COVID-19: Still Open for Business, and Business is Booming: What Companies Should Expect from the SEC in the Time of COVID-19

As the nation’s storefronts reopen and businesses attempt to return to normalcy, the U.S. Securities and Exchange Commission (SEC) is gearing up to respond to fraud and securities violations relating to the COVID-19 pandemic. The SEC’s response to the 2008 financial crisis offers insights into what companies should expect from today’s SEC and how to best prepare before the Commission comes calling. SEC-regulated entities should also pay attention to what the SEC is already saying–and doing–in response to the economic and societal turmoil accompanying the pandemic.

Executive Summary

• Following the 2008 financial crisis, Congress and the SEC implemented a number of reforms that strengthened the agency’s enforcement capabilities, including enhanced enforcement tools, like whistleblower awards and the creation of specialized units within the Division of Enforcement. Together, these and other initiatives helped lead to a dramatic spike in enforcement actions in the past decade as the agency wielded better tools and more efficient ways to use them.
• In the current COVID-19 environment, we expect the SEC to use these heightened enforcement capabilities quickly to address securities fraud in the healthcare, pharmaceutical, and medical manufacturing spheres. While these industries are expected to attract particular SEC interest, the agency will also focus on insider trading, market manipulation, corporate disclosures, and accounting fraud – particularly in high impact areas.
• Companies should track pandemic-related decision-making as SEC Exam teams have already requested information about COVID-19 policies, such as the continuity of business operations and the ability of a firm to work remotely for extended periods.
• SEC Enforcement is already investigating conduct relating to the pandemic. The SEC has issued sweep requests to public companies receiving Paycheck Protection Program (PPP) loans. The SEC has and will continue to issue subpoenas for new and preexisting investigations so companies should not expect a dip in activity. Rather, we expect the SEC to utilize the increasing number of whistleblower tips, data analytics, and focused exams to spur a wave of Enforcement activity.
• Companies should start taking proactive steps now to lessen the consequences of a potential future investigations and exams. Such actions include exercising care in public statements, preparing in advance to respond to government inquiries, assessing the company’s history of compliance, and maintaining rigorous board and management oversight, in particular as it pertains to COVID-19-related activities. Businesses in receipt of funds from the CARES Act should be particularly vigilant as long as they hold on to taxpayer funds.

The following client alert takes a deeper look into these trends, predictions, and recommendations for SEC enforcement in the age of COVID-19.

***

As stay-at-home orders and restrictions are relaxed throughout the United States in the coming months, there will be growing momentum to “get back to normal.” While publicly traded companies and regulated entities will be focused on jumpstarting economic activity, they also should be ready to face an active, prepared SEC, which has promised to “move swiftly against those who seek to profit off this national emergency by cheating or misleading investors.”² If past crises are an indication, that response will be aggressive and pervasive. In fact, the agency already has announced charges against several companies and their CEOs for alleged COVID-19 scams and issued over 30 trading suspensions due to coronavirus-related claims.³ The SEC also has started inquiries into certain public companies receiving Paycheck Protection Program (PPP) loans offered under the Coronavirus Aid, Relief, and Economic Security Act (CARES Act).⁴ This is the tip of the iceberg, and we expect that the SEC will be investigating and charging companies and individuals for pandemic-related fraud for years to come.

There are many reasons to expect an aggressive SEC response, starting with the current makeup of the Division of Enforcement (the Division). Compared to a decade ago, today’s SEC is a “tough[er] cop on the financial beat”⁵ —a status largely derived from the institutional and operational reforms implemented in the aftermath of the 2008 financial crisis. By exploring these reforms and how the SEC responded to the 2008 financial crisis along with current statements by SEC leadership, we can project the priorities we expect to see from the SEC in the aftermath of COVID-19.

Forging a Tougher SEC: The 2008 Financial Crisis and Its Rippling Effects
The 2008 financial crisis had a tremendous impact on the SEC. In particular, the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) transformed the agency, tasking it with mandatory rulemaking, directing it to create new offices, and requiring the SEC to issue regular studies and reports.⁶ In compliance with this legislative mandate, in the last 10 years the SEC has adopted 67 mandatory rules provisions, established five new offices required by Dodd-Frank, and issued more than 30 reports and studies.⁷ The result is a stronger SEC with a broader mandate.

From an enforcement perspective, Dodd-Frank equipped the SEC with enhanced tools to regulate capital markets and investments. Dodd-Frank also provided incentives for others to assist in that mission by allowing SEC staff to reward whistleblowers for providing information leading to enforcement actions. To that end, in 2010 the SEC created the Office of the Whistleblower, which facilitates a program that offers individuals who report possible violations of federal securities law a monetary incentive of between 10 percent and 30 percent of any recovery.⁸ The SEC has come to recognize that whistleblower assistance can be “among the most powerful weapons in the law enforcement arsenal of the Securities and Exchange Commission.”⁹ To date, the SEC has awarded approximately $425 million to 79 individuals, recently announcing an award of $27 million, the largest of 2020 to date.¹⁰ These whistleblower awards do not tell the whole story, as whistleblower tips have led to countless enforcement investigations, many of which were resolved with no whistleblower award or resulted in ongoing, active investigations.

In addition to paving the way for new enforcement tools, the 2008 financial crisis led to a significant reorganization of the Division to better streamline its expertise and resources. The SEC established five specialized units in 2010 and created a new office to collect, analyze, and monitor the tips, complaints, and referrals that the SEC receives each year.¹¹ The specialized units included:

1. Asset Management (focused on investigations involving investment advisors, investment companies, hedge funds, and private equity funds).
2. Market Abuse (focused on investigations involving large-scale market abuses and complex manipulation schemes by institutional traders, market professionals, and others).
3. Structured and New Products (later renamed the Complex Financial Instruments Unit) (focused on complex derivatives and financial products, including credit default swaps, collateralized debt obligations, and securitized products).
4. Foreign Corrupt Practices (focused on violations of the Foreign Corrupt Practice Act).
5. Municipal Securities and Public Pensions (focused on misconduct in the large municipal securities market and in connection with public pension funds).¹²

In 2017, the Division added two more units to address cyber-based threats and protect retail investors.¹³ The Division’s restructuring allowed for increased specialization, equipping the SEC with a heightened “capability to detect emerging fraud and misconduct, [a] greater capacity to file cases with strike-force speed, and an increase in expertise throughout the Division.”¹⁴ In the ensuing years, the SEC also put an added focus on data analytics, creating the Division of Economic Risk and Analysis in 2009 to assist enforcement with analyzing market trends to target suspicious and fraudulent conduct.¹⁵ The SEC will leverage all of these tools in its response to COVID-19.

Starting in 2010, the SEC further expanded its enforcement toolbox by allowing cooperation agreements, deferred prosecution agreements, and non-prosecution agreement.¹⁶ The SEC added a Cooperation Program aimed at incentivizing individuals engaged in wrongdoing to cooperate in ongoing investigations in exchange for a reduced penalty. These tools, long used by criminal prosecutors, expanded the SEC’s enforcement capabilities significantly and promoted “greater cooperation from individuals and companies” to strengthen the SEC’s enforcement activities.¹⁷

Taken together, these new tools and organizational structure led to a spike in enforcement actions following the 2008 financial crisis. The SEC charged 204 entities and individuals for conduct relating to the financial crisis. The targets included companies, as well as CEOs, CFOs, and other senior corporate officers, with resulting total penalties exceeding $3.76 billion.¹⁸ In response to that crisis, the SEC focused on specific misconduct, including: (1) concealing from investors risks, terms, and improper pricing in collateralized debt obligations and other structured products; (2) making misleading disclosures to investors about mortgage-related risks and exposure; (3) concealing the extent of risky mortgage-related investments in mutual funds and other financial products; and (4) other financial misdeeds.

The New SEC Meets COVID-19
The SEC responded to the 2008 financial crisis with an avalanche of reforms, initiatives, data analytics, and specialization to pursue a “bold and unrelenting” enforcement agenda.¹⁹ We expect to see these expanded enforcement capabilities, paired with a similar momentum, as the SEC responds to the COVID-19 aftermath. The SEC has already seen a 35 percent increase in tips for the two-month period beginning in mid-March compared to the same period in 2019, and given market conditions, we expect that trend to continue.²⁰

We can expect to see the SEC prioritizing enforcement related to securities fraud in the healthcare, pharmaceutical, and medical manufacturing spheres.²¹ Just as the SEC focused on banks and other lenders following the 2008 financial crisis, these industries are sure to receive enhanced scrutiny from the SEC and other government prosecutors and regulators. Actions in these areas may come quickly. In comments made to in-house regulatory professionals and outside counsel at the end of May, the director of the SEC’s New York regional office, Marc Berger, said that COVID-19 related cases are a priority and the SEC may bring an enforcement action immediately rather than relying on tolling agreements.²² In the past two months, the SEC launched at least three separate enforcement actions against companies that made misstatements related to the supply of personal protective equipment, thermal scanning equipment to detect coronavirus infection, and finger-prick testing kits.²³

Not all priorities will be healthcare related. Volatile markets and the financial stress of a severe economic downturn will likewise lead to enforcement in the hardest-hit sectors. As the co-director of the Division, Steve Peikin, noted in a speech in mid-May, the SEC will focus on insider trading and market manipulation, corporate disclosures and accounting fraud in highly impacted industries, and misconduct by investment advisors and investment companies. The latter is expected to include investigations relating to failure to honor redemption requests or the use of improper marketing materials.²⁴ Enforcement in these areas will likely include both preexisting issues exacerbated by the crisis and new misconduct in a volatile economy.

We expect the SEC’s enforcement of these priorities to manifest itself in a number of increasingly severe ways, including:

Enhanced market monitoring

As with the response following the 2008 financial crisis, the SEC has already put in place a new group. The cross-divisional COVID-19 Market Monitoring Group (the Group) will assist the SEC and staff with analysis related to effect of COVID-19 on markets, insurers, and investors; respond to requests for information; and provide analysis and assistance from fellow regulators.²⁵ The Group will work with personnel from across the agency and coordinate with other federal financial agencies.

Exams

As the COVID-19 crisis barreled towards the United States in early March, the SEC’s Office of Compliance Inspections and Examinations (OCIE) began requesting information related to COVID-19 preparedness or policies as part of its examinations of registered investment companies and advisors.²⁶ Exams sought information related to the continuity of business operations and the ability of a firm to work remotely for extended periods. Expect requests related to these topics to continue. Advisors taking advantage of government stimulus programs should also expect enhanced questions about qualifications for and use of stimulus funds, as well as proper disclosures to investors regarding receipt of those funds.

Sweep Requests

The SEC’s Home Office Enforcement team has begun voluntary inquiries of public companies receiving PPP loans. In the Matter of Certain Paycheck Protection Program Loan Recipients, the SEC has sought information including the impact of COVID-19 on the company’s business and the business’s ability to continue as an ongoing concern.²⁷ This is likely the first of many sweep investigations—whether titled as sweep investigations or not—that SEC enforcement will initiate to target companies engaged in similar, potentially problematic conduct.

Subpoenas

While criminal investigations may be hamstrung by the lack of grand juries in some jurisdictions, the SEC has continued to issue subpoenas and will continue to do so in preexisting and new investigations going forward. Compared to investigations by the Department of Justice, apart from in-person testimony, there are fewer facets of SEC investigations that cannot be conducted remotely or virtually.

Turning to the Courts

It is possible that challenges in taking testimony, interviewing witnesses, and collecting data due to COVID-19-related restrictions may cause the SEC to turn to courts sooner than they have in the past. Courts may provide quicker resolution of certain disputes, particularly for discovery, and the SEC may use that option more liberally than in the past. This could lead to an expansion in the use of subpoena enforcement actions and temporary restraining orders in particular cases.

While some SEC resources have been directed towards COVID-19 priorities, resources have not been diverted from other departments, and specialized enforcement units remain equipped to focus on their traditional priorities. The SEC’s divisional approach will therefore enable it to continue to pursue a wide array of enforcement while other divisions are focused on different market priorities. Companies should not expect the SEC to stop investigating fraud and abuse even if other regulatory priorities are becoming increasingly complicated.²⁸

Be Prepared
Should the SEC come calling, either for targeted conduct, an industry sweep, or as part of a routine exam, companies should not be caught flat-footed even as they grapple with the impacts of COVID-19. While the SEC recognizes these are “challenging times,” this rationale is unlikely to be an adequate response to the Division or OCIE inquiries. Despite the extraordinary pandemic, the SEC will still expect companies to maintain compliance and to provide thoughtful explanations for the actions they undertake during these “uncertain times.” We expect that there will be no general defense of COVID-19 for conduct that the SEC views as violating the securities laws.

The following are best practices companies should keep in mind to prepare for the coming wave of pandemic-related enforcement. Companies that applied for and received funds under the CARES Act should exercise particular caution, but these same principles can also guide companies and regulated entities as they prepare for enhanced SEC scrutiny in the months and years ahead:

Start on the Right Foot

Be careful when making public statements, especially statements to the government. Whether about marketing or advertising materials, applications for PPP loans, investor updates, public filings, or other disclosures, accuracy is critical. It will be particularly important that companies be cautious and transparent in any statements made about business conditions, contingency plans, and future prospects, as well as disclosures about potential vaccines, protective gear production, or testing. The SEC recognizes that companies and individuals do not know what the future holds but will be on the lookout for misleading or untruthful statements to investors, auditors, and the public. Seek appropriate counsel at all times to ensure you are complying with the letter and spirit of the law as well as evolving regulatory guidelines.

Respond to Inquiries Promptly and Truthfully

As public companies and regulated entities experience an expected wave of regulatory and government inquiries in the months ahead, it will be essential to provide fulsome and careful responses. Companies that are prepared in advance and can respond quickly will be in a better position to avoid long, drawn out investigations or examinations by the SEC or other regulatory agencies. Time spent preparing for the inevitable inquiries now will be time well spent in the future when the call for information comes.

Be Aware of the Skeletons in the Closet

Businesses should know their history of compliance and any ongoing conduct that may create liability in the future. An economic downturn, or even seemingly minor business disruptions, may exacerbate or spotlight prior misconduct. The government will likely check that companies are not using stimulus funding or engaging in conduct to obscure previous wrongdoings. While business may be operating slower than usual, this may be an opportune time to pressure test internal controls and update relevant policies.

Ensure Oversight at the Board and Senior Management Level

Where a company receives PPP funds, it should ensure all major decisions are presented by senior management to its board of directors for discussion and approved, including a careful review of certifications being made on behalf of the company. The board of directors should be actively engaged in overseeing this process, receiving formal written presentations and asking questions about the application and the accuracy of the certifications, not simply rubber-stamping the materials. Whether pertaining to PPP funds or other COVID-19 related decisions, board materials for review, discussion, and approval should be distributed with enough time for board members to read the materials. Sending a large amount of material to board members by email a few minutes before a meeting may not allow them time for proper oversight.

Keep an Accurate and Complete Record

If your company applied for CARES Act funding, maintain proper documentation of the rationale behind this decision, the support for certifications, and how funds are ultimately used. Importantly, companies should be prepared to answer questions about these decisions potentially years down the road. In all cases, either with or without CARES Act funding, companies at this time should pay particular attention that presentations to the board or committee meetings are properly memorialized, especially when the discussion relate to a company’s basis for attesting to certifications under the CARES Act. It also means that directors or other decision-makers have access to complete information and the opportunity to test and verify the certifications being made. This includes any email correspondence related to the topic, which may be required to be produced in an audit, investigation, or other proceeding. Adhering to a robust approval process and corresponding document preservation policy is critical when it is time for government or auditor review. If your company has a document retention policy, review the policy to ensure that the documentation will not be automatically destroyed on a set date. In the case of a PPP loan, consult with your counsel on whether to suspend the policy for documents that relate to the loan.

Protect Data Now

The reality of remote work has restricted the traditional ability to maintain and collect company data. From an uptick in the use of ephemeral messaging and personal devices for communication to the inability to image or take possession of employee devices, data maintenance and collection pose particular challenges. While the SEC will likely recognize these limitations now, they may not be as understanding months or years down the road when the necessary data is unavailable. Companies should be considering creative solutions to maintain data and should have policies in place.

Designate a Point Person for CARES Act Related Matters

Businesses in receipt of CARES Act funds should consider tasking a specific employee or group with overseeing all documentation and information regarding CARES Act funds. This point person(s) will be responsible for collecting information relating to the CARES Act certification, seeking appropriate sign-off from the board of directors or senior management (or both), and documenting every step in the process. This point person should maintain a complete record of how stimulus funds are used in the event a later reconciliation is required. Finally, this point person should assume that questions will be asked down the road and document each step in the process accordingly.

Consider Setting up a Separate Bank Account for PPP Loan Proceeds

In order to easily track the use of proceeds and tie them to the PPP loan, consider setting up a separate bank account to avoid any questions of intermingling of funds. This will also help create an audit-friendly documented trail of the use of proceeds, while making it easier for businesses to demonstrate forgivable spending derived from PPP loan funds. If your company does not open a separate account, be meticulous in documenting how, when, and why PPP funds are spent in order to avoid future investigative inquires and support your company’s claims for loan forgiveness.

Remain Vigilant

Recipients should maintain strict oversight not just of any stimulus funds received but also of their business practices as a whole. Companies should certainly ensure funds are used in compliance with the CARES Act, but they should also keep an eye on conduct elsewhere in the business, especially if they are in receipt of taxpayer funds. Consider having the point person provide a written weekly update to senior management and the board of directors on the use of proceeds and setting biweekly board calls to discuss and review the proper use of proceeds and business practices as a whole. The government will certainly be watching too.

Maximize Your Legal Support

The situation is rapidly evolving on a day-to-day basis. Be sure your company stays up to date on changes to provisions of the bailout, supplemental legislation, and governmental guidance. Consult counsel early and often. Keep counsel, internal and external, informed of any questions regarding the use of bailout funds, and keep accurate records of how bailout funds are used.

What Is Next?
The world’s response to COVID-19 has made clear that, at least for now, the normal rules have been suspended. In any crisis, there is a temptation to cut corners and bend the rules in order to survive financially. While we cannot predict when the SEC hammer will fall, we know that the agency is preparing for significant and widespread investigations to pursue misconduct arising during this period. Smart companies and individuals will be prepared when the SEC comes knocking.