive by any means, they have garnered recent positive reception from federal courts.

Ascertainability/Class Definition Issues

Although not mentioned in Rule 23, “[i]t is well-accepted that class action suits brought pursuant to Rule 23(b)(3), where individual damage claims are likely, must concern a class that is currently and readily ascertainable based on objective criteria.” Brooks v. GAF Materials Corp., 2012 U.S. Dist. LEXIS 150717, at *11 (D.S.C. Oct. 19, 2012). Hence, a class should not be certified “unless the class description is sufficiently definite so that it is administratively feasible for the court to determine whether a particular individual is a member.” Solo v. Bausch & Lomb Inc., 2009 U.S. Dist. LEXIS 115029, at *4 (D.S.C. Sept. 25, 2009). Thus, if determining class membership would require a person-by-person adjudication, the class should not be certified. Eisen v. Carlisle & Jacquelin, 417 U.S. 156, 177 (1974).

Limitations on identifying absent class members. At least two distinct trends have emerged as potential defenses in the context of consumer claims. First, courts have repeatedly held that when a court is unable to determine potential class membership from a defendant’s records, a class is unlikely to be certified. In In re Wal-Mart Stores, Inc. Wage & Hour Litig., 2008 U.S. Dist. LEXIS 14756, at *1–2 (N.D. Cal. Feb. 13, 2008), the putative class of former Wal-Mart employees allegedly received their final pay late, in violation of California law. To trigger the relevant state law, however, the employee had to provide notification of termination and come to the store to receive final pay. Wal-Mart’s databases did not provide records of either termination dates or the dates that employees made themselves available for final pay. Thus, the court held that “where nothing in the company’s databases shows or could show whether individuals should be included in the proposed class, the class definition fails.”

Courts have reached similar conclusions in consumer cases where evidence may have theoretically been available to determine the members of the class, but where such an undertaking would require extensive “mini-trials.” See, for example, Marcus v. BMW of N. Am., LLC, 687 F.3d 583, 593 (3d Cir. 2012) (“[I]f class members are impossible to identify without extensive and individualized fact-finding or ‘mini-trials,’ then a class action is inappropriate.”). Defendants should thus consider any temporal or substantive limitations of their recordkeeping systems in identifying potential class members, and assert those limitations as a defense to certification. (Of course, from the time that litigation is anticipated, companies must enact adequate document retention and preservation policies. Moreover, to the extent possible, expert testimony can be helpful in identifying the limitations in a defendant’s data.)

Judicial rejection of fail-safe classes. A second line of ascertainability analysis rejects what has been termed as a “fail-safe” class, or a class that “cannot be defined until the case is resolved on the merits.” Young v. Nationwide Mut. Ins. Co., 693 F.3d 532, 538 (6th Cir. 2012). See also Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 825 (7th Cir. 2012) (a fail-safe class is “one that is defined so that whether a person qualifies as a member depends on whether the person has a valid claim. Such a class definition is improper because a class member either wins or, by virtue of losing, is defined out of the class and is therefore not bound by the judgment.”). As the court in Brazil v. Dell Inc., 585 F. Supp. 2d 1158 (N.D. Cal. 2008), framed the issue, “the proposed classes include California persons or entities who purchased Dell computer products that ‘Dell falsely advertised.’ To determine who should be a member of these classes, it would be necessary for the court to reach a legal determination that Dell had falsely advertised.”

Two main problems with a fail-safe class render it defective from the outset. First, because the members of the class will not be known until the case is resolved on the merits, notification is unmanageable. See Kamar v. Radio Shack Corp., 375 F. App’x 734, 736 (9th Cir. 2010) (noting that fail-safe classes are not only “palpably unfair to the defendant,” but are “also unmanageable—for example, to whom should the class notice be sent?”). Second, a fail-safe class presents an unfair Catch-22 for a defendant: “Either the class members win or, by virtue of losing, they are not in the class and, therefore, not bound by the judgment.” Randleman v. Fidelity Nat’l Title Ins. Co., 646 F.3d 347, 352 (6th Cir. 2011). See also Mazzei v. Money Store, 288 F.R.D. 45, 55 (S.D.N.Y. 2012) (explaining that because “[t]he merits of Mazzei’s claim depend on whether the fees ‘were not permitted’ . . . if the trier of fact decided that any or all of the fees were permitted under the form loan agreements, there would immediately be no members of the class for those fees.”). For these reasons, nearly every circuit to address the issue has determined that fail-safe classes are impermissible. See Young, 693 F.3d at 538; Messner, 669 F.3d at 802; and Kamar, 375 F. App’x at 736.

These decisions invite close attention to the proffered class definition and provide defendants facing an FCRA class action with a firm basis to resist any claim that attempts to build a legal conclusion into the class definition itself.

“Accuracy”/“Completeness” Issues Related to Procedural Violations

Several procedural requirements of the FCRA, such as sections 1681k(a) and 1681(e)(b), make it particularly tempting for plaintiff’s counsel to turn an alleged FCRA violation into a class action. Courts are increasingly willing to hold, however, that even if the FCRA-mandated procedure was not followed, no actionable claim can exist under the FCRA unless the consumer can demonstrate the information transmitted was “inaccurate” or “incomplete.” See, for example, Jones v. Sterling Infosystems, Inc., 317 F.R.D. 404 (S.D.N.Y. 2016); Farmer v. Phillips Agency, Inc., 285 F.R.D. 688, 699–700 (N.D. Ga. 2012); Haro v. Shilo Inn, Bend LLC, 2009 U.S. Dist. LEXIS 65562, at *8–*9 (D. Or. July 24, 2009) (“[A]bsent a showing that the information obtained from OJIN was inaccurate or incomplete by omitting final disposition of the charge, plaintiff’s claim under § 1681k(a) must fail.”); Obabueki v. Choicepoint, Inc., 236 F. Supp. 2d 278, 283–84 (S.D.N.Y. 2002), aff’d, 319 F.3d 87 (2nd Cir. 2003).

This element of inaccuracy or incompleteness provides defendants with a firm basis to contend that class certification is improper as a matter of law. As the Farmer court recently held (considering a claim under section 1681k(a)):

To sustain a claim, each consumer will need to prove that the adverse information in the report defendant furnished about that consumer was either incomplete or not up to date. This will entail an individual inquiry into the contents of each consumer report issued by defendant. The scope of this individual inquiry will require a variety of evidence specific to each case—such as the production of the actual up-to-date version of the public record at the time the report was issued . . . . [This] will require the presentation of significant amounts of new evidence for each putative class member. Thus, it is clear that the predominance requirement is not met and this class cannot be certified.

Thus, defendants can persuasively argue that when a showing of inaccuracy is required for liability, no class should be certified. See Williams v. LexisNexis Risk Mgmt., Inc., 2007 U.S. Dist. LEXIS 62193, at *4 (E.D. Va. Aug. 23, 2007) (“Asserting a § 1681e(b) claim for [an] entire class would render the class-action device useless . . . because it would require an assessment of whether or not each class member’s report was, in fact, inaccurate.”); Owner-Operator Indep. Drivers Ass’n, Inc. v. USIS Commercial Svcs., Inc., 537 F.3d 1184, 1194 (10th Cir. 2008) (holding that “the accuracy of each individual’s [report], an essential element of a § 1681e(b) claim, required a particularized inquiry”); Lanzarone v. Guardsmark Holdings, Inc., 2006 U.S. Dist. LEXIS 95785, at *13–14 (C.D. Cal. Sept. 7, 2006) (“Because the Court would have to address each of these issues on a one by one basis for all of the officers in the proposed class, Plaintiff cannot meet his burden under Rule 23(b)(3).”).

Because of this authority, any defendant facing a putative class that asserts a procedural violation of the FCRA should consider advancing an “individualized-accuracy” argument against class certification.

Typicality/Commonality Issues When Practices Vary over Time

Typicality “goes to the heart of a representative[’s] ability to represent a class”—Deiter v. Microsoft Corp., 436 F.3d 461, 466 (4th Cir. 2006)—thus, a named plaintiff’s “interest in prosecuting [her] own case must simultaneously tend to advance the interests of the absent class members.” Courts have applied the typicality requirements in the context of FCRA claims in a manner that provides certain defendants with an additional basis to defend against certification. In particular, variations in a defendants’ method(s) of data collection and/or data furnishing can prevent class certification or (at the very least) can help to narrow the scope of the proposed class.

For instance, in Soutter v. Equifax Info. Servs., LLC, 498 F. App’x 260 (4th Cir. 2012), the district court certified a class of persons whose judgment information allegedly was inaccurately reported, despite the company’s supposed knowledge of flaws in its data and reporting system. Seeking only statutory and punitive damages, the plaintiff alleged that Equifax violated 15 U.S.C. § 1681e(b) by issuing inaccurate credit reports and not maintaining reasonable procedures to assure maximum possible accuracy.

The Fourth Circuit held that the plaintiff had failed to show “typicality” under Rule 23(a)(3), which the court noted also bled into the “commonality” and “ascertainability” inquiries. “While Soutter’s claim need not be ‘perfectly identical’ to the claims of the class she seeks to represent, typicality is lacking where the variation in claims strikes at the heart of the respective causes of action.” Soutter’s claim failed because it had “meaningful differences” from the class, highlighted by the fact that Equifax’s records vendor “used in-person review for the circuit court records while employing at least three different means of collecting general district court records during the class period.”

In circumstances where a defendant’s methods of data collection or data furnishing have varied over time, the Soutter decision provides a compelling basis for defendants to argue that the FCRA violation at issue is not a common issue “capable of classwide resolution . . . in one stroke.” The Farmer court also recognized this issue at 285 F.R.D. at 703, holding that given the “broad range” of defendants’ data sources, under section 1681k(a), “the court would need to determine the source of each piece of adverse information in a consumer’s report and then evaluate the quality of that source. This will necessarily entail individualized inquiry for many reports, even if some of the record sources may be common to many potential class members and thus susceptible to classwide proof.” Accord Harper v. Trans Union, LLC, 2009 U.S. Dist. LEXIS 12760, at *8 (E.D. Pa. Feb. 19, 2009) (an assessment of the reasonableness of a defendant’s procedures under § 1681e(b) “will require highly individualized proofs”). Therefore, defendants should also consider this line of analysis when the particular circumstances of the case so warrant.

Defenses to “Statutory Damages Only” Class Actions

Under Rule 23(b), certification of a class action requires the identification of common issues that cannot only be answered on a class-wide basis, but also that decide the case for all class members, making individualized actual damages claims practically impossible to pursue in a large-scale class action. (The Supreme Court recently doubled down on its landmark Dukes decision in Comcast Corp. v. Behrend, 133 S. Ct. 24 (2012). In Comcast, the majority reaffirmed the position that all of Rule 23’s requirements must be met via a “rigorous” analysis at the class-certification stage, which often overlaps with the merits of the claim. The court made clear that certification required plaintiffs to “satisfy through evidentiary proof” at least one of the provisions of Rule 23(b). For the Rule 23(b)(3) class in Comcast, this required an evidentiary showing that classwide damages could be calculated. Comcast strongly suggests that a class of any meaningful size cannot be certified if it includes members with no damages along with members with damages.) Therefore, FCRA plaintiffs typically frame their class theories around the statutory damage claim available under 15 U.S.C. § 1681n, which allows for damages between $100–$1,000 per consumer without having to offer individualized proof of harm.

Defendants, however, still have a strong basis to contend that the amount of statutory damages any given class member should receive is an individual issue. At least one appellate court recently held that calculating statutory damages per consumer is an individual issue by nature, focusing on the individual circumstances of the putative “class members,” and that “statutory damages . . . typically require an individualized inquiry.” Soutter, 498 F. App’x 265. See also Gomez v. Kroll Factual Data, Inc., 2014 U.S. Dist. LEXIS 51303, at *13 (D. Colo. Apr. 14, 2014) (“The individualized nature of an FCRA claim—particularly one seeking statutory damages—has led most courts to deny class certification in these types of cases.”); Campos v. ChoicePoint, Inc., 237 F.R.D. 478, 486 n.20 (N.D. Ga. 2006) (individual issues precluding class certification included “the determination of the proper amount of statutory damages to impose for each violation”).

Thus, defendants can contend that the statutory damages measure will vary for each consumer based on class-member-specific considerations, meaning that a statutory damages class should not be certified. Nor should plaintiffs be able to avoid this challenge to typicality because class members with actual damages can opt out of the class. Class certification precedes the opt-out process, and the named plaintiff must be adequate and typical, even if no class member opts out. See Colindreas v. QuietFlex, 235 F.R.D. 347, 376 (S.D. Tex. 2006) (“Providing class members notice and opt-out opportunity may alert class members that they can pursue individual damages claims, but are not a substitute for the adequate, conflict-free representation required under Rule 23(a)(4).”); accord Gardner v. Equifax Info. Servs., LLC, 2007 U.S. Dist. LEXIS 57416, at *6 (D. Minn. Aug. 6, 2007). Thus, any need to rely on class members with actual damages to opt out underscores the impermissibility of certification.

Superiority Considerations under the FCRA

Under Fed. R. Civ. P. 23(b)(3), superiority requires that use of a class action be “superior to other available methods for fairly and efficiently adjudicating the controversy.” Superiority “requires the court to find that the objectives of the class-action procedure really will be achieved.” Stillmock v. Weis Mkts., Inc., 385 F. App’x 267, 274 (4th Cir. 2010). “The court must compare the possible alternatives to determine whether Rule 23 is sufficiently effective to justify the expenditure of the judicial time and energy . . . and to assume the risk of prejudice” to putative class members not before it.

Defendants can argue that the class-action mechanism is not a superior method of adjudication for FCRA claims for many reasons. Multiple provisions of the FCRA make individual suits a practical alternative to a sprawling class action. Rather than limiting plaintiffs to actual damages, Congress also provided for a range of statutory damages under 15 U.S.C. § 1681n(a)(1)(A), anticipating that amounts will vary with consumer-specific evidence. Congress further incentivized individual FCRA actions by authorizing attorney’s fees for plaintiffs in “any successful action” and providing for punitive damages for willful violations. 15 U.S.C. §§ 1681n(a)(2), (a)(3); 1681o(a)(2); Harper, 2009 U.S. Dist. LEXIS 12760, at *10 (“I am further persuaded by defendant’s argument that the FCRA, by providing for the award of attorneys’ fees, already provides an incentive for the putative class members to bring individual claims.”).

Courts have consistently held that the availability of punitive or statutory damages and fee-shifting can demonstrate the viability of “individual actions in the absence of a class action.” Thorn, 445 F.3d at 328 n.20. See also, for example, Allison v. Citgo Petroleum Corp., 151 F.3d 402, 420 (5th Cir. 1998) (statutory damages and attorney’s fees “eliminate[d] financial barriers that might make individual lawsuits unlikely”). Therefore, defendants can contend that the FCRA’s scheme ensures that individual suits are a meaningful alternative to class actions. Indeed, not only are individual FCRA actions “costless” for consumers, they may produce substantial recoveries. For example, the Fourth Circuit has affirmed a jury award of $1,000 in statutory damages and $80,000 in punitive damages in an individual FCRA action against a bank that furnished information to a CRA. Saunders v. Branch Banking & Trust Co., 526 F.3d 142, 145 (4th Cir. 2008).

Statute-of-Limitations Issues

Depending on how the class claim is pled, defendants may also possess a procedural defense based on the statute of limitations. Section 1681p of the FCRA sets forth a “hybrid” limitations period:

An action to enforce any liability created under this title may be brought . . . not later than the earlier of—(1) 2 years after the date of discovery by the plaintiff of the violation that is the basis for such liability; or (2) 5 years after the date on which the violation that is the basis for such liability occurs.

Because of the peculiar nature of this limitations period, plaintiffs will often plead a five-year class to maximize potential exposure. However, under the plain language of the statute, no class member whose claim was discovered within a two-year period can properly be included in such a class.

The Fourth Circuit has noted that even when the limitations period analysis has the mere potential for giving rise to individual inquiries, class certification is erroneous. As the court noted in Broussard v. Meineke Discount Muffler Shops, Inc., 155 F.3d 331, 342 (4th Cir. 1998), if a defendant’s limitations period defense “depend[s] on facts peculiar to each plaintiff’s case,” such as what each plaintiff “knew about Meineke’s operation . . . and when he knew it,” then “class certification is erroneous.” In a subsequent decision, Gunnells v. Healthplan Servs., 348 F.3d 417, 438 (4th Cir. 2003), the same appellate court emphasized the categorical nature of its holding in Broussard:

[W]e have flatly held that “when the defendants’ affirmative defenses . . . may depend on facts peculiar to each plaintiff’s case, class certification is erroneous.” Broussard, 155 F.3d at 342 . . . . Although it is difficult to determine with any precision, it appears that here the Agents’ affirmative defenses are not without merit and would require individualized inquiry in at least some cases. (emphases added).

In short, Gunnells explains it is established that class certification is improper even when a statute of limitations defense “may depend” on individual facts “in at least some cases.”

Accordingly, courts nationwide have rejected attempts to certify five-year FCRA classes dues to the two-year discovery period. See Molina v. Roskam Baking Co., 2011 U.S. Dist. LEXIS 136460, at *14 (W.D. Mich. Nov. 29, 2011) (because the FCRA two-year discovery period “turns on the individual question of when certain class members ‘discovered’ or ‘should have discovered’ [d]efendant’s alleged misconduct, a class action is not the best method of trying the suit.”). These holdings are subject to particular emphasis when defendants are confronted with a proposed class representative who himself has discovered the purported classwide violation well in advance of the expiration of the five-year period of repose. See also Holman v. Experian Information Solutions, Inc., 2012 U.S. Dist. LEXIS 59401, at *42–43 (N.D. Cal. Apr. 27, 2012) (limiting proposed FCRA class to two years because to assess “liability to . . . more than 4,000 putative class members whose credit reports were disclosed more than two years before January 12, 2011, would require a determination of whether the class member . . . learned of Experian’s disclosure.”); but see McPherson v. Canon Bus. Solutions, Inc., 2014 U.S. Dist. LEXIS 21081, at *14–15 (D.N.J. Feb. 20, 2014) (refusing to strike five-year class allegations at the Rule 12 stage). Therefore, any defendant faced with a purported five-year FCRA class can and should move on the pleadings to have the class period limited to two years.

Conclusion

Given the highly technical nature of the FCRA, as well as the magnitude of recent awards under the statute, the FCRA is a dangerous statute for defendants. That danger is exponentially more acute in the context of a putative class action. Because of this, substantial attention to potential certification defenses is necessary from the very outset of the action, and defendants can then use the discovery process as a tool to substantiate any factual bases necessary to resist class certification. Simply put, any delay in planning a class-certification defense in an FCRA action jeopardizes the outcome of that critical ruling.

Of Spoiled Milk—Warnings That Should and Should Not Have Been Issued: Another Take on the Potential for Management and Controlling Shareholder Liability Related to an Insolvent Company’s WARN Act Violations

Introduction

For the better part of three decades, an apocryphal tale has circulated on the Internet about a man who leaps from a terminal height off a building only to be mortally wounded by a shotgun blast as he hurtles past an open window on the way down. This dark fable then asks whether the medical examiner should conclude that the death of this man, who was imminently going to perish by his own hand, was a suicide or was murder.

The Delaware bankruptcy court’s brief opinion in Stanziale v. MILK072011, LLC (In re Golden Guernsey Dairy, LLC), 548 B.R. 410 (Bankr. D. Del. 2015), addressed the insolvency analogue to this hypothetical. Otherwise stated, if management and a controlling member of a Delaware limited liability company that is already hopelessly insolvent, without any apparent justification fail to take action that could have prevented the company from incurring a substantial liability, is their failure to act wrongful as to the company, and does equity provide a remedy for that wrong? According to the Golden Guernsey decision, the answer is plainly “yes.” This, it is submitted, is the real import of this six-page opinion issued in a lawsuit filed in connection with the chapter 7 bankruptcy liquidation of a failed private-equity-backed dairy operation.

If the name “Golden Guernsey” sounds familiar, it is because the opinion was the subject of an article by Bret Amron that appeared in the July 2017 issue of this publication. Amron provides readers with a thorough and helpful review of state and federal WARN Act obligations. At issue in Golden Guernsey was the company’s violations of the Wisconsin Wage Payment Act (WWPA). The WWPA is one example of many “baby” WARN Acts various states have enacted, modeled to one extent or another on the federal Worker Adjustment and Retraining Notification Act (federal WARN Act). Given that the differences between the federal WARN Act and the WWPA are immaterial for purposes of this article, both are generically referred to herein as the WARN Act.

Perhaps less helpfully, the article then sounds the alarm that “[p]rior to [Golden Guernsey], directors and officers generally have not been held individually liable for a company’s failure to provide timely notice under the WARN Act . . . .” It further cautions that “[i]n light of [Golden Guernsey], there is at least a colorable argument for trustees and plaintiffs to assert a claim for breach of fiduciary duty against corporate officials . . . .”

Why, you may ask, has this author bothered to write a second article about a semi-obscure bankruptcy court opinion that is now approximately two years old and almost certainly has a total word count less than this installment, let alone both articles? The Amron article implied that the Delaware bankruptcy court had somehow blurred the line between statutory WARN Act liability, which is generally confined to the specific business enterprise that employed the affected individuals, and fiduciary liability of such a business enterprise’s directors, officers, managers, shareholders, and members. There are court decisions that arguably do that; however, Golden Guernsey is not one of them. Compare, for example, D’Amico v. Tweeter Opco, LLC (In re Tweeter Opco, LLC), 453 B.R. 534 (Bankr. D. Del. 2011) (holding second LLC that was indirect upstream owner of debtor LLC could be held liable as “employer” under federal WARN Act because of factors demonstrating indirect parent’s de facto control over relevant matters).

Golden Guernsey’s WARN-Act-Related Caremark Claim

Nothing about the Golden Guernsey case suggests that corporate actors now have any more reason to fear being sued on breach of fiduciary duty claims “based on [such] individuals’ failure to provide the requisite 60-day notice under the WARN Act,” as the Amron article put it, than they did prior to the issuance of this opinion. Although the failure of management and the controlling member to fulfill clear statutory obligations under the WARN Act indisputably served as the backdrop for this dispute, the bankruptcy trustee’s claim against the defendants had a well-established basis in Delaware fiduciary law. As such, the bankruptcy court properly focused on whether the complaint adequately pled a claim under Delaware law for a breach of fiduciary duty, based on the fiduciary-defendants’ failure to act in good faith. In the parlance of Delaware corporate law, at issue in Golden Guernsey was whether the trustee had alleged sufficient facts to state a so-called Caremark claim against the fiduciary defendants.

A Caremark claim—so named for the seminal case involving the directors of Caremark International (In re Caremark Int’l Inc. Deriv. Litig., 698 A.2d 959 (Del. Ch. 1996)), rev’d on other grounds, 74 A.3d 612 (Del. 2013))—is a special species of a breach-of-fiduciary-duty claim under Delaware law that “seeks to hold directors accountable for the consequences of a corporate trauma.” La. Mun. Police Empls. Ret. Sys. v. Pyott, 46 A.3d 313, 340 (Del. Ch. 2012). “In a typical Caremark case, plaintiffs argue that the defendants are liable for damages that arise from a failure to properly monitor or oversee employee misconduct or violations of law.” In re Citigroup Inc. S’holder Deriv. Litig., 964 A.2d 106, 123 (Del. Ch. 2009). In a case decided after Caremark, the Delaware Supreme Court articulated how fiduciaries may be found liable under the Caremark standard as follows:

We hold that Caremark articulates the necessary conditions predicate for director oversight liability: (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention. In either case, imposition of liability requires a showing that the directors knew that they were not discharging their fiduciary obligations. Where directors fail to act in the face of a known duty to act, thereby demonstrating a conscious disregard for their responsibilities, they breach their duty of loyalty by failing to discharge that fiduciary obligation in good faith.

Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006) (footnotes omitted) (emphasis added). It is well accepted in Delaware jurisprudence that a Caremark claim “is possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment . . . .” Citigroup, 964 A.2d at 967.

The Golden Guernsey opinion leaves little doubt that the bankruptcy court viewed the breach of fiduciary duty claim before it as in the nature of a Caremark claim. Citing Stone v. Ritter, Bankruptcy Judge Gross wrote: “A breach of the duty of loyalty may be found when the fiduciary has failed to act in good faith.” The court then continued by reciting the Stone v. Ritter restatement of the standard for a Caremark claim as it appeared in an earlier decision of the bankruptcy court. Golden Guernsey, 548 B.R. at 413 (quoting Bridgeport Hold. Inc. Liquid. Trust v. Boyer (In re Bridgeport Hold., Inc.), 388 B.R. 548, 564 (Bankr. D. Del. 2008) (quoting Stone v. Ritter, 911 A.2d at 370) (internal quotations omitted)).

Unfortunately, instead of detailing the complaint’s specific allegations that supported the Caremark claim, after identifying the standard to be applied, the Golden Guernsey opinion abruptly concluded that “[t]he Complaint alleges facts that support a finding that the Defendants breached their fiduciary duties to Debtor.” Although the court’s brevity on this issue is perhaps regrettable in light of the resulting confusion the opinion has spawned, it is certainly understandable that the bankruptcy court did not feel compelled to delve into the specific supporting allegations, considering the context in which this opinion issued.

Review of the parties’ briefing reveals that the defendants did not attempt to dispute the sufficiency of the complaint’s allegations under the Caremark standard. Otherwise stated, the defendants essentially conceded for purposes of the motion to dismiss that by not providing the WARN Act notices, they had failed to act in the face of a known duty to act in a manner that demonstrated conscious disregard for their responsibilities as fiduciaries for the company. Instead (and somewhat puzzlingly), the defendants challenged the sufficiency of the complaint on two grounds unrelated to Caremark: (1) that the trustee-plaintiff lacked standing to bring a claim on behalf of the debtor’s estate for what was argued to be an injury only to the debtor’s creditors; and (2) that the plaintiff’s claim was really a disguised “deepening insolvency” claim, a theory of liability that Delaware courts have squarely rejected. Accordingly, in view of how the parties had framed the issues in dispute, the bankruptcy court did not need to closely examine the complaint’s Caremark-claim-related allegations to dispose of the defendants’ motion to dismiss.

Had the bankruptcy court expounded in greater detail about the complaint’s allegations, it had plenty of support—especially at this preliminary stage of the litigation—for the conclusion that the complaint adequately alleged a Caremark breach of duty of loyalty claim under applicable federal pleading standards. As Delaware courts have recognized, “[i]n practice, plaintiffs often attempt to satisfy the elements of a Caremark claim by pleading that the board had knowledge of certain ‘red flags’ indicating corporate misconduct and acted in bad faith by consciously disregarding its duty to address that misconduct.” Melbourne Mun. Firefighters’ Pension Trust Fund v. Jacobs, 2016 WL 4076369, at *8 (Del. Ch. Aug. 1, 2016) (collecting cases). The Golden Guernsey complaint included numerous “red flag” allegations.

The complaint contained several detailed allegations that demonstrated that the debtor had been operating under dire financial circumstances for an extended period of time and that defendants were well aware that, among other things, the company was and had been for some time hopelessly insolvent and destined to run out of funds to operate. These allegations included the following:

  • Each of the defendants during the relevant period was directly involved in the management of the debtor.
  • The debtor had never operated profitably, either before or after being acquired by the indirect parent entity on September 9, 2011, and lost nearly $2 million in the initial three months after the acquisition.
  • Management had prepared financial statements for the 12-month period ending September 30, 2012—over three months before the debtor ceased operations—showing a net loss from operations of $4.5 million and a net loss of approximately $6.5 million.
  • The debtor’s insolvency was predictable and inevitable no later than September 2011, given its steady and consistent operating losses, capital structure, the onerous provisions contained in its milk supply agreement, its high labor costs, and interest payments.
  • The parent made no net investment of its own capital in the debtor.
  • The debtor had negative working capital of negative $113,190 as of December 31, 2011—a full year before operations were discontinued.
  • The debtor’s management and sole member were aware of the WARN Act requirements, as evidenced by certain postings made in areas of the debtor’s computer servers accessible by its employees.
  • By November 14, 2012—52 days prior to the closing of the debtor’s facilities—the debtor’s controller had provided senior individuals at the debtor’s parent with copies of a 16-week cash-flow forecast that showed the debtor would have overdrawn its line of credit by November 23, 2012, and would become even more deeply overdrawn over the next two months.
  • By December 22, 2012, the debtor’s president had notified its parent’s managing partner that the company was entirely out of funds to operate.
  • The debtor’s books and records for the relevant period contained no indication that the debtor had access to or was seeking alternate sources of funding.

The cumulative import of these allegations, if true, was to establish (1) the inevitability that the debtor’s business would have to be shut down for lack of funding; (2) the defendants’ awareness for months prior to the date that the debtor discontinued operations that the debtor would run out of money to operate; (3) the absence of any efforts to address the debtor’s financial distress; (4) the defendants’ failure to provide 60-days advance notice of the shutdown as mandated by the WARN Act; and (5) the inapplicability of any exceptions or exemptions to the WARN Act notice requirement.

To be certain, the complaint’s allegations concerning the defendants’ knowledge of the WARN Act obligations and their mental state in failing to fulfill those obligations were weak. As an element of a Caremark claim, “[c]onscious disregard involves an intentional dereliction of duty which is more culpable than simple inattention or failure to be informed of all facts material to the decision.” In re Goldman Sachs Gp., Inc. S’holder Litig., 2011 WL 4826104, at *13 (Del. Ch. Oct. 12, 2011) (quoting In re Walt Disney Co. Deriv. Litig., 906 A.2d 27, 66 (Del. 2006)). See also Lyondell Chem. Co. v. Ryan, 970 A.2d 235, 243–44 (Del. 2009) (“Only if they knowingly and completely failed to undertake their responsibilities would they breach their duty of loyalty.”).

Had this action been filed in the Court of Chancery of Delaware, it is doubtful whether the complaint would have survived a motion to dismiss that targeted the sufficiency of these allegations under Caremark. Under the Chancery Court’s established pleading standards, the plaintiff would have been required to “plead particularized facts from which it [was] reasonably inferable that the [defendants] consciously disregarded [their] duties by ‘intentionally fail[ing] to act in the face of a known duty to act.’” Melbourne, 2016 WL 4076369, at *9 (quoting Disney, 906 A.2d at 67).

The bankruptcy court is an arm of the federal district court, however, and as such federal rules of pleading applied. See, for example, Andresen v. Diorio, 349 F.3d 8 (1st Cir. 2003) (“[U]under standard Erie doctrine, state pleading requirements, so far as they are concerned with the degree of detail to be alleged, are irrelevant in federal court even as to claims arising under state law.”) (collecting cases). No applicable analogue to the Chancery Court’s heightened pleading requirement for Caremark claims exists in either the Federal Rules of Civil Procedure or the Federal Rules of Bankruptcy Procedure. Accordingly, with the benefit of the less rigorous notice pleading standards under the federal rules, it is likely that the plaintiff’s claim would have survived a Rule 12(b)(6) motion to dismiss even if the defendants directly challenged the sufficiency of its allegations under Caremark and its progeny.

Golden Guernsey, Bankruptcy Trustee Standing, and Deepening Insolvency

The principal arguments the defendants presented in support of dismissal of the complaint should have been (and were) quickly disposed of by the bankruptcy court. The defendants argued that because the debtor was alleged to have been indisputably insolvent during the entire period when the WARN Act notice might have been provided, the trustee lacked standing. The defendants asserted that “the only conceivable injury that could result from Defendants’ alleged wrongdoing is to the general unsecured creditor body, who allegedly stand to receive less than what they might have received absent the WARN Act Claim.” Motion to Dismiss Adv. Compl. of Defs. MILK072011, LLC and Andrew Nikou, ¶ 29, Stanziale v. MILK072011, LLC (In re Golden Guernsey Dairy, LLC, Adv. Pro. No. 14-50953 (KG) (Bankr. D. Del. Dec. 22, 2014), ECF No. 10. In further support of this position, the defendants sought to persuade the bankruptcy court that the trustee’s claim was really in the nature of a deepening insolvency theory of liability, which Delaware law has eschewed. The defendants argued at ¶ 28 that “an already insolvent company, with no prospects of reorganization and headed immediately towards a chapter 7 liquidation with no hope of satisfying its current liabilities, cannot be damaged by the existence of an additional claim subsequently lodged against the estate.”

Relying on a well-developed body of bankruptcy law in the Third Circuit and elsewhere, the bankruptcy court rejected this position, noting that “[t]he Trustee is charged with pursuing the estate’s interests . . . whether the claims are direct or derivative in nature.” Addressing the defendants’ attempts to characterize the trustee’s allegations as a deepening insolvency claim, the court observed:

The present case, as the Trustee alleges in the Complaint, is not one in which the Defendants made strategic errors. . . . The situation is not, as in Trenwick America Litig. Trust v. Ernst & Young, L.L.P., 906 A.2d 168 (Del. Ch. 206), aff’d sub nom. Trenwick America Litig. Trust v. Billett, 931 A.2d 438 (Del. 2007), one in which the defendants made imprudent investments.

The court later concluded (albeit in somewhat summary fashion) that this case was one in which the trustee adequately alleged the defendants’ conscious disregard for their duties by their knowing failure, without justification, to provide the WARN Act notice to affected employees.

Although the understanding of the Golden Guernsey opinion once again could have benefitted from some further explanation of why the court reached the result it did, the answer to that question becomes clear upon examination of this decision in the context of the Delaware bankruptcy court’s other decisions addressing what remains of the deepening insolvency theory post-Trenwick. Initially, in Miller v. McCown De Leeuw & Co., Inc. (In re The Brown Schools), 386 B.R. 37 (Bankr. D. Del. 2008), a decision that issued soon after the Delaware Supreme Court affirmed Trenwick, the court explored the boundaries of what was and was not an impermissible deepening insolvency claim under Delaware law. The trustee’s complaint included claims that both asserted deepening insolvency as an independent cause of action (which, following Trenwick’s affirmance, the trustee agreed to dismiss) and claims for the breach of the duty of loyalty, aiding and abetting breach of fiduciary duty, corporate waste, and civil conspiracy. All of these claims revolved around allegations that the debtors’ majority shareholders had used its control position to wrongfully prolong the debtors’ existence while the debtors were insolvent so that certain transactions could be consummated through which the majority shareholder preferred itself over the interest of the debtors and their creditors.

The Brown School defendants made the now-familiar argument that the trustee’s claims, despite not being expressly denominated as deepening insolvency claims, were just that. The bankruptcy court was unpersuaded, noting that Trenwick itself implied that other causes of action were not impacted by its holding that a claim for deepening insolvency could not be maintained as an independent cause of action. See Trenwick, 906 A.2d at 205 (“If a plaintiff cannot state a claim that the directors of an insolvent corporation acted disloyally or without due care in implementing a business strategy, it may not cure that deficiency simply by alleging that the corporation became more insolvent as a result of the failed strategy.”). Additionally, citing the Third Circuit’s decision in Seitz v. Detweiler, Hershey & Assoc., P.C. (In re CitX Corp.), 448 F.3d 672, 677–78 (3d Cir. 2006), the defendants argued that, as a matter of law, damages for deepening insolvency were unavailable. Rejecting this proposition, the bankruptcy court declined to extend CitX’s holding that deepening insolvency was not a viable measure of damages for a professional malpractice claim to the distinct claims in the action before it.

More recently, in Stanziale v. Versa Cap. Mgm’t, LLC (In re Simplexity, LLC), 2017 WL 65069 (Bankr. D. Del. Jan. 5, 2017), the Delaware bankruptcy court was again asked by the defendants seeking to escape liability on breach-of-fiduciary-duty claims to read Trenwick’s holding expansively to reach other types of claims connected with the debtor’s insolvency. Specifically, in Simplexity, the trustee alleged that the director- and shareholder-defendants had engaged in self-dealing and acted in bad faith and with gross negligence by, among other things, not causing the debtor to file bankruptcy sooner and not providing WARN Act notices to employees, despite having actual knowledge that the lender had terminated any forbearance and was about to sweep all of the debtor’s cash. The Simplexity court reasoned that the trustee’s complaint did not implicate deepening insolvency because, instead of charging the defendants with causing the debtor’s insolvency, it sought redress for “the Defendants’ failure to act in the face of insolvency itself . . . .”

Golden Guernsey likewise appears not to implicate deepening insolvency as an independent tort of the type Delaware courts have rejected. As reviewed above, the Golden Guernsey complaint appears to allege with some specificity that the defendants consciously and in bad faith ignored a known duty to provide the WARN Act notice. The trustee alleged, in substance, that by failing to act, the defendants proximately caused the debtor to incur a substantial liability for which it would not otherwise have been exposed (and for which it received nothing of value). These allegations, taken as true, do appear to state a Caremark-type claim (at least under federal pleading standards) and cannot legitimately be labeled a disguised deepening insolvency cause of action.

The Lessons Golden Guernsey Does and Does Not Teach

The Golden Guernsey opinion provides important lessons for directors, officers, managers, shareholders, members, and other control persons for distressed entities. Even in situations where a company is irretrievably insolvent and beyond rehabilitation, these parties cannot—with impunity—ignore their responsibilities to the entity. Although their respective fiduciary obligations may run only to the entity itself, Delaware law is clear that creditors of such an insolvent entity are the ultimate beneficiaries. Under such circumstances, Delaware fiduciary law does not demand self-sacrifice, nor does it allow responsible persons to cut and run, however, ignoring in the process all potential consequences to the company and its other stakeholders.

Golden Guernsey does not represent any paradigm shift or even signal a developing trend away from established standards governing the conduct of business fiduciaries, however, as suggested by the Amron article. In particular, Golden Guernsey does not mean going forward that management and controlling members or shareholders of distressed enterprises will routinely face statutory WARN Act liability. The opinion merely illustrates one scenario in which a viable Caremark claim could be pled based upon the alleged exceptional and extreme lapses of the debtor’s management and controlling member.