SEC Adopts Improvements to EDGAR System to Enhance Security, Filer Access and Account Management

On September 27, 2024, the SEC adopted a proposal from 2024 that aims to enhance the security of the Electronic Data Gathering, Analysis and Retrieval (“EDGAR”) system and improve filers’ access and account-management capabilities. Most significantly, EDGAR filers will no longer be able to use one account for the entire company. Instead, each individual logging into the EDGAR system for the filer must have their own account and credentials. Under the new system, each filer must authorize and maintain at least two individuals with individual account credentials as administrators to manage the filer’s account and make submissions on EDGAR. These account administrators may authorize and de-authorize additional individuals as users, additional account administrators or technical administrators for the filer. The account administrators will also be required to confirm annually on EDGAR that all individuals and entities reflected on the EDGAR account dashboard are authorized by the filer to act on its behalf and that all information about the filer is accurate. Additionally, the new EDGAR system will offer optional Application Programming Interfaces (“APIs”), a machine-to-machine method of making submissions, retrieving information and performing account-management tasks. Finally, Form ID, the application for access to EDGAR, will be modernized to make the form more user friendly.

On September 30, 2024, the SEC opened for filer testing and feedback a beta software environment that reflect the adopted rule and form amendments and the related technical changes, including beta versions of the filer management website and dashboard, and the ability to use all optional APIs.

Compliance with amended Form ID is required on March 24, 2025. All rule and form amendments will be effective on that date, and filers will be required to comply with all rule and form amendments by September 15, 2025.

For more information, see the SEC’s press release.

Schedule 13G Accelerated Filing Deadline Reminder

In 2023, the SEC adopted amendments to the rules governing beneficial ownership reporting under Sections 13(d) and 13(g) of the Securities Exchange Act of 1934 (the “Exchange Act”). While certain of the amendments, including those relating to Schedule 13D, went into effect earlier in 2024, the revised filing deadlines applicable to Schedule 13G went into effect on September 30, 2024.

Initial Filings

• For investors permitted to file on Schedule 13G because they are qualified institutional investors (“QIIs”) under Rule 13d-1(b), the amendments shorten the filing deadline for an initial Schedule 13G to either (i) 45 days after the calendar quarter-end in which beneficial ownership exceeds 5% of a class of equity securities or (ii) five business days after the month-end in which beneficial ownership exceeds 10% of a class of equity securities. Under the previous rules, QIIs were required to file an initial Schedule 13G within either (i) 45 days after the calendar year-end in which beneficial ownership exceeded 5% of a class of equity securities or (ii) 10 days after the month-end in which beneficial ownership exceeded 10% of a class of equity securities.

• For passive investors permitted to file on Schedule 13G under Rule 13d-1(c), the amendments shorten the filing deadline for an initial Schedule 13G to five business days after the date on which beneficial ownership exceeds 5% of a class of equity securities. Under the previous rules, passive investors were required to file an initial Schedule 13G within 10 days after the date on which beneficial ownership exceeded 5% of a class of equity securities.

• For investors permitted to file on Schedule 13G because they are exempt investors under Rule 13d-1(d) (e.g., founders or pre-IPO investors), the amendments shorten the filing deadline for an initial Schedule 13G to 45 days after the calendar quarter-end in which beneficial ownership exceeds 5% of a class of equity securities. Under the prior rules, exempt investors were required to file an initial Schedule 13G within 45 days after the calendar year-end in which beneficial ownership exceeded 5% of a class of equity securities.

As a result, under amended Rules 13d-1(b), 13d-1(c) and 13d-1(d), any beneficial owner of more than 5% as of September 30, 2024 that had not previously reported on Schedule 13G (or Schedule 13D) will have a filing obligation triggered, with a filing deadline of either November 14, 2024 (in the case of Rules 13d-1(b) (if less than 10%) and 13d-1(d)) or October 7, 2024 (in the case of Rules 13d-1(b) (if more than 10%) and 13d-1(c)). For example, a pre-IPO investor of more than 5% of a company that underwent an initial public offering in early 2024 will be required to file an initial Schedule 13G by November 14, 2024 (as compared to the deadline under the prior rules of February 14, 2025). Thereafter, initial Schedule 13G reporting obligations will be assessed on a quarter-end basis.

Amendments

• For QIIs, the amendments require a Schedule 13G amendment within either (i) 45 days after the calendar quarter-end in which a material change occurs or (ii) five business days after the month-end in which beneficial ownership of a class of equity securities exceeds 10% or, thereafter, a 5% increase or decrease in beneficial ownership of a class of equity securities occurs. The previous rules required a Schedule 13G amendment within either (i) 45 days after the calendar year-end in which any change occurred or (ii) 10 days after the month-end in which the investor’s beneficial ownership of a class of equity securities exceeded 10% or, thereafter, increased or decreased by more than 5%.

• For passive investors, the amendments require a Schedule 13G amendment within either (i) 45 days after the calendar quarter-end in which a material change occurs or (ii) two business days after beneficial ownership of a class of equity securities exceeds 10% or, thereafter, a 5% increase or decrease in beneficial ownership occurs. The previous rules required a Schedule 13G amendment within either (i) 45 days after the calendar year-end in which any change occurred or (ii) promptly after the investor’s beneficial ownership of a class of equity securities exceeded 10% or, thereafter, increased or decreased by more than 5%.

For exempt investors, the amendments require a Schedule 13G amendment within 45 days after the calendar quarter-end in which a material change occurs. The previous rules required a Schedule 13G amendment within 45 days after the calendar year-end in which any change occurred.

Amendment obligations for existing Schedule 13G filers will be assessed on September 30, 2024, but only in respect of material changes to the most recent Schedule 13G filed. Thereafter, Schedule 13G amendment obligations will be assessed on a quarter-end basis. In addition, for QIIs and passive investors, beginning on September 30, 2024, any increases in beneficial ownership above 10%, or changes of more than 5% following reporting as a 10% owner, would be subject to the new, accelerated deadlines.

For more information, see Debevoise Insights.

The CTA Reporting Deadline Is Coming: Recent Developments and Next Steps

Effective January 1, 2024, the Corporate Transparency Act (the “CTA”) requires many entities to report information about their beneficial owners, senior officers and other control persons to the U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”). Various lawsuits challenging the constitutionality of the CTA have been brought. Foremost among these is National Small Business United v. Yellen, a case in which the U.S. District Court for the Northern District of Alabama held the CTA unconstitutional on March 1, 2024. The federal government appealed this decision, and the U.S. Court of Appeals for the Eleventh Circuit heard oral arguments on September 27, 2024. Currently, the scope of the decision by the Alabama District Court in National Small Business United is narrow, relieving only the specific plaintiffs in that case as opposed to striking down the CTA as a whole. Thus, even an Eleventh Circuit opinion upholding the District Court’s decision would not offer wholesale relief from the CTA, although it may open the path for such relief in a future decision. In any case, a decision by the Eleventh Circuit is not likely before year-end. Legislative measures that could impact implementation of the CTA also have been proposed, including measures that would repeal the CTA altogether or extend reporting deadlines. It is unclear, however, whether any of these measures may be enacted before January 1, 2025. Thus, organizations should prepare to file initial beneficial ownership reports for any reporting companies by year-end.

Additionally, FinCEN stated in recent guidance that entities in existence at any time during 2024 must file beneficial ownership reports even if they cease to exist before the applicable reporting deadline. On September 10, 2024, FinCEN provided details on how an entity that no longer exists may be expected to file. The “beneficial owners” of a dissolved entity should be reported based on the beneficial ownership information that was “accurate as of the moment prior to the reporting company ceasing to exist,” and the beneficial ownership report can be filed by “[a]nyone whom a reporting company authorizes to act on its behalf—such as an employee, owner, or third-party service provider.”

For more information, see Debevoise Insights.

Recent Settled Actions Reiterate SEC’s Broad Interpretation of Rule 21F-17(a) Whistleblower Impediments

On September 9, 2024, the SEC announced settled enforcement actions against seven public companies for Rule 21F-17(a) violations. Rule 21F-17(a) of the Exchange Act prohibits any person from taking any action to impede individuals from contacting the SEC to report a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement. For the past several years, the SEC has been vocal about its position that language in employee agreements, company policies and other material could be interpreted as having a chilling effect on potential whistleblowers and therefore violative of Rule 21F-17(a). The latest companies to be charged by the SEC for language contained in their agreements include Acadia Healthcare Company, Inc., a.k.a. Brands Holding Corp.; AppFolio, Inc.; IDEX Corporation; LSB Industries; Smart for Life, Inc.; and TransUnion. Without admitting or denying the charges, these companies each agreed to civil penalties ranging from $19,500 to $1.3 million for a combined total of over $3 million in penalties. The penalty amounts appear to be largely driven by the number of violative agreements identified by the SEC. The recent settlements are the latest cautionary notice for companies to review a broad range of agreements, policies and other communications with individuals for any potential whistleblower impediments.

For more information, see Debevoise Insights.

SEC Disbands Its Enforcement Division’s Climate and ESG Task Force

On September 12, 2024, an SEC spokesperson confirmed that the SEC’s Enforcement Division’s Climate and Environmental, Social and Governance (“ESG”) Task Force (the “Task Force”) was disbanded within the past few months. The Task Force was established in March 2021 in response to increasing focus on climate- and ESG-related disclosure and investment. Its primary focus was to identify any material gaps or misstatements in issuers’ disclosure related to climate and ESG matters. Additionally, the Task Force evaluated and pursued tips, referrals and whistleblower complaints on ESG-related issues. In its statement to Bloomberg Law, the SEC stated, “the strategy has been effective, and the expertise developed by the Task Force now resides across the division.”

SEC Announced Additional Settlements with Investment Advisers and Broker-Dealers for “Off-Channel” Communications

On September 24, 2024, the SEC announced charges against 12 investment advisers and broker-dealers (the “Firms”) for failures to maintain and preserve electronic communications in violation of recordkeeping provisions of the federal securities laws.

Charges against the Firms stated that the SEC investigation “uncovered pervasive and longstanding use of unapproved communication methods, known as off-channel communications.” During the relevant period of the orders, personnel at the Firms sent and received off-channel communications of which they failed to keep records as required under securities laws. Additionally, the SEC found that most of the Firms failed to reasonably supervise their personnel with a view to preventing and detecting such violations.

In response, the Firms admitted to the facts set forth in their respective SEC orders, acknowledged their conduct violated the applicable securities laws and agreed to pay a combined civil penalty of $88,225,000. The largest penalties agreed to be paid by individual firms were $35 million. Furthermore, 10 of the Firms agreed to retain compliance consultants, who, among other things, will conduct a comprehensive review of the Firms’ relevant policies and procedures. One firm did not pay a penalty because it had self-reported its recordkeeping violation, cooperated with the investigation and demonstrated substantial efforts at compliance.

These charges continue the SEC’s self-described “Off-channel Communications Initiative,” which also resulted in 26 broker-dealers and investment advisers agreeing to pay more than $390 million in civil penalties for similar violations in August 2023. As with prior sets of charges, the SEC’s release highlighted the continued importance of self-reporting and cooperation with respect to these types of violations. SEC Director of Enforcement Gurbir Grewal, in a statement accompanying the August 2023 orders, remarked: “So here are three takeaways for those firms who haven’t yet done so: self-report, cooperate and remediate. If you adopt that playbook, you’ll have a better outcome than if you wait for us to come calling.” Notwithstanding this statement, it remains unclear what level of credit firms will get from self-reporting at this stage.

For more information, see the SEC’s press release.

Independent Director and Ex-CEO of Church & Dwight Co. Inc. Settles with the SEC for Violating Proxy Disclosure Rules

On September 30, 2024, the SEC settled charges against James R. Craigie, a former CEO, Chairman and Director of Church & Dwight Co. Inc. (“Church & Dwight”) for violating proxy disclosure rules. The SEC charged that before his appointment as an independent director in 2019, Mr. Craigie failed to disclose to the board of Church & Dwight that he maintained a close personal friendship with a Church & Dwight executive. As a result, Church & Dwight’s proxy statements in 2021 and 2022 contained misstatements of material fact when they listed Mr. Craigie as an independent director. In its complaint, the SEC alleged that Mr. Craigie maintained the relationship since 2017 and had paid more than $100,0000 to the Church & Dwight executive and his spouse for vacations. Furthermore, the SEC alleged that Mr. Craigie withheld, and instructed the Church & Dwight executive to withhold, the nature of their relationship from Church & Dwight. In response to these charges, Mr. Craigie, without admitting or denying the allegations, agreed to be permanently enjoined from further violations of the proxy provisions of the Exchange Act, pay a civil penalty of $170,000 and a five-year officer-and-director bar. The settlement is subject to court approval.

For more information, see the SEC’s press release.

DOJ Updates Guidance on Corporate Compliance Programs to Include AI Risk Management

On September 23, 2024, the U.S. Department of Justice updated its guidance to federal prosecutors related to the “Evaluation of Corporate Compliance Programs” (the “ECCP”), which is used in evaluating companies’ compliance programs in connection with charging decisions and penalty determinations, including whether to impose a monitor. This revision, the first since March 2023, addresses how companies manage risks associated with new and emerging technology, including artificial intelligence, and expands on preexisting guidance regarding employee reporting channels, whistleblower protection, post-acquisition compliance integration and use of data for compliance purposes.

The following are the key additions and other modifications in the latest ECCP:

• Most significantly, the updated ECCP squarely addresses the impact of new technologies, such as AI. DOJ now asks prosecutors to consider what technology a company uses to conduct business, whether the company has conducted a risk assessment regarding the use of such technology and whether the company has taken appropriate measures to mitigate risks associated with the technology.

• The prior ECCP already stressed the importance of an effective mechanism by which employees can anonymously or confidentially report compliance issues, as well as measures to ensure that employees who report will not be subject to retaliation. The new ECCP builds on that guidance, instructing prosecutors to consider whether and how a company incentivizes reporting (or, conversely, engages in “practices that tend to chill such reporting”), whether the company has an anti-retaliation policy and whether the company trains employees on internal reporting channels, antiretaliation policies and laws, external whistleblower programs and whistleblower protection laws.

• In the transactional context, DOJ places additional emphasis on post-acquisition integration. The 2023 version of the ECCP called for assessment of a company’s process for implementing compliance policies and procedures, and conducting post-acquisition audits, at an acquired entity. In the new ECCP, DOJ also asks what role the compliance and risk management functions have in planning and carrying out the integration process, how the company ensures compliance oversight of the acquired business and how the new business is integrated into the company’s risk assessment procedures.

• Similarly, with regard to the use of data for compliance purposes, the new ECCP expands on DOJ’s existing guidance. Specifically, prosecutors should ask not only whether a company’s compliance function has sufficient access to relevant data sources but also whether the company is “appropriately leveraging data analytics tools” for compliance purposes, how the company is managing the quality of its data and how the company is ensuring the reliability of any data analytics models it is using.

The updated ECCP’s greatest impact likely will be on how companies tailor their compliance programs to address new technologies, particularly the expectation that companies will have “conducted a risk assessment regarding the use of [AI] . . . and . . . taken appropriate steps to mitigate any risk associated with the use of that technology.” In addition, the revised ECCP puts companies on notice that, if their use of AI leads to significant compliance problems or fails to adequately identify and address those problems, as part of a charging decision, DOJ may examine the resources devoted to AI risk management and compliance.

For more information, see Debevoise Insights.

SEC Rule-Making Agenda

The SEC’s Spring 2024 Regulatory Agenda was posted earlier this year. A summary of key rule changes is included below. We expect the Fall 2024 agenda to be released by January 2025. For more information, see the full regulatory agenda here.