From the Derivatives Practice Group: We continue to see a lot of activity around virtual assets in Hong Kong, with Hong Kong’s Securities and Futures Commission weighing in most recently.

New Developments

  • CFTC’s Global Markets Advisory Committee Advances Three Recommendations. On March 7, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, advanced three new recommendations intended to (1) promote U.S. Treasury markets resiliency and efficiency, (2) provide resources on the upcoming transition to T+1 securities settlement, and (3) publish a first-ever digital asset taxonomy to support U.S. regulatory clarity and international alignment. [NEW]
  • CFTC’s Market Risk Advisory Committee to Meet. The CFTC’s Market Risk Advisory Committee (MRAC) will meet on April 9 at 9:30 am ET. The MRAC will consider current topics and developments in the areas of central counterparty risk and governance, market structure, climate-related risk, and emerging technologies affecting derivatives and related financial markets. [NEW]
  • CFTC Staff Issues Advisory Regarding FBOT Regulatory Filings. On March 1, the CFTC’s Division of Market Oversight announced that it issued an advisory notifying all foreign boards of trade (FBOTs) registered under Part 48 of the CFTC’s regulations that, beginning April 1, 2024, certain regulatory filings (covered filings) should be submitted through the CFTC’s online filings portal, which has been updated for FBOT use. The portal has been available to registered FBOTs for the submission of public filings since March 1. Covered filings will be accepted via email until March 31. Beginning April 1, FBOTs should submit all Covered Filings exclusively through the portal. [NEW]
  • CFTC Extends Public Comment Period for Proposed Rule on Real-Time Public Reporting Requirements and Swap Data Recordkeeping and Reporting Requirements. On February 26, the CFTC announced that it is extending the deadline for the public comment period on a proposed rule that makes certain modifications to the CFTC’s swap data reporting rules in Parts 43 and 45 related to the reporting of swaps in the other commodity asset class and the data element appendices to Parts 43 and 45 of the CFTC’s regulations. The deadline is being extended to April 11, 2024. The proposed rule was published in the Federal Register on December 28, 2023, with a 60-day comment period scheduled to close on February 26, 2024. [NEW]
  • CFTC Staff Issues No-Action Letter Regarding Pre-Trade Mid-Market Mark for Certain Interest Rate Swaps Referencing SOFR. On February 22, the CFTC’s Market Participants Division (MPD) issued a no-action letter applicable to all registered swap entities in relation to the requirement in Regulation 23.431 that swap dealers and major swap participants (swap entities) disclose to certain counterparties the Pre-Trade Mid-Market Mark (PTMMM) of a swap. The no-action letter states that MPD will not recommend the CFTC take an enforcement action against a registered swap entity for its failure to disclose the PTMMM to a counterparty in certain interest rate swaps referencing the Secured Overnight Financing Rate that are identified in the no-action letter, provided that: (1) real-time tradeable bid and offer prices for the swap are available electronically, in the marketplace, to the counterparty; and (2) the counterparty to the swap agrees in advance, in writing, that the registered swap entity need not disclose a PTMMM for the swap. According to the CFTC, the no-action letter provides a similar no-action position as that in CFTC Staff Letter No. 12-58 for certain interest rate swaps referencing the London Interbank Offered Rate. CFTC Commissioner Christy Goldsmith Romero objected to the no-action letter, arguing that it inappropriately shifts the burden of understanding swap dealer’s conflicts and incentives back onto counterparties, upending the Dodd-Frank Act’s intent.
  • CFTC Approves Three Proposed Rules and Other Commission Business. On February 20, the CFTC approved three proposed rules through its seriatim process: (1) Regulations to Address Margin Adequacy and to Account for the Treatment of Separate Accounts by Futures Commission Merchants; (2) Foreign Boards of Trade; and (3) Requirements for Designated Contract Markets and Swap Execution Facilities Regarding Governance and the Mitigation of Conflicts of Interest Impacting Market Regulation Functions. All three proposals have a comment deadline of April 22, 2024. Additionally, the CFTC issued an order of exemption from registration as a derivatives clearing organization (DCO) to Taiwan Futures Exchange Corporation and approved an amended order of registration for ICE NGX Canada, Inc., adding environmental contracts to the scope of contracts it is eligible to clear as a DCO.
  • CFTC Extends Comment Period on Proposed Rules for Operational Resilience Frameworks. On February 20, the CFTC extended the comment period on its proposed rules implementing requirements for operational resilience frameworks for futures commission merchants, swap dealers and major swap participants. The new deadline is April 1, 2024.

New Developments Outside the U.S.

  • SFC Issues Guidance on Disciplinary Process Under Virtual Assets Regime. On February 28, Hong Kong’s Securities and Futures Commission (SFC) published a guide outlining the disciplinary process under the new licensing regime for virtual asset trading platforms (AMLO VATP Regime). Under the new regime, introduced via an amendment to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), the SFC has the power to discipline its licensees, comprising firms, their responsible officers and those involved in their management, if it finds that such licensee’s conduct suggests that it is, or was at any time, guilty of misconduct or not fit and proper. The disciplinary process under the AMLO VATP Regime is based largely on the disciplinary process applicable to persons licensed by or registered with the SFC (including those involved in their management) under the Securities and Futures Ordinance (Cap. 571). The SFC indicated that when determining whether to take disciplinary action and the level of sanction, the SFC will consider, among other things, the nature and seriousness of the conduct, the amount of profits accrued or loss avoided, and circumstances specific to the firm or individual. [NEW]
  • HKMA Sets Out Expectations on Tokenized Product Offerings. On February 20, the Hong Kong Monetary Authority (HKMA) published a circular covering the sale and distribution of tokenized products. According to the HKMA, the prevailing supervisory requirements and consumer/investor protection measures for the sale and distribution of a product are also applicable to its tokenized form as it has terms, features and risks similar to those of the underlying product. The HKMA clarified that authorized institutions should conduct adequate due diligence and fully understand the tokenized products before offering them to customers and on a continuous basis at appropriate intervals. Authorized institutions are also expected to act in the best interest of their customers and make adequate disclosure of the relevant material information about a tokenized product, including its key terms, features and risks. Finally, the HKMA indicated that authorized institutions should put in place proper policies, procedures, systems and controls to identify and mitigate the risks arising from tokenized product-related activities.
  • HKMA Sets Standards for Digital Asset Custodial Services. On February 20, the HKMA issued guidance for authorized institutions interested in offering custody services for digital assets. The HKMA expects authorized institutions to undertake a comprehensive risk assessment followed by the implementation of appropriate policies to manage identified risks. The entire process should be overseen by the board and senior management. The HKMA also requires authorized institutions to conduct independent systems audits, store a substantial portion of client digital assets in cold storage, ensure that private keys are secured within Hong Kong and provide all records to HKMA whenever requested. Authorized institutions should notify the HKMA and confirm that they meet the expected standards in the guidance within 6 months from the date of the guidance (i.e. February 20, 2024).

New Industry-Led Developments

  • ISDA Publishes Whitepaper Charting the Next Phase of India’s OTC Derivatives Market. On March 4, ISDA published a new whitepaper that explores the growth of India’s financial markets and makes a series of market and policy recommendations to encourage the further development of a safe and efficient over-the-counter (OTC) derivatives market. The whitepaper proposes several initiatives that industry participants and regulators could take that ISDA believes will create deeper and more liquid domestic derivatives markets and enhance risk management practices. The recommendations are centered on five key pillars: (1) Broaden product development, innovation and diversification; (2) Foster adoption of similar market and risk principles across regulatory regimes; (3) Enhance market access and diversification of participants in the OTC derivatives market; (4) Ensure growth in a safe and efficient manner; and (5) Encourage greater alignment with international principles and practices. [NEW]
  • ISDA Extends Digital Regulatory Reporting InitiativeDRR: The Answer to Reporting Rule Rush. On February 26, ISDA reported that it has worked to extend its Digital Regulatory Reporting (DRR) initiative to cover the rush of reporting rules, which starts with Japan on April 1, followed by the EU on April 29, the UK on September 30 and Australia and Singapore on October 21. ISDA stated that iIn each case, regulators are revising their rules to incorporate globally agreed data standards in an effort to improve the cross-border consistency of what is reported and the format in which it is submitted – a process that started in December 2022 with the rollout of the first phase of the US Commodity Futures Trading Committee’s revised swap data reporting rules.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

This update provides a recap of 2023 highlights for capital markets, M&A activity, royalty finance transactions and clinical funding arrangements, along with expectations for 2024.

The past five years have been particularly tumultuous in the biopharma sector. Strong capital markets and M&A activity into early 2020 were whipsawed during the pandemic, with equity valuations climbing significantly through early 2021 before dropping dramatically through the fourth quarter of 2023. While dedicated healthcare funds have remained in the market during this time, generalist funds pulled back significantly in 2022 and 2023, leaving the sector with insufficient capital on the whole to support the number of public (and aspiring to be public) biopharma companies. This was reflected in the fact that over 200 Nasdaq-listed biopharma companies were trading below their cash balances as of Q32023. As a result, many biopharma companies sought less dilutive sources of capital, including royalty-based financing and third-party funding of clinical trials, while others explored sales, reverse mergers and liquidations. At the same time, a select group of companies with particularly attractive assets (either de-risked or in a therapeutic space with high investor interest) were still able to raise capital on favorable terms.

Starting in the fourth quarter of 2023, we saw the XBI rally with the broader market, which seemed to signal a bottoming out of the market and an ability more broadly to access capital. Also during this time, large pharma has amassed substantial cash balances coming out of the pandemic and from the sale of blockbuster GLP-1 drugs. This led to a strong year in 2023 for larger M&A transactions (over $1 billion), albeit with the sense that it was a buyer’s market taking advantage of the lower equity valuations of the target companies. Looking ahead, we expect a more stable capital environment in 2024, which will support capital formation and continued M&A activity, although uncertainty remains with increased geopolitical tensions, a pending presidential election in the United States and continued economic uncertainty globally.

As we enter this new year, we are cautiously optimistic that the coming year will provide a favorable deal environment for the biopharma sector and represent a return to a more balanced environment. Please read more below.

Read More

We invite you to join our team of seasoned attorneys and industry leaders for a webcast, where we will provide a recap of 2023 highlights for capital markets, M&A activity, royalty finance transactions and clinical funding arrangements, along with expectations for the Life Sciences deal market in 2024.

Register for our Webcast: Please join us on March 12, 2024: “Life Sciences Review and Outlook 2024.”


The following Gibson Dunn lawyers prepared this update: Ryan Murr, Branden Berns, Todd Trattner, Karen Spindler, and Melanie Neary.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Life Sciences practice group, or the authors in San Francisco:

Ryan Murr (+1 415.393.837, [email protected])
Branden Berns (+1 415.393.4631, [email protected])
Todd Trattner (+1 415.393.8206, [email protected])
Karen Spindler (+1 415.393.8298, [email protected])
Melanie Neary (+1 415.393.8243, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

In 2023, the U.S. Department of Justice heavily favored plea agreements over non-prosecution agreements and deferred prosecution agreements to resolve corporate criminal cases.

In 2023, the U.S. Department of Justice (“DOJ”) continued its recent trend of resolving fewer cases using corporate non-prosecution agreements (“NPAs”) and deferred prosecution agreements (“DPAs”).[1]  DOJ overwhelmingly favored corporate guilty pleas last year, with a total of 48 plea agreements compared to 19 NPAs and DPAs publicized by year-end.

In this client alert, we: (1) report key statistics regarding corporate resolutions, including an analysis of NPAs, DPAs, and Corporate Enforcement Policy (“CEP”) disgorgement from 2000 through the present and of corporate guilty pleas between 2022 and 2023; (2) assess recent developments in DOJ and SEC enforcement policy and priorities; (3) survey recent developments in DPA regimes abroad; and (4) summarize the agreements from July 31, 2023[2] through December 31, 2023.

Chart 1 below reflects the NPAs and DPAs that Gibson Dunn has identified through public-source research from 2000 through the end of 2023. Of the 19 total agreements in 2023, there were 12 DPAs and seven NPAs.  The SEC, consistent with its trend since 2016, did not enter into any NPAs or DPAs in 2023.

Chart 2 reflects total monetary recoveries related to publicly available NPAs and DPAs from 2000 through the end of 2023.  At approximately $1.5 billion, 2023 recoveries associated with DPAs and NPAs are higher than those in 2022; however, with the exception of 2022, they remain strikingly low compared to recoveries in the years following the 2008 economic recession, with the next-lowest recovery occurring in 2017, at approximately $2.7 billion.  At $4.7 billion, recoveries associated with plea agreements in 2023 far outstripped those associated with NPAs and DPAs.

Chart 3 reflects the relative mix of NPAs, DPAs, and declinations-with-disgorgement since DOJ first began issuing the latter agreements under the then-FCPA Pilot Program in 2016.  In 2023, DOJ has issued three public declinations-with-disgorgement pursuant to its Corporate Enforcement Policy, the highest number since 2018, when it issued four such resolution letters.

Charts 4 and 5 below focus on 2022 and 2023, and show the numbers of DPAs, NPAs, plea agreements, and declinations‑with‑disgorgement in those years, as well as recoveries associated with each category of agreement.[3]  These charts illustrate well a recent statement by Acting Assistant Attorney General Nicole Argentieri in November 29, 2023, that DOJ has “been using all options when it comes to the appropriate form of our resolutions, including CEP declinations, non-prosecution agreements, deferred prosecution agreements, and guilty pleas.”[4]

It is too early to tell whether an increased use of guilty pleas may be contributing to the relative decline in NPAs and DPAs.  We do note, however, that 2022 and 2023 included several high-dollar-value, parent company-level guilty pleas, suggesting that DOJ could be increasingly pursuing guilty pleas in more complex cases.  Indeed, in 2022 and 2023, all of the resolutions with recoveries over $1 billion were guilty pleas; there has not been a DPA involving recoveries of $1 billion or more since 2021.  Enforcement activity is variable, however, with the natural lifecycles of investigations sometimes yielding what appear to the public to be burst of activity followed by periods of relative quiet.  Thus, while we can note, for example, that DOJ Antitrust concluded eight public NPAs and DPAs in 2020-21 compared to three in 2022-23, and that the U.S. Attorney’s Office for the Central District of California entered into five public NPAs and DPAs in 2020-21 and none in 2022-23, it is difficult to say whether these statistics signal any kind of shift in focus or standards or if they simply illustrate the natural ebb and flow of enforcement actions.

The form, structure, and elements of corporate resolutions continues to evolve.  More than 20 years ago, Gibson Dunn led the dramatic shift to NPAs and DPAs from corporate pleas.  The explosion of policy initiatives by DOJ will shape the landscape in the coming years.  What is particularly noteworthy is the range of U.S. Attorneys’ offices prosecuting corporate cases from Mississippi to North Dakota to Oregon.  Historically, corporate prosecutions were concentrated in the biggest DOJ offices or Main Justice units, but it is now routine that any one of the 93 U.S. Attorneys’ offices feel empowered to prosecute corporations.

Continued Developments in DOJ Corporate Enforcement Policy

Corporate Enforcement Landscape in 2023

In the final months of 2023, DOJ continued to emphasize that corporate enforcement is in an “era of expansion and innovation” when discussing its corporate enforcement policies, priorities, and actions over the past year.[5]

DOJ continued to make clear that the intersection of national security and corporate crime is one area of significant expansion.  In September 21, 2023 remarks, Principal Associate Deputy Attorney General (“PADAG”) Marshall Miller reiterated DOJ’s increased corporate enforcement efforts in the national security realm and cautioned that, for companies who operate in parts of the world controlled by autocracies, “the message is simple: national security laws must rise to the top of your compliance risk chart.”[6]  In an address on October 4, 2023, Deputy Attorney General (“DAG”) Monaco similarly described the “rapid expansion of national security-related corporate crime” as the “biggest shift in corporate criminal enforcement” that she has seen in her time in government.[7]  PADAG Miller further reinforced this viewpoint in an address on November 28, 2023, stating that DOJ was “seeing national security dimensions in more familiar areas of corporate crime” and noting that “intellectual property theft and international corruption, for example, interrupt supply chains, divert disruptive technologies to dark places, and fuel the misdeeds of rogue nation-states.”[8]  PADAG Miller used the occasion to highlight that DOJ was “surging resources to address the challenge – adding more than 25 new corporate crime prosecutors to our National Security Division and increasing by 40% the number of prosecutors in the Criminal Division’s Bank Integrity Unit.”[9]

DOJ also emphasized that it has developed new tools and remedies to punish and deter wrongdoing.  As DAG Monaco noted in October 4, 2023 remarks, DOJ has recently announced resolutions that “include divestiture of lines of business, specific performance as part of restitution and remediation, and tailored compensation and compliance requirements.”[10]  For example, DAG Monaco pointed to the DPAs with pharmaceutical companies Teva and Glenmark as the first time that DOJ required divestiture as part of a corporate criminal resolution, as both companies were required to divest business lines that allegedly were central to the companies’ price-fixing conspiracy.[11]  DAG Monaco cited the Suez Rajan resolution as another example in which the Department employed specific performance as a remedy—the company was required to transport nearly one million barrels of contraband Iranian crude oil to the United States, where it now is subject to civil forfeiture proceedings.[12]  On November 29, 2023, Acting AAG Argentieri highlighted DOJ’s use of data analytics to identify potential corporate misconduct.[13]  Acting AAG Argentieri also made clear that while DOJ has “been using all options when it comes to the appropriate form of our resolutions,” it will “not hesitate to require a guilty plea where the circumstances warrant it, particularly where the nature and circumstances of the offense are especially egregious.”[14]

Both DAG Monaco and Acting AAG Argentieri have also touted early successes of the Department’s pilot program on Compensative Incentives and Clawbacks, which was announced in March 2023 and detailed in a prior Gibson Dunn client alert.[15]  DAG Monaco described the pilot program as “already bearing fruit,” pointing to the recent resolutions with Albemarle and Corficolombiana which included incentive requirements pursuant to the pilot program’s requirement that companies include compliance-promoting criteria in their compensation systems.[16]  In the Albemarle resolution, the company received credit for proactively withholding future bonuses of employees who engaged in misconduct in the form of an offset against its criminal monetary penalty equal to the amount of the bonuses that were withheld.[17] Corficolombiana agreed to implement compliance criteria in its compensation and bonus system.[18]

In the final months of 2023, DOJ underscored also the Department’s continued “innovation” in the realm of voluntary self-disclosure, including a new uniform safe harbor policy for disclosures made following mergers and acquisitions, which we cover in more detail in the next section of this report.[19]  PADAG Miller made clear that DOJ has placed a “new and enhanced premium on voluntary self-disclosure” throughout 2023.[20]  Specifically, he highlighted the Department’s aim for consistency and transparency with its uniform roll-out of a single voluntary self-disclosure policy across U.S. Attorneys’ Offices, discussed in further detail in our 2023 Mid-Year Corporate Resolutions Update.[21]  In her address on November 29, 2023, Acting AAG Argentieri explained that these policies encouraging companies to voluntarily self-disclose misconduct serve another valuable purpose—namely, allowing DOJ “to build stronger cases against culpable individuals more quickly.”[22]  In support, she cited the fact that 14 individuals had been charged in connection with the Fraud Section’s 2023 corporate resolutions and declinations with disgorgement.[23]

Announcement of Consumer Protection Branch Voluntary Disclosure Policy

On March 3, 2023, DOJ publicly released a voluntary self-disclosure policy for the Consumer Protection Branch (“CPB”) of the Civil Division.  The policy, dated February 2023, is designed to encourage companies to voluntarily self-disclose to the CPB “potential violations of federal criminal law involving the manufacture, distribution, sale, or marketing of products regulated by, or conduct under the jurisdiction of, the Food and Drug Administration (FDA), the Consumer Product Safety Commission (CPSC), the Federal Trade Commission (FTC), or the National Highway Traffic Safety Administration (NHTSA),” and also to disclose “potential misconduct involving failures to report to, or misrepresentations to, those agencies.”[24]  The policy states that as long as there are no aggravating actors, CPB will not seek a corporate guilty plea for disclosed conduct if the company has: (1) voluntarily self-disclosed directly to CPB; (2) fully cooperated as described in JM § 9-28.700; and (3) timely and appropriately remediated the criminal conduct as described in U.S.S.G. § 8B2.1(b)(7), “including providing restitution to identifiable victims and improving its compliance program to mitigate the risk of engaging in future illegal activity.”[25]  In addition, the policy provides that “CPB will not require the imposition of an independent compliance monitor for a cooperating company that voluntarily self-discloses the relevant conduct if, at the time of resolution, the company also demonstrates that it has implemented and tested an effective compliance program as described in U.S.S.G. § 8B2.1.”[26]  This new policy likely will trigger more corporate self-disclosures and may be the fodder for more NPAs and DPAs.

Announcement of M&A Safe Harbor Policy

On October 4, 2023, in remarks at the Society of Corporate Compliance and Ethics’ Annual Compliance & Ethics Institute, DAG Monaco announced that, for the first time, DOJ has adopted a uniform safe harbor policy for voluntary disclosures that companies make in the context of mergers and acquisitions (“M&A”).[27]  This new M&A Safe Harbor Policy is the latest in a series of DOJ updates that are aimed at incentivizing voluntary self-disclosures.  DAG Monaco explained that DOJ seeks to incentivize acquiring companies to “timely disclose misconduct uncovered during the M&A process” by clarifying timelines and conduct necessary to achieve a presumption of declination for an acquired entity’s misconduct.[28]

The new Mergers & Acquisitions Safe Harbor Policy applies department-wide to conduct discovered and disclosed by an acquiring company during the M&A process—whether before or after closing.  Under the policy, acquiring companies will receive the presumption of a declination if they promptly and voluntarily disclose misconduct discovered in bona-fide, arms-lengths M&A transactions, provided that they cooperate with DOJ, timely and “fully remediate” the misconduct, and make appropriate restitution and disgorgement.[29]  DAG Monaco explained that, “[to] ensure predictability,” DOJ was setting “clear timelines” for the disclosure and remediation.  Specifically, under the policy, companies have a baseline of six months from the date of closing to disclose misconduct discovered at the acquired entity (regardless of whether the misconduct was discovered pre- or post-acquisition) and a baseline of one year from the date of closing to fully remediate the misconduct.[30]  However, these deadlines are subject to a reasonableness analysis dependent on the facts, circumstances, and complexity of a particular transaction.  For example, DAG Monaco explained that DOJ could extend these deadlines in certain circumstances and that “companies that detect misconduct threatening national security or involving ongoing or imminent harm can’t wait for a deadline to self-disclose.”[31]  Under the policy, aggravating factors at the acquired company also will not impact the acquiring company’s ability to receive a declination.[32]  Depending on the circumstances, the acquired entity may also qualify for voluntary self-disclosure benefits, including potentially a declination.[33]

Creation of the International Corporate Anti-Bribery Initiative

In a November 29, 2023 keynote address at the 40th International Conference on the Foreign Corrupt Practices Act (“FCPA”), Acting AAG Argentieri emphasized DOJ’s continued coordination with foreign authorities on investigations that involve misconduct in multiple countries.[34]  Acting AAG Argentieri announced the creation of the International Corporate Anti-Bribery initiative (“ICAB”)—a new initiative intended to build on and deepen DOJ’s partnerships with foreign enforcement authorities.  ICAB, which will be led by three prosecutors with corruption experience, seeks to strengthen DOJ’s ability to identify, investigate, and prosecute foreign bribery offenses in certain targeted regions.[35]

Continued Developments in SEC Corporate Enforcement Policy

Culture of Proactive Compliance

In addition to the developments in DOJ enforcement policy described above, the SEC also provided insight into its corporate enforcement policies, priorities, and actions over the past year.[36]

In an October 24, 2023 address at the New York City Bar Association’s Compliance institute, SEC Enforcement Director, Gurbir Grewal, provided guidance on how compliance professionals, who “serve as the first lines of defense against misconduct,” can work to create a “culture of proactive compliance.”[37]   Director Grewal explained that proactive compliance requires three components: (1) education, (2) engagement, and (3) execution.  He first explained that compliance professionals must educate themselves “about the law and [relevant] external developments,” such as new actions, examination priorities, or SEC rules, with a particular focus on “emerging and heightened risk areas.”[38]  Director Grewal stated that compliance professionals must “really engage” with their company’s business units and seek to understand “their activities, strategies, risks, financial incentives, counterparties, sources of revenue and profits.”[39]  Director Grewal then noted that proactive compliance also requires effective implementation of meaningful policies and procedures, through “leadership, training, constant oversight and the right tone at the top.”[40]  He stressed the importance of self-reporting, adding that, if compliance officials were to detect a securities violation, “the best thing to do would be to self-report and cooperate.”[41]

Director Grewal also addressed the issue of Chief Compliance Officer (“CCO”) liability, which he referred to as “the proverbial elephant that shows up in any room where a regulator like me is speaking to those working in compliance.”[42]  Director Grewal emphasized that the SEC does “not second-guess good faith judgments of compliance personnel made after reasonable inquiry and analysis.”[43]  He explained that the SEC generally brings enforcement actions against CCOs where: (1) they affirmatively participated in misconduct unrelated to their compliance role or responsibilities; (2) they misled regulators; or (3) there was a “wholesale failure” by the CCO in carrying out their compliance responsibilities.[44]  As an example of the first category, Director Grewal cited the case of Steven Teixeira, the Chief Compliance Officer of a U.S. unit of a Chinese international payment processing company, LianLian Global.[45]  The SEC charged Teixeira with insider trading based on allegations that he “traded based on material nonpublic information that he surreptitiously obtained from his girlfriend’s laptop about upcoming mergers and acquisitions in which her employer was involved” and then traded on that information.[46]  For the second category, Director Grewal pointed to the SEC’s case against Meredith Simmons.[47]  Ms. Simmons was charged with “aiding and abetting and causing a firm’s books and records violation when she provided backdated and factually inaccurate compliance review memos to the SEC, falsely claiming that she created the memos contemporaneously with the reviews”[48] while acting in her capacity of CCO for a New York-based hedge fund.[49]  Director Grewal described the “wholesale failure” cases as “rare,” noting that such cases generally involved “no education, no engagement and no execution.”[50]

International Developments

As noted in previous updates (see, e.g., our 2021 Year-End Update), several countries outside the United States have developed DPA-like regimes in the past several years.  In particular, such agreements have now been used by enforcement agencies in Brazil (see our 2019 Year-End Update for details), Canada (see our 2018 Mid-Year Update for details), France (see our 2019 Year-End and 2020 Mid-Year Updates for details), Singapore, and the United Kingdom (see our 2014 Year-End Update for details), with varying degrees of frequency.  Notably, Canada saw its second-ever DPA-like agreement (known as a remediation agreement) in 2023, and following a two-year hiatus on DPAs in the UK, 2023 saw its first-ever use by an enforcement entity other than the Serious Fraud Office.

United Kingdom

In a significant development, on December 5, 2023, the UK’s Crown Prosecution Service (“CPS”) entered into its first-ever DPA with a corporate entity.  Previously, DPAs had only been used by the UK’s Serious Fraud Office (“SFO”).  Entain plc, a London-headquartered global online sports betting and gaming business, entered into the DPA with the CPS to resolve allegations that Entain had failed to prevent bribery by its third-party suppliers and employees in Turkey, in violation of Section 7 of the UK Bribery Act (Failure to Prevent Bribery).[51]  The alleged offenses took place from July 2011 to December 2017 in Turkey, leading to an investigation by HM Revenue and Customs.[52]  Entain has since exited its business from Turkey and significantly strengthened its global compliance controls.  According to the CPS, the full statement of facts will be published after any criminal proceedings against individuals are completed.

As part of the agreement, Entain agreed to pay a total of £615 million ($782.9 million as of the time of this writing).[53]  This figure includes a financial penalty and disgorgement of profits of £585 million, payment of CPS’s costs of £10 million, and a charitable payment of £20 million.[54]  In the court’s approval of the agreement, Entain was credited for its “extensive cooperation” with the investigation.[55]  And in determining that a DPA was an appropriate resolution, the court considered the disproportionate consequences (e.g., Entain potentially losing its licenses in other jurisdictions) that the company might have suffered if the company had been criminally prosecuted instead.[56]

Although it is the first time that the CPS has utilized this resolution mechanism, the Entain DPA is the second-largest corporate criminal settlement in UK history, surpassed in value only by the SFO’s DPA with Airbus in 2020, which we discussed in our 2020 Mid-Year Update.  It remains to be seen whether CPS will expand its use of DPAs in corporate criminal proceedings, but companies facing criminal charges in the UK will undoubtedly look to the Entain DPA as a test case going forward.

France

After a quiet first few months of the year, France’s prosecuting agencies entered into multiple DPA-like agreements (known as convention judiciaire d’intérêt public, or “CJIPs”) since May 2023.

On May 15, 2023, Guy Dauphin Environnement (“GDE”), a recycling and waste management company, entered into a CJIP with the French National Prosecutor’s Office (“PNF”) to resolve allegations of public corruption related to the construction of a landfill.[57]  The PNF alleged that GDE attempted to influence a local government council’s decision regarding the landfill by inviting the president of the council and his chief of staff to lunches and dinners, and by considering the appointment of the president of the council to GDE’s supervisory board, among other favors.[58]  Under the CJIP, GDE agreed to pay a fine of €1.23 million (approximately USD $1.35 million) and spend three years implementing a compliance program supervised by the French Anti-Corruption Agency.[59]

Additionally, on May 15, 2023, Bouygues Bâtiment Sud Est, an engineering, construction, and real estate development firm, and its subsidiary Linkcity Sud Est, a real estate developer, entered into a CJIP with the PNF to resolve allegations that the companies benefited from irregularities in the awarding of several public procurement contracts.  Specifically, the companies allegedly provided employees of the Hospital of Annecy Genevoi, a state-owned entity, with restaurant invitations and concert tickets in connection with the award of several construction projects, and several procurement selection criteria were allegedly disregarded throughout the contract process as a result of these favors.[60]  As part of the CJIP, Bouygues Bâtiment Sud Est and Linkcity Sud Est agreed to pay a fine of €7.96 million (approximately USD $8.7 million) and submit to the supervision of the French Anti-Corruption Agency for a three-year period for purposes of developing the companies’ compliance program.[61]

On June 27, 2023, Technip UK Limited, a subsidiary of TechnipFMC plc, and Technip Energies France SAS, a subsidiary of Technip Energies NV—all global providers of oil and gas services, entered into a CJIP with the PNF to resolve allegations of bribery and corruption of foreign public officials between 2008 and 2012 related to Technip’s subsea projects in Africa.[62]  Under the CJIP, Technip UK and Technip Energies France agreed to pay fines of €154.8 million and €54.1 million, respectively, for a total of €208.9 million (approximately $227.5 million as of this writing).[63]

On October 11, 2023, Acieries Hachette et Driout, a steel mill in Saint-Dizier, France, signed a CJIP with the financial prosecutor of the Tribunal judiciaire de Belfort.[64]  According to the financial prosecutor, an investigation revealed that Acieries Hachette et Driout produced checks to another company as a bribe to ensure that this company would sell Hachette’s steel products to Cryostar, an industrial equipment supplier in the medical and industrial gas, natural gas, hydrogen, and clean energy fields.  Acieries Hachette et Driout was instructed to pay €1.2 million in fines to settle the allegations.

On November 28, 2023, the Seves Group SARL and Sediver SAS signed a CJIP with the Financial Public Prosecutor at the Paris judicial court.[65]  According to the allegations, the two companies fraudulently obtained public contracts in the Democratic Republic of Congo as part of several projects to modernize electrical infrastructure.  These companies obtained these contracts by paying Fichtner, a company appointed by the World Bank to manage the infrastructure rehabilitation program.  The scheme was then reproduced in Algeria, Nigeria, and Libya.  The World Bank had been investigating this program since January 2015.  Sediver self-reported the scheme to the Financial Public Prosecutor in Nanterre in April 2017.  The CJIP imposes a fine of more than €13 million and requires the implementation of a compliance program under the supervision of the French Anti-Corruption Agency for a term of three years.

On November 29 2023, the Marseille prosecutor’s office validated three CJIPs entered into with companies of the Omnium development group.[66]  An investigation had been opened into SEMIVIM (a “bailleur social,” which is a local company that develops then rents housing at moderate rates, and often is treated like a governmental service) in the city of Martigues, under suspicion of bribery in the allocation of construction projects during a public bidding process.  The Société d’isolation et de peinture Omnium, Sud est étanchéité, and Entreprise Ventre, three companies of the Omnium group, were accused of bribing an employee of SEMIVIM to secure these projects.  One of the Omnium executives admitted that the company was awarded a construction project called “Paradis Saint Roch” as a result of his participation in this scheme.  The companies were indicted in May 2022 on counts of corruption of a person charged with a public service mission, influence-peddling on a person charged with a public service mission, concealment of favoritism, and concealment of illegal taking of interests.  The companies of the Omnium group must pay a public interest fine of €1,700,000.  A three-year compliance program must also be established under the control of the French Anti-Corruption Agency.  And the CJIP requires payments of €125,000 to SEMIVIM and €125,000 to the municipality of Martigues in compensation for their damages.  The investigation into other actors in the bribery scheme is ongoing.

Finally, on December 4, 2023, the French National Financial Prosecutor’s Office validated a CJIP with ADP Ingénierie, a company of Groupe ADP.[67]  ADP operates three Paris airports and 26 international airports, and ADP Ingénierie provides engineering for airport development projects.  The agreement terminates the investigations relating to bribery in contracts concluded by ADP Ingénierie in Libya in 2007 and 2008, and in the Emirate of Fujairah in 2011.  To settle the allegations, the company agreed to pay a fine of €14.6 million under the terms of the CJIP.  The also CJIP provides that ADP International and its subsidiaries are subject to a compliance program of two years managed by an independent Integrity Compliance Officer (not by the French Anti-Corruption Agency), and ADP SA agreed to implement improvements to its group-wide compliance program.

Canada

On May 17, 2023, the Public Prosecution Service of Canada (PPSC) announced that Ultra Electronics Forensic Technology Inc. (UEFTI), a 3D imaging and automated ballistic identification company, had entered into a remediation agreement with the PPSC earlier in the year, to resolve allegations of public corruption related to the bribing of government officials in the Philippines.  UEFTI allegedly attempted to bribe the two officials to win a contract with the Philippine National Police for a ballistic identification system.[68]

As part of the four-year remediation agreement, UEFTI agreed to pay a penalty of C$6,593,178 (approximately USD $4.9 million); a surcharge of C$659,318 (approximately USD $492,000); and forfeiture of C$3,296,589 (approximately USD $2.5 million).  UEFTI must also cooperate in any future investigations related to the conduct and submit to the supervision of an external auditor for a four-year term, paid for by UEFTI.[69]

2023 Agreements Since Mid-Year Update

The remainder of this alert summarizes corporate resolutions from July 31, 2023 to December 31, 2023.  The appendix at the end of the alert provides key facts and figures regarding these resolutions, along with links to the resolution documents themselves (where available).

Albemarle Corporation (NPA)

On September 28, 2023, Albemarle Corporation (“Albermarle”), a specialty chemicals manufacturing company, entered into a three-year NPA with the U.S. Department of Justice’s Criminal Division, FCPA Section, and the U.S. Attorney’s office for the Western District of North Carolina.[70]  The agreement resolved allegations of a bribery conspiracy involving public officials in Vietnam, Indonesia, and India from 2009 through 2017.[71]  The government alleged that the company conspired to pay bribes to government officials through its third-party sales agents and subsidiary employees, in exchange for obtaining and retaining chemical catalyst business with state-owned refineries worth approximately $98.5 million.[72]  According to the agreement, Albermarle self-reported the conduct 16 months after learning of the misconduct but the government did not view the disclosure as “reasonably prompt” under the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy and the U.S. Sentencing Guidelines.[73]

In connection with the agreement, Albemarle agreed to pay a total of $218.4 million, including $98.2 million in penalties.[74]  Albemarle also agreed to pay another $98.5 million in forfeiture of the proceeds of the alleged violation, of which DOJ credited $81.9 million on account of the company’s agreement to pay $103.6 million in disgorgement and prejudgment interest to resolve a parallel investigation by the SEC.[75]  The agreement imposes additional corporate obligations on the Company, including a requirement to self-report evidence or allegations of conduct that may constitute a violation of the FCPA anti-bribery or accounting provisions, and to modify its compliance program to ensure it maintains an effective system of internal accounting controls and a rigorous anti-corruption compliance program, but does not impose an independent monitor.

Amani Investments, LLC (Guilty Plea)

On January 19, 2023 Amani Investments, LLC, (“Amani”), a registered Money Service Business and operator of kiosks that exchanged U.S. currency for Bitcoin, entered into a plea agreement with the U.S. Attorney’s Office for the Eastern District of California to resolve allegations that Amani violated the federal Bank Secrecy Act, which requires money services businesses to report each transaction involving more than $10,000 in currency via a Currency Transaction Report (“CTR”).[76]  According to the agreement, on multiple occasions Amani exchanged over $10,000 in U.S. currency for Bitcoin without filing a CTR, resulting in more than $1,000,000 in unreported transactions.[77]

Pursuant to the agreement, Amani agreed to forfeit a 2019 Mercedes-Benz, several gold coins, approximately 0.041836 Bitcoin, a Bitcoin Casascius coin (a physical coin that contains a Bitcoin redemption code), and $1,000,000 in U.S. currency.[78]  The parties also agreed that the government would recommend to the court a two- to three-level reduction in the computation of the applicable offense level for sentencing purposes if Amani clearly demonstrates acceptance of responsibility for its conduct including by meeting with and assisting the probation officer in the preparation of the pre-sentence report, being truthful and candid with the probation officer, and not otherwise engaging in conduct that constitutes obstruction of justice.[79]  Amani expressly reserved the right to argue that it is unable to pay a fine, and that no fine be imposed.[80]

In sentencing Amani, the court accepted the agreed-upon forfeiture order proposed by the parties.[81]  The court also sentenced Amani to 36 months of probation.[82]  Neither the plea agreement nor judgment contained any heightened compliance or reporting requirements.

Aylo Holdings S.à.r.l. (DPA)

On December 21, 2023, Aylo Holdings S.à.r.l. (formerly known as “MindGeek S.à.r.l.”) and its subsidiaries (collectively referred to as “MindGeek”) entered into a DPA with the United States Attorney’s Office for the Eastern District of New York to resolve allegations that MindGeek, which operated and maintained websites through which third parties could post and distribute pornographic videos, engaged in “unlawful monetary transactions” from 2017 to 2020.[83]  Such transactions included receiving payments for hosting videos from certain content providers despite having indications that those providers engaged in sex trafficking and misled numerous actresses to participate in pornographic films by luring the actresses with advertisements for “modeling” jobs and only later revealing the true nature of the work.[84]  According to DOJ’s allegations, those content providers proceeded to misrepresent to their victims that the films would not be posted online and, in some cases, would pressure women into participating with threats of legal action, “outing,” or canceling their flights home if they failed to perform.[85]

The DPA requires MindGeek, which did not self-disclose its conduct to DOJ, to pay a total monetary penalty of $1,844,953—including a $974,692 criminal fine and $870,261 in forfeiture—and to pay compensation to the individuals who were defrauded, or otherwise a victim of sex trafficking by the content providers at issue, and had their images posted on websites owned, operated, or controlled by MindGeek.[86]  MindGeek also agreed to undergo a three-year monitorship by an independent compliance monitor with expertise in screening and monitoring illegal content for online platforms.[87]

Banque Pictet et Cie SA (DPA)

On December 4, 2023, the U.S. Department of Justice announced that Banque Pictet et Cie SA (“Banque Pictet”), a bank based in Switzerland, entered into a three-year DPA with the U.S. Attorney’s Office for the Southern District of New York, resolving allegations that the bank conspired with U.S. taxpayers to hide $5.6 billion in assets from the IRS in undeclared bank accounts.[88]  This alleged conspiracy involved the bank helping U.S. taxpayers hide assets, sometimes through intermediaries, and then to repatriate assets to the United States to avoid discovery by U.S. authorities.[89]  The alleged undeclared assets of U.S. taxpayers totaled approximately $5.6 billion across 1,637 bank accounts, and taxpayers allegedly evaded approximately $50.6 million in U.S. taxes through the conspiracy.[90]  The bank also allegedly circumvented a Qualified Intermediary Agreement that the bank had signed with the IRS in April 2002 to ensure that U.S. securities held by the bank were subject to appropriate tax withholding.

Banque Pictet agreed to pay a total of approximately $122.9 million to the U.S. Treasury, which included approximately $31.8 million in restitution, $52.2 million in forfeiture, and a $39 million penalty.[91]  Additionally, the bank agreed to provide annual reports attesting to its continuing compliance with the terms of the DPA and providing specific updates regarding its performance of the DPA’s terms.  Among other terms, the DPA requires: continued cooperation with DOJ and the Internal Revenue Service, including compliance with requirements of the Program for Non-Prosecution Agreements or Non-Target Letters for Swiss Banks (the “Swiss Bank Program”),[92] a self-disclosure program announced by the Tax Division of DOJ in 2013, and under which a total of 84 banks self-disclosed misconduct in exchange for NPAs.  The DPA also includes a requirement to close relevant accounts, a prohibition on opening additional violative accounts, and self-reporting of violations of other U.S. criminal laws during the DPA’s term.[93]

Binance (Guilty Plea)

Binance is the world’s largest crypto currency exchange by trading volume and it is an overseas, non U.S. company.  On November 21, 2023, Binance reached a settlement to resolve a multi-year investigation with DOJ, the Commodity Futures Trading Commission (“CFTC”), the U.S. Department of Treasury’s Office of Foreign Asset Control (“OFAC”), and the Financial Crimes Enforcement Network (“FinCEN”).[94]  Gibson Dunn represented Binance in this resolution.

Although Binance is a non-U.S. company, the enforcers alleged that it historically had U.S. users on its platform.  As a result, the enforcers alleged that Binance needed to register as a foreign-located money services business and maintain an adequate anti-money laundering (“AML”) program under U.S. law because it did business “wholly or in substantial part” within the United States.[95]

Prior to the Binance resolution, resolutions with cryptocurrency exchanges generally involved U.S. exchanges, which are prohibited from providing financial services to persons in jurisdictions subject to sanctions regulated by OFAC.[96]  As a non-U.S. person, Binance could do business in sanctioned jurisdictions.[97]  However, because Binance’s platform historically had both U.S. users and users from sanctioned jurisdictions, enforcers alleged that Binance used a “matching engine [. . .] that matched customer bids and offers to execute cryptocurrency trades.”[98]  The failure to have sufficient controls on the matching engine meant that it would “necessarily cause” transactions between U.S. users and users subject to U.S. sanctions.[99]  Enforcers took the position that these transactions violated U.S. civil and criminal sanctions law because the International Emergency Economic Powers Act (“IEEPA”) prohibits, among other things, “causing” a violation of sanctions by another party.[100]  In other words, by pairing trades between a historical U.S. user and person from a sanctioned jurisdiction, Binance was causing the U.S. person to violate their sanctions obligations.  This resolution illustrates the breadth of U.S. jurisdiction to police sanctions offenses, even against non-U.S. companies.

Criminally, Binance pled guilty to (1) conspiracy to conduct an unlicensed money transmitting business, in violation of 18 U.S.C. § 1960 and 31 U.S.C. § 5330 for failure to register,[101] (2) failure to maintain an effective anti-money laundering program, in violation of 31 U.S.C. §§ 5318(h), 5322,[102] and (3) violating the International Emergency Economic Powers Act, 50 U.S.C. § 1701 et seq.[103]  Binance also entered into parallel civil settlements with FinCEN (failure to register, AML program) and OFAC (sanctions).[104]  Further, Binance also entered into a settlement with the CFTC for violating various sections of the Commodities Exchange Act.[105]

As part of the resolution, which binds the entire DOJ Criminal and National Securities Divisions, Binance agreed to pay $4.3 billion to the U.S. government over an approximately 18-month period.[106]  Binance also agreed to continue with certain compliance enhancements and agreed to a three-year DOJ monitorship.[107]

Centera Bioscience (Guilty Plea)

On October 30, 2023, Centera Bioscience (d/b/a Nootropics Depot), an Arizona-based marketer and distributor of pharmaceutical drugs, entered into a plea agreement with the U.S. Attorney’s Office for the District of New Hampshire, to resolve allegations that Centera Bioscience distributed misbranded drugs into interstate commerce that had not been approved by the Food and Drug Administration (FDA).[108]  According to the plea agreement, Centera Bioscience “sold multiple drugs, including tianeptine, phenibut, adrafinil, and racetam drugs” on Nootropicsdepot.com and other online platforms between April 2018 and December 2021 in violation of 21 U.S.C. § 331(a), which prohibits introducing adulterated or misbranded drugs into interstate commerce.[109]  These misbranded drugs were distributed throughout the United States, including in New Hampshire where the charges were brought, even though the FDA has not approved any of these drugs for use in the United States.  The Company’s CEO, Paul Eftang, also pleaded guilty to the same offense.

As part of the plea agreement, Centera Bioscience agreed to forfeit $2.4 million and forfeit all drugs that had been seized in connection with this matter by the FDA and Customs and Border Protection.[110]  The company also agreed to a term of three years of probation.  Sentencing has been scheduled for February 5, 2024.

Corporación Financiera Colombiana SA (DPA)

On August 10, 2023, Corporación Financiera Colombiana SA (“Corficolombiana”) entered into a three-year DPA with the U.S. Department of Justice’s Criminal Division’s Fraud Section and the U.S. Attorney’s Office for the District of Maryland to resolve allegations that the Company had conspired to offer and pay more than $23 million in bribes to high-ranking Colombian government officials to win a contract to construct and operate a highway toll road known as the Ocaña-Gamarra Extension, in violation of the FCPA.[111]

Pursuant to the DPA, Corficolombiana agreed to pay a criminal penalty of $40.6 million.[112]  However, the DPA also includes a provision allowing the Company to credit up to half of that criminal penalty against the amount assessed against the company and its subsidiary, Estudios y Proyectos del Sol S.A.S. (“Episol”), by Colombia’s Superintendencia de Industria y Comercio (“SIC”), for violations of Colombian laws related to the same conduct, so long as the company and Episol drop their appeals of the SIC resolution.[113]  In addition, Corficolombiana will pay over $40 million in disgorgement and prejudgment interest as part of a resolution of the SEC’s parallel investigation.[114]  The company has implemented, and agreed to continue to implement, compliance policies and procedures to prevent and detect violations of the FCPA and other applicable anti-corruption laws, including implementing compliance criteria in its compensation and bonus system.[115]  During the DPA’s term, Corficolombiana is also required to provide periodic reports regarding its compliance program and to self-report any evidence or allegations of further violations of FCPA anti-bribery or accounting provisions.[116]

Freepoint Commodities LLC (Guilty Plea)

On December 14, 2023, Freepoint Commodities LLC (“Freepoint”) entered into a three-year DPA with the DOJ’s Criminal Division Fraud Section and the U.S. Attorney’s Office for the District of Connecticut, to resolve allegations that Freepoint was involved in a corrupt scheme to pay bribes to Brazilian government officials in violation of anti-bribery provisions of the FCPA.[117]  DOJ separately charged three individuals in relation to the alleged bribery scheme, including a Freepoint senior oil trader and agent.[118]

According to the DPA, from approximately 2012 and continuing through 2018, Freepoint employees and agents agreed to pay approximately $3.9 million to Eduardo lnnecco, a Brazilian oil and gas broker working as an agent for various energy trading companies including Freepoint.[119]  Payments were allegedly made for the purpose of bribing Brazilian foreign officials to secure improper commercial advantages to obtain business from Petrobras, a Brazilian state-owned and state-controlled oil company.[120]  Freepoint allegedly earned over $30 million in connection with the conduct at issue.[121]

Freepoint received cooperation credit despite its “limited” and “reactive” cooperation in early phases of the investigation.[122]  Freepoint did not receive voluntary disclosure credit but received credit based on efforts to cooperate with the investigation, conducting internal analyses of the alleged conduct, and committing to enhance its compliance programs.[123]  In light of the cooperation efforts, Freepoint’s criminal penalty was set at $68 million which reflected a discount of 15% off the bottom of the U.S. Sentencing Guidelines fine range, and forfeiture of over $30 million.[124]  Freepoint has also agreed to disgorge more than $7.6 million to the Commodity Futures Trading Commission (“CFTC”) in a related matter which will be credited up to 25% of the forfeiture amount against disgorgement.[125]

Freepoint agreed to continue cooperating with DOJ in any ongoing or future criminal investigation relating to the conduct at issue, and to report evidence of any other conduct that would violate U.S. antibribery provisions.[126]  It also agreed to continue implementing an effective corporate compliance program and report progress annually to the Fraud Section and the U.S. Attorney’s Office for the District of Connecticut for the term of the agreement, with a possible extension of an additional year if the Fraud Section and Office determine that Freepoint knowingly violates any provision of the agreement or fails to fulfill all obligations.[127]

GDP Tuning LLC and Custom Auto of Rexburg LLC (Guilty Plea)

On August 23, 2023, GDP Tuning LLC and Custom Auto of Rexburg LLC (d/b/a Gorilla Performance), and the companies’ owner, Barry Pierce (collectively, “Gorilla Performance Parties”), entered into a plea agreement with the U.S. Attorney’s Office for the District of Idaho and the Department of Justice’s Environment and Natural Resources Division to resolve allegations that Gorilla Performance Parties had conspired to violate the Clean Air Act (“CAA”).[128]  The defendants admitted to purchasing and selling tuning devices and software that tampered with vehicles’ onboard diagnostic systems for emissions.  These devices allowed vehicle owners to remove vehicle emissions control equipment without the vehicles’ on-board diagnostic systems detecting the removal and activating “limp mode,” which substantially reduces vehicles’ speeds.  Such monitoring devices in vehicles are required under the CAA.[129]

Gorilla Performance Parties agreed to pay $1 million in criminal fines in total and to not manufacture, sell, or install devices that defeat vehicles’ emissions controls.[130]  The defendants also agreed not to commit future violations of the CAA or other federal, state, or local laws or environmental regulations.[131]  The maximum financial penalty is $500,000 or twice the gross gain, on the approximately $14 million in revenue the defendants received from the scheme.[132]  The plea agreements also include five years of probation.[133]  As of the date of this publication, the defendants had not been sentenced.

Glenmark Pharmaceuticals Inc., USA (DPA) and Teva Pharmaceuticals USA, Inc. (DPA)

On July 31, 2023, Glenmark Pharmaceuticals Inc., USA (“Glenmark”) entered into a three-year DPA with DOJ Antitrust Division resolving allegations of conspiracy to fix prices of pravastatin, a cholesterol drug, and other generic drugs sold in the United States in violation of the Sherman Act, 15 U.S.C. § 1.[134]  Glenmark was charged with conspiring with Teva Pharmaceuticals, whose DPA was announced the same day and is discussed below, among other companies.

Glenmark agreed to a $30 million criminal penalty.  The agreement notes that DOJ and Glenmark agreed to a penalty below the relevant Guidelines fine range due to Glenmark’s inability to pay a higher monetary penalty without substantially jeopardizing its continued viability.[135]  In addition to the penalty, the agreement requires that Glenmark divest its pravastatin drug line—the Glenmark and Teva DPAs are the first to use the remedy of divestiture.[136]  The company has implemented, and agreed to continue to implement, compliance policies and procedures to prevent and detect antitrust violations.[137]  During the DPA’s term, Glenmark is required to provide periodic reports regarding its compliance program.[138]

Approximately one month later, on August 21, 2023, Teva Pharmaceuticals USA, Inc. (“Teva”) entered into a three-year DPA with DOJ Antitrust Division also resolving allegations of conspiracy to fix prices of pravastatin and other generic drugs sold in the United States in violation of the Sherman Act, 15 U.S.C. § 1.[139]

Teva agreed to a $225 million criminal penalty and to donate $50 million worth of certain medications to humanitarian organizations.[140]  According to DOJ’s press release, this is the largest penalty to date for a domestic antitrust cartel.[141]  In addition to the penalty, like the Glenmark DPA, the agreement requires Teva to divest its pravastatin drug line.[142]  Unlike the Glenmark DPA, the agreement requires Teva to retain a monitor to facilitate, oversee, and report on the divestiture.[143]  Teva’s DPA is particularly notable for its express discussions of both (1) the fact that a guilty plea would result in mandatory exclusion from federal programs and the collateral impact that a guilty plea would have on customers and employees; and (2) the fact that the DPA represents the parent company’s second such agreement, Teva having entered into a DPA in 2016 to resolve FCPA charges.[144]  The DPA states that although DOJ “generally disfavors multiple deferred prosecution agreements, the resolution here is appropriate given that the matters at issue in the 2016 resolution did not involve recent or similar types of misconduct; the same personnel, officers, or executives; or the same entities; and in light of the extraordinary remedial measures required.”[145]  This reflects the more nuanced approach to “recidivism” articulated in the 2023 revisions to DOJ’s Corporate Enforcement Policy, discussed in our 2023 Mid-Year Update.

H&D Sonography LLC (DPA)

On August 15, 2023, H&D Sonography LLC (“H&D”), a New Jersey-based diagnostic testing company, entered into a three-year DPA with the U.S. Attorney’s Office for the District of New Jersey to resolve allegations that H&D conspired to violate the federal Anti-Kickback Statute by overpaying physicians for office space in return for increased diagnostic test referrals.[146]  According to the DPA, from January 2015 to December 2018, H&D subleased space in physicians’ offices for the purpose of conducting diagnostic tests.[147]  H&D allegedly paid the physicians for more hours than it used, at times paying more than the offices’ monthly rents.[148]  According to the government, in return for these payments the physicians referred patients to H&D, which then billed Medicare for the tests.[149]

The DPA does not impose any criminal penalties or restitution on H&D, nor does it impose a monitor.  Concurrently with the DPA, H&D and its owners agreed to a $95,000 civil settlement to resolve allegations that H&D’s Medicare billing violated the False Claims Act.[150]  The settlement states that $75,000 of the settlement amount is restitution.[151]

HealthSun Health Plans, Inc. (Declination with Disgorgement)

On October 25, 2023, DOJ’s Fraud Section issued a CEP declination to HealthSun Health Plans, Inc. (“HealthSun”).[152]  The HealthSun declination is one of three CEP declinations issued by DOJ in 2023.[153]  According to the declination letter, the government’s investigation found evidence that from approximately 2015 to 2020, HealthSun’s former Director of Medicare Risk Adjustment Analytics submitted, and caused HealthSun to submit to the U.S. Department of Health and Human Services’ Centers for Medicare & Medicaid Services (“CMS”), false and fraudulent information to increase reimbursements to HealthSun for certain Medicare Advantage enrollees.[154]  DOJ alleged that CMS made approximately $53 million in overpayments to HealthSun because of HealthSun’s conduct.  DOJ stated that it had declined to prosecute the case based on an assessment of the factors in the Corporate Enforcement and Voluntary Disclosure Policy, including HealthSun’s timely and voluntary self-disclosure of the misconduct, full and proactive cooperation, and timely and appropriate remediation.[155]  According to the declination letter, HealthSun’s cooperation included producing information about all individuals involved in the misconduct and information obtained from imaging several business and personal cell phones; and its remediation included reporting and correcting the false information submitted to CMS and implementing and testing a risk-based Medicare Advantage compliance program.

In connection with the declination, HealthSun agreed to disgorge the approximately $53 million that DOJ alleged CMS overpaid.[156]  In connection with the alleged scheme, the company’s former Director of Medicare Risk Adjustment Analytics has been charged with conspiracy to commit health care fraud, as well as wire fraud and major fraud against the United States.[157]

Lifecore Biomedical, Inc. (Declination with Disgorgement)

On November 16, 2023, DOJ’s Fraud Section and the United States Attorney’s Office for the Northern District of California informed Lifecore Biomedical, Inc. (“Lifecore”) that they were declining to prosecute the company for alleged bribes paid to Mexican government officials in violation of the FCPA.[158]  According to the declination letter, Lifecore’s former subsidiary Yucatan Foods L.P. (“Yucatan”) owned and operated Procesadora Tanok S. de R.L. de C.V. (“Tanok”).[159]  Yucatan and Tanok allegedly paid bribes to Mexican government officials before and after Lifecore acquired Tanok and Yukatan on December 1, 2018.[160]  Specifically, the government alleged that individuals from the companies used a third party to pay approximately $14,000 in bribes to a Mexican government official to secure a wastewater discharge permit.[161]  Tanok employees and agents also allegedly paid a third party approximately $310,000 to prepare fraudulent manifests while knowing that a portion of the funds were being used to bribe Mexican officials to sign the manifests.[162]

During Lifecore’s pre-acquisition diligence, a Yucatan officer involved in the misconduct took steps to conceal the misconduct from Lifecore and its auditor.[163]  Once Lifecore discovered the misconduct during its post-acquisition integration, it conducted an internal investigation and voluntarily disclosed the conduct to DOJ.[164]  Lifecore subsequently divested itself of the legacy Yucatan and Tanok business.[165]

The government stated in its declination letter that the financial benefit attributable to the alleged conduct was $1,286,060, and that Lifecore had incurred $879,555 in expenses by constructing a wastewater treatment plant and paying Mexican regulators the duties it owed.[166]  Lifecore has agreed to disgorge the remaining $406,505.[167]  Lifecore also agreed to continue to cooperate with the government’s ongoing investigation and to require any successor-in-interest to agree to the obligations in the letter, including continued cooperation with the government.[168]

New Orleans Steamboat Company (Guilty Plea)

On August 16, 2023, the New Orleans Steamboat Company (“NOSC”) entered into a plea agreement with the U.S. Attorney’s Office for the Eastern District of Louisiana, resolving allegations that it violated the Clean Water Act by discharging excess ballast material into the Inner Harbor Navigation Canal in New Orleans.[169]  The allegations arose out of a 2019 incident in which a former NOSC employee notified the Louisiana State Police Hazmat Hotline that he had captured a video of NOSC employees and supervisors dumping a black, unknown waste material from the M/V City of New Orleans into the Inner Harbor Navigation Canal.[170]  In exchange for NOSC’s guilty plea, the U.S. Attorney’s Office agreed it would not bring any other charges against NOSC or any related companion entity that operates out of the same office as NOSC arising from or related to the alleged conduct.[171]

Following the hearing, NOSC was sentenced to a $50,000 fine—the maximum penalty for the violation, one year probation, and a $400 special assessment fee.[172]

Nomura Securities International, Inc. (NPA)

On August 22, 2023, Nomura Securities International, Inc. (“NSI”), a U.S.-based broker-dealer subsidiary of Japanese financial services firm Nomura Holdings, entered into an NPA with the U.S. Attorney’s Office for the District of Connecticut.[173]  The NPA resolved allegations that, from approximately 2009 to 2013, NSI, through its employees, engaged in a scheme to defraud its customers by making fraudulent misrepresentations in the purchase and sale of residential mortgage-backed securities.[174]  NSI traders allegedly took “secret and unearned compensation from NSI customers” by misrepresenting certain pricing information in trades—for example, by lying to the buyer about the seller’s asking price.[175]  NSI also allegedly took steps to conceal the fraudulent conduct from its customers and from employees who did not participate in the scheme.[176]

Pursuant to the NPA, NSI agreed to pay a penalty of $35 million and $807,718 in restitution to impacted customers.[177]  The restitution amount credits NSI for remediation payments of $20,125,615 previously made to impacted customers in connection with NSI’s related settlement agreement with the SEC in 2019.[178]  The agreement does not contain a requirement for NSI to retain an independent compliance monitor, both because NSI represented that it had taken steps to improve its compliance program to “prevent and detect violations of the securities fraud statutes and other applicable anti-fraud laws,” and because “certain structural changes in the secondary market for [residential mortgage-backed securities]” made it less likely that the relevant conduct would occur again.[179]  However, the agreement does impose an ongoing obligation on NSI to self-report “any evidence or allegation of a criminal violation of U.S. federal law.”[180]

NuDay (Guilty Plea)

On September 8, 2023, NuDay entered into a plea agreement with the U.S. Attorney’s Office for the District of New Hampshire, to resolve three counts of failure to file export information, in violation of 13 U.S.C. § 305.[181]  According to the plea agreement, NuDay, a New Hampshire-based nonprofit, made over 100 shipments of humanitarian goods to Syria between May 2018 and December 2021 while Syria was subject to sanctions.[182]  NuDay allegedly claimed in shipping documents that these shipments were of nominal value to keep them below the $2,500 threshold, above which NuDay would have been required to file an Electronic Export Information through the Automated Export System maintained by the Census Bureau and U.S. Customs and Border Protection.[183]  In reality, the value of some of NuDay’s shipments exceeded the threshold, with one of NuDay’s shipments valued at more than $8.3 million.[184]  According to the agreement, NuDay used two companies to transport the goods: AJ Worldwide Services transported shipments from the United States to Turkey, and Safir Forwarding shipped them from Turkey to Syria.[185]  As the exporting company, NuDay bore responsibility for providing AJ Worldwide Services with truthful information about the value of the goods and their ultimate destination for reporting to the United States Department of Commerce.[186]  The plea agreement states that NuDay falsely informed AJ Worldwide Services that the final destination for the shipments was Turkey, rather than identifying the destination as Syria, which would have required an export license.[187]

In the plea agreement, NuDay and the government agreed on a recommended fine of $25,000 and five years of probation.[188]  They also stipulated that the founder of NuDay, Nadia Alawa, and her family will have no further involvement with the organization.[189]  On December 28, 2023, NuDay was sentenced to five years of probation, the maximum penalty for an organizational defendant.[190]  NuDay was also ordered to pay a $25,000 fine.[191]

Pro-Mark Services, Inc. (NPA)

On October 30, 2023, the U.S. Department of Justice announced that Pro-Mark Services, Inc. (“Pro-Mark”) entered into a three-year NPA with the Department of Justice, Antitrust Division, and the U.S. Attorney’s Office for the District of North Dakota, resolving allegations concerning the award of federal construction contracts amounting to $70 million.[192]  The agreement required the company to pay a criminal penalty of $949,000.[193]

Secor, Inc. & Matthew Castle (Guilty Plea)

On November 9, 2023, Secor, Inc. (“Secor”), a federal halfway house that contracted with the Federal Bureau of Prisons (“BOP”) to house inmates, entered into a plea agreement with the U.S. Attorney’s Office for the Western District of Virginia, to resolve allegations that Secor made materially false statements to the U.S. Bureau of Prisons (“BOP”) and committed wire fraud.[194]  Secor’s former president and director, Matthew Castle pleaded guilty to the same charges.[195]  According to the plea agreement, in 2018, Secor entered into a contract with the BOP that allowed some of the offenders under the care of Secor to be assigned to “home confinement,” meaning certain offenders would live at an approved residence not owned by Secor.[196]  BOP agreed to pay Secor a per diem rate for offenders who resided at Secor’s facilities and a different per diem rate for those on home-confinement.[197]  Under the terms of the contract, Secor was required to outfit home-confinement offenders with GPS monitoring equipment, and Secor personnel were required to personally visit each offender’s residence on at least a monthly basis to ensure the offender was living at their assigned residence and in accordance with applicable rules.  In reality, according to its plea agreement, Secor did not issue the GPS monitoring equipment to many of the home-confinement offenders for whom it was required and failed to conduct requisite home visits.[198]  Meanwhile, on multiple occasions, Castle completed BOP documentation certifying that he had conducted the required visits and noted no issues, according to his plea agreement.[199]  Castle and Secor filed monthly invoices with the BOP for reimbursement, which BOP paid on the basis of Secor’s and Castle’s representations and contractual obligations.[200]

In connection with their plea agreements, Secor and Castle agreed to jointly and collectively pay  $208,105 in restitution.[201]  Secor agreed to serve one- to five-years’ probation, to be determined at sentencing, to pay $25,000 in criminal fines, and to forfeit $40,000.[202]  Castle agreed to pay $5,000 in criminal fines and serve a term of imprisonment of 12-21 months, to be determined at sentencing.[203]  Sentencing is currently scheduled to take place in March 2024.[204]

Sinister Manufacturing Company, Inc. (Guilty Plea)

On August 1, 2023, diesel parts manufacturer Sinister Manufacturing Company, Inc. (“Sinister Diesel”) entered into a plea agreement with the U.S. Attorney’s Office for the Eastern District of California and the Environmental Crimes Section of the Environmental and Natural Resources Division to resolve allegations that Sinister Diesel had conspired to violate the Clean Air Act and defraud the United States and violated the Clean Air Act by tampering with the monitoring device of an emissions control system of a diesel truck.[205]  According to the plea agreement, Sinister Diesel manufactured and sold so-called “delete kits” that enabled diesel truck owners to disable and override emissions controls required by the U.S. Environmental Protection Agency (“EPA”).[206]  The agreement also describes conduct to evade regulatory action, including conducting phone-only sales, removing violative products from the company’s website, and partnering with at least one other company to bundle products that together would allow “deleted” trucks to run without emissions controls.[207]

The district court sentenced Sinister Diesel on November 14, 2023 and entered judgment on November 17, 2023, imposing a $500,000 criminal fine ($250,000 for each count).[208]  Separately, Sinister Diesel agreed to pay an additional $500,000 under a civil consent decree for a total fine of $1 million.[209]  The district court sentenced Sinister Diesel to a three-year probational term, subject to Sinister Diesel’s compliance with the consent decree and no further violations of federal and state environmental laws.[210]  Additionally, pursuant to the civil consent decree, Sinister Diesel agreed to—among other things—refrain from selling devices designed override a car’s emissions controls;[211] cease providing technical support and warranty coverage for such products;[212] implement a compliance program;[213] and make annual disclosures to the EPA and DOJ for four years regarding progress of its compliance measures.[214]  The consent decree also includes a detailed table of fines for future violations of its prohibitions, including a fine of at least $500,000 for transferring intellectual property in violation of its terms.[215]

Suez Rajan Limited (Guilty Plea) and Empire Navigation Inc. (DPA)

On March 16, 2023, Suez Rajan Limited (“Suez Rajan”), a Marshall Islands shipping company, entered into a plea agreement with the U.S. Attorney’s Office for the District of Columbia to resolve allegations that Suez Rajan conspired to violate the IEEPA, which empowers the U.S. president to impose economic sanctions on foreign countries, including Iran.[216]  According to the agreement, Suez Rajan violated U.S. sanctions on Iran by facilitating the illicit sale and transport of Iranian oil.  Specifically, Suez Rajan used a chartered vessel to transport Iranian-origin crude oil to China and sought to obfuscate the origin of the crude oil by engaging in ship-to-ship transfers and masking the locations and identities of the vessels involved.[217]  Suez Rajan pleaded guilty to one count of conspiracy to violate IEEPA.[218]

In the plea agreement, Suez Rajan and the government agreed to a sentence of three years of corporate probation and a fine of almost $2.5 million.[219]  In addition, pursuant to a separate three-year DPA, Empire Navigation Inc., the operating company of the chartered vessel carrying the contraband cargo, agreed to cooperate and transport the Iranian oil to the United States as well as pay a separate $2.5 million fine.  The cargo is now subject to a civil forfeiture action in the U.S. District Court for the District of Columbia.[220]  As noted above, DOJ has recently touted this resolution as a rare case in which specific performance was required by the resolution.[221]

The Suez Rajan case is the first-ever criminal resolution involving a company that violated sanctions by facilitating the illicit sale and transport of Iranian oil.[222]

Tysers Insurance Brokers Ltd. and H.W. Wood Ltd. (DPAs)

On November 20, 2023, two UK reinsurance brokers—Tysers Insurance Brokers Ltd. and H.W. Wood Ltd. (collectively, “brokers”)—each entered into a three-year DPA with the U.S. Department of Justice in the Southern District of Florida.[223]  The agreements settle charges of conspiracy to violate the anti-bribery provisions of the FCPA between 2013 and 2017.[224]  The government alleges the brokers engaged in a scheme to bribe government officials in Ecuador through intermediaries, in an amount totaling approximately $2.8 million, to obtain and retain business with state-owned insurance companies.[225]

In connection with its DPA, Tysers agreed to pay a $36 million criminal penalty and $10.5 million in forfeiture.[226]  H.W. Wood agreed that the appropriate fine under the U.S. Sentencing Guidelines would be $22.5 million in criminal penalties and $2.3 million in forfeiture.[227]  However, due to H.W. Wood’s inability to pay that amount, the company agreed with DOJ to a reduced criminal penalty of $508,000 and no forfeiture amount.[228]  In analyzing the company’s inability to pay, DOJ looked to the company’s financial condition and alternative sources of capital, among other factors included in DOJ’s Inability to Pay Guidance,[229] and concluded that paying a criminal penalty greater than $508,000 would “substantially threaten the continued viability” of H.W. Wood.[230]  The agreements impose corporate obligations on the brokers, including a requirement to self-report any evidence or allegation of conduct that may constitute a violation of the FCPA anti-bribery provisions, and to modify its compliance program to ensure it maintains an effective system of internal accounting controls and a rigorous anti-corruption compliance program, but do not impose an independent monitor.[231]  Both companies received cooperation and remediation credit of 25% off the bottom of the applicable U.S. Sentencing Guidelines fine range.[232]

View, Inc. (Guilty Plea)

On March 14, 2023, View, Inc., a California window manufacturing company with operations in Mississippi, entered into a plea agreement with the U.S. Attorney’s Office for the Northern District of Mississippi to resolve allegations that it negligently discharged wastewater into a Publicly Owned Treatment Works (POTW) without a permit, in violation of the Clean Water Act.[233]  View, Inc.’s alleged unpermitted wastewater discharges allegedly accounted for approximately 40% of the relevant POTW’s permitted capacity.[234]  The plea agreement does not contain an agreed‑upon penalty recommendation to the court nor does it contain recommendations for any other consequence.[235]  The agreement states that the government will not charge View, Inc., former officers, directors, or employees with other offenses relating to the same charge.

On August 18, 2023, View, Inc. was sentenced to pay a $3 million fine and a community service payment to DeSoto County Regional Utility Authority of $450,000, in addition to a three‑year period of probation.[236]  The judgment also notes that View, Inc. will enter into a separate, but related, civil Agreed Order with the Mississippi Commission on Environmental Quality, and under that agreement is expected to pay a civil penalty of $1.5 million.[237]

VIP Healthcare Solutions, Inc. (Guilty Plea)

On October 17, 2023, VIP Healthcare Solutions, Inc. (“VIP Healthcare”) entered into a plea agreement with the U.S. Attorney’s Office for the District of Puerto Rico and pleaded guilty along with the company’s secretary and president.  The agreement resolved allegations that VIP Healthcare, which managed a diagnostic and treatment center in the Municipality of Cataño, falsely certified the truth and accuracy of information in its 2020 Paycheck Protection Program (PPP) loan application.[238]  According to the agreement, among other things, the application falsely claimed that the company’s secretary owned 85% of the company and failed to list the company president as an owner.[239]  According to the plea agreement, the parties agreed to a recommended sentence of two years of probation and a fine, but it does not recommend a specific fine amount.[240]  On January 17, 2024, the court sentenced VIP Healthcare to two years’ probation but did not impose a fine.[241]

Western River Assets, LLC and River Marine Enterprises, LLC (Guilty Plea)

On October 17, 2023, Western River Assets, LLC and River Marine Enterprises, LLC entered into plea agreements with the U.S. Attorney’s Office for the Southern District of West Virginia, to resolve allegations that the two entities violated the Refuse Act of 1899, 33 U.S.C. §§ 407 and 411, which penalize discharge of refuse into navigable waters.[242]  According to the plea agreements, Western River Assets owned a towboat, the M/V Gate City, and moored it along the West Virginia Shore of the Big Sandy River between 2010 and January 2018.[243]  River Marine Enterprises operated the towboat during that time period.[244]  On December 5, 2017, the Coast Guard issued an Administrative Order after an inspection, requiring the sole owner of the two companies, David K. Smith, to remove all oil and hazardous substances from the M/V Gate City by January 31, 2018.[245]  On around January 10, 2018, before the contractors engaged by River Marine Enterprises were able to remove the oil and other substances, the M/V Gate City sank, discharging oil and other substances into the Big Sandy River.[246]  The government alleged that as a direct result of the sinking and the spill, the City of Kenova closed its municipal drinking water intake for three days, and multiple regulatory agencies expended money and other resources to respond to the spill.[247]

According to the agreements, Western River Assets and River Marine Enterprises could each face a maximum fine of $200,000, probation for up to five years, and an order of restitution.[248]  The agreements do not contain a recommended sentence.[249]  The sentencing has yet to occur, but a sentencing hearing is scheduled on February 26, 2024.[250]  Smith was charged with the same violation and also pleaded guilty on October 17, 2023.[251]  He could face imprisonment for no less than one month and no more than a year, a fine up to $100,000, and supervised release for one year.[252]

Zona Roofing LLC (Guilty Plea)

On November 20, 2023, Zona Roofing LLC (“Zona”) entered into a plea agreement, through its owner and principal Yilbert Segura (“Segura”), with the U.S. Attorney’s Office for the District of New Jersey.[253]  Zona was charged with two counts of Willful Violation of Occupational Safety and Health Administration (“OSHA”) standards by failing to provide fall protection and fall protection training to employees engaged in the replacement of a residential roof, resulting in the death of an employee.[254]

As part of the plea agreement, Zona, through Segura, was sentenced to five years’ probation, and ordered to pay $75,000 in restitution.[255]  Additionally, Zona was ordered to comply with special conditions outlined in the Agreement, which require Zona to provide fall training and procedures to all employees and follow enhanced safety provisions for future construction projects.[256]

Z&L Properties (Guilty Plea)

On August 17, 2023, Z&L Properties Inc., (“Z&L Properties”), a California-based subsidiary of a Chinese property development company, entered into a plea agreement with the U.S. Attorney’s Office for the Northern District of California to resolve allegations that Z&L Properties conspired to commit and did commit honest services wire fraud.[257]

Although the plea agreement itself is sealed, a four-page Criminal Information alleges that between November 2018 and January 2020, Z&L Properties executives approved or paid bribes to a former member of the San Francisco Department of Public Works and another individual, including in the form of food, drink, transportation, and lodging during a trip to China in 2018 and thereby conspired to defraud the public of its right to honest services.[258]  According to the Information, the purpose of these payments was to influence the official to act favorably with respect to Z&L Properties’ requests for city approvals needed to complete one of the company’s construction projects.[259]

On October 16, 2023, the court sentenced Z&L Properties to pay a $1 million fine, and to implement an anti-corruption compliance program as set out in the plea agreement.[260]

Appendix

The chart below summarizes the agreements concluded by DOJ from July 2023 through December 2023.  The complete text of each publicly available agreement in hyperlinked in the chart.

The figures for “Monetary Recoveries” may include amounts not strictly limited to an NPA, DPA, or guilty plea, such as fines, penalties, forfeitures, and restitution requirements imposed by other regulators and enforcement agencies, as well as amounts from related settlement agreements, all of which may be part of a global resolution in connection with the NPA or DPA, paid by the named entity and/or subsidiaries.  The term “Monitoring & Reporting” includes traditional compliance monitors, self-reporting arrangements, and other monitorship arrangements found in resolution agreements.

U.S. Deferred Prosecution Agreements, Non-Prosecution Agreements, and Plea Agreements August-December 2023
Company Agency Alleged Violation Type Monetary Recoveries Monitoring & Reporting Term of Agreement (Months)
Albemarle Corporation W.D. N.C. FCPA NPA $218,509,663 No monitor 36
Amani Investments, LLC E.D. Cal; U.S. Postal Inspection Service; FBI; IRS; DEA Bank Secrecy Act; Conspiracy to avoid filing currency transaction reports. Guilty Plea $1,000,000 (and other assets) N/A N/A
Aylo Holdings, S.a.r.l. E.D.N.Y. Unlawful Monetary Transactions (18 U.S.C. 1957) DPA $1,844,953 36 month compliance monitor 36
Banque Pictet et Cie SA S.D.N.Y. Tax Evasion DPA $122,900,000 No monitor 36
Binance Holdings Limited DOJ.; W.D. Wash; CFTC; FinCEN; OFAC AML Guilty Plea $4,316,126,163 3-year independent compliance consultant N/A
Centera Bioscience D. N.H. Distribution of misbranded drugs Guilty Plea  $2,400,000 3-years’ probation N/A
Corporación Financiera Colombiana SA DOJ Fraud.; D. Md. FCPA DPA $80,600,000 No monitor 36
Empire Navigation Inc. D.D.C.; DOJ NSD Trade Sanctions/IEEPA/Export Controls DPA $2,500,000 No 36
Freepoint Commodities LLC D. Conn; DOJ Fraud FCPA DPA $98,551,150 No monitor 36
GDP Tuning LLC; Custom Auto of Rexburg LLC D. Idaho; DOJ Environmental Crimes Section, EPA Criminal Enforcement Clean Air Act Guilty Plea $1,000,000 5 years’ probation N/A
Glenmark Pharmaceuticals Inc., USA DOJ, Antitrust Division Sherman Antitrust Act DPA $30,000,000 Self-reporting 36
H&D Sonography D.N.J. Anti-Kickback Statute DPA $95,000 No monitor 36
H.W. Wood Ltd S.D. Fl FCPA DPA  $508,000 No monitor 36
HealthSun Health Plans, Inc. DOJ Fraud False Claims; Wire Fraud Declination with Disgorgement  $53,170,115 No monitor N/A
Lifecore Biomedical, Inc. DOJ Fraud; N.D. Cal. FCPA Declination with Disgorgement  $406,505 No monitor N/A
New Orleans Steamboat Co. E.D. La.; EPA; DOT Clean Water Act Guilty Plea $50,400 N/A N/A
Nomura Securities International, Inc. D. Conn.; DOL Securities Fraud NPA $55,933,332 No monitor 12
NuDay D. N.H. Export Controls Guilty Plea $25,000 No monitor N/A
Oregon Tool, Inc. D. Or. AML NPA $1,724,803 No monitor N/A
Pro-Mark Services, Inc. DOJ, Antitrust Division; D. N.D. Conspiracy to defraud the United States NPA  $949,000 No monitor 36
River Marine Enterprises S.D. WV; EPA Discharge of refuse into navigable waters Guilty plea Pending N/A N/A
Secor, Inc. W.D.Va.; Russell County Sheriff’s Office, Bureau of Prisons Wire fraud; Making materially false statements Guilty Plea $278,105 1 – 5 years’ probation NA
Sinister Manufacturing Company, Inc. E.D. Cal; EPA; FBI; DOJ ENRD Division Clean Air Act Guilty Plea $1,000,000 N/A N/A, 36 month probation
Suez Rajan Limited D.D.C.; DOJ NSD Trade Sanctions/IEEPA/Export Controls Guilty plea $2,500,000 N/A 36
Teva Pharmaceutical Industries USA, Inc. DOJ, Antitrust Division Sherman Antitrust Act DPA $225,000,000 Yes, to oversee divestiture of pravastatin drug line 36
Tysers Insurance Brokers S.D. Fl FCPA DPA $46,589,275 No monitor 36
View, Inc. N.D. Miss; EPA Clean Water Act Guilty plea $4,950,000 N/A N/A
VIP Healthcare Solutions, Inc. D.P.R. Making a false statement in connection with a Paycheck Protection Program (PPP) loan application Guilty Plea $0 2-years’ probation NA
Western River Assets S.D. WV; EPA Refuse Act of 1899 – Discharge of refuse into navigable waters Guilty plea Pending N/A N/A
Zona Roofing LLC D.N.J.; OSHA Occupational Safety and Health Administration standards Guilty Plea  $75,000 N/A 5-years’ probation
Z&L Properties N.D. Cal. Honest services wire fraud Guilty Plea $1,000,000 No N/A

__________

[1] This update addresses developments and statistics through December 31, 2023.  NPAs and DPAs are two kinds of voluntary, pre-trial agreements between a corporation and the government, most commonly used by DOJ.  They are standard methods to resolve investigations into corporate criminal misconduct and are designed to avoid the severe consequences, both direct and collateral, that conviction would have on a company, its shareholders, and its employees.  Though NPAs and DPAs differ procedurally—a DPA, unlike an NPA, is formally filed with a court along with charging documents—both usually require an admission of wrongdoing, payment of fines and penalties, cooperation with the government during the pendency of the agreement, and remedial efforts, such as enhancing a compliance program or cooperating with a monitor who reports to the government.  Although NPAs and DPAs are used by multiple agencies, since Gibson Dunn began tracking corporate NPAs and DPAs in 2000, we have identified over 700 agreements initiated by DOJ, and 10 initiated by the U.S. Securities and Exchange Commission (“SEC”).

[2] For an analysis of corporate resolutions from the first half of 2023, please see Gibson Dunn’s Mid-Year Corporate Resolutions Update at https://www.gibsondunn.com/corporate-resolutions-update-2023/.

[3] Gibson Dunn began tracking corporate guilty pleas in 2022.

[4] U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Keynote Address at the 40th International Conference on the Foreign Corrupt Practices Act (Nov. 29, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-address-40th.

[5] U.S. Dep’t of Justice, Deputy Attorney General Lisa O. Monaco Announced New Safe Harbor Policy for Voluntary Self-Disclosures Made in Connection with Mergers and Acquisitions (Oct. 4, 2023), https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-o-monaco-announces-new-safe-harbor-policy-voluntary-self (hereinafter “Monaco Remarks”).

[6] U.S. Dep’t of Justice, Principal Associate Deputy Attorney General Marshall Miller Delivers Remarks at the Global Investigations Review Annual Meeting (Sept. 21, 2023), https://www.justice.gov/opa/speech/principal-associate-deputy-attorney-general-marshall-miller-delivers-remarks-global (hereinafter “Miller Remarks”).

[7] Monaco Remarks.

[8] U.S. Dep’t of Justice, Principal Associate Deputy Attorney General Marshall Miller Delivers Remarks at the New York City Bar Association’s International White Collar Crime Symposium (Nov. 28, 2023), https://www.justice.gov/opa/speech/principal-associate-deputy-attorney-general-marshall-miller-delivers-remarks-new-york.

[9] Id.

[10] Monaco Remarks.

[11] Id.

[12] Id.

[13] U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Keynote Address at the 40th International Conference on the Foreign Corrupt Practices Act (Nov. 29, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-address-40th.

[14] Id.

[15] Id.; see also U.S. Dep’t of Justice, Deputy Attorney General Lisa Monaco Delivers Remarks at American Bar Association National Institute on White Collar Crime (Mar. 2, 2023), https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-remarks-american-bar-association-national; U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Remarks at the American Bar Association 10th Annual London White Collar Crime Institute (Oct. 10, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-remarks-american-bar.

[16] Monaco Remarks.

[17] Id.; see also U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Remarks at the American Bar Association 10th Annual London White Collar Crime Institute (Oct. 10, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-remarks-american-bar.

[18] Deferred Prosecution Agreement, United States v. Corporacion Financiera Colombiana SA, No. 8:23-CR-00262 (D. Md. Aug. 10, 2023).

[19] E.g., Monaco Remarks.

[20] Miller Remarks.

[21] Miller Remarks.

[22] U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Keynote Address at the 40th International Conference on the Foreign Corrupt Practices Act (Nov. 29, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-address-40th.

[23] Id.

[24] U.S. Dep’t of Justice, Voluntary Self-Disclosure Policy for Business Organizations (Feb. 2023), https://www.justice.gov/file/1571106/download.

[25] Id.

[26] Id.

[27] Monaco Remarks.

[28] Id.

[29] Id.

[30] Id.

[31] Id.

[32] Id.

[33] Id.

[34] U.S. Dep’t of Justice, Acting Assistant Attorney General Nicole M. Argentieri Delivers Keynote Address at the 40th International Conference on the Foreign Corrupt Practices Act (Nov. 29, 2023), https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-address-40th.

[35] Id.

[36] SEC, Remarks at New York City Bar Association Compliance Institute (Oct. 24, 2023), https://www.sec.gov/news/speech/grewal-remarks-nyc-bar-association-compliance-institute-102423 (hereinafter “Grewal Remarks”).

[37] Id.

[38] Id.

[39] Id.

[40] Id.

[41] Id.

[42] Id.

[43] Id.; see also In the Matter of the Application of Thaddeus J. North, Admin. Proc. File No. 3-17909 (Oct. 29, 2018) (Commission Opinion) (collecting Commission decisions) (“These decisions reflect the principle that, in general, good faith judgments of CCOs made after reasonable inquiry and analysis should not be second guessed.”), www.sec.gov/files/litigation/opinions/2018/34-84500.pdfaff’d sub nom. North v. S.E.C., 829 Fed. App’x 729, 730 (D.C. Cir. Oct. 23, 2020).

[44] Grewal Remarks.

[45] Id.; Securities and Exchange Commission, “SEC Charges Stockbroker and Friend with Insider Trading” (June 29, 2023), www.sec.gov/news/press-release/2023-124.

[46] Grewal Remarks.

[47] Id.

[48] Id.

[49] In the Matter of Meredith A. Simmons, Admin. Proc. File No. 3-20114 (Sept. 30, 2020), www.sec.gov/files/litigation/admin/2020/34-90061.pdf.

[50] Grewal Remarks.

[51] Deferred Prosecution Agreement, Rex v Entain plc, December 5, 2023, https://www.entaingroup.com/‌media/hyakjf4z/entain-deffered-prosecution-agreement-05122023.pdf.

[52] Id.

[53] Id.

[54] Id.

[55] Approved Summary Judgement, Rex and Entain plc, December 5, 2023, https://www.entaingroup.com‌/media/lr3h0zfl/entain-approved-summary-of-judgement-regarding-dpa-05122023.pdf.

[56] Id.

[57] Guy Dauphin Environnement CJIP (May 15, 2023), https://www.justice.gouv.fr/sites/default/files‌/2023-06/CJIP_GDE_20230517.pdf.

[58] Id.

[59] Id.

[60] Bouygues Bâtiment Sud Est and Linkcity Sud Est CJIP (May 15, 2023), https://www.justice.gouv.fr/sites/default/files/2023-06/CJIP_BBSE_LYSE_20230523.pdf.

[61] Id.

[62] Press Release, Technip Energies to Resolve Outstanding Matters with the French Parquet National Financier (Nov. 30, 2023), https://www.ten.com/en/media/press-releases/technip-energies-resolve-outstanding-matters-french-parquet-national-financier.

[63] TechnipFMC, TechnipFMC Reaches Resolution of French Parquet National Financier (PNF) Investigation (Nov. 30, 2023), https://www.technipfmc.com/en/investors/financial-news-releases/press-release/technipfmc-reaches-resolution-of-french-parquet-national-financier-pnf-investigation.

[64] Acieries Hachette et Driout CJIP (October 11, 2023), https://rebeca-documentation.finances.gouv.fr/exl-php/resultat/rebeca_portail_recherche_avancee_internet?WHERE_IS_DOC_REF_LIT=DOC00448542&.

[65] Seves Group SARL and Sediver SAS CJIP (November 28, 2023), https://www.agence-francaise-anticorruption.gouv.fr/files/files/CJIP/231128_CJIP%20SEVES%20SEDIVER.pdf.

[66] D’Isolation et de Peinture Omnium and Omnium Develloppement CJIP (November 29, 2023), https://www.agence-francaise-anticorruption.gouv.fr/files/files/CJIP/CJIP%20OMNIUM/CJIP%20SAS%20D’ISOLATION%20ET%20DE%20PEINTURE%20OMNIUM.pdf.

[67] ADP Ingenierie CJIP (December 4, 2023), https://rebeca-documentation.finances.gouv.fr/exl-php/resultat/rebeca_portail_recherche_avancee_internet?CTX=NOFACETTE&WHERE_IS_DOC_REF_LIT=DOC00447085.

[68] Press Release, Public Prosecution Service of Canada (May 17, 2023), https://www.ppsc-sppc.gc.ca/eng/nws-nvs/2023/17_05_23.html.

[69] Id.

[70] See Non-Prosecution Agreement, United States v. Albermarle Corp. (Sept. 28, 2023), https://www.justice.gov/media/1316796/dl?inline.

[71] Id. at A-5.

[72] Id.

[73] Id. at 1-2.

[74] Id. at 4.

[75] Id. at 3.

[76] Plea Agreement, United States v. Amani Investments, LLC, No. 2:23-cr-00014-JAM (E.D. Cal. Feb. 7, 2023).

[77] Id. at 14-16.

[78] Id.

[79] Id. at 8.

[80] Id. at 8.

[81] Final Order of Forfeiture, United States v. Amani Investments, LLC, No. 2:23-cr-00014-JAM (E.D. Cal. Oct. 23, 2023).

[82] Judgment, United States v. Amani Investments, LLC, No. 2:23-cr-00014-JAM (E.D. Cal. Sep. 15, 2023).

[83] Deferred Prosecution Agreement, Aylo Holdings S.à.r.l. and the U.S. Attorney’s Office for the Eastern District of New York (Dec. 21, 2023), https://www.justice.gov/d9/2023-12/2023.12.21_dpa‌_final_court‌_exhibit_version_0.pdf (“Aylo DPA”).

[84] Aylo DPA Attachment B, Criminal Information at 4-10; Aylo DPA Attachment C, Statement of Facts at C-6-12; Press Release, GirlsDoPorn Owners and Employees Charged in Sex Trafficking Conspiracy (Oct. 10, 2019), https://www.justice.gov/usao-sdca/pr/girlsdoporn-owners-and-employees-charged-sex-trafficking-conspiracy (“Content Provider Press Release”); Criminal Complaint, United States v. Michael James Pratt, et al., 3:19-CR-04488 (S.D. Cal. Oct. 10. 2019) at 1-4 (“Content Provider Criminal Complaint”).

[85] Content Provider Press Release; Content Provider Criminal Complaint; Press Release, Adult Film Performer Pleads Guilty in GirlsDoPorn Sex Trafficking Conspiracy (Dec. 17, 2020), https://www.justice.gov/usao-sdca/pr/adult-film-performer-pleads-guilty-girlsdoporn-sex-trafficking-conspiracy.

[86] Aylo DPA at 8-9.

[87] Id. at 12-13.

[88] Press Release, U.S. Dep’t of Justice, Swiss Private Bank, Banque Pictet, Admits to Conspiring with U.S. Taxpayers to Hide Assets and Income in Offshore Accounts (Dec. 4, 2023), https://www.justice.gov/usao-sdny/pr/swiss-private-bank-banque-pictet-admits-conspiring-us-taxpayers-hide-assets-and-income.

[89] Criminal Information, United States v. Banque Pictet & Cie SA, No. 1:23-CR-631 (S.D.N.Y. Dec. 4, 2023), at 5-6.

[90] Deferred Prosecution Agreement with, United States v. Banque Pictet & Cie SA, No. 1:23-CR-631 (S.D.N.Y. Nov. 16, 2023), Statement of Facts at 2-3.

[91] Deferred Prosecution Agreement, United States v. Banque Pictet & Cie SA (November, No. 1:23-CR-631), at 5-6 (S.D.N.Y. Nov. 16, 2023), at 2-3.

[92] Id. at 5.

[93] Id. at 5-10.

[94] See Binance Blog, Binance Announcement: Reaching Resolution with U.S. Regulators (Nov. 21, 2023), https://www.binance.com/en/blog/leadership/binance-announcement-reaching-resolution-with-us-regulators-2904832835382364558.

[95] 31 C.F.R. § 1010.100(ff).

[96] See, e.g., Press Release, U.S. Dep’t of the Treasury, Treasury Announces Two Enforcement Actions for Over $24M and $29M Against Virtual Currency Exchange Bittrex, Inc. (Oct. 11, 2022), https://home.treasury.gov/news/press-releases/jy1006 (announcing an enforcement action against Bittrex, Inc., a virtual currency exchange that was based in Washington state).

[97] See International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701(a)(1)(A) (empowering the President to prohibit transactions by “any person, or with respect to any property, subject to the jurisdiction of the United States.”); see also Office of Foreign Assets Control, Frequently Asked Questions: 11. Who Must Comply with OFAC Regulations?, https://ofac.treasury.gov/faqs/11 (“U.S. persons must comply with OFAC regulations, including all U.S. citizens and permanent resident aliens regardless of where they are located, all persons and entities within the United States, all U.S. incorporated entities and their foreign branches. In the cases of certain programs, foreign subsidiaries owned or controlled by U.S. companies also must comply. Certain programs also require foreign persons in possession of U.S.-origin goods to comply.”).

[98] Attachment A, “Statement of Facts,” to the Plea Agreement in United States v. Binance Holdings Ltd., No. 23-178RAJ (Nov. 21, 2023), https://www.justice.gov/opa/media/1326901/dl?inline (hereinafter “Binance SOF”) at 7, ¶ 22.

[99] Id.

[100] 50 U.S.C. § 1705(a) (“It shall be unlawful for a person to violate, attempt to violate, conspire to violate or cause a violation of any license, order, regulation, or prohibition issued [pursuant to IEEPA].”).

[101] Plea Agreement in United States v. Binance Holdings Ltd., No. 23-178RAJ (Nov. 21, 2023), https://www.justice.gov/opa/media/1326901/dl?inline (hereinafter “Binance Plea Agreement”), at 2 ¶ 2.

[102] Id.

[103] Id.

[104] See Nikhilesh De, Binance to Make ‘Complete Exit’ From U.S., Pay Billions to FinCEN, OFAC on Top of DOJ Settlement, CoinDesk (Nov. 21, 2023), https://www.coindesk.com/policy/2023/11/21/binance-to-make-complete-exit-from-us-pay-billions-to-fincen-ofac-on-top-of-doj-settlement/.

[105] Id.

[106] Binance Plea Agreement at 17 ¶ 24.

[107] Id at 23 ¶ 32.

[108] Plea Agreement, Centera Bioscience (d/b/a Nootropics Depot), No. 23-cr-69-TSM-01/02 (D.N.H. Aug. 15, 2023), at 1.

[109] Id. at 2.

[110] Id. at 6.

[111] Deferred Prosecution Agreement, United States v. Corporacion Financiera Colombiana SA, No. 8:23-CR-00262 (D. Md. Aug. 10, 2023).

[112] Id.

[113] Id.

[114] Id.

[115] Id.

[116] Id.

[117] Deferred Prosecution Agreement, United States v. Freepoint Commodities LLC, No. 3:23-cr-00224 (D. Conn. Dec. 14, 2023), at 1 (hereinafter “Freepoint DPA”), https://www.justice.gov/opa/media/‌1329266‌‌/dl?inline.

[118] See DOJ Press Release, “Commodities Trading Company Agrees to Pay Over $98M to Resolve Foreign Bribery Case,” (Dec. 14, 2023), https://www.justice.gov/opa/pr/commodities-trading-company-agrees-pay-over-98m-resolve-foreign-bribery-case.

[119] Freepoint DPA, Statement of Facts at 2, 5.

[120] Id. at 3, 5-12.

[121] Freepoint DPA at 11.

[122] Id. at 4.

[123] Id. at 4-5.

[124] Id. at 6.

[125] Id.; see also DOJ Press Release.

[126] Freepoint DPA at 6-8.

[127] Id. at 3, 13-15.

[128] Press Release, U.S. Dep’t of Justice, Idaho Diesel Parts Companies and Owner Agree to Pay $1 Million After Pleading Guilty to Selling and Installing Illegal Defeat Devices (Aug. 23, 2023), https://www.justice.gov/usao-id/pr/idaho-diesel-parts-companies-and-owner-agree-pay-1-million-after-pleading-guilty-selling.

[129] Plea Agreement, United States v. GDP Tuning LLC, No. 4:23-CR-00168, at 2­3 (D. Idaho June 23, 2023).

[130] Press Release, U.S. Dep’t of Justice, Idaho Diesel Parts Companies and Owner Agree to Pay $1 Million After Pleading Guilty to Selling and Installing Illegal Defeat Devices (Aug. 23, 2023), https://www.justice.gov/usao-id/pr/idaho-diesel-parts-companies-and-owner-agree-pay-1-million-after-pleading-guilty-selling.

[131] Plea Agreement, United States v. GDP Tuning LLC, No. 4:23-CR-00168 (D. Idaho June 23, 2023), at 6.

[132] Id. at 4.

[133] Id.

[134] Deferred Prosecution Agreement, United States v. Glenmark Pharm. Inc., USA, No. 2:20-cr-00200-RBS (E.D. Pa. Aug. 21, 2023).

[135] Id. at 7.

[136] Id. at 9; Press Release, U.S. Dep’t of Justice, Major Generic Drug Companies to Pay Over Quarter of a Billion Dollars to Resolve Price-Fixing Charges and Divest Key Drug at the Center of Their Conspiracy (Aug. 21, 2023), https://www.justice.gov/opa/pr/major-generic-drug-companies-pay-over-quarter-billion-dollars-resolve-price-fixing-charges.

[137] Id. at 22.

[138] Id. at 25.

[139] Deferred Prosecution Agreement, United States v. Teva Pharm. USA, Inc., No. 2:20-cr-00200-RBS (E.D. Pa. Aug. 21, 2023) (hereinafter “Teva DPA”).

[140] Id. at 7, 10.

[141] Press Release, U.S. Dep’t of Justice, Major Generic Drug Companies to Pay Over Quarter of a Billion Dollars to Resolve Price-Fixing Charges and Divest Key Drug at the Center of Their Conspiracy (Aug. 21, 2023), https://www.justice.gov/opa/pr/major-generic-drug-companies-pay-over-quarter-billion-dollars-resolve-price-fixing-charges.

[142] Teva DPA at 9.

[143] Id.

[144] Id. at 4.

[145] Id.

[146] Deferred Prosecution Agreement, United States v. H&D Sonography LLC, Mag. No. 23-11136 (D.N.J. Aug. 17, 2023), ¶ 1.

[147] Id. at Attach. A, ¶ 6.

[148] Id. at Attach. A, ¶¶ 6-7.

[149] Id. at Attach. A, ¶ 11.

[150] Settlement Agreement, United States v. H&D Sonography LLC, Mag. No. 23-11136 (D.N.J. Aug. 18, 2023), ¶¶ 1, C-E.

[151] Id. at ¶ 1.

[152] Declination Letter, HealthSun Health Plans, Inc. (Oct. 25, 2023).

[153] See generally CEP Declinations, https://www.justice.gov/criminal/criminal-fraud/corporate-enforcement-policy/declinations.

[154] Id. at 1.

[155] Id. at 1-2.

[156] Id. at 2.

[157] Press Release, U.S. Dep’t of Justice, Former Executive at Medicare Advantage Organization Charged for Multimillion-Dollar Medicare Fraud Scheme (Oct. 26, 2023), https://www.justice.gov/opa/pr/‌former-executive-medicare-advantage-organization-charged-multimillion-dollar-medicare-fraud.

[158] Letter from Glenn S. Leon, Chief, U.S. Dep’t of Justice, Fraud Section & Ismail J. Ramsey, U.S. Attorney for the Northern District of California, to Manuel A. Abascal, Counsel for Lifecore Biomedical, Inc. (Nov. 16, 2023), https://www.justice.gov/criminal/media/1325521/dl?inline.

[159] Id.

[160] Id.

[161] Id.

[162] Id.

[163] Id.

[164] Id.

[165] Id.

[166] Id.

[167] Id.

[168] Id.

[169] Title 33, U.S.C. § 1319 (c)(2)(A); Plea Agreement, United States v. New Orleans Steamboat Company, No. 2:23-cr-00108-JCZ-DPC, at 1 (E.D. La. Aug. 16, 2023).

[170] Factual Basis for Plea Agreement, United States v. New Orleans Steamboat Company, No. 2:23-cr-00108-JCZ-DPC, at 1 (E.D. La. Aug. 16, 2023).

[171] Plea Agreement, at 1.

[172] Judgment, United States v. New Orleans Steamboat Company, No. 2:23-cr-00108-JCZ-DPC (E.D. La. Aug. 24, 2023).

[173] Non-Prosecution Agreement, Nomura Securities International, Inc. (Aug. 22, 2023), at 1 (hereinafter “NSI NPA”); see also Press Release, U.S. Dep’t of Labor, Nomura Securities International Agrees to Pay $35 Million Penalty Stemming from Its Participation in Securities Fraud Scheme (Aug. 22, 2023), https://www.oig.dol.gov/public/Press%20Releases/Nomura%20Securities%20International%20Agrees%20to%20Pay%20$35%20Million%20Penalty%20Stemming%20from%20Its%20Participatio.pdf.

[174] NSI NPA at 7.

[175] Id. at 11.

[176] Id.

[177] Id. at 12.

[178] Id.

[179] Id. at 3.

[180] Id. at 2.

[181] Plea Agreement, United States v. NuDay, 23-cr-00072-JL-TSM-1 (D.N.H. Aug. 18 2023); see also Press Release, U.S. Dep’t of Justice, NuDay Charity Pleads Guilty in Connection with the Illegal Export of Goods to Syria (Sept. 8, 2023), https://www.justice.gov/usao-nh/pr/nuday-charity-pleads-guilty-connection-illegal-export-goods-syria.

[182] Plea Agreement, United States v. NuDay, 23-cr-00072-JL-TSM-1 (D.N.H. Aug. 18 2023) at 2.

[183] Id. at 3

[184] Id.

[185] Id. at 2.

[186] Id.

[187] Id.

[188] Id. at 4.

[189] Id.

[190] Press Release, U.S. Dep’t of Justice, NuDay Charity Sentenced for Illegal Exports to Syria (Dec. 28, 2023), https://www.justice.gov/usao-nh/pr/nuday-charity-sentenced-illegal-exports-syria.

[191] Id.

[192] Case, U.S. Dep’t of Justice, Antitrust Division, United States v. Pro-Mark Services, Inc. (Nov. 8, 2023), https://www.justice.gov/atr/case/us-v-pro-mark-services-inc.

[193] Id.

[194] Plea Agreement of Secor, Inc., Dkt. Entry 3, United States v. Matthew Castle & Secor, Inc., 1:23-CR-00014-RSB (Oct. 10, 2023).

[195] Plea Agreement of Matthew Castle, Dkt. Entry 2, United States v. Matthew Castle & Secor, Inc., 1:23-CR-00014-RSB (Oct. 10, 2023).

[196] Agreed Statement of Facts Sufficient to Establish a Factual Basis for a Guilty Plea, at 2, Dkt. Entry 4, United States v. Matthew Castle & Secor, Inc., 1:23-CR-00014-RSB (Oct. 10, 2023).

[197] Id. at 2-3.

[198] Id. at 3-4.

[199] Id. at 4.

[200] Id.

[201] Plea Agreement of Matthew Castle, supra, at 5; Plea Agreement of Secor, Inc., supra, at 3.

[202] Plea Agreement of Secor, Inc., supra, at 3.

[203] Plea Agreement of Matthew Castle, supra, at 3.

[204] See Dkt. Entry 19, United States v. Matthew Castle & Secor, Inc., 1:23-CR-00014-RSB.

[205] Plea Agreement at 2, United States v. Sinister Mfg. Co., 2:23-CR-168-JAM (E.D. Cal. Aug. 1, 2023), ECF No. 10 (hereinafter “Sinister Diesel Plea Agreement”); Judgment, United States v. Sinister Mfg. Co., 2:23-CR-168-JAM (E.D. Cal. Nov. 17, 2023), ECF No. 22 (entering judgment for one count under 18 U.S.C. § 371, “Conspiracy to Violate the Clean Air Act and to Defraud the United States,” and one count under 42 U.S.C. § 7413(c)(2)(C), “Tampering with a Monitoring Device or Method Required Under the Clean Air Act”) (hereinafter “Sinister Diesel Judgment”).

[206] Sinister Diesel Plea Agreement, Ex. A at A-2 to A-9.

[207] Id.

[208] Sinister Diesel Judgment at 5; Sentencing Minutes Entry, 2:23-CR-168-JAM (Nov. 14, 2023), ECF No. 21; Sinister Diesel Plea Agreement at 3.

[209] Sinister Diesel Plea Agreement at Ex. B, ¶ 11 (United States v. Sinister Mfg. Co., 2:23-CV-01580-JDP (E.D. Cal. Aug. 1, 2023)).

[210] Sentencing Minutes Entry, 2:23-CR-168-JAM, ECF No. 21; Sinister Diesel Plea Agreement at 4-5.

[211] Sinister Diesel Plea Agreement at Ex. B, ¶¶ 16-19.

[212] Id.

[213] See id. at Ex. B, ¶¶ 15-30.

[214] Id. at Ex. B, ¶¶ 31, 82.

[215] Id. at Ex. B, ¶ 37.

[216] Plea Agreement, United States v. Suez Rajan Limited, No. CR 23-088-02, Dkt. 6 (D.D.C. March 16, 2023).

[217] Statement of Offense, United States v. Suez Rajan Limited, No. CR 23-088-02, Dkt. 7 (D.D.C. April 19, 2023); see also Stefania Palma and Chris Cook, “Owner of ship seized carrying Iranian oil pleads guilty in US court,” Financial Times (Sept. 7, 2023), https://www.ft.com/content/0441b637-15e7-4cec-8fd0-84c86ea1d529.

[218] Plea Agreement, United States v. Suez Rajan Limited, No. CR 23-088-02, Dkt. 6 (D.D.C. March 16, 2023).

[219] Id.

[220] Id.

[221] Monaco Remarks.

[222] Press Release, U.S. Dep’t of Justice, The Government Also Seized Almost One Million Barrels of Iranian Crude Oil (Sept. 8, 2023), at 1, https://www.justice.gov/usao-dc/pr/justice-department-announces-first-criminal-resolution-involving-illicit-sale-and.

[223] See Deferred Prosecution Agreement, United States v. Tysers Ins. Brokers Ltd. (Nov. 20, 2023) (https://www.justice.gov/media/1325796/dl?inline) (“Tysers DPA”); Deferred Prosecution Agreement, United States v. H.W. Wood Ltd. (Nov. 20, 2023) (https://www.justice.gov/media/1325801/dl?inline) (“H.W. Wood DPA”).

[224] Tysers DPA at A-5; H.W. Wood DPA at A-4.

[225] Tysers DPA at A-6; H.W. Wood DPA at A-5

[226] Tysers DPA at 43.

[227] H.W. Wood DPA at 9, 11.

[228] Id. at 11

[229] Oct. 8, 2019 Memorandum from Assistant Attorney General Brian Benczkowski to All Criminal Division Personnel re: Evaluating a Business Organization’s Inability to Pay a Criminal Fine or Criminal Monetary Penalty.

[230] H.W. Wood DPA at 5.

[231] Tysers DPA at 6-8, 48; H.W. Wood DPA at 6-8, 45.

[232] Id.

[233] Plea Agreement, United States v. View, Inc., No. 3:22-CR-151 (N.D. Miss. March 14, 2023) (hereinafter “View, Inc. Plea Agreement”).

[234] See DOJ Press Release, “California Company Sentenced for Illegally Discharging Wastewater From Olive Branch Manufacturing Plant,” (Aug. 15, 2023), https://www.justice.gov/usao-ndms/pr/california-company-sentenced-illegally-discharging-wastewater-olive-branch.

[235] Id.

[236] Judgment, United States v. View, Inc., No. 3:22CR00151-001 (N.D. Miss. Aug. 18, 2023), 2-4.

[237] Id. at 3.

[238] Plea Agreement at 1, 10-12, United States v. VIP Healthcare Sols., Inc., No. 3:23-cr-00058 (D.P.R. Oct. 17, 2023), ECF No. 77 (hereinafter “VIP Healthcare Plea Agreement”).

[239] Id. at 10-11.

[240] Id. at 3.

[241] Judgment, United States v. VIP Healthcare Sols., Inc., No. 3:23-cr-00058 (D.P.R. Jan. 17, 2024), ECF No. 107.

[242] Plea Agreement, United States v. Western River Assets, LLC, No. 23-cr-00005 (S.D.W. Va. Oct. 18, 2023) (hereinafter “Western River Assets Plea Agreement”); Plea Agreement, United States v. River Marine Enterprises, LLC, No. 23-cr-00005 (S.D.W. Va. Oct. 18, 2023) (hereinafter “River Marine Enterprises Plea Agreement”).

[243] Western River Assets Plea Agreement, at 11-12; River Marine Enterprises Plea Agreement, at 11-12.

[244] Id.

[245] Id.

[246] Id.

[247] Id.

[248] Western River Assets Plea Agreement, at 2; River Marine Enterprises Plea Agreement, at 2.

[249] Id.

[250] Order, United States v. Smith et al, 23-cr-00005 (S.D.W. Va. Oct. 18, 2023), at 3.

[251] Plea Agreement, United States v. Smith, No. 23-cr-00005 (S.D.W. Va. Oct. 18, 2023), at 1.

[252] Id. at 2.

[253] Plea Agreement, United States v. Zona Roofing LLC, No. 2:23-mj-16119-JRA, at 1 (D.N.J. Nov. 20, 2023).

[254] Id.

[255] Id.

[256] Id. at 2-5.

[257] Press Release, Company Admitted Its Chairman Bribed Former San Francisco Department of Public Works Head Mohammed Nuru with Meals, Hotel During China Trip (Oct. 16, 2023), https://www.justice.gov/usao-ndca/pr/property-developer-zl-properties-fined-1-million-after-pleading-guilty-honest-services (hereinafter “Z&L Properties Press Release”).

[258] Criminal Information, United States v. Z&L Properties, Inc., No, 3:23-cr-00221 (N.D. CA. (July 18, 2023)) (hereinafter “Z&L Properties Criminal Information”).

[259] Id.

[260] See Z&L Properties Press Release.


The following Gibson Dunn lawyers prepared this client alert: F. Joseph Warin, M. Kendall Day, Courtney Brown, Melissa Farrar, Justin Accomando, Michael Dziuban, Allison Lewis, Kelly Skowera, Jake McGee, Alex Murphy, Cate Harding, Alex Buettner, Mike Ulmer, Douglas Colby, Wynne Leahy, Todd Truesdale, Shannon McAvoy, Yixian Sun*, Sarah Pongrace, Rachel Iida, Austin Morris, Lorena Balić, Alex Ogren, David Reck, Christopher Scott, Hayley Lawrence, Betsy Goodwin*, and Nathalie Gunasekera.

Gibson Dunn’s White Collar Defense and Investigations Practice Group successfully defends corporations and senior corporate executives in a wide range of federal and state investigations and prosecutions, and conducts sensitive internal investigations for leading companies and their boards of directors in almost every business sector. The Group has members across the globe and in every domestic office of the Firm and draws on more than 125 attorneys with deep government experience, including more than 50 former federal and state prosecutors and officials, many of whom served at high levels within the Department of Justice and the Securities and Exchange Commission, as well as former non-U.S. enforcers. Joe Warin, a former federal prosecutor, is co-chair of the Group and served as the U.S. counsel for the compliance monitor for Siemens and as the FCPA compliance monitor for Alliance One International. He previously served as the monitor for Statoil pursuant to a DOJ and SEC enforcement action. He co-authored the seminal law review article on NPAs and DPAs in 2007. M. Kendall Day is a partner in the Group and a former white collar federal prosecutor who spent 15 years at the Department of Justice, rising to the highest career position in the DOJ’s Criminal Division as an Acting Deputy Assistant Attorney General.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of Gibson Dunn’s White Collar Defense and Investigations or Anti-Corruption and FCPA practice groups:

Washington, D.C.
F. Joseph Warin (+1 202.887.3609, [email protected])
Stephanie Brooker (+1 202.887.3502, [email protected])
Courtney M. Brown (+1 202.955.8685, [email protected])
David P. Burns (+1 202.887.3786, [email protected])
John W.F. Chesley (+1 202.887.3788, [email protected])
Daniel P. Chung (+1 202.887.3729, [email protected])
M. Kendall Day (+1 202.955.8220, [email protected])
Stuart F. Delery (+1 202.955.8515, [email protected])
Michael S. Diamant (+1 202.887.3604, [email protected])
Gustav W. Eyler (+1 202.955.8610, [email protected])
Melissa Farrar (+1 202.887.3579, [email protected])
Amy Feagles (+1 202.887.3699, [email protected])
Scott D. Hammond (+1 202.887.3684, [email protected])
George J. Hazel (+1 202.887.3674, [email protected])
Adam M. Smith (+1 202.887.3547, [email protected])
Patrick F. Stokes (+1 202.955.8504, [email protected])
Oleh Vretsona (+1 202.887.3779, [email protected])
David C. Ware (+1 202.887.3652, [email protected])
Ella Alves Capone (+1 202.887.3511, [email protected])
Lora Elizabeth MacDonald (+1 202.887.3738, [email protected])
Nicole Lee (+1 202.887.3717, [email protected])
Pedro G. Soto (+1 202.955.8661, [email protected])

New York
Zainab N. Ahmad (+1 212.351.2609, [email protected])
Reed Brodsky (+1 212.351.5334, [email protected])
Mylan L. Denerstein (+1 212.351.3850, [email protected])
Karin Portlock (+1 212.351.2666, [email protected])
Mark K. Schonfeld (+1 212.351.2433, [email protected])
Orin Snyder (+1 212.351.2400, [email protected])
Alexander H. Southwell (+1 212.351.3981, [email protected])

Dallas
David Woodcock (+1 214.698.3211, [email protected])

Denver
Ryan T. Bergsieker (+1 303.298.5774, [email protected])
Robert C. Blume (+1 303.298.5758, [email protected])
John D.W. Partridge (+1 303.298.5931, [email protected])
Laura M. Sturges (+1 303.298.5929, [email protected])

Houston
Gregg J. Costa (+1 346.718.6649, [email protected])

Los Angeles
Michael H. Dore (+1 213.229.7652, [email protected])
Michael M. Farhang (+1 213.229.7005, [email protected])
Diana M. Feinstein (+1 213.229.7351, [email protected])
Douglas Fuchs (+1 213.229.7605, [email protected])
Nicola T. Hanna (+1 213.229.7269, [email protected])
Poonam G. Kumar (+1 213.229.7554, [email protected])
Marcellus McRae (+1 213.229.7675, [email protected])
Eric D. Vandevelde (+1 213.229.7186, [email protected])
Debra Wong Yang (+1 213.229.7472, [email protected])

San Francisco
Winston Y. Chan (+1 415.393.8362, [email protected])
Charles J. Stevens (+1 415.393.8391, [email protected])

Palo Alto
Benjamin Wagner (+1 650.849.5395, [email protected])

London
Patrick Doris (+44 20 7071 4276, [email protected])
Sacha Harber-Kelly (+44 20 7071 4205, [email protected])
Michelle Kirschner (+44 20 7071 4212, [email protected])
Allan Neil (+44 20 7071 4296, [email protected])
Matthew Nunan (+44 20 7071 4201, [email protected])
Philip Rocher (+44 20 7071 4202, [email protected])

Paris
Benoît Fleury (+33 1 56 43 13 00, [email protected])
Bernard Grinspan (+33 1 56 43 13 00, [email protected])

Frankfurt
Finn Zeidler (+49 69 247 411 530, [email protected])

Munich
Kai Gesing (+49 89 189 33 285, [email protected])
Katharina Humphrey (+49 89 189 33 155, [email protected])
Benno Schwarz (+49 89 189 33 110, [email protected])

Hong Kong
Kelly Austin (+1 303.298.5980, [email protected])
Oliver D. Welch (+852 2214 3716, [email protected])

Singapore
Joerg Biswas-Bartz (+65 6507 3635, [email protected])

*Betsy Goodwin and Yixian Sun, associates in the firm’s New York office, are not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

This edition of Gibson Dunn’s Federal Circuit Update for February 2024 summarizes the current status of several petitions pending before the Supreme Court, and recent Federal Circuit decisions concerning printed publications, written description, claim construction, and inequitable conduct.

Federal Circuit News

Noteworthy Petitions for a Writ of Certiorari:

There were no new potentially impactful petitions filed before the Supreme Court in February 2024. We provide an update below of the petitions pending before the Supreme Court that were summarized in our January 2024 update:

  • In Vanda Pharmaceuticals Inc. v. Teva Pharmaceuticals USA, Inc. (US No. 23-768), after the respondents waived their right to file a response, the Court requested a response, which is due March 18, 2024. Three amicus curiae briefs have been filed.
  • In Ficep Corp. v. Peddinghaus Corp. (US No. 23-796), the respondent filed its opposition brief on February 23, 2024.
  • The Court denied the petitions in Liquidia Technologies, Inc. v. United Therapeutics Corp. (US No. 23-804) and VirnetX Inc. v. Mangrove Partners Master Fund, Ltd. (US No. 23-315).

Federal Circuit Practice Update

Promptu Systems Corp. v. Comcast Corp. et al., No. 22-1093 (Fed. Cir. Feb. 16, 2024): The Federal Circuit (Moore, C.J., Prost and Taranto, JJ. (per curiam)) issued sua sponte an order in four related cases (Nos. 19-2368 (consolidated with 19-2369), 20-1253, 22-1093, 22-1939) clarifying that Rule 28 of the Federal Rules of Appellate Procedure prohibits counsel from exceeding the word count through incorporation by reference. The appellee incorporated by reference multiple pages of argument from the brief in one case into another and was asked by the Court why appellee should not be sanctioned. Although the Court chose not to award sanctions in this case, it made clear that “violating these provisions in the future will likely result in sanctions.”

New Oral Argument Scheduling Conflicts Guidance. On February 26, 2024, the clerk’s office provided guidance clarifying what would be considered allowable and unallowable scheduling conflicts for upcoming oral argument sessions. This guidance is published here.

Upcoming Oral Argument Calendar

The list of upcoming arguments at the Federal Circuit is available on the court’s website.

Key Case Summaries (February 2024)

Weber, Inc. v. Provisur Technologies, Inc., No. 22-1751, 22-1813 (Fed. Cir. Feb. 8, 2024): Weber filed petitions for inter partes review (“IPR”) against Provisur’s patents directed to high-speed mechanical slicers used in food processing plants to slice and package foods, like meats and cheeses. The invalidity grounds asserted in the IPR petitions included combinations based on Weber’s operating manuals. The Patent Trial and Appeal Board (“Board”) concluded that Weber’s operating manuals were not prior art printed publications.

The panel (Reyna, J., joined by Hughes and Stark, JJ.) reversed-in-part, vacated-in-part, and remanded. The Court concluded that Weber’s operating manuals were printed publications because they were intended to be “accessible to interested members of the relevant public by reasonable diligence” and were not subject to confidentiality restrictions by Weber’s copyright notice and terms and conditions.

RAI Strategic Holdings, Inc. v. Philip Morris Products, S.A., No. 22-1862 (Fed. Cir. Feb. 9, 2024): Philip Morris filed a petition for post-grant review challenging RAI’s patent directed to electrically powered smoking articles. The Board found that the claims lacked written description support because the claimed “length of about 75% to 85% of a length of the disposable aerosol forming substance” for the heating member was narrower than the ranges disclosed in the specification. Specifically, the specification disclosed ranges of 75% to 125%, 85% to 110%, and 90% to 110%. No range disclosed in the specification contained the upper limit of 85%.

The Federal Circuit (Stoll, J., joined by Chen and Cunningham, JJ.) affirmed-in part, vacated-in-part, and remanded. The Court vacated the Board’s determination that the broader ranges disclosed in the specification did not provide written description support for the narrower claimed range. “Given the predictability of electro-mechanical inventions such as the one at issue here, and the lack of complexity of the particular claim limitation at issue—i.e., reciting the length of a heating member—a lower level of detail is required to satisfy the written description requirement than for unpredictable arts.” Specifically, there was no evidence that changing the length of the heating member changed the invention’s operability, effectiveness, or other parameters.

Promptu Systems Corp. v. Comcast Corp. et al., No. 22-1939 (Fed. Cir. Feb. 16, 2024): Promptu sued Comcast for infringing Promptu’s patents directed to speech recognition technology. Promptu stipulated to non-infringement under the district court’s constructions, and challenged the constructions on appeal.

The Federal Circuit (Taranto, J., joined by Moore, C.J., and Prost, J.) vacated and remanded. The Court held that the district court erred or erred-in-part in its construction of four claims terms because the constructions were not consistent with disclosures in the specification. The Court additionally explained that “only those terms need be construed that are in controversy, and only to the extent necessary to resolve the controversy.” Thus, although the Court determined that the district court’s construction of certain terms were too narrow, it was unclear what aspects of those terms needed clarification “for resolution of the liability issues.” The Court therefore remanded to the district court to make that determination in the first instance.

Freshub, Inc. v. Amazon.com, Inc., No. 22-1391 (Fed. Cir. Feb. 26, 2024): Freshub sued Amazon for infringing Freshub’s patent related to voice-processing technology. Amazon denied infringement and asserted the defense that the patents are unenforceable due to inequitable conduct committed by Freshub’s parent company, Ikan Holdings LLC. Specifically, Amazon argued when Ikan revived the abandoned patent application from which the asserted patents claim priority, Ikan had intentionally misrepresented to the U.S. Patent and Trademark Office (“PTO”) that the application had been unintentionally abandoned when the abandonment was actually intentional. A jury found Amazon did not infringe the patents. Subsequently, the district court held a bench trial on the inequitable conduct claim, but found that Amazon had failed to prove the inequitable conduct by clear and convincing evidence.

The Federal Circuit (Taranto, J., joined by Reyna and Chen, JJ.) affirmed. The claim limitation at issue was whether Amazon’s shopping list met the “identify an item” limitation. Amazon presented evidence that the shopping-list feature added words to a shopping list whether or not it corresponded to a purchasable item, and therefore, did not meet the limitation. Although there was no claim construction narrowing the meaning of “item” to only purchasable items, this was one reasonable interpretation of the claim language, and therefore, the Court determined that substantial evidence supported the jury’s finding of noninfringement.

The Court also affirmed the district court’s rejection of Amazon’s inequitable conduct defense. “To prevail on the defense of inequitable conduct, the accused infringer must prove that the applicant misrepresented or omitted material information with the specific intent to deceive the PTO.” Therasense, Inc. v. Becton, Dickinson & Co., 649 F.3d 1276, 1287 (Fed. Cir. 2011) (en banc). While the Court found that Amazon had presented evidenced that Ikan’s counsel knew that the application had been abandoned, the Court determined that Amazon had not presented by clear and convincing evidence that Ikan intentionally abandoned the application. The Court determined that Amazon therefore could not show that counsel’s statement that the abandonment was unintentional was made with the specific intent to deceive the PTO.


The following Gibson Dunn lawyers assisted in preparing this update: Blaine Evanson, Jaysen Chung, Audrey Yang, Vivian Lu, Julia Tabat, and Michelle Zhu.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Federal Circuit. Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Appellate and Constitutional Law or Intellectual Property practice groups, or the following authors:

Blaine H. Evanson – Orange County (+1 949.451.3805, [email protected])
Audrey Yang – Dallas (+1 214.698.3215, [email protected])

Appellate and Constitutional Law:
Thomas H. Dupree Jr. – Washington, D.C. (+1 202.955.8547, [email protected])
Allyson N. Ho – Dallas (+1 214.698.3233, [email protected])
Julian W. Poon – Los Angeles (+ 213.229.7758, [email protected])

Intellectual Property:
Kate Dominguez – New York (+1 212.351.2338, [email protected])
Y. Ernest Hsin – San Francisco (+1 415.393.8224, [email protected])
Josh Krevitt – New York (+1 212.351.4000, [email protected])
Jane M. Love, Ph.D. – New York (+1 212.351.3922, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

2023 proved that there is never a dull moment when it comes to the False Claims Act (FCA). It was an especially significant year in terms of enforcement developments.

The Department of Justice (DOJ) recovered approximately $2.7 billion through FCA settlements and judgments, making FY 2023 the 15th straight year in which recoveries exceeded $2 billion.  The government and whistleblowers initiated more than 1,200 new FCA matters—a new record and a 26% increase over the previous one.  Moreover, DOJ initiated 500 of these matters, the most by far in any given year since DOJ began releasing data tracking this metric.  Even relator-initiated matters were significantly higher than in past years; at 712, FY 2023’s total is the third-highest since 2000.  Simply put, DOJ and the relators’ bar were more active in FY 2023 than ever before.  Their efforts, as in past years, were focused primarily in the healthcare space—although this past year saw a marked increase in recoveries from defense contractors, as well.

Last year was notable in other ways, too.  Four years after announcing its FCA cooperation credit policy, DOJ began explicitly acknowledging certain companies’ cooperation in settlement agreements.  Yet it did so with varying degrees of specificity regarding what the companies did to earn such credit, resulting in—at best—limited guidance for companies to follow in evaluating options for self-disclosure, cooperation, and remediation.  Elsewhere, DOJ deepened its commitment to pursuing FCA allegations in the cybersecurity realm, and multiple states expanded their false claims laws.  And while few caselaw developments could rival the two Supreme Court FCA decisions handed down in the first half of 2023, the latter half of the year still saw significant Circuit‑level decisions related to materiality, damages calculations, and the FCA’s anti‑retaliation provision, among other topics.

We cover all of this, and more, below.  We begin by summarizing recent enforcement activity, then provide an overview of notable legislative and policy developments at the federal and state levels, and finally analyze significant court decisions since the publication of our 2023 Mid-Year Update.

As always, Gibson Dunn’s recent publications regarding the FCA may be found on our website, including in-depth discussions of the FCA’s framework and operation, industry-specific presentations, and practical guidance to help companies avoid or limit liability under the FCA.  And, of course, we would be happy to discuss these developments—and their implications for your business—with you.

I. FCA ENFORCEMENT ACTIVITY

A. NEW FCA ACTIVITY

By a wide margin, 2023 was a record year for new FCA enforcement actions.  More FCA cases were opened in 2023 than any year for which data is available.  The government and qui tam relators filed 1,212 new cases, a stunning 249 more cases from the record set in 2022 (representing a 26% increase).  And, as highlighted by DOJ, “[t]he government and whistleblowers were party to 543 settlements and judgments, the highest number of settlements and judgments in a single year.”[1]

This increase reflects DOJ’s laser-like focus on FCA enforcement.  Last year, the government initiated 500 cases based on referrals or investigations, as opposed to qui tam matters.  This far surpasses the prior record, set in 1987, of 340 government‑initiated cases, and outstrips the 305 matters opened the year before.  Simply put, DOJ is aggressively seeking possible claims on its own initiative.

Historically, the vast majority of FCA recoveries have come from cases where DOJ initiated the case or intervened.  Presumably, this portends significant FCA recoveries in years to come.

Number of FCA New Matters, Including Qui Tam Actions

Source: DOJ “Fraud Statistics – Overview” (Feb. 22, 2024)

B. TOTAL RECOVERY AMOUNTS

In FY 2023, the total dollars recovered through FCA cases (just shy of $2.7 billion) represented a significant increase over the previous year ($2.2 billion), though it remained far short of 2021’s most recent highwater mark ($5.7 billion).

Importantly, 2023 saw a return to normalcy in terms of the percentage of recoveries in which the United States either intervened or initiated the case.  DOJ’s decision on whether to intervene historically has been a critical inflection point in cases—and one that strongly predicts whether a case will be successful.  In short, DOJ is good at picking “winners.”  FY 2022 presented a stark anomaly where more than half the FCA recoveries recorded (54%) stemmed from cases brought by a relator without the support of DOJ.  This past year, FY 2023, 16% of recoveries came from qui tam actions in which the government declined to intervene, generally consistent with the overall trend and similar to numbers most recently seen in 2015 and 2017.  Even that percentage, though, demonstrates the increase in the relators’ bar taking these cases into discovery and obtaining recoveries in recent years.  Since 2014, relators have recovered a total of approximately four times more in FCA cases than in all other years since 2000 combined.

Assuming this indicator remains roughly consistent, we may soon see recoveries surpassing the record set in 2014, given DOJ’s aggressive initiation of cases in FY 2023.

Settlements or Judgments in Cases Where the Government Declined Intervention as a Percentage of Total FCA Recoveries

Source: DOJ “Fraud Statistics – Overview” (Feb. 22, 2024)

C. FCA RECOVERIES BY INDUSTRY

The breakdown of FCA recoveries by industry shifted marginally in 2023.  Consistent with existing trends, healthcare cases accounted for the lion’s share of recoveries—68%, equating to more than $1.8 billion.  That, however, represents the lowest portion of FCA recoveries since 2017 (then 63%).  This shift is largely due to increased recoveries related to Department of Defense (DOD) procurement, which made up 21% of recoveries in 2023, equating to over $550 million.  The remaining 12% of recoveries (nearly $320 million) were from cases involving other industries.

Regarding the healthcare-related claims, DOJ touted its cases alleging Medicare Advantage fraud, unnecessary services and substandard care fraud, claims related to the opioid epidemic, and unlawful kickbacks.  Beyond those cases, DOJ emphasized its enforcement efforts targeting government defense contractors, as well as COVID-19 and cybersecurity fraud.[2]

FCA Recoveries by Industry

Source: DOJ “Fraud Statistics – Health and Human Services”; “Fraud Statistics – Department of Defense”; “Fraud Statistics – Other (Non-HHS and Non-DoD)” (Feb. 22, 2024)

II. NOTEWORTHY DOJ ENFORCEMENT ACTIVITY DURING THE SECOND HALF OF 2023

A. HEALTHCARE AND LIFE SCIENCE INDUSTRIES

  • On July 13, a dermatology practice which operates 13 clinics in southeast Tennessee and north Georgia, and one of its dermatologists, agreed to pay $6.6 million to resolve allegations that they violated the FCA by overbilling federal healthcare programs for various dermatological surgeries and procedures. The government alleged that the practice and the physician falsely claimed that both the surgery and pathology portion of procedures were conducted by the dermatologist, when in fact certain portions were conducted by other individuals, and that the defendants regularly billed Medicare in a way that improperly bypassed Medicare’s “multiple procedure reduction rule.”  As part of the settlement, the practice entered into a corporate integrity agreement (CIA) with the Department of Health and Human Services Office of the Inspector General (HHS-OIG), which focuses on the practice’s continuing obligation to properly bill and submit reimbursement claims to government payors.  The settlement resolved a suit brought by a qui tam relator; the relator will receive $1.3 million of the settlement amount.[3]
  • On July 14, an electronic health record (EHR) technology vendor agreed to pay $31 million to settle allegations that it violated the FCA and the federal Anti-Kickback Statute (AKS). The vendor allegedly misrepresented its software’s capabilities and falsely obtained certification from HHS under a program that grants incentive payments to incentivize healthcare providers that adopt EHR  The vendor also allegedly provided unlawful remuneration to customers for referrals, including sales credits and tickets to sporting and entertainment events.  This settlement is the latest in a series of resolutions with EHR vendors, including a $45 million settlement from late 2022 that we covered in our Year-End 2022 FCA Update.  The settlement resolved a qui tam suit brought by two relators from a facility that used the company’s EHR software; the relators will receive nearly $5.6 under the settlement agreement.[4]
  • On July 31, a Maine-based Medicare Advantage organization agreed to pay approximately $22.5 million to resolve allegations that it submitted inaccurate diagnosis codes for its enrollees, thereby increasing its reimbursements from Medicare. The government alleged that the provider reviewed the charts of its Medicare Advantage beneficiaries to identify additional diagnosis codes and then submitted those codes to Medicare although they were not supported by the patients’ medical records.  The settlement resolved a qui tam suit brought by a former employee, who will receive approximately $3.8 million in the settlement.[5]
  • On August 1, two pharmacy companies and their respective owners agreed to pay over $3.5 million to resolve allegations that they violated the FCA by billing Medicare for medications that were not actually dispensed. The companies also agreed to a five-year exclusion from participation in federal healthcare programs, surrendered their Drug Enforcement Agency (DEA) Certificates of Registration, and ceased operations.[6]
  • On August 1, a clinical laboratory and its owner agreed to pay $5.7 million to settle an outstanding FCA judgment against them. An initial judgment of approximately $30.6 million was entered against the laboratory and owner in 2018 after a court found that the lab knowingly submitted false claims to Medicare for travel reimbursements.  In particular, the court concluded that the lab billed Medicare for lab technician travel when specimens were not accompanied by technicians and billed travel for each specimen when groups of specimens were transported together.  Due to the defendants’ inability to pay the original judgment in full, the laboratory and owner agreed to pay the new $5.7 million settlement over a period of five years.  The settlement resolved a qui tam suit brought by the lab’s competitor, who will receive $1.3 million of the settlement.  The settlement imposes future payment obligations in the event that certain contingencies transpire in relation to the laboratory owner’s income.[7]
  • On August 10, a Florida-based durable medical equipment supply company agreed to pay $29 million to settle allegations that it fraudulently claimed reimbursement from Medicare and Medicare Advantage Plans for rental payments for oxygen equipment in excess of the 36-month cap on reimbursement. The settlement agreement stated that approximately $12.6 of the settlement amount constituted restitution.  In conjunction with the DOJ settlement, the company also entered into a five-year CIA with HHS-OIG, which requires the company to undertake various compliance measures and to retain an independent compliance expert to review the company’s compliance program.  The DOJ settlement resolved a qui tam suit brought by former employees, who will receive approximately $5.7 of the settlement amount.[8]
  • On August 24, a Michigan pain management doctor and two pain center entities he owned and operated collectively agreed to pay $6.5 million to resolve a variety of FCA allegations. The government alleged that the doctor and entities billed Medicare and Medicaid for excessive and medically unnecessary urine drug tests irrelevant to patient treatment, additional laboratory charges not separately billable from the urine drug tests, routine moderate sedation services not actually required for interventional pain management procedures, and medically unnecessary or otherwise non-reimbursable back braces.  The settlement resolves claims in two qui tam lawsuits, and the relators will collectively receive approximately $1.3 million of the settlement amount.[9]
  • On August 30, a California company that operates multiple healthcare providers agreed to pay $5 million to resolve claims that it violated the FCA and the California FCA by causing the submission of false claims to California’s Medicaid program. The government alleged that the company billed for unallowable and/or inflated costs for services it provided to “Adult Expansion” population members (as defined under the Affordable Care Act).  This settlement is the latest in a series of resolutions related to the Medicaid Adult Expansion program in California, through which the United States has recovered a total of $95.5 million.  The allegations underlying the August 30 settlement stemmed from a qui tam suit by a former medical director, who will receive approximately $950,000 as his share of the recovery.[10]
  • On September 13, a Texas company that managed and operated dermatology practices, surgical centers, and pathology laboratories across the United States agreed to pay approximately $8.9 million, including approximately $5.9 million in restitution, to resolve self-reported claims of potential violations of the FCA, the AKS, and the Stark Law. The government alleged that former senior managers of the company offered to increase the purchase price of 11 dermatology practices in exchange for agreements to refer laboratory services to affiliated entities after the acquisition.  The government credited the company for self-reporting the alleged conduct at a time when the government was unaware of it.  The settlement agreement itself, however, is not publicly available, and the press release announcing the settlement does not specify how much the cooperation credit reduced the amount the government otherwise would have sought to recover.[11]
  • On September 15, a cardiac diagnostics company and its founder-owner agreed to pay approximately $4.5 million to resolve allegations that they paid physicians millions of dollars in the form of rent payments and referral fees to induce them to refer patients to the diagnostics company in violation of the AKS and the FCA.  As part of the settlement, the government, the company and its founder-owner entered into a consent judgment for $64.4 million, which the government can seek to enforce if the required settlement payments are not made.  The settlement agreement resolves a qui tam suit but does not specify the relator’s share of the recovery.[12]
  • On September 30, a Connecticut-based healthcare and insurance company agreed to pay approximately $172 million to resolve allegations that it submitted, and failed to withdraw, inaccurate and untruthful diagnosis codes for its Medicare Advantage Plan enrollees. The government alleged that, as part of the company’s “chart review” program to identify all medical conditions that the charts supported and to assign the beneficiaries diagnosis codes for those conditions, the company added diagnosis codes that the patients’ healthcare providers had not included to inflate the payments the company received from the Centers for Medicare and Medicaid Services (CMS).  In addition, the government alleged that the company failed to withdraw false diagnosis codes and repay CMS, including where the company itself added the codes and where providers included them initially and the company’s review did not support the use of the codes.  Along with the settlement, the company entered into a five-year CIA with HHS-OIG, which requires (among other things) an independent review organization to audit the company with a focus on risk adjustment data.[13]
  • On October 2, a Delaware-based specialty pharmacy and its CEO agreed to pay a total of $20 million to resolve FCA allegations premised on alleged AKS violations. Specifically, the government alleged that the company improperly waived Medicare and TRICARE patients’ copayments to induce patients to purchase the company’s services and specialty drugs, and that the company gave kickbacks to physicians to induce referrals in the form of gifts, dinners, and free administrative and clinical support services.  The settlement stemmed from a qui tam suit brought by two former employees of the company, who together will receive approximately $4 million of the recovery.[14]
  • On October 2, a California-based provider of genomic-based diagnostic tests agreed to pay $32.5 million to resolve allegations that it violated the FCA by improperly billing Medicare for the company’s principal laboratory test. In particular, the government alleged that the company violated the Medicare “14-Day Rule,” which governs reimbursement for laboratory tests for patients discharged after hospital stays.  The settlement resolved two qui tam actions brought by two relators, who collectively will receive a share of approximately $5.7 million of the settlement.[15]
  • On October 10, an Illinois-based cardiac imaging company and its founder agreed to pay approximately $85.5 million in an FCA resolution premised on alleged violations of the AKS and the Stark Law. The government alleged that the company paid above fair market value fees to cardiologists to supervise certain scans for patients the cardiologists referred to the company as improper referral; the fees allegedly included amounts for time that the cardiologists spent off-site or attending to other patients as well as for services beyond supervision that were not actually provided.  The government also alleged that the company knowingly relied on a consultant’s fair market value analysis that was based on inaccurate information about the relevant services and that the consultant that provided the analysis later disclaimed.  The company also entered into a five-year CIA with HHS-OIG, which imposes (among other obligations) an annual risk assessment and the retention of an independent review organization.  The FCA settlement resolves a qui tam action brought by one of the company’s former billing managers, whose share of the government’s recovery had not been determined at the time the settlement was announced.[16]
  • On October 17, multiple Michigan inpatient and hospitalist entities agreed to pay approximately $4.4 million to resolve allegations they violated the FCA by billing for services for beneficiaries located in Michigan and Indiana that were not rendered to the Michigan-based beneficiaries, permitting doctors to regularly bill impossible days of services, and by upcoding medical services (using more expensive billing codes than the codes corresponding to the services provided). The settlement resolves claims in two qui tam suits, with relators receiving approximately $767,000 of the settlement.[17]
  • On October 30, a drug manufacturer and its founder agreed to pay at least $3.8 million and up to $50 million to resolve allegations that the company knowingly underpaid quarterly rebates to Medicaid programs for one of the company’s drugs. The government alleged that the drug manufacturer paused manufacturing of an acquired drug and later relaunched it as a reformulation (despite not changing any active ingredients) with a price increase of more than 400%.  However, the manufacturer allegedly refused to pay the larger Medicaid rebate invoices tied to the price increase.  The settlement amount is tied to certain financial contingencies.[18]
  • On November 8, an eastern Kentucky hospital system and one of its physicians agreed to collectively pay approximately $3 million to resolve allegations that they violated the FCA by submitting claims for non-covered services to Medicare and Kentucky Medicaid.  The government alleged that the hospital and physician billed, or caused to be billed, federal healthcare programs for reimbursement of services without the requisite documentation to support medical necessity of those services.  The matter arose from the hospital system’s voluntary self-disclosure of the claims.  The government stated explicitly that its recovery was limited to 1.5 times the amount of monetary loss caused by the alleged false claims, which is consistent with DOJ’s cooperation credit policy for FCA cases.[19]
  • On November 9, DOJ announced that a healthcare management company, its executive, and six skilled nursing facilities agreed to a consent judgment in the amount of approximately $45.6 million to resolve claims that they violated the FCA and the AKS. The government alleged that under the direction and control of the management company and its executive, the skilled nursing facilities entered into medical directorship agreements that purported to compensate physicians for administrative services but actually provided kickbacks for physicians that referred patients to the skilled nursing facilities.  The consent judgment calls for scheduled payments for each defendant based on their ability to pay, and the settlement contains a series of covenants by the government not to enforce the consent judgment as to certain assets, combined with provisions for increasing the payments owed by the defendants in the event of certain financial contingencies.  In connection with the settlement agreement, the management company, one of the executives, and one of the skilled nursing facilities entered into a five-year CIA with HHS-OIG.[20]
  • On December 6, a Pennsylvania-based company and its Illinois-based subsidiary agreed to pay more than $14.7 million to resolve allegations that they violated the FCA by knowingly submitting claims to federal healthcare programs for more expensive types of remote cardiac monitoring than what physicians had intended to order or that were medically necessary. According to the government, the companies ignored requests by physicians for types of monitoring that carried lower reimbursement rates than what the companies ended up billing.  The settlement agreement resolved two qui tam actions brought by, respectively, an individual employee of one of the company’s customers and by an LLC.  The individual will receive $2.3 million of the settlement share, and the LLC will receive approximately $270,000.[21]
  • On December 19, a healthcare network agreed to pay $345 million to resolve allegations that it violated the FCA by knowingly submitting claims to Medicare for services that were referred to the network in violation of the Stark Law. In particular, the government alleged that senior management employed physicians and paid them above fair market value and in a way that took account of the volume of the physicians’ referrals to the network.  The network allegedly continued this conduct despite warnings from a compensation valuation firm that the physician salaries exceeded fair market value.  In connection with the settlement, the network entered into a five-year corporate integrity agreement with HHS-OIG.  The settlement resolved a qui tam lawsuit brought by the network’s former Chief Financial and Chief Operating Officer, whose share of the recovery, according to the government “ha[d] not yet been determined” as of the time of the press release.  The settlement agreement resolves only the allegations in the government’s partial complaint-in-intervention; as of this writing, the relator continues to pursue FCA claims premised on AKS allegations.[22]
  • On December 20, a hospital operator agreed to pay $2 million, and to make additional payments in the event of certain contingencies, to resolve claims that the center violated the FCA. The government alleged that the center falsely claimed cost outlier payments—supplemental reimbursements by Medicare and TRICARE that aim to incentivize treatment for patients whose cost of care in an inpatient setting is particularly high.  As part of the alleged conduct, the company improperly inflated its charges for inpatient care while underreporting charges on the cost reports it submitted to the government, and concealed an obligation to return outlier payments to which it was not entitled.  The government also alleged that the company double‑billed the government for COVID-19 tests.  The settlement resolved a qui tam suit brought by a former employee, who received approximately $300,000 of the settlement.[23]
  • On December 21, a pharmaceutical company agreed to pay $6 million to resolve allegations that it violated the FCA by paying kickbacks in exchange for prescriptions. Specifically, the government alleged that the company knowingly paid for free genetic testing, as well as the associated fees; according to the government, the company knew the tests had to be positive for a certain genome in order for insurers to pay for the company’s medication.  The settlement resolved a lawsuit brought by a qui tam relator, who will receive approximately $1.1 million of the federal settlement amount.[24]
  • On December 21, a Missouri urgent care provider agreed to pay $9.1 million to settle allegations that it violated the FCA by submitting claims for physician services that actually were performed by non-physician practitioners.  The settlement resolved allegations that the provider both upcoded billing for patient visits and submitted upcoded visit claims for COVID-19 vaccinations and patient care. The DOJ press release notes that the company “fully cooperated in the investigation,” but it is not clear whether DOJ awarded any cooperation credit on that basis.  The press release did note that the company had voluntarily self‑disclosed separate conduct—the payment of bonuses to physicians in part based on the volume or value of referrals—to HHS-OIG in March 2021.[25]
  • On December 22, a Pennsylvania manufacturer of durable medical equipment agreed to pay $2.5 million to resolve allegations that it violated the FCA by giving kickbacks to sleep laboratories.  The government alleged that the manufacturer gave the laboratories free diagnostic sleep-respiratory disorder masks to induce prescriptions or referrals for masks the company manufactured for treatment of sleep disorders.[26]

B. GOVERNMENT CONTRACTING AND PROCUREMENT

  • On July 21, a consulting firm agreed to pay approximately $377 million to resolve allegations that from 2011 to 2021 it violated the FCA by improperly billing unrelated or disproportionate costs to its government contracts. In particular, the government alleged that the firm billed the government for costs that were unallowable or that should have been allocated to commercial contracts instead of to government contracts.  The settlement is the largest, by dollar value, since our 2023 Mid-Year Update, and is a rare example of an FCA settlement based on alleged violations of the federal cost accounting standards (CAS).  The settlement resolved a qui tam suit brought by a former employee, who will receive almost $70 million of the settlement.[27]
  • On July 21, two government contractors agreed to pay a total of $7 million to resolve allegations that they violated the FCA by falsely representing what methodology they used to measure customer satisfaction on certain government websites. The government alleged that the contractors were awarded a five-year contract with the Federal Consulting Group (a part of the U.S. Department of Interior) with the understanding that the company would measure customer satisfaction using the American Customer Satisfaction Index’s (ASCI) methodology, but that the company instead used a different methodology.  The settlement resolves claims in a qui tam lawsuit brought by two relators, who will receive a total of $1.5 million of the settlement amount.[28]
  • On August 4, an electronic connector manufacturing company agreed to pay approximately $18 million to settle allegations that it violated the FCA by submitting false claims for electrical connectors to the U.S. government and military.  The company allegedly submitted claims for reimbursement of the connectors that did not meet the testing and manufacturing specifications required for the claims to be eligible for reimbursement.[29]
  • On September 5, a New Jersey-based company paid approximately $4.1 million to resolve claims that it violated the FCA by failing to satisfy certain required cybersecurity controls in connection with information technology services provided to federal agencies.  Specifically, the government alleged that the company failed to implement three required cybersecurity controls for Trusted Internet Connections with respect to General Services Administration (GSA) contracts from 2017 to 2021 within an internet protocol service it provided to federal agencies.  The claims stemmed from a written self-disclosure of potential issues by the company, submitted to the GSA’s Office of Inspector General.  The settlement agreement states that the company received credit for disclosure, cooperation, and remediation; although it does not specify the amount of the credit, it does detail certain cooperation and remediation steps the company took, such as identifying responsible individuals, disclosing facts it had gathered and attributing them to specific sources, assisting in damages calculations, and imposing employment consequences for responsible individuals.[30]
  • On September 15, a Pennsylvania-based research and engineering services provider, agreed to pay $4.4 million to settle allegations that it violated the FCA by knowingly double billing for labor and material costs in relation to contracts with the U.S. Navy.  The settlement agreement specifies that $2.1 million of the settlement amount constitutes restitution, and notes that there was a parallel administrative case that arose out of government audits of the relevant contracts and that the parties had agreed in principle to settle.  It does not appear that there was a qui tam case underlying the settlement.[31]
  • On September 28, a major military aircraft manufacturer agreed to pay $8.1 million to resolve allegations that it violated the FCA by failing to adhere to critical manufacturing requirements in the production of composite parts for certain aircraft sold to the United States military.  The government alleged that the manufacturer failed to conduct routine checks and surveillance of machines used to cure certain composite parts, and that the manufacturer did not maintain required documentation concerning periodic testing of those machines.  The settlement resolved a qui tam action by three whistleblowers who worked at the company’s manufacturing facility producing the composite parts; together they will receive approximately $1.5 million of the settlement.[32]
  • On November 20, a Virginia-based tactical gear and equipment company agreed to pay nearly $2.1 to settle allegations that it submitted false claims in connection with the sale of “American-made” products that were actually manufactured in foreign countries in violation of the Trade Agreements Act and the Berry Amendment’s requirement that certain items purchased by DOD be 100% domestic in origin. The settlement resolved a qui tam suit brought by an employee, who will receive an unspecified portion of the settlement amount.[33]

C. OTHER

  • On August 15, a Florida real estate broker and his companies agreed to pay $4 million to resolve FCA allegations that they knowingly provided false information in support of multiple Paycheck Protection Program (PPP) and Economic Injury Disaster Loan Program (EIDL) loans.  The government alleged that the broker submitted false and fraudulent applications and documents, including false tax documents and employee wage reports, to obtain four EIDL loans and 14 PPP loans.  The government also claimed that he submitted false and fraudulent forgiveness applications wherein he falsely certified that the entire loan amounts were used to pay eligible business costs.[34]
  • On September 28, a Florida-based automotive company agreed to pay $9 million to resolve allegations that it violated the FCA by knowingly providing false information in support of a PPP loan application it submitted.  The government contended that the company certified it was a small business and had fewer than 500 employees, making it eligible for PPP funds designated for “small business concerns” under the CARES Act.  According to the government, the company in fact had over 3,000 employees, it knew when it made the certifications that it was ineligible for the loan program, and the government later forgave the loan.  The settlement resolved claims brought in a qui tam lawsuit, and the relator will receive approximately $1.6 million of the recovery amount.[35]
  • On October 31, an energy company agreed to pay $16 million to resolve allegations that it under-reported and under-paid natural gas royalties owed to the United States under administrative regulations for natural gas exploration.  The government contended that the company knowingly deducted the costs of placing natural gas in marketable condition (which companies must do at no cost to the government) from the royalties it owed the government, knowingly deducted the costs of transporting carbon dioxide from the royalties, and knowingly failed to pay royalties on carbon dioxide.  The settlement also resolved ongoing Department of Interior administrative proceedings regarding the same alleged conduct.[36]
  • On November 1, a restaurant chain with locations in New York and Arizona and its owner agreed to pay $2 million to resolve allegations that they violated the FCA by falsely certifying that the restaurant chain was eligible to receive a Restaurant Revitalization Fund (RRF) grant in the amount of $928,554. Specifically, the government alleged that by falsely certifying that the restaurant chain did not have more than 20 locations, when in fact it had 21, the restaurant chain and its owner falsely claimed eligibility for the RRF grant.  The settlement resolved a complaint filed by a qui tam relator whose share of the settlement will be $200,000.[37]
  • On December 5, a Dallas-based importer of industrial products and two Chinese companies agreed to pay approximately $2.5 million to resolve allegations that they violated the FCA by submitting false invoices for customs valuations, which in turn resulted in lower values for the imported goods and lost customs revenue. The settlement resolved a qui tam suit brought by two relators, who received a $500,000 share as part of the settlement agreement.[38]
  • On December 7, a New Jersey-based public relations firm agreed to pay nearly $2.3 million to settle allegations that the company violated the FCA by wrongfully taking a loan from the PPP. The United States contended that the company knowingly applied for and received a $2 million PPP loan, despite the fact that it was ineligible to receive the funds because it was a required registrant under the Foreign Agent Registration Act.  The company allegedly later sought and received forgiveness for the total loan value.  The settlement agreement states that the government considers approximately $2.1 million of the $2.3 million settlement amount to be restitution.  The qui tam relator who brought the original lawsuit will receive $229,000, or 10%, of the recovery amount.[39]
  • On December 11, a Texas‑based roofing company agreed to pay $9 million to resolve allegations that it violated the FCA by falsely certifying that eight of its affiliate companies were eligible to receive PPP loans in the amount of $6.7 million, which were all later forgiven in full. The government alleged that by improperly claiming to have fewer than 500 employees, each applicant falsely represented that it was qualified as a small business eligible to receive a loan, when the applicants’ affiliations with each other meant that they collectively had more than 500 employees.  The settlement resolved a lawsuit brought by a qui tam relator who will receive $1 million of the settlement amount.[40]  The law firm that represented the relator characterized it in a blog post as a “data miner” that “analyzes PPP loan data for prospective cases.”[41]

III. LEGISLATIVE AND POLICY DEVELOPMENTS

A. FEDERAL POLICY AND LEGISLATIVE DEVELOPMENTS

1. DOJ’s Cooperation Credit Policy, Several Years On

In the aggregate, FCA resolutions afford a fairly clear window into DOJ’s programmatic enforcement priorities.  While any given settlement agreement’s level of detail regarding the covered conduct is often vigorously negotiated, agreements—and the press releases that announce them—typically contain enough high-level information about the nature of the government’s allegations for other companies in various industries to identify the government’s focus areas.

The government’s approach to awarding cooperation credit in FCA cases is markedly less transparent.  In May 2019, DOJ issued a policy—now codified at Section 4-4.112 of the Justice Manual—regarding the circumstances under which such credit could be awarded.[42]  At the core of the policy are voluntary disclosure, cooperation in the government’s investigation, and remediation.[43]  In announcing the policy, DOJ stated that “[m]ost frequently, cooperation credit will take the form of a reduction in the damages multiplier and civil penalties,” and that DOJ “may publicly acknowledge the company’s cooperation.”[44]  However, beyond that general statement, and a statement in the policy that cooperation credit cannot result in a defendant paying less than single damages, the policy said precious little about how much cooperation credit DOJ would award in various circumstances.  (Gibson Dunn’s 2019 analysis of the policy provided further details on the policy and the significant discretion it granted to the government.)

The triad of disclosure, cooperation and remediation described in the FCA policy is a familiar one.  In the criminal sphere, DOJ has made these same three concepts the centerpiece of its enforcement regime—not only from the standpoint of whether and how much cooperation credit to award, but also in terms of what type of resolution vehicle to use.[45]  In the criminal enforcement context, however, DOJ tends to be more explicit about how much cooperation credit it awards and the factors that lead it to do so.

For example, several of DOJ’s new voluntary disclosure policies clarify that for a company that has made a qualifying self‑disclosure, DOJ will seek penalties of no more than 50% of the applicable criminal penalties, if the government determines criminal penalties are necessary.[46]  These policies also make clear that companies that meet the policies’ criteria for disclosure, cooperation and remediation will not face guilty pleas absent aggravating factors.[47]  Such policies also go beyond general pronouncements, and deal with more specific types of fact patterns that companies often face—the most notable example being DOJ’s recent “safe harbor” policy for companies that make voluntary self-disclosures regarding misconduct discovered in the course of mergers and acquisitions.[48]  In the text of specific resolution agreements, moreover, DOJ frequently “shows its work” by explaining how much cooperation credit it is awarding and why.  For example, in a recent deferred prosecution agreement with a commodities company related to alleged U.S. Foreign Corrupt Practices Act violations, the government explicitly awarded credit for cooperation efforts but not for voluntary disclosure, and stated that the company was receiving a 15% discount off the bottom end of the applicable U.S. Sentencing Guidelines penalty range.[49]

By contrast, nearly five years on from the codification of DOJ’s FCA cooperation credit policy, it is difficult to discern how DOJ is assessing the forms of cooperation and remediation the policy deems relevant, and to what effect in terms of settlement amounts.  Before 2023, DOJ seldom invoked the policy as having affected the terms of a settlement when announcing resolutions.  Although certain resolutions from 2023 reflect a possible shift toward more frequent discussion of the policy and provide valuable details about its application in practice, the statements DOJ is making continue to provide more questions than answers.  Several examples from 2023 bear this out:

  • In one of the year’s notable cybersecurity-related FCA resolutions, DOJ “acknowledged that [the company] took a number of significant steps entitling it to credit for cooperating with the government.”[50]  These included a written self-disclosure to the GSA after the company learned of the relevant issues; “an independent investigation and compliance review of the issues and . . . multiple detailed supplemental written disclosures” to GSA; identification of responsible individuals to DOJ; disclosure of facts the company uncovered in its investigation, including by attributing the facts to specific sources; assistance to DOJ in the analysis of potential damages; and “prompt and substantial remedial measures” such as compliance enhancements, “substantial capital investments” in compliance initiatives, and employment consequences for responsible individuals.[51]  The agreement, however, spends less than three lines stating that the company received cooperation credit; it does not specify which if any of the company’s efforts carried more weight than others in the government’s determination to award cooperation credit.  The agreement did identify the portion of the amount that the government considered to be restitution; assuming this reflects DOJ’s views of single damages, then the total settlement amount was approximately 1.5 times the alleged single damages.[52]
  • In another resolution involving a hospital system, DOJ did not publish the settlement agreement itself, but explicitly stated in the press release announcing the settlement that “[b]ecause the company self-reported the conduct to the government, it was able to resolve its False Claims Act liability for only 1.5 times the amount of monetary loss caused by its false claims.”[53]

The second example above suggests that voluntary self‑disclosure may be the engine of the cooperation credit analysis.  Yet without more explicit statements from DOJ as to how it views companies’ disclosure, cooperation and remediation efforts, it is difficult to know which factors are ultimately responsible for any given award of cooperation credit.

On another level, while both examples above suggest that settlement at 1.5 times single damages is within reach for companies that satisfy DOJ’s policy, another resolution from 2023 awarded credit under the policy but reflected a reduction to only 1.75 times single damages.  Further, like other resolutions, this one did not state which aspects of the companies’ efforts led DOJ to think that further reductions were inappropriate.[54]  At the same time, DOJ has been known to settle at 1.5 times single damages—or even less—without any mention of self-disclosure, thus raising questions around the incentives for self-disclosure in the first instance.  For example, in October, a New Jersey public relations firm reached a settlement of FCA allegations related to PPP funds, and the settlement amount was approximately 1.1 times the government’s stated restitution figure.[55]

In short, while DOJ’s more frequent invocation of its cooperation credit policy is a welcome development, for the time being it has done little to answer the questions the policy itself left open regarding the value of disclosure, cooperation, and remediation.  Time will tell whether future resolutions will continue the recent trend of explicitly noting companies’ cooperation, and whether they will reflect a more detailed—and uniform—approach by DOJ to explaining how much cooperation credit it is awarding and why.

2. Civil Cyber-Fraud Initiative

Since announcing its Civil Cyber-Fraud Initiative in October 2021, DOJ has increasingly used the FCA to address cybersecurity concerns, and 2023 was no exception.  The Civil Cyber‑Fraud Initiative uses the FCA to encourage disclosure and to hold accountable entities and individuals that put U.S. information or information systems at risk by knowingly providing deficient cybersecurity products or services, misrepresenting their cybersecurity practices or protocols, or violating obligations to monitor and report cybersecurity incidents and breaches.[56]  Several recent cases highlight a growing trend of using the FCA to target government contractors that are required to meet certain cybersecurity requirements, even when no beach has occurred:

  • In the cybersecurity-related FCA resolution mentioned above, the information services technology company paid $4.1 million to settle FCA allegations after self-disclosing potential issues with certain cybersecurity controls.[57] The company, which provides secure public internet connection capabilities to federal agencies, was contractually required to comply with the Office of Management and Budget’s Trusted Internet Connections initiative at all times.  After identifying concerns with certain security controls that allegedly affected the company’s compliance with critical capabilities, the company self-disclosed the concern and implemented measures to remediate the issue.
  • In a recently unsealed qui tam complaint stemming from the Civil Cyber-Fraud Initiative, a relator alleged that a university submitted false cybersecurity certifications to DOD. Despite making certifications of compliance with National Institute of Standards and Technology (NIST) requirements, the relator claims that the university failed to store controlling unclassified information in NIST-compliant applications, and replaced legitimate risk assessments with templates designed to simply “check the box.”[58]

These cases demonstrate that DOJ’s use of the FCA to pursue cybersecurity enforcement extends beyond commercial defense or cybersecurity-related contracts to any government agreement that includes representations about cybersecurity compliance.  Healthcare companies should take note and pay particular attention to government contract provisions governing the storage, protection, and transmittal of protected health information and personal identifiable information, which may contain specific cybersecurity requirements or representations.

Cybersecurity enforcement will be an area to watch as it relates to self-disclosure in particular.  In October 2023, DOD, the GSA, and NASA proposed a rule that would amend the Federal Acquisition Regulation (FAR) to require government contractors to disclose cybersecurity incidents within eight hours of discovering them, and to provide other periodic updates on efforts to remediate cybersecurity incidents.[59]  Even though such disclosures to the government would not necessarily include information within the full scope of what it would consider relevant to possible FCA claims, the disclosures by definition will position the government to start investigating potential misconduct far closer in time to its occurrence than in other situations—even ones, such as the healthcare overpayment context, in which reporting to the government is required.  The proposed FAR rule’s early reporting requirement could create additional incentives for federal contractors to quickly investigate and disclose potential FCA violations to DOJ, lest DOJ learn of the underlying cyber breaches too quickly for self-disclosure credit to be available.  At the same time, it is possible DOJ will deem self-disclosure of potential FCA violations to carry less weight given that disclosure of the fact of a cyber incident would already be required by law.  If the eight-hour disclosure provision remains in the FAR rule when it becomes final, it will be instructive to track the extent to which DOJ calibrates its application of the cooperation credit policy in the cyber context to focus on cooperation and remediation, as opposed to disclosure.

3. Other Federal Policy Developments

HHS-OIG Compliance Program Guidance

On November 6, 2023, HHS‑OIG released its new General Compliance Program Guidance (GCPG).[60]  This document is designed to serve as a non-binding guide for healthcare entities, and includes guidance about compliance with the FCA and other applicable laws.  The GCPG describes how the FCA in the healthcare context encompasses billing services or items to Medicare or Medicaid “where the service is not actually rendered to the patient, is already provided under another claim, is upcoded, or is not supported by the patient’s medical record.”[61]  To ensure compliance with the FCA, the guidance recommends that entities take “proactive measures . . . including regular reviews to keep billing and coding practices up-to-date as well as regular internal billing and coding audits.”[62]

The guidance also outlines seven focus areas for corporate compliance programs, including policies and training, governance and reporting, risk assessments and audits, employment consequences, and responding to discoveries of misconduct.[63]  In its discussion of risk assessments and auditing, the guidance makes clear that entities should put in place mechanisms for auditing the effectiveness of compliance controls, beyond simply auditing with an eye to identifying potential violations of law.[64]  And the guidance emphasizes that an entity’s response to discovering misconduct should include self-disclosure to the appropriate government authority where “credible evidence of misconduct from any source is discovered and, after a reasonable inquiry, the compliance officer or counsel has reason to believe that the misconduct may violate criminal, civil, or administrative law.”[65]  Notably, the guidance states that such disclosure should be made “not more than 60 days after the determination that credible evidence of a violation exists.”[66]  It remains to be seen the extent to which this expectation ends up at odds with DOJ’s view of when an “obligation” to return healthcare overpayments arises under the Affordable Care Act (ACA) and the FCA, given that the ACA requires entities to return overpayments within 60 days of identifying them.[67]

HHS‑OIG has also signaled its intent to release industry segment-specific compliance program guidance in 2024 and to update the documents periodically.[68]

COVID-19 Enforcement

DOJ’s FCA enforcement efforts related to the COVID-19 pandemic are part of a broader landscape of civil and criminal enforcement initiatives to which DOJ has devoted significant resources over the last several years.  In August 2023, DOJ provided an update on the efforts of its COVID-19 Fraud Enforcement Task Force.[69]  According to DOJ, it had seized over $1.4 billion in COVID-19 relief funds as of that date, and had recently conducted a single coordinated enforcement effort involving 371 defendants and $836 million in relief funds, primarily from the Paycheck Protection Program, the Internal Revenue Service (IRS) Employee Retention Credit program, and Economic Injury Disaster Loans.[70]

B. STATE LEGISLATIVE DEVELOPMENTS

2023 saw states continue to expand the reach of their FCA statutes, some more aggressively than others.  Most notably, as we discussed in our 2023 Mid-Year Update, New York became the first state to amend its FCA to cover persons who improperly fail to file a tax return in the state, obviating the need for the State or relators to show the person submitted an actual false “claim, record, or statement.”  Connecticut also expanded the scope of its FCA statute to include claims relating to most state programs and benefits (although explicitly carving out tax-related claims), rather than only state-administered health and human services programs, as it had previously.[71]

More recently, New Jersey also amended its FCA statute.  It did so specifically to qualify for the federal financial incentive that allows states to receive a ten-percentage-point increase in their shares of any amounts recovered under the FCA if the state’s laws meet certain specified criteria.[72]  For a state to qualify for this incentive, HHS-OIG must determine that the state’s FCA is “at least as effective” as the federal FCA at facilitating qui tam actions.[73]  With its bill, New Jersey implemented changes to bring the state’s law in line with HHS-OIG’s guidance.  In addition to clarifying certain language and terminology to better align the statute with the federal FCA, the amendment expanded protections for relators by removing the bar preventing “an employee or agent of the State or a political subdivision from bringing an action based on information discovered in a civil, criminal, or administrative investigation or audit that was within the scope of the employee’s or agent’s duties or job description” and by expanding anti-retaliation protection to contractors and agents, beyond just employees.[74]  With New Jersey’s amendment, there are now 23 state FCAs on HHS-OIG’s “approved” list and six on its “not approved” list.[75]

In Washington state, meanwhile, the legislature repealed a sunset provision that applied to whistleblower provisions, thus allowing qui tam actions to continue to be brought indefinitely.[76]  The sunset provision was initially put in place to address the concern that the availability of qui tam actions would cause relators to indiscriminately file claims under the Washington FCA, but legislators found that this did not occur and the legislature’s Joint Legislative Audit and Review Committee unanimously recommended the bill repealing the sunset provision.[77]

IV. CASE LAW DEVELOPMENTS

A. The Third Circuit Weighs in on FCA Materiality Post-Escobar

The Supreme Court’s decision in Universal Health Servs., Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016), set forth a number of factors relevant to the potential materiality of a misrepresentation under the FCA.  Among those factors are (1) whether the government has “designate[d] compliance with” the relevant “statutory, regulatory, or contractual requirement as a condition of payment”; (2) whether the alleged violation is “minor or insubstantial”; and (3) whether the government continued to pay claims “despite its actual knowledge that certain requirements were violated” or, instead, “consistently refuse[d] to pay claims in the mine run of cases based on noncompliance.”  Id. at 194–95.

In late August, the Third Circuit addressed the interplay of these factors.  In United States v. Care Alternatives, 81 F.4th 361 (3d Cir. 2023), the court reversed the district court’s grant of summary judgment to a defendant based on materiality.  Relators in the case were former employees of Care Alternatives, a for-profit hospice provider.  They alleged that Care Alternatives submitted Medicare claims even though patient records did not document hospice eligibility as required under 42 C.F.R. § 418.22(b)(2).  Under that provision, for a patient to be eligible for hospice care paid by Medicare, a physician must certify that the patient is “terminally ill,” meaning that the physician has signed the certification with the knowledge that the patient’s medical record “‘support[s] the medical prognosis’ of terminal illness.”  Id. at 366 (citation omitted).  Relators alleged that Care Alternatives submitted claims that were accompanied by physician certifications of terminal illness, but that the patients’ records lacked sufficient clinical documentation “supporting that diagnosis.”  Id. at 367.

The district court granted Care Alternatives’ first summary judgment motion based on a failure to show falsity; the Third Circuit reversed.  (We covered the Circuit Court opinion in our 2020 Mid-Year Update.)  Care Alternatives then filed a second motion for summary judgment.  The district court again granted summary judgment to Care Alternatives, this time holding that relators had not established that the alleged misrepresentations to Medicare were material, given that the government continued to reimburse claims from Care Alternatives even after being made aware of the deficiencies in the underlying patient records.

The Third Circuit reversed and remanded, holding that the district court improperly assigned dispositive weight to a single factor under Escobar—that the government continued to reimburse despite knowing of the alleged clinical documentation deficiencies.  The court concluded that a dispute of fact remained as to whether Care Alternatives’ alleged regulatory violations were “minor” or “went to the very essence of the bargain,” given that the parties contested the pervasiveness of the documentation errors, Care Alternatives’ awareness of its compliance problems, and whether the patients at issue were eligible for the Medicare hospice benefit.  Id. at 370–72 (internal quotation marks omitted).  And the court determined that, contrary to the district court’s opinion, a dispute of fact also remained as to whether the government ever had “actual knowledge” of the violation during the period in which it continued to reimburse Care Alternatives.  Id. at 374–75.  Noting that “relators are not required to conduct discovery on government officials to demonstrate materiality,” the court held that Care Alternatives had not met its burden of demonstrating an absence of dispute as to the timing of the government’s knowledge.  Id. at 375.

B. The Fifth Circuit Overturns a Jury Verdict for the Government on Statute-of-Limitations Grounds

In United States v. Corporate Management, Inc., 78 F.4th 727 (5th Cir. 2023), a Medicare overbilling case, the Fifth Circuit heard an appeal following a nine-week jury trial that resulted in an approximately $10.8 million verdict for the government (roughly $32 million after trebling).  Defendants appealed on a number of grounds, including that certain claims the government added when it intervened were untimely under the FCA’s statute of limitations.  The relator filed the initial complaint in May 2007, alleging that Defendants had submitted false claims to Medicare, including by overbilling for supply costs.  Id. at 734–35.  The government did not intervene until September 2015.  Id. at 735.  In its complaint‑in‑intervention, the government added two claims, including a claim that Defendants “took advantage of Medicare’s 101% reimbursement rate” for critical access hospitals by setting up a sham “management fee” agreement between one such hospital and a management company owned by the hospital’s owner, which was used to improperly inflate salaries paid to the owner and his wife.  Id.  On appeal, Defendants argued that all claims accruing before September 2009, six years prior to the government’s complaint, were barred by the statute of limitations, and that the judgment should therefore be reduced to approximately $4.6 million.  Id. at 741.  The government argued that its claims related back to the relator’s original allegations that Defendants submitted fraudulent Medicare cost reports, or in the alternative, that the claims were viable in light of the FCA’s tolling period (which tolls the limitations period for up to three years “after the date when facts material to the right of action are known or reasonably should have been known by the official of the United States charged with responsibility to act in the circumstances”).  Id.; 31 U.S.C. § 3731(b)(2).

The Fifth Circuit disagreed with the government on both arguments.  It explained that to relate back, a new claim must be “tied to a common core of operative facts.”  78 F.4th 742 (internal quotation marks omitted).  Whereas both the relator and the government alleged fraudulent cost reporting, the relator’s complaint contained no allegations regarding inflated salaries paid to the hospital owner and his wife.  Id. at 743.  Thus, rather than merely “add detail or clarify the claims on which it [was] intervening,” the government made new claims and sought to “‘fault [Appellants] for conduct different from that’ alleged by” the relator.  Id. (internal quotation marks omitted).  The Fifth Circuit further held that the government could not invoke the FCA’s three-year tolling provision, because there was evidence—in the form of a sealed government motion seeking an extension of the seal period—that an expert recommended in August 2011 that the government intervene in the case, and thus that by that time the government “likely did know” facts material to the case.  Id. at 745 (emphasis in original).  In reaching this conclusion, the court declined to decide whether DOJ or the relevant Medicare administrative contractor was the “official of the United States charged with responsibility to act in the circumstances” under the FCA’s tolling provision.  Id.; 31 U.S.C. § 3731(b)(2).

C. The Ninth Circuit Imposes Limits on Calculation of Statutory Penalties and Upholds “Actual Damages” Framework

The FCA imposes a penalty for each violation of the statute, as well as “3 times the amount of damages which the Government sustains because of the act of” the defendant.  31 U.S.C. § 3729(a).  In cases involving allegations that claims for payment were “tainted” by a defendant’s violation of an underlying contractual or regulatory requirement, FCA plaintiffs frequently seek penalties for every claim, and argue that the relevant goods or services were worthless to the government and that the proper measure of damages thus should be based on the full value of each claim.

In Hendrix ex rel. United States v. J-M Manufacturing Co., Inc., 76 F.4th 1164 (9th Cir. 2023), the Ninth Circuit reinforced important limitations on both of these theories.  Relator and government entity plaintiffs in the case claimed that J-M violated the FCA by falsely representing that its PVC pipes were compliant with certain industry standards which measured compliance based on the material of the pipes and its performance under a series of tests, as well as the manufacturing process for the pipes.  Under relevant standards, if the tested pipes are compliant, the manufacturer can claim compliance with those standards for pipes produced thereafter without additional testing, so long as the pipes are produced through “materially unchanged processes.”  Id. at 1168.

During the first phase of a bifurcated trial, plaintiffs sought to prove that J-M continued to advertise its PVC pipes as compliant with industry standards after materially changing its manufacturing process from the pipes’ last compliance testing.  At the end of Phase One, the jury found that J-M knowingly made materially false claims for payment because it represented in marketing materials that its pipes were uniformly compliant with industry standards.  The jury made no findings regarding the physical longevity of any particular piece of pipe.  During the damages phase of the trial, the district court granted judgment as a matter of law in favor of J-M on actual damages after the jury was unable to reach a verdict.  The court awarded plaintiffs one statutory penalty per project at issue, and not—as the plaintiffs had sought—one penalty for each piece of pipe that had been stamped with the relevant industry standard.  The court declined to impose damages, stating that the government had not established that the pipes were value-less.

The Ninth Circuit affirmed, ruling that the plaintiffs were not entitled to recover the entire PVC purchase price without a showing that the pipes had not operated as intended, and lacked all value in light of the jury’s Phase One findings.  To the contrary, plaintiffs had successfully installed the pipes and used them for many years following installation without issue, and apparently without any plans to replace the pipes.  To award damages in these circumstances, the Ninth Circuit held, would “impose a strict liability standard” without requiring proof of actual damages, and would “conflate[] ‘the materiality element of the FCA claim’ with ‘actual damages.’”  Id. at 1174.  In considering other cases in which the full contract price was awarded as damages, the court distinguished those cases as involving goods that “were either plainly unusable, not used, or returned.”  Id.

The Ninth Circuit also rejected plaintiffs’ claims that statutory penalties should be awarded for each piece of PVC pipe purchased, rather than for each individual project.  The court reasoned that the government entity plaintiffs “did not establish how much non-compliant pipe they received nor were they able to identify any specific piece of non-complaint pipe.”  Id. at 1172.

The J-M case is an important reminder that there are limits on local, state, and federal governments’ ability to accumulate FCA damages merely because a regulatory violation preceded the provision of goods or services.  Time will tell how closely other courts hew to the Ninth Circuit’s admonition that the materiality of a particular regulatory requirement does not automatically mean that goods or services provided after such a violation was committed were worthless.

D. The Tenth Circuit Clarifies a Prior Ruling on the FCA’s Retaliation Provision

In United States ex rel. Barrick v. Parker-Migliorini International, the Tenth Circuit clarified the extent to which an employer must be on notice that a relator is engaging in conduct protected by the FCA in order for the employer to be liable for retaliatory termination.  79 F.4th 1262 (10th Cir. 2023).  Brandon Barrick was a senior financial analyst for PMI, who alleged FCA claims regarding two methods of beef distribution.  First, according to Barrick, PMI exported beef to Costa Rica, which accepted beef subject to a lower (and therefore, cheaper) USDA testing standard, which would then be repackaged and sold to Japan, which required a higher (and more expensive) testing standard.  Second, PMI was allegedly submitting beef to the USDA for testing, indicating that it was being sent to Moldova—when it was, in fact, being sent to Hong Kong, and, in turn, illegally smuggled into China.  Id. at 1268–69.

Barrick alleged he had several conversations with PMI’s CFO regarding his concerns, and that the CFO confirmed that PMI was implementing these schemes and that they were illegal.  Id. at 1268–69.  Over the course of six months, Barrick allegedly cooperated with USDA, DOJ, and the FBI, including by recording several conversations with the CFO.  See id. at 1271.  Barrick alleged that one month after the FBI raided PMI’s offices, Barrick was terminated as part of a company-wide reduction in force of nine personnel.  Id. at 1269.  PMI claimed it did not learn of Barrick’s cooperation with the government until nearly two years later.  Id.

The FCA prohibits retaliation for “lawful acts done by the employee . . . in furtherance of an action under this section or other efforts to stop 1 or more violations of this subchapter.”  31 U.S.C.  § 3730(h)(1) (emphasis added).  In 2022, the Tenth Circuit held that to show they were the victim of unlawful retaliation, a relator must show that (1) they were engaging in protected activity; (2) their employer had notice that they were engaged in protected activity; and (3) the employer terminated them because of their engagement in protected activity.  Barrick, 79 F.4th at 1270 (citing U.S. ex rel. Sorenson, 48 F.4th 1146, 1158–59 (10th Cir. 2022)).  In the Barrick case, PMI argued that to satisfy the notice prong of this standard, “Barrick was required to ‘convey a connection to the FCA.’”  79 F.4th at 1270.  Relying on the FCA’s broad protection of “‘other efforts’ to stop [FCA] violations,” the court clarified that relators need not “say magic words, such as ‘FCA violation’ or ‘fraudulent report to the government to avoid payment,’ to put [employers] on notice.”  Id.  Rather, the person “must have conveyed to [the employer] that he was attempting to stop [the employer] from (1) engaging in fraudulent activity to avoid paying the government an obligation or (2) claiming unlawful payments from the government.”  Id. at 1271.  The employer “does not need to know the activity violates the FCA specifically.”  Id.  The court then upheld the jury’s findings that there was sufficient circumstantial evidence upon which the jury could have found PMI was aware that Barrick was engaging in protected conduct.

The Barrick case is significant because it means that, at least in the Tenth Circuit, the requisite nexus between an employee complaint and the FCA may be satisfied by evidence that the employee gave notice she was attempting to stop efforts to claim unlawful payments from, or efforts to unlawfully avoid making payments to, the government.  That creates a tension with the text of the FCA’s anti-retaliation provision, which is specific to employee acts in furtherance of qui tam suits or of other efforts to stop a violation of the FCA in particular.  Barrick seemingly left open the question of whether the employee herself must believe the conduct she is reporting violates the FCA specifically, or whether it is sufficient that the employee believe the conduct violates any of the myriad statutory, regulatory, and contractual requirements that are often used as the basis for FCA claims.

E. The Eleventh Circuit Reinforces a Strict Approach to Pleading Presentment Under Rule 9(b)

In some federal jurisdictions, including the Eleventh Circuit, to prevail on an FCA claim, “a relator must allege an actual false claim for payment that was presented to the government.”  Carrel v. AIDS Healthcare Found., Inc., 898 F.3d 1267, 1277 (11th Cir. 2018) (internal quotation marks and emphasis omitted).  In United States ex rel. 84Partners, LLC v. Nuflo, Inc., 79 F.4th 1353 (11th Cir. 2023), the Eleventh Circuit affirmed the district court’s dismissal of an FCA claim based on failure to allege presentment with the requisite particularity.

Relator—an entity called 84Partners, LLC, which included two former employees of a shipbuilding contractor and a pipe fitting manufacturer—brought a false-presentment FCA claim against their former employers, as well as a subcontractor and a pipe fitting distributor, based on the alleged installation of defective pipe fittings on nuclear submarines subsequently delivered to the Navy.  Relator alleged that the manufacturer made defective parts and that the other defendants recklessly disregarded their obligations to inspect the parts before delivery or installation, resulting in at least 42 defective pipe fittings being installed on Navy vessels.  The Navy made payments for all “allowable costs,” which included costs for parts installed on nuclear submarines, but relator failed to identify “any claim for payment submitted to the Navy that included any of the 42 [defective] parts.”  Id. at 1357 (alteration added).

The district court dismissed the relator’s second amended complaint with prejudice, noting that, despite eight years of litigation and limited discovery, relator was still unable to state a claim for false presentment; the court also noted that relator had not requested leave to further amend its operative complaint.  Id. at 1358.  The Eleventh Circuit affirmed, concluding that although the “complaint allege[d] with particularity egregious underlying conduct,” it failed to “allege with particularity the actual submission of false claims—claims covering the 42 defective parts, or any other defective parts, that made it into submarines.”  Id. at 1361.  Notably, the government had filed an amicus brief in the Eleventh Circuit, in which it urged the court to eschew a requirement to plead actual false claims—arguing, among other things, that the requirement is a poor fit for cases in which the government is the “only buyer . . . and requests for payment are submitted to one potential government payer under readily-identifiable contracts.”  Brief for United States as Amicus Curiae, United States ex rel. 84Partners, LLC v. Nuflo, Inc., No. 21-13673, at 23 (11th Cir. Jan. 20, 2022).  The government attempted to contrast such fact patterns with healthcare cases, in which the claims submission process is more complex and involves entities beyond the government itself.  See id.  While the government made other arguments against the application of a strict Rule 9(b) standard, this explicit contrast between types of FCA cases—and the insinuation that a stricter Rule 9(b) standard may actually have a role to play in healthcare cases in particular—is an interesting window into how the government thinks about different FCA fact patterns.

F. The District of Massachusetts Sets the Stage for a Deepened Circuit Split over Causation in AKS-Predicated FCA Cases

Our 2023 Mid-Year False Claims Act Update discussed the deepening circuit split over the proper causation standard for AKS-predicated FCA claims.  In brief, the Sixth Circuit and Eight Circuit have held that the AKS imposes a “but for” causation standard, see e.g., United States ex rel. Martin v. Hathaway, 63 F.4th 1043, 1052–53 (6th Cir. 2023); United States ex rel. Cairns v. D.S. Medical L.L.C., 42 F.4th 828 (8th Cir. 2022), whereas the Third Circuit has rejected a “but‑for” causation standard and instead determined that the FCA and AKS “require[] something less than proof that the underlying medical care would not have been provided but for a kickback.”  United States ex rel. Greenfield v. Medco Health Solutions, Inc., 880 F.3d 89, 96 (3d Cir. 2018).  Now, the First Circuit is also set to rule on this question after the district court granted interlocutory appeal in two cases with opposite holdings: United States v. Regeneron Pharms., Inc., No. CV 20-11217-FDS (D. Mass.) and United States v. Teva Pharms. USA, Inc., Civil Action No. 20-11548-NMG (D. Mass.).

In Teva, the government alleged that Teva caused the submission of false claims to Medicare through kickbacks it paid in the form of co-pay subsidies in connection with the sale of its multiple sclerosis drug, Copaxone.  Both Teva and the United States filed motions for summary judgment on the issue of causation, among other issues.  Teva argued that the government must prove “but-for” causation, citing Martin, 63 F.4th 1043 and Cairns, 42 F.4th 828.  The government argued that the FCA only requires a “sufficient causal connection” between a kickback and a claim, citing Guilfoile v. Shields, 913 F.3d 178, 190 (1st Cir. 2019) and Greenfield, 880 F.3d 89.  On July 14, 2023, the district court in Teva held that “[t]he government need not prove ‘but for’ causation,” and concluded that “[t]he government has established evidence of ‘a sufficient causal connection’ between Teva’s payments to CDF and ATF and the resulting Medicare Copaxone claims.”  Teva, 2023 WL 4565105, at *3–4 (D. Mass. July 14, 2023).  Thus, the Teva court joined the Third Circuit in rejecting the “but-for” causation standard.  On August 14, 2023, the Teva court granted interlocutory appeal on the causation question, finding that the standard for causation is “a controlling question of law as to which there is substantial ground for difference of opinion and an immediate appeal may materially advance the ultimate termination of this litigation.”  Teva, Order, Docket No. 235. (D. Mass. Aug. 14, 2023) (internal citations omitted).

In Regeneron, the government alleged that Regeneron improperly sent millions of dollars to an independent charitable foundation to subsidize patient co-pays for Eylea, a drug that treats neovascular (wet) age-related macular degeneration.  Similar to the Teva case, both the government and the company filed motions for summary judgment on the causation standard.  On September 27, 2023—months after the Teva court issued its ruling—the Regeneron court held that the appropriate standard for causation was “but for” causation and that “the factual evidence is sufficient to withstand summary judgment on the issue of causation.”  Regeneron, 2023 WL 6296393, at *13 (D. Mass. Sept. 27, 2023).  On October 25, 2023, the Regeneron court certified its decision for interlocutory appeal to the First Circuit on the same question as the Teva case, stating that “if both this matter and the Teva matter were to proceed to trial—and both trials are expected to be lengthy and complex—at least one of those trials would employ an incorrect causation standard, and thus waste considerable time and resources.”  Regeneron, 2023 WL 7016900, at *1 (D. Mass. Oct. 25, 2023).  The Regeneron court further reiterated that “the issue is one of national importance, as reflected in the split among the circuits as to the correct standard.”  Id.

Both cases have been accepted by the First Circuit, but it has not yet ruled.  That ruling seems likely to deepen the existing circuit split on the issue of causation.  But it remains to be seen whether the addition of another Circuit-level decision will prompt the Supreme Court to weigh in where it has not done so to date.  (In October the Court denied a certiorari petition in the Martin case.)  This issue carries significant implications for FCA defendants, as exemplified by the $487 million jury verdict in May 2023 against a medical supply company in a case involving allegations of false claims caused by illegal kickbacks.  (We covered this case in our 2023 Mid-Year Update.)

V. CONCLUSION

We will monitor these developments, along with other FCA legislative activity, settlements, and jurisprudence throughout the year and report back in our 2024 False Claims Act Mid-Year Update.

__________

[1] Press Release, U.S. Dep’t of Justice, False Claims Act Settlements and Judgments Exceed $2.68 Billion in Fiscal Year 2023 (Feb. 22, 2024), https://www.justice.gov/opa/pr/false-claims-act-settlements-and-judgments-exceed-268-billion-fiscal-year-2023 [hereinafter DOJ FY 2023 Recoveries Press Release].

[2] DOJ FY 2023 Recoveries Press Release.

[3] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Tenn., Dermatologist Agrees to Pay $6.6 Million to Settle Allegations of Fraudulent Billing Practices (July 13, 2023), https://www.justice.gov/usao-edtn/pr/dermatologist-agrees-pay-66-million-settle-allegations-fraudulent-billing-practices.

[4] See Press Release, U.S. Atty’s Office for the Dist. of Vt., Electronic Health Records Vendor NextGen Healthcare, Inc. to Pay $31 Million to Settle False Claims Act Allegations (July 14, 2023),  https://www.justice.gov/usao-vt/pr/electronic-health-records-vendor-nextgen-healthcare-inc-pay-31-million-settle-false; United States ex rel. Markowitz et al. v. NextGen Healthcare, Inc., Case No. 2:18-cv-195 (D. Vt.), Settlement Agreement, https://www.justice.gov/opa/file/1305766/dl?inline.

[5] See Press Release, Dep’t of Justice, Martin’s Point Health Care Inc. to Pay $22,485,000 to Resolve False Claims Act Allegations (July 31, 2023), https://www.justice.gov/opa/pr/martins-point-health-care-inc-pay-22485000-resolve-false-claims-act-allegations.

[6] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Pa., Northeast Philadelphia Pharmacies and Their Owners Agree to Pay Over $3.5 Million to Resolve False Claims Act Liability (Aug. 1, 2023), https://www.justice.gov/usao-edpa/pr/northeast-philadelphia-pharmacies-and-their-owners-agree-pay-over-35-million-resolve.

[7] See Press Release, Dep’t of Justice, Clinical Laboratory and Its Owner Agree to Pay an Additional $5.7 Million to Resolve Outstanding Judgement for Billing Medicare for Inflated Mileage-Based Lab Technician Travel Allowance Fees (Aug. 1, 2023), https://www.justice.gov/opa/pr/clinical-laboratory-and-its-owner-agree-pay-additional-57-million-resolve-outstanding.

[8] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Wash., Lincare Holdings Agrees to Pay $29 Million to Resolve Claims of Overbilling Medicare for Oxygen Equipment in Largest-Ever Health Care Fraud Settlement in Eastern Washington (Aug. 28, 2023), https://www.justice.gov/usao-edwa/pr/lincare-holdings-agrees-pay-29-million-resolve-claims-overbilling-medicare-oxygen; see also Settlement Agreement, Case No. 2:21-cv-151-TOR (E.D. Wash.), https://www.justice.gov/usao-edwa/file/1311981/dl?inline.

[9] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Mich., Michigan Doctor to Pay $6.5 million to Resolve False Claims Act Allegations (Aug. 24, 2023), https://www.justice.gov/usao-edmi/pr/michigan-doctor-pay-65-million-resolve-false-claims-act-allegations.

[10] See Press Release, U.S. Dep’t of Justice, Office of Pub. Affairs, Health Care Provider Agrees to Pay $5 Million for Alleged False Claims to California’s Medicaid Program (Aug. 30, 2023),

https://www.justice.gov/opa/pr/health-care-provider-agrees-pay-5-million-alleged-false-claims-californias-medicaid-program https://www.justice.gov/opa/pr/health-care-provider-agrees-pay-5-million-alleged-false-claims-californias-medicaid-program.

[11] See Press Release, U.S. Atty’s Office for the Northern Dist. of Tex., Dermatology Management Company to Pay $8.9 Million to Resolve Self-Reported False Claims Act Liability (Sept. 13, 2023), https://www.justice.gov/usao-ndtx/pr/dermatology-management-company-pay-89-million-resolve-self-reported-false-claims-act.

[12] See Press Release, U.S. Atty’s Office for the Southern Dist. of N.Y., U.S. Settles False Claims Act Lawsuit Against Cardiologist and His Medical Practice for Paying Millions in Kickbacks for Referrals (Sept. 18, 2023), https://www.justice.gov/usao-sdny/pr/us-settles-false-claims-act-lawsuit-against-cardiologist-and-his-medical-practice.

[13] See Press Release, U.S. Dep’t of Justice, Cigna Group to Pay $172 Million to Resolve False Claims Act Allegations (Sept. 30, 2023), https://www.justice.gov/opa/pr/cigna-group-pay-172-million-resolve-false-claims-act-allegations.

[14] See Press Release, U.S. Dep’t of Justice, United States Settles Kickback Allegations with BioTek reMEDys Inc., Chaitanya Gadde and Dr. David Tabby (Oct. 2, 2023), https://www.justice.gov/opa/pr/united-states-settles-kickback-allegations-biotek-remedys-inc-chaitanya-gadde-and-dr-david.

[15] See Press Release, U.S. Atty’s Office for the Eastern Dist. of N.Y., Genomic Health Inc. to Pay $32.5 Million to Resolve Allegations Relating to the Submission of False Claims for Genomic Diagnostic Tests (Oct. 2, 2023), https://www.justice.gov/usao-edny/pr/genomic-health-inc-pay-325-million-resolve-allegations-relating-submission-false.

[16] See Press Release, U.S. Dep’t of Justice, Mobile Cardiac PET Scan Provider and Founder to Pay $85 Million to Resolve Allegedly Unlawful Payments to Referring Doctors (Oct. 10, 2023), https://www.justice.gov/opa/pr/mobile-cardiac-pet-scan-provider-and-founder-pay-85-million-resolve-allegedly-unlawful.

[17] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Mich., Hospitalist Companies Agree to Pay Nearly $4.4 Million to Settle False Claims Act Allegations (Oct. 17, 2023), https://www.justice.gov/usao-edmi/pr/hospitalist-companies-agree-pay-nearly-44-million-settle-false-claims-act-allegations#:~:text=(defendants)%20have%20agreed%20to%20pay,one%20day%2C%20and%20billing%20for.

[18] See Press Release, U.S. Dep’t of Justice, Drugmaker Nostrum and Its CEO Agree to Pay Up to $50 Million to Settle False Claims Act Claims for Underpaying Rebates Owed Under Medicaid Drug Rebate Program (Oct. 30, 2023), https://www.justice.gov/opa/pr/drugmaker-nostrum-and-its-ceo-agree-pay-50-million-settle-false-claims-act-claims.

[19] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Ky., Eastern Kentucky Hospital System and Cardiologist Agree to Collectively Pay More Than $3 Million to Resolve Civil Liability for Improper Healthcare Billings (Nov. 28, 2023), https://www.justice.gov/usao-edky/pr/eastern-kentucky-hospital-system-and-cardiologist-agree-collectively-pay-more-3.

[20] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, California Skilled Nursing Facilities, Owner and Management Company Agree to $45.6 Million Consent Judgement to Settle Allegations of Kickbacks to Referring Physicians (Nov. 15, 2023), https://www.justice.gov/opa/pr/california-skilled-nursing-facilities-owner-and-management-company-agree-456-million-consent.

[21] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, BioTelemetry and LifeWatch to Pay More than $14.7 Million to Resolve False Claims Act Allegations Relating to Remote Cardiac Monitoring Services (Dec. 18, 2023), https://www.justice.gov/opa/pr/biotelemetry-and-lifewatch-pay-more-147-million-resolve-false-claims-act-allegations.

[22] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Indiana Health Network Agrees to Pay $345 Million to Settle Alleged False Claims Act Violations (Dec. 19, 2023), https://www.justice.gov/opa/pr/indiana-health-network-agrees-pay-345-million-settle-alleged-false-claims-act-violations.

[23] See Press Release, U.S. Atty’s Office for the Southern Dist. of Tex., United Memorial Medical Center to Pay $2M Plus Additional Payments for Allegedly Causing False Claims Related to Excessive Cost Outlier Payments and Double Billing for Covid-19 tests (Dec. 20, 2023), https://www.justice.gov/usao-sdtx/pr/united-memorial-medical-center-pay-2m-plus-additional-payments-allegedly-causing-false.

[24] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Pharmaceutical Company Ultragenyx Agrees to Pay $6 Million for Allegedly Paying Kickbacks to Induce Claims for Its Drug Crysvita (Dec. 21, 2023), https://www.justice.gov/opa/pr/pharmaceutical-company-ultragenyx-agrees-pay-6-million-allegedly-paying-kickbacks-induce.

[25] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Mo., United States Reaches $9.1 Million Civil Settlement with Total Access Urgent Care over False Claims Allegations (Dec. 21, 2023), https://www.justice.gov/usao-edmo/pr/united-states-reaches-91-million-civil-settlement-total-access-urgent-care-over-false.

[26] See Press Release, U.S. Atty’s Office for the Southern Dist. of Cal., Phillips Respironics Pays $2.4 Million for Allegedly Giving Kickbacks (Dec. 22, 2023), https://www.justice.gov/usao-sdca/pr/phillips-respironics-pays-24-million-allegedly-giving-kickbacks.

[27] See Press Release, U.S. Atty’s Office for the Dist. of D.C., Booz Allen Agrees to Pay $377.45 Million to Settle False Claims Act Allegations (July 21, 2023), https://www.justice.gov/usao-dc/pr/booz-allen-agrees-pay-37745-million-settle-false-claims-act-allegations.

[28] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Mich., Federal Contractor Agrees to Pay $7 Million to Settle False Claims Act Allegations (July 21, 2023), https://www.justice.gov/usao-edmi/pr/federal-contractor-agrees-pay-7-million-settle-false-claims-act-allegations.

[29] See Press Release, U.S. Atty’s Office for the Northern Dist. of N.Y., Amphenol Corporation Pays $18 Million To Resolve Allegations That It Submitted False Claims for Electrical Connectors (Aug. 4, 2023), https://www.justice.gov/usao-ndny/pr/amphenol-corporation-pays-18-million-resolve-allegations-it-submitted-false-claims#_ftn1.

[30] See Press Release, U.S. Dep’t of Justice, Office of Pub. Affairs, Cooperating Federal Contractor Resolves Liability for Alleged False Claims Caused by Failure to Fully Implement Cybersecurity Controls (Sept. 5, 2023),

https://www.justice.gov/opa/pr/cooperating-federal-contractor-resolves-liability-alleged-false-claims-caused-failure-fully; Settlement Agreement, https://www.justice.gov/opa/file/1313011/dl?inline.

[31] See Press Release, U.S. Atty’s Office for the Eastern Dist. of Pa., Navmar Applied Sciences Corporation Agrees to Pay $4.4 Million to Resolve Claims of Double-Billing and Cost-Shifting Under U.S. Navy Contracts (Sept. 15, 2023), https://www.justice.gov/usao-edpa/pr/navmar-applied-sciences-corporation-agrees-pay-44-million-resolve-claims-double.

[32] See, Press Release, U.S. Atty’s Office for the Eastern Dist. of Pa., Boeing to Pay $8.1 Million to Resolve Alleged False Claims Act Violations Arising from Manufacture of V-22 Osprey Aircraft (Sept. 28, 2023), https://www.justice.gov/usao-edpa/pr/boeing-pay-81-million-resolve-alleged-false-claims-act-violations-arising-manufacture.

[33] See Press Release, U.S. Atty’s Office for the Southern Dist. of Ohio, Virginia Tactical Gear & Equipment Company Agrees to Pay More than $2 Million to Settle Allegations Related to Buy American Act (Nov. 20, 2023), https://www.justice.gov/usao-sdoh/pr/virginia-tactical-gear-equipment-company-agrees-pay-more-2-million-settle-allegations.

[34] See Press Release, U.S. Atty’s Office for the Northern Dist. of Fl., Florida Real Estate Broker Agrees to Pay over $4 Million to Resolve False Claims Act Allegations Relating to Fraudulent Cares Act Loans (Aug. 16, 2023), https://www.justice.gov/usao-ndfl/pr/florida-real-estate-broker-agrees-pay-over-4-million-resolve-false-claims-act.

[35] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Victory Automotive Group Inc. Agrees to Pay $9 Million to Settle False Claims Act Allegations Relating to Paycheck Protection Program Loan (Oct. 11, 2023), https://www.justice.gov/opa/pr/victory-automotive-group-inc-agrees-pay-9-million-settle-false-claims-act-allegations.

[36] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, http://tinyurl.com/FCA-settlement.

[37] See Press Release, U.S. Atty’s Office for the Northern Dist. of N.Y., United States Attorney Freedman Announces First-Ever Settlement of False Claims Act Whistleblower Case Involving Grants for Restaurants and Similar Businesses Struggling During the COVID-19 Pandemic (Nov. 1, 2023), https://www.justice.gov/usao-ndny/pr/united-states-attorney-freedman-announces-first-ever-settlement-false-claims-act.

[38] See Press Release, U.S. Atty’s Office for the Northern Dist. of Tex., Dallas Importer and Two Chinese Companies to Pay $2.5 Million to Resolve Allegations of Underpaying Customs Duties (Dec. 5, 2023), https://www.justice.gov/usao-ndtx/pr/dallas-importer-and-two-chinese-companies-pay-25-million-resolve-allegations.

[39] See Press Release, U.S. Atty’s Office for the Dist. of N.J., Bergen County Public Relations Company Settles Allegations It Received Improper Paycheck Protection Program Loan (Dec. 7, 2023), https://www.justice.gov/usao-nj/pr/bergen-county-public-relations-company-settles-allegations-it-received-improper-paycheck.

[40] See Press Release, U.S. Atty’s Office for the Northern Dist. of Tex., National Roofing Company Settles PPP Fraud Allegations for $9 Million (Dec. 11, 2023), https://www.justice.gov/usao-ndtx/pr/national-roofing-company-settles-ppp-fraud-allegations-9-million.

[41] Jason Marcus, Bracker & Marcus Ties for the Largest PPP Settlement on Record (last visited Feb. 10, 2023), https://www.fcacounsel.com/blog/bracker-marcus-ties-for-the-largest-ppp-settlement-on-record/.

[42] Justice Manual 4-4.112, Guidelines for Taking Disclosure, Cooperation, and Remediation into Account in False Claims Act Matters (May 2019), https://www.justice.gov/jm/jm-4-4000-commercial-litigation#4-4.112.

[43] Id.

[44]Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Department of Justice Issues Guidance on False Claims Act Matters and Updates Justice Manual (May 7, 2019),  https://www.justice.gov/opa/pr/department-justice-issues-guidance-false-claims-act-matters-and-updates-justice-manual.

[45] See, e.g., Speech, U.S. Dep’t of Justice, Deputy Attorney General Lisa Monaco Delivers Remarks at American Bar Association National Institute on White Collar Crime (Mar. 2, 2023), https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-remarks-american-bar-association-national.

[46]U.S. Dep’t of Justice, U.S. Attorneys’ Offices Voluntary Self-Disclosure Policy (Feb. 22, 2023);  see, e.g., https://www.justice.gov/d9/pages/attachments/2023/02/23/usao_voluntary_self-disclosure_policy.pdf; https://www.justice.gov/criminal-fraud/file/1562831/dl; https://www.justice.gov/d9/2023-04/NSD%20VSD%20Policy%20-3.1.23.pdf.

[47]Id. See https://www.justice.gov/corporate-crime/voluntary-self-disclosure-and-monitor-selection-policies.

[48]Speech, Office of Pub. Affairs, U.S. Dep’t of Justice, Deputy Attorney General Lisa O. Monaco Announces New Safe Harbor Policy for Voluntary Self-Disclosures Made in Connection with Mergers and Acquisitions (Oct. 4, 2023), https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-o-monaco-announces-new-safe-harbor-policy-voluntary-self.

[49]Deferred Prosecution Agreement, United States v. Freepoint Commodities, LLC, No. 3-23-cr-224-KAD (Dec. 12, 2023) https://www.justice.gov/opa/media/1329266/dl?inline, at ¶ 4.

[50] Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Cooperating Federal Contractor Resolves Liability for Alleged False Claims Caused by Failure to Fully Implement Cybersecurity Controls (Sept. 5, 2023), https://www.justice.gov/opa/pr/cooperating-federal-contractor-resolves-liability-alleged-false-claims-caused-failure-fully.

[51] Id.

[52] Settlement Agreement, U.S. Dep’t of Justice and Verizon Business Network Services LLC (Sept. 5, 2023), https://www.justice.gov/opa/file/1313011/dl?inline.

[53] Press Release, U.S. Atty’s Office for Eastern Dist. of Ky., Eastern Kentucky Hospital System and Cardiologist Agree to Collectively Pay More Than $3 Million to Resolve Civil Liability for Improper Healthcare Billings (Nov. 28, 2023), https://www.justice.gov/usao-edky/pr/eastern-kentucky-hospital-system-and-cardiologist-agree-collectively-pay-more-3.

[54] Settlement Agreement, U.S. Dep’t of Justice and VitalAxis, Inc. (June 15, 2023), https://www.justice.gov/d9/press-releases/attachments/2023/06/16/settlement_agreement_-_vitalaxis_-_signed_redacted.pdf.

[55] Settlement Agreement, U.S. Dep’t of Justice and MWW Group LLC (Oct. 27, 2023), https://www.justice.gov/usao-nj/media/1327611/dl?inline.

[56] Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative (Oct. 6, 2021), https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative?utm_medium=email&utm_source=govdelivery.

[57] Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Cooperating Federal Contractor Resolves Liability for Alleged False Claims Caused by Failure to Fully Implement Cybersecurity Controls (Sept. 5, 2023), https://www.justice.gov/opa/pr/cooperating-federal-contractor-resolves-liability-alleged-false-claims-caused-failure-fully.

[58] See United States ex rel. Matthew Decker v. Pennsylvania State University, 22-cv-03895-PD (E.D. Pa. Oct. 5, 2022).

[59]See U.S. Dep’t of Defense, Gen. Servs. Admin., and Nat’l Aeronautics and Space Admin., Federal Acquisition Regulation: Cyber Threat and Incident Reporting and Information Sharing (FAR Case 2021-017) (Oct. 3, 2023), https://www.federalregister.gov/documents/2023/10/03/2023-21328/federal-acquisition-regulation-cyber-threat-and-incident-reporting-and-information-sharing.

[60] See Office of Inspector General, U.S. Dep’t of Health & Hum. Servs., General Compliance Program Guidance (Nov. 2023), https://oig.hhs.gov/compliance/general-compliance-program-guidance/.

[61] Id. at 18.

[62] Id. at 19.

[63] See id. at 32.

[64] Id. at 58.

[65] Id. at 61.

[66] Id.

[67] See 42 U.S.C. § 1320a-7k.

[68] See General Compliance Program Guidance at 7.

[69] See Press Release, Office of Pub. Affairs, U.S. Dep’t of Justice, Justice Department Announces Results of Nationwide COVID-19 Fraud Enforcement Action (Aug. 23, 2023), https://www.justice.gov/opa/pr/justice-department-announces-results-nationwide-covid-19-fraud-enforcement-action.

[70] See id.

[71] S.B. 426, 2022 Gen. Assemb. (Conn. 2022); Pub. Act 23-129—HB 6826, Office of Legislative Research Public Act Summary (https://www.cga.ct.gov/2023/SUM/PDF/2023SUM00129-R02HB-06826-SUM.PDF).

[72] See Senate Budget and Appropriations Committee Statement to Senate Bill No. 4018, State of New Jersey, June 27, 2023 (https://pub.njleg.state.nj.us/Bills/2022/S4500/4018_S1.HTM); State False Claims Act Reviews, U.S. Dep’t of Health and Human Servs, Office of Inspector General, last visited Jan. 19, 2024 (https://oig.hhs.gov/fraud/state-false-claims-act-reviews/).

[73] State False Claims Act Reviews, U.S. Dep’t of Health and Human Servs, Office of Inspector General, https://oig.hhs.gov/fraud/state-false-claims-act-reviews/ (last visited Jan. 19, 2024).

[74] Id.

[75] Senate Budget and Appropriations Committee Statement to Senate Bill No. 4018, State of New Jersey, June 27, 2023 (https://pub.njleg.state.nj.us/Bills/2022/S4500/4018_S1.HTM).

[76] 2023 Legislative Agenda on Public Health, Washington State, Office of the Attorney General, https://www.atg.wa.gov/2023-legislative-agenda (last visited Jan. 19, 2023).

[77] 2023 AG Request Legislation, Protecting Whistleblower Provision of the Medicaid False Claims Act, Attorney General of Washington, 2023 (https://agportal-s3bucket.s3.amazonaws.com/uploadedfiles/Another/Office_Initiatives/Medicaid%20FCA%20Whistleblower.pdf).


The following Gibson Dunn lawyers prepared this update: Jonathan Phillips, Winston Chan, John Partridge, James Zelenay, Michael Dziuban, Alyse Ullery, John Turquet Bravard, Francesca Broggini, Samantha Hay, Katie King, James Lavery, Hayley Lawrence, Wynne Leahy, Anne Lonowski, José Madrid, Katie Rubanka, Dominic Solari, Daniel Strellman, Adrienne Tarver, Chumma Tum, Nicole Waddick, Erin Wall, and Sara Zamani.

Gibson Dunn lawyers regularly counsel clients on the False Claims Act issues and are available to assist in addressing any questions you may have regarding these issues. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s False Claims Act/Qui Tam Defense practice group:

Washington, D.C.
Jonathan M. Phillips – Co-Chair (+1 202.887.3546, [email protected])
F. Joseph Warin (+1 202.887.3609, [email protected])
Gustav W. Eyler (+1 202.955.8610, [email protected])
Lindsay M. Paulin (+1 202.887.3701, [email protected])

Geoffrey M. Sigler (+1 202.887.3752, [email protected])
Joseph D. West (+1 202.955.8658, [email protected])

San Francisco
Winston Y. Chan – Co-Chair (+1 415.393.8362, [email protected])
Charles J. Stevens (+1 415.393.8391, [email protected])

New York
Reed Brodsky (+1 212.351.5334, [email protected])
Mylan Denerstein (+1 212.351.3850, [email protected])
Alexander H. Southwell (+1 212.351.3981, [email protected])

Denver
Ryan T. Bergsieker (+1 303.298.5774, [email protected])
Robert C. Blume (+1 303.298.5758, [email protected])
Monica K. Loseman (+1 303.298.5784, [email protected])
John D.W. Partridge (+1 303.298.5931, [email protected])

Dallas
Andrew LeGrand (+1 214.698.3405, [email protected])

Los Angeles
Nicola T. Hanna (+1 213.229.7269, [email protected])
Jeremy S. Smith (+1 213.229.7973, [email protected])
Deborah L. Stein (+1 213.229.7164, [email protected])
James L. Zelenay Jr. (+1 213.229.7449, [email protected])

Palo Alto
Benjamin Wagner (+1 650.849.5395, [email protected])

*Nicole Waddick is an associate practicing in the firm’s San Francisco office who currently is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

From the Derivatives Practice Group: In a busy week for derivatives reporting, the CFTC extended the public comment period for its proposed reporting and ISDA touted its Digital Regulatory Reporting (DRR) initiative as the best approach to handling various jurisdictions’ revised reporting requirements set to go live this year.

New Developments

  • CFTC Extends Public Comment Period for Proposed Rule on Real-Time Public Reporting Requirements and Swap Data Recordkeeping and Reporting Requirements. On February 26, the CFTC announced that it is extending the deadline for the public comment period on a proposed rule that makes certain modifications to the CFTC’s swap data reporting rules in Parts 43 and 45 related to the reporting of swaps in the other commodity asset class and the data element appendices to Parts 43 and 45 of the CFTC’s regulations. The deadline is being extended to April 11, 2024. The proposed rule was published in the Federal Register on December 28, 2023, with a 60-day comment period scheduled to close on February 26, 2024. [NEW]
  • CFTC Staff Issues No-Action Letter Regarding Pre-Trade Mid-Market Mark for Certain Interest Rate Swaps Referencing SOFR. On February 22, the CFTC’s Market Participants Division (MPD) issued a no-action letter applicable to all registered swap entities in relation to the requirement in Regulation 23.431 that swap dealers and major swap participants (swap entities) disclose to certain counterparties the Pre-Trade Mid-Market Mark (PTMMM) of a swap. The no-action letter states that MPD will not recommend the CFTC take an enforcement action against a registered swap entity for its failure to disclose the PTMMM to a counterparty in certain interest rate swaps referencing the Secured Overnight Financing Rate that are identified in the no-action letter, provided that: (1) real-time tradeable bid and offer prices for the swap are available electronically, in the marketplace, to the counterparty; and (2) the counterparty to the swap agrees in advance, in writing, that the registered swap entity need not disclose a PTMMM for the swap. According to the CFTC, the no-action letter provides a similar no-action position as that in CFTC Staff Letter No. 12-58 for certain interest rate swaps referencing the London Interbank Offered Rate. CFTC Commissioner Christy Goldsmith Romero objected to the no-action letter, arguing that it inappropriately shifts the burden of understanding swap dealer’s conflicts and incentives back onto counterparties, upending the Dodd-Frank Act’s intent.
  • CFTC Approves Three Proposed Rules and Other Commission Business. On February 20, the CFTC approved three proposed rules through its seriatim process: (1) Regulations to Address Margin Adequacy and to Account for the Treatment of Separate Accounts by Futures Commission Merchants; (2) Foreign Boards of Trade; and (3) Requirements for Designated Contract Markets and Swap Execution Facilities Regarding Governance and the Mitigation of Conflicts of Interest Impacting Market Regulation Functions. All three proposals have a comment deadline of April 22, 2024. Additionally, the CFTC issued an order of exemption from registration as a derivatives clearing organization (DCO) to Taiwan Futures Exchange Corporation and approved an amended order of registration for ICE NGX Canada, Inc., adding environmental contracts to the scope of contracts it is eligible to clear as a DCO.
  • CFTC Extends Comment Period on Proposed Rules for Operational Resilience Frameworks. On February 20, the CFTC extended the comment period on its proposed rules implementing requirements for operational resilience frameworks for futures commission merchants, swap dealers and major swap participants. The new deadline is April 1, 2024.
  • CFTC GMAC to Meet March 6. The CFTC’s Global Markets Advisory Committee (GMAC) will meet on Wednesday, March 6 at 10am ET. The GMAC will hear presentations from its Global Market Structure Subcommittee, Technical Issues Subcommittee and Digital Asset Markets Subcommittee, and consider their recommendations. The CFTC stated that the GMAC recently advanced eight recommendations to the Commission following its November meeting. According to the CFTC, the upcoming GMAC meeting will build upon the GMAC’s progress toward developing solutions to the most significant challenges in global markets, as set forth in its 2023-2025 work program.

New Developments Outside the U.S.

  • HKMA Sets Out Expectations on Tokenized Product Offerings. On February 20, the Hong Kong Monetary Authority (HKMA) published a circular covering the sale and distribution of tokenized products. According to the HKMA, the prevailing supervisory requirements and consumer/investor protection measures for the sale and distribution of a product are also applicable to its tokenized form as it has terms, features and risks similar to those of the underlying product. The HKMA clarified that authorized institutions should conduct adequate due diligence and fully understand the tokenized products before offering them to customers and on a continuous basis at appropriate intervals. Authorized institutions are also expected to act in the best interest of their customers and make adequate disclosure of the relevant material information about a tokenized product, including its key terms, features and risks. Finally, the HKMA indicated that authorized institutions should put in place proper policies, procedures, systems and controls to identify and mitigate the risks arising from tokenized product-related activities.
  • HKMA Sets Standards for Digital Asset Custodial Services. On February 20, the HKMA issued guidance for authorized institutions interested in offering custody services for digital assets. The HKMA expects authorized institutions to undertake a comprehensive risk assessment followed by the implementation of appropriate policies to manage identified risks. The entire process should be overseen by the board and senior management. The HKMA also requires authorized institutions to conduct independent systems audits, store a substantial portion of client digital assets in cold storage, ensure that private keys are secured within Hong Kong and provide all records to HKMA whenever requested. Authorized institutions should notify the HKMA and confirm that they meet the expected standards in the guidance within 6 months from the date of the guidance (i.e. February 20, 2024).
  • ASIC Publishes Third Consultation Paper on OTC Derivatives Reporting. On February 15, the Australian Securities and Investments Commission (ASIC) published Consultation Paper (CP) 375: Proposed changes to the ASIC Derivatives Transaction Rules (Reporting): Third consultation. CP 375 proposes the following changes to ASIC Derivative Transaction Rules (Reporting) 2024: simplify the exclusion of exchange-traded derivatives; simplify the scope of foreign entity reporting; remove the alternative reporting provisions; clarify the exclusion of FX securities conversion transactions; and add additional allowable values for two data elements. Additionally, CP 375 proposes minor changes to ASIC Derivative Transaction Rules (Clearing) 2015: simplify and align the exclusion of exchange-traded derivatives with the 2024 reporting rules and make minor updates to re-reference certain definitions to their changed location in the Corporations Act 2001. The proposed changes would commence on October 21, 2024, except for the changes to the scope of foreign entity reporting and the removal of alternative reporting provisions, which would commence on April 1, 2025. ASIC indicated that it does not expect most reporting entities to face any material additional compliance burden upon implementation of the proposed changes. However, a small number of international reporting entities and some small-scale exempt reporting entities may be impacted, according to ASIC. The consultation period will run until March 28, 2024.
  • Council of the EU Ratifies EMIR 3 Agreement at Ambassador Level. On February 14, the European Market Infrastructure Regulation 3 (EMIR 3) package (regulation and directive), as negotiated in the trilogues, was approved at ambassador level. The texts are available here. According to ISDA, the final text maintains the Council of the EU’s less punitive approach of an operational active account with representativeness. It also introduces a requirement for financial counterparties and non-financial counterparties above certain de minimis thresholds to hold an active account at an EU CCP and to clear a number of representative trades in that account. The directive amending the Capital Requirement Regulation is intended to provide more specific tools and powers under Pillar 2 in the context of excessive concentration to CCPs.
  • CPMI, IOSCO Publish Paper on Streamlining VM in Centrally Cleared Markets. On February 14, the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published a discussion paper on streamlining variation margin (VM) in centrally cleared markets. The discussion paper follows the review of margining practices, published in 2022 by the Basel Committee on Banking Supervision, the CPMI and IOSCO. The discussion paper sets out eight effective practices, covering intraday VM call scheduling and frequency, treatment of excess collateral, the pass-through of VM by CCPs and transparency between CCPs, clearing members and their clients. The deadline for comment is April 14.
  • ESMA Withdraws Euronext Authorization as a Data Reporting Service Provider Under MIFIR Upon the Entity’s Request. On February 13, ESMA withdrew the authorization of Euronext Paris SA (Euronext) as a Data Reporting Service Provider (DRSP) under the Markets in Financial Instruments Regulation (MiFIR). Euronext was authorized as both an Approved Reporting Mechanism and an Approved Publication Arrangement under MiFIR since January 3, 2018. MiFIR provides that ESMA shall withdraw the authorization of a DRSP where the DRSP expressly renounces its authorization. ESMA’s withdrawal decision follows the notification by Euronext of its intention to renounce its authorization under the conditions set out in Article 27e(a) of MIFIR.
  • ESMA Publishes Latest Edition of its Newsletter. On February 13, ESMA published  its latest edition of the Spotlight on Markets Newsletter. The newsletter focused on the last ESMA consultation package related to the Markets in Crypto Assets Regulation (MiCA). ESMA invited stakeholders to send their feedback on reverse solicitation and classification of crypto assets as financial instruments by April 29, 2024. The newsletter also launched a call for candidates for ESMA’s Securities Markets Stakeholder Group and called interested parties who can give a strong voice to consumers, industry, users of financial services, employees in the financial sector, SMEs as well as academics to apply by March 18.

New Industry-Led Developments

  • ISDA Updates Updated OTC Derivatives Compliance Calendar. On February 29, ISDA announced that it has updated its global calendar of compliance deadlines and regulatory dates for the over-the-counter (OTC) derivatives space. [NEW]
  • ISDA Extends Digital Regulatory Reporting InitiativeDRR: The Answer to Reporting Rule Rush. On February 26, ISDA reported that it has worked to extend its Digital Regulatory Reporting (DRR) initiative to cover the rush of reporting rules, which starts with Japan on April 1, followed by the EU on April 29, the UK on September 30 and Australia and Singapore on October 21. ISDA stated that iIn each case, regulators are revising their rules to incorporate globally agreed data standards in an effort to improve the cross-border consistency of what is reported and the format in which it is submitted – a process that started in December 2022 with the rollout of the first phase of the US Commodity Futures Trading Committee’s revised swap data reporting rules. [NEW]
  • ISDA Publishes Clearing Model Comparison. On February 1, ISDA published a comparison of US Treasury clearing models at the Fixed Income Clearing Corporation, as well as models for clearing repos at other central counterparties globally and models for clearing derivatives. ISDA explained that Tthis comparison is intended to help market participants understand existing and potential new clearing models for UST cash and repo transactions as they implement the US SEC’s recent rules requiring clearing of such transactions. [NEW]
  • ISDA Responds to FCA on Commodity Derivatives. On February 15, ISDA and the Association for Financial Markets in Europe (AFME) submitted a joint response to the UK Financial Conduct Authority (FCA) consultation on the reform of the UK commodity derivatives regulatory framework. The consultation sought to remove unnecessary burdens on firms and strengthen the supervision of the UK’s commodity derivatives markets. The associations indicated that they strong support the FCA’s proposal to apply a narrower position limits regime that it views as more proportionate to the risks associated with certain commodity derivatives contracts. However, the associations expressed concern over the proposed approaches for setting position limits and adding additional reporting obligations. They noted that the complex and burdensome frameworks proposed can, in their view, discourage participation in UK trading venues by non-UK participants and may have a negative impact on the competitiveness of UK markets. The response also recommends a longer implementation period of at least 24 months, based on the association’s perception of the scale of the operational and technical changes required.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The Office of Information and Communications Technology and Services of the U.S. Department of Commerce is poised to dramatically expand compliance requirements in key technology sectors with new leadership and proposed new regulations targeting Infrastructure as a Service providers and large AI model training.

Since coming into office, the Biden administration has largely continued and expanded efforts to regulate AI and other emerging technologies begun under the Trump administration, and recent actions by the U.S. Department of Commerce (“Commerce”) signal that U.S. Infrastructure as a Service (“IaaS”)providers and their resellers will soon face a host of new compliance requirements concerning their customers and ultimate end-users.

Commerce recently announced the appointment of Elizabeth Cannon as the first Executive Director of the Office of Information and Communications Technology and Services (“OICTS”), signaling a renewed focus on the information and communications technology and services (“ICTS”) sector. For several years, Commerce has worked to stand up OICTS to implement a series of executive orders (“EOs”) issued by the Trump and Biden administrations aimed at securing the telecommunications supply chain,[1] addressing malicious cyber-enabled activity,[2] protecting the sensitive data of U.S. citizens,[3] and providing guardrails on the use and development of AI.[4]

Finalizing regulations implementing these varied EOs has proven a difficult task, as Commerce, along with partner government agencies, continue to develop measures designed to address pressing national security concerns while simultaneously avoiding stifling the innovation necessary to develop emerging technologies. Early in this effort, Commerce developed regulations permitting the Secretary of Commerce (“Secretary”) to block certain information and communications technology or service transactions involving “foreign adversaries.” These regulations became effective in March 2021, implementing Trump era EO 13,873. The Biden administration quickly followed suit after taking office, issuing a pair of EOs aimed at protecting the sensitive data of U.S. citizens (EO 14,034) and providing guardrails for the development and use of AI (EO 14,110), in addition to regulations expanding the Secretary’s discretion to block transactions involving “connected software application” and foreign adversaries. More recently, Commerce announced an advance notice of proposed rulemaking to solicit public comment on similar restrictions targeting transactions involving “connected vehicles,” a term whose definition has yet to be defined but would include automotive vehicles incorporating ICTS. Despite these regulatory developments, OICTS has until recently remained a nascent office with relatively little enforcement activity. However, that is likely to change in the near term, and companies may soon be faced with a new set of compliance and reporting obligations, along with steep penalties for inaction.

On January 29, 2024, Commerce’s Bureau of Industry and Security (“BIS”) issued a proposed rule aimed at the activities of U.S. IaaS providers, including the training of large AI models. These new rules would require all U.S. IaaS providers and their foreign resellers to establish written Customer Identification Programs (“CIPs”) to collect, verify, and maintain identifying information about their foreign customers. Additionally, U.S. IaaS providers would be required to file reports with Commerce whenever they have “knowledge” (defined to cover actual knowledge and an awareness of a high probability, which can be inferred from acts constituting willful blindness) of any transaction between the provider and a foreign person “which results or could result in the training of a large AI model with potential capabilities that could be used in malicious cyber-enabled activity.”[5] The proposed new rule implements specific provisions of two separate EOs—EO 13,984 issued in the final days of the Trump administration and the aforementioned EO 14,110—and is aimed at addressing threats to U.S. IaaS products and services by foreign malicious cyber actors.

Compliances professionals already familiar with Know Your Customer (“KYC”) requirements under such existing trade controls regimes as the U.S. Export Administration Regulations (“EAR”) administered by BIS and various sanctions programs administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”) will recognize much of the language in the proposed compliance requirements. However, the proposed ICTS regulations also contain many unique facets such as customer identification and recordkeeping requirements that require additional consideration. Ultimately, companies that operate in the IaaS and AI fields, as well as related industries, will likely be obliged to implement additional compliance and reporting measures before transacting with certain foreign persons once the proposed regulations come into effect.

At present, there is no effective date for the proposed rule, though Commerce has requested public comment on several aspects of the proposed regulations—including whether Commerce should receive and approve all CIPs—by April 29, 2024. Once the comment process concludes, Commerce will then move forward with a “final rule,” though additional comments may be requested at Commerce’s discretion. However, given the details already included in the proposed rule, a final rule and effective date in the coming months are likely.

Key Terms and Definitions

The definitions in the new regulations clearly articulate the potentially expansive impact the proposed rule is likely to have. For example, the new CIP requirements (discussed in detail below) apply to all U.S. providers of “IaaS products,” defined broadly as a product or service offered to a consumer “that provides processing, storage, networks, or other fundamental computing resources, and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications.”[6]

A “U.S. IaaS provider” is defined to include any U.S. person that offers any “IaaS product,” while the term “U.S. person” is broadly defined to include U.S. citizens and permanent resident aliens, entities organized under U.S. law, and persons present in the United States, similar to the definition of “U.S. person” under EAR.[7] The term “foreign reseller of U.S. [IaaS] products,” is similarly broadly defined to include non-U.S. persons who have “established an [IaaS] account to provide [IaaS] products subsequently, in whole or in part, to a third party.”[8] Importantly, and as discussed in detail below, such foreign resellers are also subject to certain compliance and reporting requirements under the new regulations.

Likely in an attempt to standardize the definition across various government agencies, “AI” is defined by reference to 15 U.S.C. 9401(3), which defines the term as “a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations or decisions influencing real or virtual environments. Artificial intelligence systems use machine and human-based inputs to (A) perceive real and virtual environments; (B) abstract such perceptions into models through analysis in an automated manner; and (C) use model inference to formulate options for information or action.”[9]

While the AI reporting requirements are tied specifically to “large AI model[s] with potential capabilities that could be used in malicious cyber-enabled activity,” the technical parameters of this term are not yet wholly defined.[10] Rather, Commerce notes that it will publish applicable technical conditions in a forthcoming Federal Register notice, though it remains unclear if these parameters will be published as a proposed or final rule. Where the lines defining the types of “AI” caught under the proposed regulations are ultimately drawn will have a significant impact on many industries, and Commerce appears highly interested in receiving additional input and guidance from members of potentially-impacted industries through the public comment process.

Customer Identification Program Requirement: Collect, Identify, Maintain

The proposed CIP requirement consists of three main components: (1) information collection; (2) customer verification; and (3) recordkeeping. These requirements apply to both U.S. IaaS providers and their foreign resellers.

Customer information. The proposed rule provides that all U.S. IaaS providers and their foreign resellers must collect, at minimum, the following information from any potential foreign customer prior to opening an account with that customer:

  • Name or business name;
  • Address (for an entity, the principal place of business and the location(s) from which the IaaS product will be used; for an individual, the street address and the location(s) from which the IaaS product will be used);
  • Jurisdiction under whose laws the person is organized (for a person other than an individual);
  • Name(s) of beneficial owner(s) of an IaaS account in which a foreign person has an interest (if not held by an individual);
  • Means and source of payment for the account (including credit number, account number, and customer identifier);
  • Email address;
  • Telephonic contact information; and
  • IP addresses used for access or administration and the date and time of each such access or administrative action.[11]

Customer verification. The proposed rule also requires the CIP to contain procedures for verifying the identity of potential foreign customers through (i) a “documentary verification method,” (ii) a “non-documentary verification method,” or (iii) in some cases, a combination of both.[12] The CIP must also address situations where the IaaS provider will obtain further information to verify a customer’s identity when other documentary and non-documentary methods fail, or when the attempted verification leads the IaaS provider to doubt the true identity of the potential customer.[13] Finally, the proposed rule requires the CIP to include procedures for situations in which the U.S. IaaS provider cannot reasonably ascertain the identity of a potential customer, including procedures describing (i) when the provider should not open an account for the potential customer, (ii) the terms under which a customer may use an account while the provider attempts to verify the customer’s identity (such as restricted permission or enhanced monitoring of the account), (iii) when the IaaS provider should close an account after verification attempts have failed, and (iv) other measures for account management or redress for customers whose identification could not be verified or whose information may have been compromised.[14]

Recordkeeping. The proposed recordkeeping requirements are relatively straightforward. Under the proposed rule, the CIP must include procedures for maintaining a record of the identifying information collected by the provider; retain the required record for at least two years after the date the account is closed (or was last accessed); and include methods to ensure the record will not be shared with any third party. With respect to the content of the record, the proposed rule requires the record to include:

  • All identifying customer information listed above;
  • A copy or description of any document relied on to verify a customer’s identity;
  • A description of any methods and the results of any measures used to verify the identity of the customer and the account’s beneficial owner(s); and
  • A description of the resolution of any substantive discrepancy discovered when verifying identifying information.[15]

While trade compliance professionals have deep familiarity with conducting customer due diligence to satisfy long-standing regulatory requirments, the explicit level of detail that CIPs must address extends beyond the KYC requirements currently outlined by OFAC[16] and BIS.[17] As stated above, the proposed CIP rule applies to both U.S. IaaS providers and their foreign resellers. Indeed, under the proposed rule, U.S. providers are responsible for ensuring their foreign resellers maintain compliant CIPs and for furnishing those CIPs to Commerce within 10 days upon request.[18] In addition, U.S. providers must take appropriate action in response to their foreign resellers’ non-compliance with the rule. Specifically, the proposed rule provides that a U.S. IaaS provider must, upon receiving evidence that a foreign reseller has failed to maintain a CIP or to undertake good-faith efforts to prevent the use of U.S. IaaS products for malicious cyber-enabled activities, take steps to (1) terminate the foreign reseller account within 30 days absent remediation by the reseller, and (2) if relevant, report the malicious cyber-enabled activity.[19] According to the proposed rule, Commerce anticipates that compliance with any new CIP regulations would be required within one year of the date of publication of a final rule, which as noted above could be published in the upcoming months. In light of these forthcoming requirements, compliance professionals should revisit and revise, as appropriate, the requirements and procedural guidance associated with their customer due diligence programs.

CIP Certification

Commerce proposes to monitor compliance with the CIP requirement in part by requiring U.S. IaaS providers to certify their CIPs (and the CIPs of their foreign resellers) on an annual basis. Under the proposed rule, each U.S. IaaS provider is required to submit a “CIP certification form” that must include, among other items:

  • A description of the systems or tools the IaaS provider uses to verify the identity of foreign customers;
  • The procedures the IaaS provider uses to require a customer to notify the provider of any changes to the customer’s ownership (including the addition or removal of beneficial owners);
  • The systems or tools used by the IaaS provider to detect malicious cyber activity;
  • The procedures for requiring each foreign reseller to maintain a CIP;
  • The procedures for identifying when a foreign person transacts to train a large AI model with potential capabilities that could be used in malicious cyber-enabled activities;
  • The name, title, email, and phone number of the primary contact responsible for managing the CIP;
  • A description of the IaaS provider’s service offerings and customer bases in foreign jurisdictions;
  • The number of employees in IaaS provision and related services;
  • The process the IaaS provider uses to report any malicious cyber activity;
  • The number of IaaS customers;
  • The number and locations of the IaaS provider’s foreign beneficial owners;
  • A list of all foreign resellers of IaaS products; and
  • The number of IaaS customer accounts held by foreign customers whose identity has not been verified, including a description and timeline of actions the IaaS provider will take to verify the identity of each customer, among other information.[20]

The annual certification must include various attestations, including attestations that the provider has (i) reviewed its CIP since the date of its last certification; (ii) updated its CIP to account for any changes in its service offerings, the threat landscape, and changes to the applicable regulations since its last certification; (iii) tracked the number of times it was unable to verify the identity of any customer since its last certification; and (iv) recorded the resolution of each situation described in (iii).[21] The proposed rule also requires IaaS providers to notify Commerce outside of the annual reporting cycle in various situations, including when the provider undergoes a significant change in business operations or corporate structure, or if the provider implements a material change to its CIP, such as a material change in its customer verification methods.[22] Importantly, newly established IaaS providers will be required to submit a CIP certification prior to furnishing any foreign customer with an IaaS account.[23]

Compliance Assessments

Commerce plans to use compliance assessments to enforce the proposed CIP requirement. Under the proposed rule, Commerce will, after reviewing CIP certification forms, and “at its sole discretion as to time and manner,” conduct compliance assessments of certain U.S. IaaS providers based on the risks associated with a given CIP, U.S. IaaS provider, or any of the provider’s foreign resellers.[24] Commerce similarly has the power to request an audit of any U.S. IaaS provider’s CIP processes and procedures. The evaluation of potential risks by Commerce will consider, among other criteria, whether the services or products of the U.S. provider or foreign reseller are likely to be used by foreign malicious cyber actors, or by a foreign person to train a large AI model with potential capabilities that could be used in malicious cyber-enabled activity.[25]

The proposed rule outlines two general actions Commerce may take based on the results of a compliance assessment. First, Commerce may require a U.S. IaaS provider to take remedial measures, including (i) general measures to address any risk of U.S. IaaS products being used in support of malicious cyber activity, and (ii) “special measures”—including prohibitions or conditions on maintaining accounts with certain foreign persons—to counter malicious cyber-enabled activity. Second, Commerce may decide to review a particular transaction or class of transactions of an IaaS provider. Nothing in the proposed rule limits Commerce to recommending (or requiring) only one specific remedial measure, and it is possible Commerce could impose multiple remedial obligations in response to a compliance assessment.[26]

Exemptions from the CIP Requirement

Although the proposed CIP requirement generally applies to all U.S. IaaS providers and their foreign resellers, the proposed rule allows the Secretary to exempt any provider, any specific type of account or lessee, or reseller from the CIP requirement if the party “implements security best practices to otherwise deter abuse of IaaS products.”[27] To satisfy this criterion, a party must establish an Abuse of IaaS Products Deterrence Program (“ADP”) that is designed to detect, prevent, and mitigate malicious cyber-enabled activities in connection with their accounts. The ADP must include policies and procedures to (i) identify relevant “Red Flags” (that is, activities that indicate possible malicious cyber-enabled activities) for the relevant accounts; (ii) detect those Red Flags, including by implementing privacy-preserving data sharing and analytics methods as feasible; and (iii) respond appropriately to any Red Flags detected.[28] The ADP (including the relevant Red Flags) must also be updated regularly to reflect changes in risks and must be continuously administered by the U.S. IaaS provider.

Establishing an ADP is a necessary, but not sufficient, condition to obtain an exemption from the CIP requirement. Specifically, the proposed rule explains that the Secretary will decide whether to grant an exemption by considering:

  • Whether the size and complexity of the ADP is commensurate with the nature of the provider’s product offerings;
  • Whether the ADP’s ability to detect and respond to Red Flags is sufficiently robust;
  • Whether oversight of reseller arrangements is effective;
  • The extent to which the provider cooperates with law enforcement to provide forensic information for investigations of identified malicious cyber-enabled activities; and
  • Whether the provider participates in public-private collaborative efforts, such as consortia to develop improved methods to detect and mitigate cyber-enabled activities.[29]

Even after an ADP is deemed sufficient by the Secretary, the proposed regulations are clear that the exemption may be revoked at any time, including to impose special measures as described below.

Special Measures

The overarching purpose of the CIP requirement is to prevent foreign persons from using U.S. IaaS products to conduct malicious cyber-enabled activities. Consistent with that purpose, the proposed rule permits the Secretary to require providers to take “special measures” if the Secretary determines that “reasonable grounds exist for concluding that a foreign jurisdiction or foreign person is conducting malicious cyber-enabled activities using U.S. IaaS products.”[30] These “special measures” include (1) prohibitions or conditions on opening or maintaining accounts within a foreign jurisdiction that has a significant number of foreign persons offering or obtaining U.S. IaaS products used for malicious cyber activity; and (2) prohibitions or conditions on maintaining an account with a foreign person who has a pattern of conduct of obtaining or offering U.S. IaaS products for use in malicious cyber activities.[31]

In selecting which special measure to take, the Secretary will consider:

  • Whether the imposition of any special measure would create a “significant competitive disadvantage” for U.S. IaaS providers, including due to any undue burden associated with compliance;
  • The extent to which the timing of any special measure would have a “significant adverse effect on legitimate business activities” involving the particular foreign jurisdiction or foreign person; and
  • The effect of any special measure on U.S. national security or foreign policy, law enforcement investigations, U.S. supply chains, or public health.[32]

Any special measure imposed under the proposed rule may not remain in effect for more than 365 calendar days (absent publication of a notice of extension), and a U.S. IaaS provider has 180 days following the Secretary’s determination that a special measure is required before it must implement the measure.[33]

Reporting of Large AI Model Training

The second key piece of the proposed rule requires U.S. IaaS providers to submit a report to Commerce whenever they have “knowledge” (as defined above) of any transaction between the provider and a foreign person “which results or could result in the training of a large AI model with potential capabilities that could be used in malicious cyber-enabled activity.”[34] The proposed rule defines “large AI model” as any AI model with the technical conditions of a “dual-use foundation model” or that “otherwise has technical parameters of concern” that enable the AI model to “aid or automate aspects of malicious cyber-enabled activity,” though as noted previously, the technical parameters defining what exactly constitutes a large AI model are forthcoming.[35]

For covered transactions involving such AI models, the proposed rule requires U.S. IaaS providers to report to Commerce, within 15 calendar days of a covered transaction occurring (or the provider or reseller having knowledge that a covered transaction has occurred) (i) certain identifying information about the foreign customer (such as name, address, means and source of payment, and the location from which the training request originates) and (ii) information about the training run itself, including the estimated number of computational operations used in the training run, the model of the primary AI used in the training run accelerators, and information on cybersecurity practices, among others.[36] U.S. IaaS providers must also require their foreign resellers to submit similar reports to the provider within 15 calendar days whenever the reseller has knowledge of a covered transaction, after which the provider must file the report with Commerce within 30 calendar days of the covered transaction.[37] Following such reports, Commerce may initiate follow-up requests to which the U.S. IaaS provider must respond within 15 calendar days.[38] Finally, under the proposed rule, no U.S. IaaS provider may provide IaaS products to a foreign reseller unless the provider has made all reasonable efforts to ensure the reseller has complied with the large AI model training reporting requirement.[39]

Penalties and Enforcement

Even though related ICTS regulations already permit penalties, Commerce has proposed new enforcement provisions specifically tied to non-compliance with the proposed rule. Violations can result in civil monetary fines of up to $364,992 per violation (an amount adjusted annually for inflation) or twice the value of the transaction, whichever is greater. Criminal penalties involving fines up to $1,000,000, imprisonment for up to 20 years, or both are also available in cases involving willful violations.[40] Under the proposed rule, violations would include the following:

  • Engaging in, or conspiring to engage in, any conduct prohibited by the proposed regulations;
  • Failing to submit reports, certifications, or recertifications, as appropriate, or failing to comply with terms of notices or orders from Commerce;
  • Failing to implement or maintain CIPs as required, or continuing to transact with a foreign reseller that fails to implement or maintain a CIP as set forth in the regulations;
  • Providing IaaS products to a foreign person while failing to comply with any direction, determination, or condition issued under the regulations;
  • Aiding, abetting, counseling, commanding, inducing, procuring, permitting, approving, or otherwise supporting any act prohibited by any direction, determination, or condition issued under the regulations;
  • Attempting or soliciting a violation of any direction, determination, or condition issued under the regulations;
  • Failing to implement any required prohibition or suspension related to large AI model training; and
  • Making a false or misleading representation, statement, notification, or certification, whether directly or indirectly through any other person, or falsifying or concealing any material fact to Commerce related to compliance with the regulations.[41]

Looking Forward

The proposed rule has significant implications for U.S. IaaS providers and their resellers, requiring the implementation of robust CIPs, certification of those programs on an annual basis, and, under some circumstances, the imposition of “special measures” against a foreign jurisdiction or foreign person when that jurisdiction or person obtains products for use in malicious cyber activities. As discussed previously, the proposed rule also requires IaaS providers and their foreign resellers to report transactions with foreign persons that involve training large AI models with potential capabilities for malicious cyber-enabled activity. Although a final rule is likely still several months away, IaaS providers can take several steps now to prepare for the new regulations and ease the transition to the new reporting regime:

  • Provide Written Comments: Commerce is soliciting public comment on various aspects of the proposed rule, including on whether it should receive and approve all CIPs, and whether there currently exist best practices for customer identification and verification that IaaS providers can use as a model for their CIPs. Companies must provide comments by email ([email protected]) or at regulations.gov by April 29, 2024.
  • Review and Enhance Current Practices: IaaS providers can perform an internal review of their current customer identification and verification practices to assess how those practices align with the proposed CIP requirements and identify areas that fall short of those requirements. Such a review would allow providers to jumpstart their compliance efforts and prepare for any required reports.
  • Take Stock of Foreign Resellers and Foreign Customers: Because the reporting obligations apply to U.S. IaaS providers and their foreign resellers, providers may find it beneficial to evaluate their existing reseller relationships and the extent to which their resellers take steps to verify the identity of their customers and operate using cybersecurity best practices. U.S. IaaS providers may also consider reviewing the compliance obligations in their contracts with foreign resellers to ensure that the requirements under the proposed rule are sufficiently covered.
  • Identify AI Training-Related Accounts: IaaS providers should review current and potential future accounts that may fall within the proposed rule’s definition of transactions involving “large AI model training.” The turnaround time for reporting such transactions is relatively short (15 calendar days), so providers may be well-served by conducting a preliminary assessment of their obligations under this part of the proposed rule before the final rule goes into effect. Providers may also wish to proactively develop or enhance procedures for responding to instances of suspected training of large AI models for use in malicious cyber-enabled activities to ensure all appropriate deadlines are met.

Gibson Dunn attorneys remain ready to assist companies with these preparatory steps or to address any questions about the potential role that OICTS may play in the near future.

__________

[1] Exec. Order No. 13,873, 84 Fed. Reg. 22,689 (May 17, 2019).

[2] Exec. Order No. 13,984, 86 Fed. Reg. 6,837 (Jan. 25, 2021).

[3] Exec. Order No. 14,034, 86 Fed. Reg. 31,423 (June 11, 2021).

[4] Exec. Order No. 14,110, 88 Fed. Reg. 75,191 (Nov. 1, 2023).

[5] Taking Additional Steps To Address the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities, 89 Fed. Reg. 5,698, 5,733 (Jan. 29, 2024) [hereinafter NPRM].

[6] Id. at 5,726.

[7] Id. at 5,727.

[8] Id. at 5,726.

[9] 15 U.S.C. 9401(3).

[10] NPRM, supra note 5, at 5,727.

[11] Id. at 5,727-28.

[12] Id. at 5,728.

[13] Id.

[14] Id.

[15] Id.

[16] See OFAC, A Framework for OFAC Compliance Commitments 4 (May 2, 2019), https://ofac.treasury.gov/media/16331/download?inline.

[17] See 15 C.F.R. Part 732, Supplement No. 3.

[18] NPRM, supra note 5, at 5,729-30.

[19] Id. at 5,729.

[20] Id.

[21] Id.

[22] Id.

[23] Id. at 5,730.

[24] Id.

[25] Id.

[26] Id.

[27] Id.

[28] Id. at 5,730-31.

[29] Id. at 5,731-32.

[30] Id. at 5,732.

[31] Id.

[32] Id. at 5,733.

[33] Id. at 5,732.

[34] Id. at 5,733 (emphasis added).

[35] Id. at 5,727.

[36] Id. at 5,734.

[37] Id.

[38] Id.

[39] Id.

[40] Id. at 5,735.

[41] Id. at 5,734.


The following Gibson Dunn lawyers prepared this update: Adam Smith, Stephenie Gosnell Handler, Chris Timura, Marcus Curtis, and Chris Mullen.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these issues. For additional information about how we may assist you, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or the following leaders and members of the firm’s International Trade or Privacy, Cybersecurity & Data Innovation practice groups:

International Trade:
Adam M. Smith – Washington, D.C. (+1 202.887.3547, [email protected])
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, [email protected])
Christopher T. Timura – Washington, D.C. (+1 202.887.3690, [email protected])
David P. Burns – Washington, D.C. (+1 202.887.3786, [email protected])
Marcus Curtis – Orange County (+1 949.451.3985, [email protected])
Chris R. Mullen – Washington, D.C. (+1 202.955.8250, [email protected])
Samantha Sewall – Washington, D.C. (+1 202.887.3509, [email protected])

Privacy, Cybersecurity and Data Innovation:
S. Ashlie Beringer – Palo Alto (+1 650.849.5327, [email protected])
Jane C. Horvath – Washington, D.C. (+1 202.955.8505, [email protected])
Vivek Mohan – Palo Alto (+1 650.849.5345, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The decision raises questions as to the validity of certain stockholder consent and designation-related rights found in many public and private company stockholder agreements.

On February 23, 2024, Vice Chancellor J. Travis Laster of the Delaware Court of Chancery issued a long-awaited opinion[1] ruling on the validity of pre-approval requirements and board- and committee-related designation rights included in the stockholder agreement between a public company and its founder that was entered into before the company went public.

The decision calls into question the enforceability of certain stockholder consent and designation-related rights that have long been considered market-standard and are found in many stockholder agreements for both public and private companies.  This alert summarizes the provisions that were challenged in the case and the Court’s decision.  The decision left many questions unanswered, and we encourage you to reach out to any of your Gibson Dunn contacts to discuss the implications of this decision and any next steps.

I. Challenged Provisions

The challenged provisions in the case fall into two primary categories: (i) pre-approval requirements (commonly referred to as “consent” or “veto” rights[2]) and (ii) board and committee composition provisions (so-called “designation” provisions). The plaintiff challenged the facial validity of these provisions in the company’s stockholder agreement on the basis that they violate Section 141(a) of the Delaware General Corporation Law (DGCL), which provides that “the business and affairs of every corporation organized … [in Delaware] shall be managed by or under the direction of a board of directors, except as may be otherwise provided … [under the DGCL] or in its certificate of incorporation.”  The plaintiff also argued that the committee composition-related rights further violate Section 141(c) of the DGCL, which provides that company boards are tasked with forming committees.[3] Specifically, the plaintiff challenged[4] the following provisions (the Challenged Provisions) in the company’s stockholder agreement that give the founder certain rights for as long as a specified condition[5] is satisfied:

  • Pre-Approval Requirements: Require the founder’s[6] advance approval of 18 different categories of actions that encompass, in the words of the Court, “virtually everything the [b]oard can do.”[7]
  • Board Composition Provisions: Include six provisions that give the founder the right to determine the size of the company’s board and select a majority of the directors who serve on it.
    • Size Requirement: The company’s board is obligated to maintain its size at no more than 11 seats.
    • Designation Right: The founder is entitled to name a number of designees equal to a majority of those seats.
    • Nomination Requirement: The company’s board must nominate the founder’s designees as candidates for election.
    • Recommendation Requirement: The company’s board must recommend that stockholders vote in favor of the founder’s designees.
    • Efforts Requirement: The company must use reasonable efforts to enable the founder’s designees to be elected and continue to serve.
    • Vacancy Requirement: The company’s board must fill any vacancy in a seat occupied by a founder designee with a new founder designee.
  • Committee Composition Provision: Requires the company’s board to populate any committee with a number of founder designees proportionate to the number of founder designees on the full board.

II. Decision

The Court first determined that Section 141 of the DGCL applies because the company’s stockholder agreement was an “internal corporate governance arrangement.” The Court stated that “[i]nternal corporate governance arrangements that do not appear in the charter and deprive boards of a significant portion of their authority contravene Section 141(a).”[8]  The Court emphasized that “Section 141(a) is the source of Delaware’s board-centric model of corporate governance,”[9] and that “[t]he presence of a stockholder who controls the corporation does not alter the board-centric framework.”[10] Further, the Court was unsympathetic to arguments that the arrangements reflect widely accepted “market practice,” noting that “[w]hen market practice meets a statute, the statute prevails.”[11]

The Court then held that the Pre-Approval Requirements, as well as three of the six Board Composition Provisions (the Recommendation Requirement, the Vacancy Requirement and the Size Requirement), all violate Section 141(a) of the DGCL.  In the Court’s view:

  • The Recommendation Requirement: improperly compels the company’s board to recommend the founder’s designees for election.
  • The Vacancy Requirement: improperly compels the company’s board to fill a vacancy created by a departing founder designee with another founder designee.
  • The Size Requirement: improperly enables the founder to prevent the Board from increasing the number of board seats beyond 11.[12]

The Court also determined that the Committee Composition Provision violates both Section 141(a) and Section 141(c) of the DGCL because “[d]etermining the composition of committees falls within the [b]oard’s authority” and cannot be determined by stockholders.[13]

The Court upheld the Designation Right, the Nomination Requirement and the Efforts Requirement noting that these provisions simply allowed the founder to identify director candidates, aligned with his stockholder right to nominate candidates, and provided for the facilitation of certain processes without binding the board to any particular course of action.[14]  The Court noted that challenges could, however, be brought to these provisions as applied.

III. Next Steps

Both public and private companies should keep their boards abreast of these developments, particularly if they are subject to stockholder agreements that may need to be reviewed or revisited in light of the Court’s decision.  Equally, stockholders relying on similar provisions in stockholder agreements as the founder in this case should consider implementing alternative strategies before such protections are challenged.  Gibson Dunn is here to help.

__________

[1] See West Palm Beach Firefighters’ Pension Fund v. Moelis & Company, case number 2023-0309, in the Court of Chancery of the State of Delaware (the “Opinion”).

[2] Although one could argue that “consent” and “veto” rights may imply a different sequence of events, the Delaware Court of Chancery deemed the distinction to be meaningless.

[3] Specifically, Section 141(c)(2) of the DGCL provides that “[t]he board of directors may designate 1 or more committees, each committee to consist of 1 or more of the directors of the corporation. The board may designate 1 or more directors as alternate members of any committee, who may replace any absent or disqualified member at any meeting of the committee.”

[4] In addition to the company’s arguments on the merits, the company sought summary judgment on both laches (contending that the plaintiff waited too long to sue) and ripeness (contending that the plaintiff sued too early). The Delaware Court of Chancery issued a separate decision rejecting those defenses. W. Palm Beach Firefighters Pension Fund v. Moelis & Co. (Timing Decision), 2024 WL 550750 (Del. Ch. Feb. 12, 2024).

[5] Under the company’s stockholder agreement, the specified condition was deemed to be satisfied for so long as the founder (i) maintains direct or indirect ownership of an aggregate of at least 4,458,445 shares of Class A shares and equivalent Class A shares … ; (ii) maintains directly or indirectly beneficial ownership of at least five percent (5%) of the issued and outstanding Class A shares … ; (iii) has not been convicted of a criminal violation of a material U.S. federal or state securities law that constitutes a felony or a felony involving moral turpitude; (iv) is not deceased; and (v) has not had his employment agreement terminated in accordance with its terms because of a breach of his covenant to devote his primary business time and effort to the business and affairs of the company and its subsidiaries or because he suffered an “incapacity” (as defined in the company’s stockholder agreement). In addition, the founder is entitled to fewer rights once the ownership threshold falls below a certain level.  However, the Court did not address those provisions as they are not currently in effect.

[6] Technically, the company’s stockholder agreement granted rights to an entity owned by the founder but because the founder controls such entity, the Court determined that he controls how the rights are exercised as well.

[7] Opinion at 4.

[8] Opinion at 2.

[9] Opinion at 1.

[10] Opinion at 2.

[11] Opinion at 132.

[12] Opinion at 11.

[13] Id.

[14] Opinion at 12.


The following Gibson Dunn lawyers assisted in preparing this update: Colin Davis, Andrew Fabens, Julia Lapitskaya and Justine Robinson.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. For further information, please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Capital Markets, Emerging Companies, Mergers and Acquisitions, Private Equity, Securities Litigation or Securities Regulation and Corporate Governance practice groups:

Capital Markets:
Andrew L. Fabens – New York (+1 212.351.4034, [email protected])
Hillary H. Holmes – Houston (+1 346.718.6602, [email protected])
Stewart L. McDowell – San Francisco (+1 415.393.8322, [email protected])
Peter W. Wardle – Los Angeles (+1 213.229.7242, [email protected])

Emerging Companies:
Chris W. Trester – Palo Alto (+1 650.849.5212, [email protected])

Mergers and Acquisitions:
Robert B. Little – Dallas (+1 214.698.3260, [email protected])
Saee Muzumdar – New York (+1 212.351.3966, [email protected])

Private Equity:
Richard J. Birns – New York (+1 212.351.4032, [email protected])
Ari Lanin – Los Angeles (+1 310.552.8581, [email protected])
Michael Piazza – Houston (+1 346.718.6670, [email protected])
John M. Pollack – New York (+1 212.351.3903, [email protected])
Steven R. Shoemate – New York (+1 212.351.3879, [email protected])

Securities Litigation:
Colin B. Davis – Orange County (+1 949.451.3993, [email protected])
Monica K. Loseman – Denver (+1 303.298.5784, [email protected])
Brian M. Lutz – San Francisco (+1 415.393.8379, [email protected])
Craig Varnen – Los Angeles (+1 213.229.7922, [email protected])

Securities Regulation and Corporate Governance:
Aaron Briggs – San Francisco (+1 415.393.8297, [email protected])
Elizabeth Ising – Washington, D.C. (+1 202.955.8287, [email protected])
Thomas J. Kim – Washington, D.C. (+1 202.887.3550, [email protected])
Brian J. Lane – Washington, D.C. (+1 202.887.3646, [email protected])
Julia Lapitskaya – New York (+1 212.351.2354, [email protected])
James J. Moloney – Orange County (+1 949.451.4343, [email protected])
Ronald O. Mueller – Washington, D.C. (+1 202.955.8671, [email protected])
Mike Titera – Orange County (+1 949.451.4365, [email protected])
Lori Zyskowski – New York (+1 212.351.2309, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

Gibson Dunn’s Workplace DEI Task Force aims to help our clients develop creative, practical, and lawful approaches to accomplish their DEI objectives following the Supreme Court’s decision in SFFA v. Harvard. Prior issues of our DEI Task Force Update can be found in our DEI Resource Center. Should you have questions about developments in this space or about your own DEI programs, please do not hesitate to reach out to any member of our DEI Task Force or the authors of this Update (listed below).

Key Developments:

On February 25, 2024, the parties in American Alliance for Equal Rights v. Hidden Star filed a joint stipulation of dismissal of all claims, and the court closed the case the next day. Hidden Star is an Austin-based nonprofit organization that provides grants with the goal of helping “female, minority, and low-income entrepreneurs” through its Galaxy Grant program. Plaintiff American Alliance for Equal Rights (AAER) had claimed that the program violated Section 1981 based on alleged race- and gender-based eligibility restrictions, and had moved for a preliminary injunction, preventing Hidden Star from proceeding with the next grant contest. While Hidden Star’s mission is to help women- and minority-owned business and low-income entrepreneurs, its Galaxy Grant program never limited program eligibility to female and minority candidates. AAER agreed to dismiss the suit in exchange for clarification of grant eligibility-related language on Hidden Star’s website. Gibson Dunn represented Hidden Star in this matter.

On February 22, 2024, AAER filed a complaint and motion for a preliminary injunction against Jorge Zamanillo in his official capacity as the Director of the National Museum of the American Latino, part of the Smithsonian Institution. AAER v. Zamanillo, No. 1:24-cv-509 (D.D.C. Feb. 22, 2024). The complaint targets the Museum’s internship program, which aims to provide Latino, Latina, and Latinx undergraduates with training in non-curatorial art museum careers. AAER claims that the program constitutes race discrimination in violation of the Fifth Amendment because the Museum considers the race of applicants in choosing interns and allegedly refuses to hire non-Latino applicants. AAER has asked for an injunction to prevent the Museum from closing the application window on April 1, or selecting interns for the program (currently scheduled to begin in late April).

The EEOC filed an amicus curiae brief in Roberts & Freedom Truck Dispatch v. Progressive Preferred Ins. Co., et al. on February 22, 2024. The case concerns a challenge to Progressive’s grant program for Black entrepreneurs under Section 1981. (See case update below.) The EEOC explained that courts model Section 1981 standards governing private-sector voluntary affirmative action plans after the Title VII standards for such plans, which the EEOC is charged with enforcing. Accordingly, the EEOC argued, as Title VII permits voluntary affirmative-action plans in private employment, so too does Section 1981. The EEOC argued for evaluating Section 1981 challenges to affirmative action plans under a reasonableness standard, as the EEOC does under Title VII, not the strict scrutiny standard applied to post-secondary education affirmative action programs in the SFFA decision.

The Supreme Court denied certiorari in Coalition for TJ v. Fairfax County School Board on February 20, 2024. In 2020, Thomas Jefferson High School for Science and Technology (TJ), a public magnet school in Virginia, implemented a new policy of making admissions decisions based on a holistic review of students’ grades, written essays, and “Experience Factors,” which included family income and attendance at an underrepresented middle school. A coalition of parents and alumni challenged TJ’s policy under the Equal Protection Clause, arguing it was adopted to reduce the number of Asian American students admitted to the school. The district court granted the Coalition’s requested injunction against the admissions policy, but a month prior to the SFFA v. Harvard decision, a Fourth Circuit panel upheld the policy, reasoning that it does not require admissions officers to make race-based distinctions or cause an intentional or disparate impact. The Coalition petitioned the Supreme Court for review, but the Court declined to hear the case. Justice Alito dissented from the denial, criticizing the Fourth Circuit’s reasoning as an “indefensible . . . flagrantly wrong . . . virus that may spread if not promptly eliminated.” Justice Alito, joined by Justice Thomas, cautioned that the Fourth Circuit’s decision is a “grave injustice” to hardworking students and provides a model for flouting the Court’s SFFA decision.

On February 15, 2024, America First Legal (AFL) filed a lawsuit against the Department of Education (DOE) to enforce three separate Freedom of Information (FOIA) requests. In August 2023, AFL sent a FOIA request to DOE for records and communications related to its “National Summit on Equal Opportunity in Higher Education,” a strategy session intended to identify ways to help colleges and universities continue promoting diversity after the Supreme Court’s ruling in SFFA v. Harvard. AFL alleges in its lawsuit that DOE failed to respond to this and two other FOIA requests and that DOE’s “unlawful delays” are evidence that “DOE is covering up an impermissible federal DEI takeover of America’s education system.”

AFL sent a letter to the EEOC on February 14, 2024, alleging that statements on the Walt Disney Company’s “Reimagine Tomorrow” webpage, where the company expresses its goals of “amplifying underrepresented voices and untold stories as well as championing the importance of accurate representation in media and entertainment,” show that the company is violating Title VII. AFL claims that Disney uses unlawful quotas to ensure the inclusion of traditionally underrepresented groups—like women and minorities—in the filmmaking industry. In the letter, AFL also takes issue with Disney’s “Underrepresented Director” program, which grants recipients $25,000 to support their business endeavors. AFL asserts that this program is unlawful because it is only available to “women, AAPI, Black, Indigenous/Native, Latinx, LGBTQIA+, disability-identifying, and religiously marginalized individuals.” The letter asks that the EEOC initiate an investigation into Disney’s alleged “unlawful racial discrimination.”

On February 14, 2024, the Legal Defense Fund (LDF) launched its Equal Protection Initiative, an “interdisciplinary project to protect and advance public and private sector efforts to remove barriers to equal opportunity for Black people.” As part of the Initiative, LDF has issued a guidance report that aims to assist businesses in advancing their diversity goals following the Supreme Court’s SFFA decision. LDF says that its guidance—developed in partnership with the Lawyers’ Committee for Civil Rights Under Law, Asian Americans Advancing Justice, Latino Justice, the ACLU, and the Asian American Legal Defense and Education Fund—offers employers a comprehensive approach to communicating diversity goals to employees and job candidates, developing deep job candidate pools, and creating an inclusive work environment, while maintaining compliance with anti-discrimination laws.

On February 13, 2024, AAER filed a complaint against Alabama Governor Kay Ivey, challenging a state law that requires Governor Ivey to ensure there are no fewer than two individuals “of a minority race” on the Alabama Real Estate Appraisers Board (AREAB). The AREAB consists of nine seats, with eight currently filled. The remaining seat is reserved for a member of the public at large with no real estate background. Because there is only one minority member among the current Board, AAER asserts that state law will require that the open seat go to a minority. AAER states that one of its members applied for this final seat, but was denied purely on the basis of race. The complaint argues that the state law violates the Equal Protection Clause and asks the court to invalidate the state law entirely and allow for any member of the public to qualify for the open seat.

The Congressional Asian Pacific American Caucus (CAPAC) sent a letter to the leaders of Fortune 100 companies on February 12, 2024, calling for an increase in representation of Asian Americans, Native Hawaiians, and Pacific Islanders (AANHPIs) in executive roles. A study conducted by Los Angeles nonprofit Leadership Education for Asian Pacifics found that members of AANHPI communities are significantly underrepresented in senior corporate positions and “hold only 2.7 percent of the total number of corporate board seats.” CAPAC—composed of 75 Members of Congress—asked letter recipients to provide the caucus with data on current AANHPI representation among senior and government relations staff, as well as the percentages of philanthropic funding and contract dollars awarded to AANHPI recipients and AANHPI-owned businesses. In a press statement, CAPAC Chair Rep. Judy Chu (D-Cal.) explained the caucus’s goal: “[W]ith this letter to Fortune 100 companies, we will determine whether the largest businesses in America have followed through on their promises and encourage them to continue this crucial work—even in the face of assaults on diversity, equity, and inclusion from Republican officeholders.”

Media Coverage and Commentary:

Below is a selection of recent media coverage and commentary on these issues:

  • Inside Higher Ed, “Waiting for a ‘Last Word’ on Affirmative Action” (February 22): Inside Higher Ed’s Liam Knox reported on the Supreme Court’s February 22 decision to deny the petition for certiorari filed by a group of parents challenging the diversity-driven admissions policy at Thomas Jefferson High School for Science and Technology, Virginia’s highly competitive magnet school (case update above). Glenn Roper of the Pacific Legal Foundation (PLF)—counsel for the parents’ group and for plaintiffs in a number of other pending lawsuits challenging diversity-based initiatives in publicly-funded institutions—told Knox that his clients were “devastated” by the Supreme Court’s decision, but that PLF was undeterred. He remarked that “[i]f anything, this multiplies our efforts,” and concluded that “[t]here are multiple unanswered questions from the [SFFA] ruling that the court is going to have to address eventually.” Knox reported that Richard Kahlenberg, a lecturer at George Washington University’s School of Public Policy, interpreted the Court’s decision as an answer in itself: “Typically if SCOTUS is upset about the direction of the lower courts, they don’t hesitate to intervene. That they didn’t is, to me, a green light for authentic, race-neutral strategies to increase diversity.” But University of Chicago professor Sonja Starr told Knox that the decision could also be a sign that the Court was willing to “let[] the issue percolate among the lower courts” and to wait for a future “opportunit[y] to take a bite from this particular apple.”
  • Law.com, “GC of Texas University Taking Heat Over Cancellation of Pride Week” (February 22): Greg Andrews of Law.com reports that the University of North Texas has cancelled its annual Pride Week, which had been planned for March, based on the recommendation of the school’s Office of General Counsel. The recommendation follows the January 1, 2024 implementation of Texas Senate Bill 17, a sweeping anti-DEI measure affecting all state universities. Andrews says that the University’s OGC interpreted the law to prohibit schools from hosting programs tied to race, color, ethnicity, gender identity, or sexual orientation, but many faculty disagree and consider the OGC’s interpretation to be overly broad. At a meeting of the Faculty Senate on February 14, 2024, librarian Coby Condrey reportedly argued that the law’s exceptions for academic freedom in the classroom should apply, as “the library, for librarians, is our classroom.” Other faculty speculated that concerns for funding have motivated the cancellation.
  • Inc. Magazine, “‘It All Fell Apart’: Fearless Fund Founder on Impact of DEI Lawsuits” (February 21): Inc. Magazine’s Brit Morse reports on the operational difficulties faced by Fearless Fund and Hello Alice, which are each facing lawsuits, alleging that their grant programs violate Section 1981. In an interview with Morse, Fearless Fund CEO Arian Simone shared that her organization has had to reduce its team of 19 people to only 6, and Hello Alice co-founder Elizabeth Gore reported that the company recently laid off 69% of its team. Both organizations have also struggled with funding, despite their upward trajectories prior to the suits, according to Morse. Simone reported to Morse that only two of Fearless Fund’s corporate partners, Costco and JP Morgan, have remained onboard, and Gore shared that Hello Alice has not raised any funds since the lawsuit was filed. Morse notes that anti-DEI groups’ litigation and advocacy campaign has been successful, as large companies have pulled back on DEI initiatives established in 2020. But Morse says that neither Fearless Fund nor Hello Alice plans to shutter anytime soon, and she shares Simone’s commitment to her mission: “So I have the current industry, the macro-economic climate, the affirmative action ruling in June, the attack on DEI, and now, on top of that, my company is in litigation . . . I have five things, a whole hand, but guess what: A hand is powerful because it creates a fist and I’m going to continue to fight.”
  • Washington Post, “As DEI gets more divisive, companies are ditching their teams” (February 18): The Post’s Taylor Telford reports on new data from workforce intelligence provider Revelio Labs, indicating that DEI jobs decreased by 5 percent in 2023 and have fallen by 8 percent so far in 2024. According to Revelio, this is twice the rate of non-DEI jobs. Telford notes that Revelio’s data is consistent with media reporting in recent weeks about large-scale DEI layoffs at Zoom and Snap; other large companies—including Tesla, DoorDash, Lyft, Home Depot, and X—made similar cuts in 2023. But Lisa Simon, Revelio’s senior economist, told Telford that although the “overall number of DEI officers has decreased . . . it’s not enough to destroy all the strides that happened after 2020.” And Revelio’s data indicates that other companies continue to build their DEI teams: in 2023, several corporations (including J.M. Smucker, Victoria’s Secret, Michaels, Moderna, Prudential, ConocoPhillips, and Conagra Brands) expanded their DEI teams by 50 percent or more.
  • SSRN, “The First Amendment Right to Affirmative Action” (February 15, 2024): Alexander Volokh, Associate Professor at Emory University School of Law, explores the relationship between the First Amendment and federal civil right laws, and proposes that universities—in their role as “speaking associations”—may pursue arguments under the First Amendment to protect their right to promote diversity in their institutions. Professor Volokh asserts that a university’s affirmative action programs are part of that institution’s “message,” thus qualifying for protections under the First Amendment. He argues that universities, as speaking associations, have the right to choose both who speaks on their behalf and who receives the message they wish to communicate. Under that presumption, he posits that the First Amendment will prove crucial to future litigation over the prominence and survival of affirmative action programs in the wake of SFFA v. Harvard. He explains that “[u]sing an antidiscrimination law like Title VI or 42 U.S.C. § 1981 to force the university to speak through people not of its choosing . . . could impede the university’s ability to speak.” Professor Volokh also suggests that the First Amendment may protect charitable donations (like those at issue in Fearless Fund) as expressive speech, depending on “how donations are socially perceived.”
  • Bloomberg Law, “Alphabet, Microsoft Pivot From Nasdaq Diversity Reporting Format” (February 14): Bloomberg’s Andrew Ramonas reports on the different ways that public companies are complying with new Nasdaq board diversity reporting requirements. Although most companies produce tables of numbers—the format suggested in Nasdaq’s template—others use dots, checkmarks, or other visual chart formats. According to Ramonas, this variety in reporting makes it more difficult for investors to make side-by-side comparisons between companies. But in an interview with Ramonas, Amy Augustine, director of environmental, social, and governance investing at BostonTrust Walden Co., emphasized the overall benefits of the reporting requirement: “It’s so far from where we were when there was no listing standard that it really does feel like progress.” The SEC is crafting its own proposal to require public companies to disclose board diversity, with a tentative release date of April 2024.
  • Harvard Business Review, “Building a Supplier Diversity Program? Learn from the U.S. Government” (February 9): Chris Parker and Dwaipayan Roy, professors at the University of Virginia’s Darden School of Business, provide guidance for corporate leaders seeking to diversify their supply chains. Parker and Roy sought advice from procurement leaders at four federal agencies: the Department of Health and Human Services (HHS), the Department of Veteran Affairs, the National Aeronautics and Space Administration, and the Department of Housing and Urban Development. These leaders advise that companies’ first step should be to identify capable small, diverse-owned businesses (SDBs). This may involve creating partnerships with minority business associations, or pooling information on SDBs with other companies or government entities (HHS, for example, maintains a public SDB database). The second step, according to these procurement leaders, involves communicating directly with SDBs, who “often lack awareness about a company’s specific procurement needs.” Companies can accomplish this goal through different channels, from outreach events to regular email updates sent to SDB procurement managers.

Case Updates:

Below is a list of updates in new and pending cases:

1. Contracting claims under Section 1981, the U.S. Constitution, and other statutes:

  • Alexandre v. Amazon.com, Inc., No. 3:22-cv-1459 (S.D. Cal. 2022): White, Asian, and Native Hawaiian entrepreneur plaintiffs, on behalf of a putative class of past and future Amazon “delivery service partner” (DSP) program applicants, challenged a DEI program that provides $10,000 grants to qualifying delivery service providers who are “Black, Latinx, and Native American entrepreneurs.” Plaintiffs allege violations of California state civil rights laws prohibiting discrimination. On December 6, 2023, Amazon moved to dismiss.
    • Latest update: On February 16, 2024, the plaintiffs filed their opposition to Amazon’s motion to dismiss, arguing that they have standing because they visited Amazon’s website with the intent to become an Amazon DSP, only to be confronted by Amazon’s DEI program, and therefore did not apply. The plaintiffs also assert that Amazon’s public policy arguments should fail because the program is designed as “virtue-signaling in order to curry favor with certain races.”
  • Bradley, et al. v. Gannett Co. Inc., No. 1:23-cv-01100-RDA-WEF (E.D.Va. 2023): On August 18, 2023, white plaintiffs sued Gannett over its alleged “Reverse Race Discrimination Policy,” claiming that Gannett’s expressed commitment to having its staff demographics reflect the communities it covers violates Section 1981. On November 24, Gannett moved to dismiss and to strike the plaintiffs’ class action allegations. On February 8, 2024, the plaintiffs moved for a preliminary injunction and for class certification. On February 9, 2024, Gannett filed a motion to stay briefing on the plaintiffs’ motions pending a ruling on Gannett’s motion to dismiss, arguing that it may moot any need for class certification or a preliminary injunction.
    • Latest update: The plaintiffs filed their opposition to Gannett’s motion on February 13, 2024, urging the court to consider the motion to dismiss, motion for preliminary injunction, and motion for class certification together given their significant legal and factual overlap. The plaintiffs further argued that the stay sought by Gannett required a showing of a “high likelihood of prevailing” on the pending motion to dismiss, which Gannett had not shown, especially given the “rarity with which a claim for § 1981 racial discrimination meets the requirements to be dismissed on a 12(b)(6) motion.” Gannett’s reply, filed on February 14, 2024, renewed its call for efficiency, noting that resolving the pending motions for class certification and preliminary injunction would require significant, potentially unnecessary, factual development. On February 21, 2024, the court granted Gannett’s motion to stay briefing on the plaintiff’s pending motions.
  • Mid-America Milling Company v. U.S. Dep’t of Transportation, No. 3:23-cv-00072-GFVT (E.D. Ky. 2023): Two plaintiff construction companies sued the Department of Transportation, asking the court to enjoin the DOT’s Disadvantaged Business Enterprise Program (DBE), an affirmative action program that awards contracts to minority-owned and women‑owned small businesses in DOT-funded construction projects with the statutory aim of granting 10% of certain DOT-funded contracts to these businesses nationally. The plaintiffs alleged that the program constitutes unconstitutional race discrimination in violation of the Fifth Amendment.
    • Latest Update: On February 6, 2024, the plaintiffs filed their opposition to DOT’s motion to dismiss, arguing that they stated a plausible claim for relief based on allegations that most contracts in Kentucky and Indiana contain DBE goals; that the plaintiffs regularly bid on and compete for those contracts; and that it is highly improbable that the plaintiffs’ losses are not due, at least in part, to the DBE program. The plaintiffs underscored that regardless of whether they lost specific contracts due to their race and/or gender, they had sufficiently alleged that they were injured by the unequal opportunity to compete for those contracts. DOT replied on February 20, 2024, reiterating that the plaintiffs had failed to identify “what contract they allegedly lost, to whom, where or when this contract was let or by what state agency.” DOT also argued that the plaintiffs’ failure to allege specific contracts lost undermines their standing argument, indicating that plaintiffs had not suffered an injury-in-fact.
  • Roberts & Freedom Truck Dispatch v. Progressive Preferred Ins. Co., et al., No. 23-cv-1597 (N.D. Oh. 2023): On August 16, 2023, plaintiffs represented by AFL sued defendants Progressive Insurance, Hello Alice, and Circular Board, Inc., alleging that the defendants’ grant program that awarded funding specifically to Black entrepreneurs to support their small businesses violated Section 1981.
    • Latest update: On February 7, 2024, defendant Progressive filed a motion to dismiss for lack of jurisdiction and failure to state a claim and defendant Circular Board filed a motion to dismiss for failure to state a claim. The defendants argue that the plaintiffs lack Article III standing because they did not plead causation. The defendants also assert that the plaintiffs’ claims do not involve a “contract” under Section 1981 but that, if they do, the court should compel arbitration or transfer the case to federal court in California. The defendants argue that applying Section 1981 to a program “with the express purpose of combatting sociopolitical inequalities” violates the First Amendment, and that the grant program is a “voluntary, private affirmative action program” under Johnson v. Transportation Agency, Santa Clara County, 480 U.S. 616 (1987). On February 16, 2024, the court granted leave to file an amicus curiae brief to the Southern Poverty Law Center, the Lawyers’ Committee for Civil Rights Under the Law, the National Hispanic Bar Association, and Asian Americans Advancing Justice, and on February 23, 2024, the court granted leave to file an amicus curiae brief to the EEOC (see update above).

2. Employment discrimination and related claims:

  • Gerber v. Ohio Northern University, No. 2023-1107-CVH (Ohio. Ct. Common Pleas Hardin Cnty. 2023): On June 30, 2023, a law professor sued his former employer, Ohio Northern University, for terminating his employment after an internal investigation determined that he bullied and harassed other faculty members. On January 23, 2024, the plaintiff, now represented by AFL, filed an amended complaint. The plaintiff claims that his firing was actually in retaliation for his vocal and public opposition to the university’s stated DEI principles and race-conscious hiring, which he believed were illegal. The plaintiff alleged that the investigation and his termination breached his employment contract, violated Ohio civil rights statutes, and constituted various torts, including defamation, false light, conversion, infliction of emotional distress, and wrongful termination in violation of public policy.
    • Latest update: On February 20, 2024, the defendants filed answers and a joint motion for partial dismissal of the plaintiff’s second amended complaint. The defendants argued for dismissal of the wrongful termination claims because such claims only apply to at-will employees, and the plaintiff was a contract employee. The defendants also argued for dismissal of all claims against the defendants in their individual capacities, including the “conclusory” tort claims.
  • Haltigan v. Drake, No. 5:23-cv-02437-EJD (N.D. Cal. 2023): A white male psychologist sued the University of California Santa Cruz, arguing that a requirement that prospective faculty candidates submit and be evaluated in part on the basis of statements explaining their views and understanding of DEI principles functioned as a loyalty oath that violated his First Amendment freedoms. The plaintiff claimed that because he is “committed to colorblindness and viewpoint diversity”––which he alleged was contrary to UC Santa Cruz’s position on DEI––he would be compelled to alter his political views to be a viable candidate for the position. The plaintiff sought a declaration that the University’s DEI statement requirement violated the First Amendment and a permanent injunction against the enforcement of the requirement. On January 12, 2024, the district court granted UC Santa Cruz’s motion to dismiss with leave to amend.
    • Latest update: On February 2, 2024, the plaintiff filed a second amended complaint, adding additional allegations regarding his job search, his DEI statement, and why his application would have been futile. The plaintiff brought the same claims and requested the same relief as in his first complaint.

3. Challenges to agency rules, laws, and regulatory decisions:

  • Alliance for Fair Board Recruitment v. SEC, No. 21-60626 (5th Cir. 2021): On October 18, 2023, a unanimous Fifth Circuit panel rejected petitioners’ constitutional and statutory challenges to Nasdaq’s Board Diversity Rules and the SEC’s approval of those rules. Gibson Dunn represents Nasdaq, which intervened to defend its rules. Petitioners sought a rehearing en banc.
    • Latest update: On February 19, 2024, the Fifth Circuit granted petitioners’ motion for rehearing en banc and vacated the October 18, 2023 panel opinion. Oral argument is tentatively scheduled for the week of May 13, 2024.
  • Valencia AG, LLC v. New York State Off. of Cannabis Mgmt., et al., No. 5:24-cv-00116-GTS-TWD (N.D.N.Y. 2024): On January 24, 2024, Valencia AG, a cannabis company owned by white men, sued the New York State Office of Cannabis Management for discrimination, alleging that New York’s Cannabis Law and implementing regulations favored minority-owned and women-owned businesses. The regulations include goals to promote “social & economic equity” (“SEE”) applicants, which the plaintiff claims violates the Equal Protection Clause and Section 1983. On February 7, 2024, the plaintiff filed a motion for a temporary restraining order and preliminary injunction, seeking to prohibit the defendants from implementing the regulations, charging SEE applicants reduced fees, or preferentially granting SEE applicants’ applications.
    • Latest update: On February 8, 2024, the court denied the plaintiff’s motion for a temporary restraining order because Valencia had not made a sufficient showing that it would experience irreparable harm without it, characterizing the motion as “plagued by a lack of personal knowledge.” The court will be scheduling a hearing on the plaintiff’s motion for preliminary injunction “in the coming days.”

4. Actions against educational institutions:

  • Palsgaard v. Christian, et al., No. 1:23-cv-01228-SAB (E.D. Cal. 2023): In August 2023, California community college professors filed suit and moved for a preliminary injunction against the state’s new DEI-related evaluation competencies and corresponding language in their faculty contract, which they alleged require them to endorse the state’s views on DEI concepts. The plaintiffs challenged the DEI rules and contract language as compelled speech in violation of the First and Fourteenth Amendments. On December 15, 2023, the defendants filed their motions to dismiss. In response, on January 19, 2024, the plaintiffs filed a joint opposition.
    • Latest update: On February 9, 2024, the state and district defendants filed replies in support of their motions to dismiss. In both replies, the defendants argued that the plaintiffs did not meet the injury element of standing because the implementation guidelines did not proscribe speech, punish speech, or otherwise bind the plaintiffs. The defendants also argued that the plaintiffs failed to state a viable claim because the regulations do not prohibit speech, compel speech, or discriminate against the viewpoint of certain speech. Finally, the defendants argued that the plaintiffs’ overbreadth and vagueness challenges were meritless.
  • Brooke Henderson, et al. v. Springfield R-12 School District, et al., No. 23-01374 (8th Cir. 2023): On August 18, 2021, two educators sued a Springfield, Missouri school district alleging that the district’s mandatory equity training violated their First Amendment rights. The educators claimed that the equity training constituted compelled speech, content and viewpoint discrimination, and an unconstitutional condition of employment. The at-issue Fall 2020 equity training included sessions on anti-bias, anti-racism, and white supremacy. On January 12, 2023, the district court granted the defendants’ motion for summary judgment.
    • Latest update: The plaintiffs appealed the decision to the U.S. Court of Appeals for the Eighth Circuit. Oral argument was held on February 15, 2024 before Judges James B. Loken, Steven M. Colloton, and Jane L. Kelly. Counsel for the plaintiffs argued that the training compelled educators to engage in political speech, while counsel for the defendants argued that the educators were not compelled because they did not face punishment. The judges questioned the attorneys on several First Amendment issues, including the public forum doctrine, the test applied to public employee trainings, and the standard for compelled speech.
  • Doe v. New York University, No. 1:23-cv-09187 (S.D.N.Y. 2023): On December 1, 2023, a white male first-year law student at NYU who intends to apply for the NYU Law Review sued the university, alleging the NYU Law Review’s use of race and sex or gender preferences in selecting its members violates Title VI, Title IX, and Section 1981.
    • Latest update: On January 29, 2024, NYU filed a motion to dismiss, arguing that the plaintiff lacks standing because his hypothetical injury is too attenuated and that the claim is not yet ripe because the Law Review’s policy has not yet been implemented. On February 20, 2024, the plaintiff filed his opposition, arguing that he faces an imminent and severe injury in the coming months due to the university’s knowing discrimination.

The following Gibson Dunn attorneys assisted in preparing this client update: Jason Schwartz, Mylan Denerstein, Blaine Evanson, Molly Senger, Zakiyyah Salim-Williams, Matt Gregory, Zoë Klein, Mollie Reiss, Alana Bevan, Marquan Robertson, Janice Jiang, Elizabeth Penava, Skylar Drefcinski, Mary Lindsay Krebs, and David Offit.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Labor and Employment practice group, or the following practice leaders and authors:

Jason C. Schwartz – Partner & Co-Chair, Labor & Employment Group
Washington, D.C. (+1 202-955-8242, [email protected])

Katherine V.A. Smith – Partner & Co-Chair, Labor & Employment Group
Los Angeles (+1 213-229-7107, [email protected])

Mylan L. Denerstein – Partner & Co-Chair, Public Policy Group
New York (+1 212-351-3850, [email protected])

Zakiyyah T. Salim-Williams – Partner & Chief Diversity Officer
Washington, D.C. (+1 202-955-8503, [email protected])

Molly T. Senger – Partner, Labor & Employment Group
Washington, D.C. (+1 202-955-8571, [email protected])

Blaine H. Evanson – Partner, Appellate & Constitutional Law Group
Orange County (+1 949-451-3805, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

FAQs about Government Shutdowns

The U.S. Government is rapidly approaching a partial shutdown this week, which can be averted only if Congress passes funding legislation by Friday, March 1.  If it fails to pass funding legislation by March 8, the government will go into a full shutdown.  After a meeting between congressional leadership and the President today, House Speaker Mike Johnson (R-LA) said he was committed to avoiding a shutdown, but no details have emerged as to how Congress will accomplish that.  Gibson Dunn’s Public Policy Practice Group is closely monitoring the funding negotiations and their potential effects on our clients.  Here, we address the questions our clients have been asking us most frequently.

  1. Which agencies would be affected by a shutdown and when?

In January, Congress passed a “laddered” continuing resolution (“CR”), which broke apart the 12 government funding divisions into two units.  Congress provided funding for one unit until March 1, and the other until March 8.  Pub. Law No. 118-35.

On March 1, funding will expire for the Departments of Agriculture, Energy, Veterans Affairs, Transportation, and Housing & Urban Development; the Food & Drug Administration; the Commodity Futures Trading Commission; and military construction.  Id.

On March 8, all of the other agencies’ funding will expire, including the Departments of Justice, Treasury, Commerce, Labor, Defense, Homeland Security, State, Education, Interior, and Health & Human Services; the Environmental Protection Agency; the Social Security Administration; many independent agencies (e.g., the Securities and Exchange Commission, Federal Election Commission, Federal Trade Commission); and the judicial and legislative branches.  Id.

  1. What will happen if there is a shutdown?

Each agency has different procedures in the event of a shutdown, but generally, all non-essential government functions will cease.  Essential functions will continue—but the personnel performing them will be working without pay, which can cause morale to suffer and employees to skip work.  All federal government employees will receive backpay once Congress breaks its impasse, but federal contractors likely will not.

Essential functions—many of which relate to safety—include:

  • Air traffic control and inspections
    • Note that during previous shutdowns, air travel became challenging because some TSA workers and air traffic controllers did not report to work: plan for long lines.
  • Food safety inspections
  • Veterans’ health care workers
  • Functions related to nuclear reactors
  • Law enforcement
  • Power grid maintenance
  • Essential IRS operations
    • During a previous shutdown, 14,000 IRS workers did not show up when they were recalled to work; this could present a challenge for the ongoing U.S. tax season should this scenario repeat itself. Refund delays would be likely.

Mandatory spending for Social Security, Medicare, and Medicaid also will continue.

Non-essential functions that will cease include things like:

  • Agency rulemaking
  • Consideration of applications for various permits or approvals
    • This includes everything from Committee on Foreign Investment in the United States (“CFIUS”) reviews to passport renewals.
  • Many judicial processes
    • Civil cases may be postponed, but criminal case likely will proceed.
    • If a government attorney who has been furloughed is involved in the case, however, hearing and filing dates may be postponed.
  • Issuing new loans or grants
    • Distribution of funds under major programs like the CHIPS and Science for America Act will be impeded.
  • The running of national parks

Many government subsidy programs will run out of funds (although some, such as SNAP food stamp benefits, have enough funding to continue through March).

  1. What are the chances of a shutdown?

This is the fourth time in four months that we have come close to a federal government shutdown.  Congress has averted the previous ones by passing short-term CRs, which keep funding levels the same as the previous year (as opposed to passing the 12 individual appropriations bills that would change funding levels).

Today, President Biden, House Speaker Mike Johnson (R-LA), Senate Majority Leader Chuck Schumer (D-NY), House Minority Leader Hakeem Jeffries (D-NY), and Senate Minority Leader Mitch McConnell (R-KY) met.  Speaker Johnson said he was committed to avoiding a shutdown, but the challenge will be finding a path forward that appeases both Democrats and the far right members of the Republican caucus.

The options for keeping the government open now include passing a short-term CR to allow for further negotiations, a long-term CR to finish out the fiscal year, or a combination of some portion of the 12 spending bills for some agencies, and a CR for the remainder.  The current political dynamics, however, are making it increasingly difficult for Congress to pass any funding legislation.  Republicans are willing to consider a long-term CR because if there is no new budget by April 30, it will trigger a government-wide 1% spending cut negotiated in last year’s debt-ceiling agreement.  That makes Democrats equally unwilling to consider a long-term CR.  But Speaker Johnson working with the Democrats to pass a short-term CR that would allow additional time for negotiations is anathema to House Republicans, who have already proven themselves willing to jettison a speaker over a spending deal they don’t like.

Although today’s meeting signals hope that congressional leaders are committed to avoiding a shutdown, until a specific deal emerges, the near-term future of government funding will be uncertain.

On March 13, at 12:00PM EDT, the Public Policy Practice Group will present a webcast on the federal legislative and policy outlook for 2024.  Register here.


The following Gibson Dunn lawyers assisted in preparing this update: Michael Bopp, Roscoe Jones, Jr., Amanda Neely, and Daniel Smith.

Gibson Dunn’s Public Policy Practice Group is available to assist clients as they navigate the uncertain and rapidly changing dynamics of a potential partial or full government shutdown.  Our practice group members provide strategic counseling; real-time intelligence gathering; development and enhancement of policy positions; legislative text drafting; and lobbying services.  Please contact the Gibson Dunn lawyer with whom you usually work, any leader or member of the firm’s Public Policy practice group, or the following:

Michael D. Bopp – Co-Chair, Washington, D.C. (+1 202.955.8256, [email protected])
Mylan L. Denerstein – Co-Chair, New York (+1 212.351.3850, [email protected])
Roscoe Jones, Jr. – Co-Chair, Washington, D.C. (+1 202.887.3530, [email protected])
Amanda H. Neely – Washington, D.C. (+1 202.777.9566, [email protected])
Daniel P. Smith – Washington, D.C. (+1 202.777.9549, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

This update highlights steps taken by the Food and Drug Administration to implement the Modernization of Cosmetics Regulation Act since its enactment in 2022 as well as actions expected in the cosmetics space this year.

In December 2022, Congress passed the Modernization of Cosmetics Regulation Act of 2022 (MoCRA), which overhauled the Food and Drug Administration (FDA) framework for the regulation of cosmetics. MoCRA granted FDA new authorities and imposed a series of new requirements on the cosmetics industry, including with respect to adverse event recordkeeping and reporting, facility registration and product listing, good manufacturing practices (GMPs), safety substantiation, fragrance allergen labeling, facility suspension, records access, and mandatory recall authority.

FDA is required to develop multiple regulations and guidances to implement the new law, a number of which issued in 2023 and are expected to issue in 2024, with opportunities for stakeholder comment and feedback.

This client alert highlights three steps FDA has taken to implement MoCRA since its enactment and eight actions to expect from FDA on cosmetics in 2024.

In 2023, FDA took several measures to implement its new authorities under MoCRA, most notably:

  1. Moving the regulation of cosmetics out of the Center for Food Science and Nutrition (CFSAN) and into the Office of Chief Scientist (OCS). This shift out of CFSAN and into OCS, with the Chief Scientist publicly leading MoCRA’s implementation, signals that, post-enactment of MoCRA, the regulation of cosmetics is now a higher priority for the agency. In addition, FDA has explained that moving cosmetics regulation to the Office of the Commissioner will leverage FDA’s areas of expertise across the agency as it works to implement its new authorities.
  2. Holding a public listening session and seeking written comments on GMPs for cosmetic products. Under MoCRA, FDA is required to issue regulations establishing GMPs for facilities that manufacture cosmetic products. While, as discussed below, it is doubtful that FDA will meet its statutory deadlines for issuance of the proposed and final GMP regulations (December 2024 and December 2025, respectively), the listening session is a critical first step in their development.
  3. Issuing guidance on cosmetic product facility registration and cosmetic product listing. Under MoCRA, for the first time, FDA has the authority to require the registration of facilities where cosmetic products are manufactured and the submission of cosmetic product listings, including a list of ingredients used in the products. In December 2023, FDA issued guidance detailing who is responsible for making the registration and listing submissions and what, where, when, and how to submit the information. FDA also announced that it will not enforce the registration and listing requirements until July 1, 2024.

In 2024, FDA will continue to ramp up implementation of MoCRA, including by issuing guidance for industry, launching new systems for submission of information to FDA, and taking steps to enforce new requirements. Look for FDA to take the following actions in the cosmetics space in 2024:

  1. Focusing on microbiological contamination in cosmetic products. FDA has long expressed concerns about the risks of contamination of cosmetic products with microorganisms and has expressed a renewed focus on the issue post-enactment of MoCRA. In June 2023, FDA issued a draft guidance for industry on insanitary conditions in the preparation, packing and holding of tattoo inks and the risk of microbial contamination. Over the course of 2023, the agency also added makeup products from three firms from China to an import alert due to microbiological contamination. In addition, FDA highlighted in a new cosmetics fact sheet for small businesses the importance of conducting testing to determine the safety of each ingredient, including microbiological safety. Expect FDA to take further action, including finalizing the tattoo ink guidance and possibly issuing untitled or warning letters, to address issues of microbiological contamination in cosmetic products over the coming year.
  2. Enforcing registration and listing requirements. As noted above, FDA has announced that it will not take action to enforce cosmetic product facility registration and listing requirements until July 1, 2024. In advance of that date, FDA has issued guidance to industry on compliance with these requirements, as well as tools and options for making electronic submissions. FDA likely will give industry, especially smaller businesses, an additional, unofficial buffer to allow for industry (and agency) adjustment to the reporting requirements but, by the fall, will expect compliance with the new requirements. If and when FDA decides to enforce these requirements, consistent with its approach in other product areas, the agency is likely to prioritize companies whose products it believes pose a risk to the public health, such as manufacturers of contaminated, unsafe, or otherwise adulterated cosmetic products.
  3. Issuing guidance for industry on records access and mandatory recalls. The Office of the Chief Scientist has announced that, by the end of 2024, FDA expects to develop, in conjunction with the Office of Regulatory Affairs, two key guidances for industry on the circumstances in which FDA can exercise new authorities granted by MoCRA: accessing and copying records relating to a cosmetic product and ordering a person to cease the distribution of and recall a cosmetic product. Industry will be particularly interested FDA’s interpretation of its records access authority under the new statute, given the potential scope of the authority and FDA’s previous lack of access to cosmetic product records. Interested stakeholders should consider participating in FDA’s guidance development process by submitting comments on key concerns and issues.
  4. Standing up a system for the electronic submission of serious adverse event reports. MoCRA imposes a new requirement that industry submit serious adverse event reports associated with the use of cosmetic products to FDA. As of December 2023, FDA has modified the current FDA paper form (Form MedWatch3500A) to make it easier for the cosmetics industry to complete the form. Last month, FDA announced that, over the course of the next several months, the agency will have an electronic means for submission of the reports.
  5. Conducting research on per- and polyfluoroalkyl substances (PFAS) in cosmetics. Under MoCRA, by December 2025, FDA is required to issue a report summarizing the results of an assessment of the use of PFAS in cosmetic products and the evidence regarding the safety of such use, including any risks associated with their use. FDA has said that there is not much published data available on PFAS in cosmetics. Last month, FDA announced that it be working to fill certain scientific gaps through its own research, which can be expected to begin this year. Of note, this work comes as a bipartisan bill to ban PFAS in cosmetics has been introduced in the House, although its chances of passage are slim, given the limited amount of time for bill passage given this year’s longer, election-year recess, Republican control of the House, and a lack of a companion bill in the Senate. In addition, on the state side, multiple state legislatures have taken, and are taking, steps to ban PFAS in cosmetic products.
  6. Issuing a proposed rule on testing methods for talc in cosmetics. MoCRA required that FDA issue a proposed rule on testing methods for detecting and identifying asbestos in talc-containing cosmetic products by December 29, 2023. According to the Office of Management and Budget (OMB) website, OMB received the proposed rule from FDA for review on January 2, 2024. With eight FDA rules currently under review with OMB as of February 27, 2024, there is some likelihood that the talc proposed rule will not issue this year, especially given the timing of the mandatory 60-day Congressional review period for rules under the Congressional Review Act, combined with the longer, election-year recess starting in August. Nonetheless, because the proposed rule is being issued pursuant to a statutory mandate, there is a chance that OMB will complete its review in time for it to publish at some point this spring.
  7. Developing implementation and strategic workforce plans for MoCRA implementation. In December 2023, the Government Accountability Office (GAO) issued a report entitled Cosmetic Safety: Better Planning Would Enhance FDA Efforts to Implement New Law. The report’s recommendations centered around FDA’s lack of organizational changes necessary to implement MoCRA. Within the next few months, FDA likely will respond to the recommendations in that report by developing implementation and strategic workforce plans, as called for by GAO.
  8. Hiring a new MoCRA lead? Last, but not least, over the course of 2023, Dr. Namandje Bumpus, as FDA’s Chief Scientist, made several public appearances and statements about her work and priorities as the agency lead on MoCRA’s implementation. Earlier this month, Dr. Bumpus moved to her new role as Principal Deputy Commissioner. FDA is now looking for a new Chief Scientist to take Dr. Bumpus’s place. She is continuing to hold the cosmetics portfolio for the moment, but, once hired, the new Chief Scientist is expected to take over the implementation of MoCRA. It remains to be seen whether her replacement will be hired within this calendar year and, if so, what priorities the new hire will have in the area of cosmetics regulation.

Finally, this year, there are several regulations that FDA is required to issue under MoCRA, or has indicated it is seeking to issue, that likely will not publish before the end of the year. In 2024, do not expect to see FDA regulations on:

  1. Cosmetics GMPs and fragrance allergen labeling. MoCRA requires FDA to issue proposed rules regarding GMPs for cosmetics and fragrance allergen labeling by December 29, 2024, and June 29, 2024, respectively. Neither of these proposed rules appeared in the most recent editions of the Unified Agenda, the compilation of information about regulations under development by federal agencies, which means there is little chance they will issue in 2024, especially given competing priorities for the agency.
  2. Use of formaldehyde as an ingredient in certain hair products. In 2023, FDA announced its intention to publish a proposed rule on the use of formaldehyde and formaldehyde-releasing chemicals as an ingredient in hair smoothing or hair straightening products. Dr. Bumpus emphasized the importance of the proposed rule to the agency in multiple postings to her official Twitter feed. Although FDA has given a target date of July 2024 for issuance of the rule, given the number of high priority regulations FDA has said it will issue by this spring, most if not all of which require review by OMB, as well as the 60-day review period mandated by the Congressional Review Act, it is unlikely that the formaldehyde proposed rule will publish this year.

The following Gibson Dunn lawyers assisted in preparing this update: Katlin McKelvie and Carlo Felizardo.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s FDA and Health Care practice group:

Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, [email protected])
Katlin McKelvie – Washington, D.C. (+1 202.955.8526, [email protected])
John D. W. Partridge – Denver (+1 303.298.5931, [email protected])
Jonathan M. Phillips – Washington, D.C. (+1 202.887.3546, [email protected])
Carlo Felizardo – Washington, D.C. (+1 202.955.8278, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

In re Illinois Nat’l Ins. Co., No. 22-0872 – Decided February 23, 2024

On February 23, the Texas Supreme Court unanimously held that an insured suffers a “loss”—and a claimant can sue the insurers directly—when the claimant and the insured settle, and the claimant agrees to look solely to the liability insurance policy for any recovery. But, because the insured doesn’t face liability beyond the insurance proceeds, the insurer isn’t bound by the settlement agreement during the subsequent coverage litigation.

“Because the settlement agreement establishes that [the insured] is legally obligated to pay and is ‘in fact liable’ to [the claimant] for any recoverable insurance benefits, [the claimant] has suffered a ‘loss’ under the policies and the no-direct-action rule does not prevent [the claimant] from suing the Insurers directly.”

Justice Boyd, writing for the Court

Background:

A group of investors (GAMCO) brought a securities class action against Cobalt International Energy—an oil-and-gas exploration company—after the SEC announced an investigation into Cobalt. Cobalt’s insurers denied coverage and defense costs. After Cobalt filed for bankruptcy, it settled with GAMCO for $220 million—which the parties believed to be the maximum coverage available under Cobalt’s liability insurance policies. GAMCO agreed to look solely to Cobalt’s insurers to recover the $220 million; Cobalt agreed to allow GAMCO to control the coverage litigation but didn’t assign its policies or coverage claims. Both parties denied any fault or liability. The bankruptcy court and U.S. district court presiding over the GAMCO-Cobalt suit approved the settlement.

GAMCO then intervened in Cobalt’s ongoing contract suit against its insurers. The trial court denied the insurers’ jurisdictional pleas and summary judgment motions, holding that (1) Cobalt’s defense costs and the settlement amount are covered “losses” under the policies; (2) GAMCO can sue the insurers directly; and (3) the settlement agreement is admissible in the coverage litigation, not subject to collateral attack, and could be used to establish the amount of Cobalt’s loss. The Fourteenth Court denied mandamus relief.

Issues:

(1) Does an insured suffer a “loss” under a liability policy when its settlement agreement with the claimant doesn’t require the insured to pay money and limits the claimant’s recovery to any liability coverage available under the policy?

(2) Can a claimant that agrees in a settlement agreement to look only to the insured’s insurance policies for recovery sue the insurers directly for insurance benefits?

(3) Is the insured-claimant settlement agreement binding on the insurer or admissible as evidence to establish coverage or the amount of loss?

Court’s Holdings:

(1) Yes. The insured suffered a covered “loss” because the settlement agreement legally obligated the insured to pay the claimant any insurance benefits it receives in its coverage dispute with the insurers. The insurance policies are assets that belong to the insured, and liability policies like those at issue here require the insurers to pay benefits on behalf of the insured regardless of whether the insured actually pays. In so holding, the Texas Supreme Court rejected the notion that the claimant’s covenant not to execute on the judgment prevents the insured from having a legal obligation to pay under the settlement agreement.

(2) Yes. Because the settlement agreement established that the insured had a legal obligation to pay its insurance benefits to the claimant, the claimant can sue the insurers directly to recover under the policies. Although the “no direct action” rule generally bars claimants from suing a defendant’s insurer directly, it doesn’t apply once the insured’s legal obligation to pay the claimant is established by judgment or settlement.

(3) No. Because the settlement agreement didn’t result from a “fully adversarial proceeding,” it isn’t binding against the insurers or admissible to establish coverage or the amount of the insured’s loss.

What It Means:

  • The Court confirmed that, in the subsequent coverage litigation against the insurer, a settlement agreement between the insured and the claimant—which protects the insured “against any ‘actual risk of liability’ beyond its obligation to pay insurance benefits it may or may not receive”—would be neither binding nor admissible because it didn’t “result from a fully adversarial proceeding.”
  • Although mandamus is generally “unavailable when a trial court denies summary judgment, no matter how meritorious the motion,” the Court held that the insurers had no adequate remedy by appeal because the trial—at which the insurers wouldn’t be able to challenge their liability for the full amount of the settlement agreement—would’ve been “a complete waste of the courts’ and parties’ resources.”

The Court’s opinion is available here.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding developments at the Texas Supreme Court. Please feel free to contact the following practice leaders:

Appellate and Constitutional Law Practice

Thomas H. Dupree Jr.
+1 202.955.8547
[email protected]
Allyson N. Ho
+1 214.698.3233
[email protected]
Julian W. Poon
+1 213.229.7758
[email protected]
Brad G. Hubbard
+1 214.698.3326
[email protected]

Insurance and Reinsurance

Geoffrey Sigler
+1 202.887.3752
[email protected]
Deborah L. Stein
+1 213.229.7164
[email protected]

Related Practice: Texas Litigation

Trey Cox
+1 214.698.3256
[email protected]
Collin Cox
+1 346.718.6604
[email protected]
Andrew LeGrand
+1 214.698.3405
[email protected]
Russ Falconer
+1 346.718.3170
[email protected]

This alert was prepared by Texas associates Elizabeth Kiernan, Stephen Hammer, and Bryston Gallegos.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

From the Derivatives Practice Group: The CFTC issued a no-action letter, approved three proposed rules and extended the comment period on a fourth this week.

New Developments

  • CFTC Staff Issues No-Action Letter Regarding Pre-Trade Mid-Market Mark for Certain Interest Rate Swaps Referencing SOFR. On February 22, the CFTC’s Market Participants Division (MPD) issued a no-action letter applicable to all registered swap entities in relation to the requirement in Regulation 23.431 that swap dealers and major swap participants (swap entities) disclose to certain counterparties the Pre-Trade Mid-Market Mark (PTMMM) of a swap. The no-action letter states that MPD will not recommend the CFTC take an enforcement action against a registered swap entity for its failure to disclose the PTMMM to a counterparty in certain interest rate swaps referencing the Secured Overnight Financing Rate that are identified in the no-action letter, provided that: (1) real-time tradeable bid and offer prices for the swap are available electronically, in the marketplace, to the counterparty; and (2) the counterparty to the swap agrees in advance, in writing, that the registered swap entity need not disclose a PTMMM for the swap. According to the CFTC, the no-action letter provides a similar no-action position as that in CFTC Staff Letter No. 12-58 for certain interest rate swaps referencing the London Interbank Offered Rate. CFTC Commissioner Christy Goldsmith Romero objected to the no-action letter, arguing that it inappropriately shifts the burden of understanding swap dealer’s conflicts and incentives back onto counterparties, upending the Dodd-Frank Act’s intent. [NEW]
  • CFTC Approves Three Proposed Rules and Other Commission Business. On February 20, the CFTC approved three proposed rules through its seriatim process: (1) Regulations to Address Margin Adequacy and to Account for the Treatment of Separate Accounts by Futures Commission Merchants; (2) Foreign Boards of Trade; and (3) Requirements for Designated Contract Markets and Swap Execution Facilities Regarding Governance and the Mitigation of Conflicts of Interest Impacting Market Regulation Functions. All three proposals have a comment deadline of April 22, 2024. Additionally, the CFTC issued an order of exemption from registration as a derivatives clearing organization (DCO) to Taiwan Futures Exchange Corporation and approved an amended order of registration for ICE NGX Canada, Inc., adding environmental contracts to the scope of contracts it is eligible to clear as a DCO. [NEW]
  • CFTC Extends Comment Period on Proposed Rules for Operational Resilience Frameworks. On February 20, the CFTC extended the comment period on its proposed rules implementing requirements for operational resilience frameworks for futures commission merchants, swap dealers and major swap participants. The new deadline is April 1, 2024. [NEW]
  • CFTC GMAC to Meet March 6. The CFTC’s Global Markets Advisory Committee (GMAC) will meet on Wednesday, March 6 at 10am ET. The GMAC will hear presentations from its Global Market Structure Subcommittee, Technical Issues Subcommittee and Digital Asset Markets Subcommittee, and consider their recommendations. [NEW]
  • SEC Adopts Rule to Expand Definitions of “Dealers” and “Government Securities Dealers.” On February 6, the SEC adopted a rule that requires market participants to register as “dealers” or “government securities dealers” for the first time and become members of a self-regulatory organization (SRO). The final rule, codified in Exchange Act Rules 3a5-4 and 3a44-2, purports to define the phrase “as a part of a regular business” in Sections 3(a)(5) and 3(a)(44) of the Securities Exchange Act of 1934 to identify certain activities that would cause persons engaging in such activities to be “dealers” or “government securities dealers” and be subject to the registration requirements of Sections 15 and 15C of the Act, respectively. Under the final rule, any person that engages in activities as described in the rule is a “dealer” or “government securities dealer” and, absent an exception or exemption, required to: register with the SEC under Section 15(a) or Section 15C, as applicable; become a member of an SRO; and be subject to applicable SRO and Treasury rules and requirements. Notably, the rule is non-exclusive, meaning that even if a firm does not meet any of the criteria in the rule, the SEC claims that the firm could still be a dealer anyway depending on the “facts and circumstances.”
  • SEC and CFTC Adopt Amendments to Enhance Private Fund Reporting. On February 8, the SEC adopted amendments to Form PF, the confidential reporting form for certain SEC-registered investment advisers to private funds, including those that also are registered with the CFTC as commodity pool operators or commodity trading advisers. According to the SEC, the amendments, which the CFTC concurrently adopted, are designed to enhance the ability of the Financial Stability Oversight Council (FSOC) to monitor and assess systemic risk and to bolster the SEC’s oversight of private fund advisers and the agency’s investor protection efforts. The SEC and CFTC also agreed to a memorandum of understanding related to the sharing of Form PF data. The SEC stated that, among other things, the amendments to Form PF will enhance how large hedge fund advisers report investment exposures, borrowing and counterparty exposure, market factor effects, currency exposure, turnover, country and industry exposure, central clearing counterparty reporting, risk metrics, investment performance by strategy, portfolio liquidity, and financing and investor liquidity in an effort to provide better insight into the operations and strategies of these funds and their advisers and improve data quality and comparability. Further, the amendments will require additional basic information about advisers and the private funds they advise, including identifying information, assets under management, withdrawal and redemption rights, gross asset value and net asset value, inflows and outflows, base currency, borrowings and types of creditors, fair value hierarchy, beneficial ownership, and fund performance, which, according to the SEC, will provide greater insight into private funds’ operations and strategies, assist in identifying trends, including those that could create systemic risk, improve data quality and comparability, and reduce reporting errors. The amendments will also require more detailed information about the investment strategies, counterparty exposures, and trading and clearing mechanisms employed by hedge funds, while also removing duplicative questions.
  • CFTC Global Markets Advisory Committee Advances Key Recommendations. On February 8, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, formally advanced eight recommendations to the CFTC that are intended to enhance the resiliency and efficiency of global markets, including U.S. Treasury markets, repo and funding markets, and commodity markets. To date, this is the largest number of recommendations advanced by a CFTC Advisory Committee in a single meeting. The GMAC’s Global Market Structure Subcommittee prepared four recommendations: (1) appropriately calibrated block and cap sizes under CFTC Part 43 swap data reporting rules, intended to enhance market liquidity and financial stability; (2) addition of certain central counterparties (CCPs) as permitted counterparties under CFTC Rule 1.25(d), intended to promote the well-functioning of the repo market; (3) expansion of cross-margining between the CME Group and the Fixed Income Clearing Corporation, intended to support greater efficiency in the U.S. Treasury markets; and (4) best practices for exchange volatility control mechanisms, intended to address market stress and market dislocation during periods of high volatility. The GMAC’s Technical Issues Subcommittee prepared four additional recommendations, as follows: (5) adoption of lessons learned from a global default simulation across CCPs, intended to address systemic risk and promote financial stability; (6) harmonization of the treatment of money market funds as eligible collateral, intended to improve market liquidity; (7) improvement of trade reporting for market oversight, intended to ensure international standardization and global aggregation and analysis of data to address systemic risk; and (8) improvement of trade reporting for market oversight, intended to facilitate data sharing across jurisdictions for systemic risk analysis.
  • CFTC Customer Advisory Alerts App and Social Media Users to Financial Romance Fraud. On February 7, the CFTC’s Office of Customer Education and Outreach (OCEO) issued a customer advisory alerting dating/messaging app and social media users to a scam asking for financial support or giving investment advice using the platforms. The Customer Advisory: Six Warning Signs of Online Financial Romance Frauds, reminds app and social media users to be wary of texts and messages from strangers that promote cryptocurrency investments. According to the OCEO, the text could actually be from international criminal organizations that trick victims into investing money in cryptocurrency or foreign currency scams only to defraud them. The OCEO stated that the scam can take advantage of even the savviest of investors because fraudsters develop relationships with their victims through weeks of seemingly authentic text messaging conversations, a practice known as “grooming.” The advisory points out several warning signs of a financial grooming fraud, which include fraudsters attempting to move conversations from a dating or social media platform to a private messaging app, as well as their claims of wealth from cryptocurrency or foreign currency trading due to insider information. The advisory also includes steps users can take to avoid financial grooming frauds.

New Developments Outside the U.S.

  • HKMA Sets Out Expectations on Tokenized Product Offerings. On February 20, the Hong Kong Monetary Authority (HKMA) published a circular covering the sale and distribution of tokenized products. According to the HKMA, the prevailing supervisory requirements and consumer/investor protection measures for the sale and distribution of a product are also applicable to its tokenized form as it has terms, features and risks similar to those of the underlying product. The HKMA clarified that authorized institutions should conduct adequate due diligence and fully understand the tokenized products before offering them to customers and on a continuous basis at appropriate intervals. Authorized institutions are also expected to act in the best interest of their customers and make adequate disclosure of the relevant material information about a tokenized product, including its key terms, features and risks. Finally, the HKMA indicated that authorized institutions should put in place proper policies, procedures, systems and controls to identify and mitigate the risks arising from tokenized product-related activities. [NEW]
  • HKMA Sets Standards for Digital Asset Custodial Services. On February 20, the HKMA issued guidance for authorized institutions interested in offering custody services for digital assets. The HKMA expects authorized institutions to undertake a comprehensive risk assessment followed by the implementation of appropriate policies to manage identified risks. The entire process should be overseen by the board and senior management. The HKMA also requires authorized institutions to conduct independent systems audits, store a substantial portion of client digital assets in cold storage, ensure that private keys are secured within Hong Kong and provide all records to HKMA whenever requested. Authorized institutions should notify the HKMA and confirm that they meet the expected standards in the guidance within 6 months from the date of the guidance (i.e. February 20, 2024). [NEW]
  • ASIC Publishes Third Consultation Paper on OTC Derivatives Reporting. On February 15, the Australian Securities and Investments Commission (ASIC) published Consultation Paper (CP) 375: Proposed changes to the ASIC Derivatives Transaction Rules (Reporting): Third consultation. CP 375 proposes the following changes to ASIC Derivative Transaction Rules (Reporting) 2024: simplify the exclusion of exchange-traded derivatives; simplify the scope of foreign entity reporting; remove the alternative reporting provisions; clarify the exclusion of FX securities conversion transactions; and add additional allowable values for two data elements. Additionally, CP 375 proposes minor changes to ASIC Derivative Transaction Rules (Clearing) 2015: simplify and align the exclusion of exchange-traded derivatives with the 2024 reporting rules and make minor updates to re-reference certain definitions to their changed location in the Corporations Act 2001. The proposed changes would commence on October 21, 2024, except for the changes to the scope of foreign entity reporting and the removal of alternative reporting provisions, which would commence on April 1, 2025. ASIC indicated that it does not expect most reporting entities to face any material additional compliance burden upon implementation of the proposed changes. However, a small number of international reporting entities and some small-scale exempt reporting entities may be impacted, according to ASIC. The consultation period will run until March 28, 2024. [NEW]
  • Council of the EU Ratifies EMIR 3 Agreement at Ambassador Level. On February 14, the European Market Infrastructure Regulation 3 (EMIR 3) package (regulation and directive), as negotiated in the trilogues, was approved at ambassador level. The texts are available here. According to ISDA, the final text maintains the Council of the EU’s less punitive approach of an operational active account with representativeness. It also introduces a requirement for financial counterparties and non-financial counterparties above certain de minimis thresholds to hold an active account at an EU CCP and to clear a number of representative trades in that account. The directive amending the Capital Requirement Regulation is intended to provide more specific tools and powers under Pillar 2 in the context of excessive concentration to CCPs. [NEW]
  • CPMI, IOSCO Publish Paper on Streamlining VM in Centrally Cleared Markets. On February 14, the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published a discussion paper on streamlining variation margin (VM) in centrally cleared markets. The discussion paper follows the review of margining practices, published in 2022 by the Basel Committee on Banking Supervision, the CPMI and IOSCO. The discussion paper sets out eight effective practices, covering intraday VM call scheduling and frequency, treatment of excess collateral, the pass-through of VM by CCPs and transparency between CCPs, clearing members and their clients. The deadline for comment is April 14.
  • ESMA Withdraws Euronext Authorization as a Data Reporting Service Provider Under MIFIR Upon the Entity’s Request. On February 13, ESMA withdrew the authorization of Euronext Paris SA (Euronext) as a Data Reporting Service Provider (DRSP) under the Markets in Financial Instruments Regulation (MiFIR). Euronext was authorized as both an Approved Reporting Mechanism and an Approved Publication Arrangement under MiFIR since January 3, 2018. MiFIR provides that ESMA shall withdraw the authorization of a DRSP where the DRSP expressly renounces its authorization. ESMA’s withdrawal decision follows the notification by Euronext of its intention to renounce its authorization under the conditions set out in Article 27e(a) of MIFIR.
  • ESMA Publishes Latest Edition of its Newsletter. On February 13, ESMA published  its latest edition of the Spotlight on Markets Newsletter. The newsletter focused on the last ESMA consultation package related to the Markets in Crypto Assets Regulation (MiCA). ESMA invited stakeholders to send their feedback on reverse solicitation and classification of crypto assets as financial instruments by April 29, 2024. The newsletter also launched a call for candidates for ESMA’s Securities Markets Stakeholder Group and called interested parties who can give a strong voice to consumers, industry, users of financial services, employees in the financial sector, SMEs as well as academics to apply by March 18.
  • Hong Kong Government Launches Consultation on Regulating OTC Trading of Virtual Assets. On February 8, the Hong Kong government launched a public consultation on legislative proposals to introduce a licensing regime for providers of over-the-counter trading services of virtual assets (VAs). Under the proposed licensing regime, any person who conducts a business in providing spot trading services of VAs-for-money or money-for-VAs will be required to be licensed by the Commissioner of Customs and Excise, irrespective of whether the services are provided through a physical outlet and/or digital platforms. Licensees will be required to comply with AML/CFT requirements and other regulatory requirements. The public consultation period ends on April 12, 2024.
  • HKMA Consults on Capital Treatment of Cryptoasset Exposures. On February 7, the Hong Kong Monetary Authority (HKMA) published a Consultation Paper on CP24.01 Cryptoasset Exposures setting out a proposal for implementing new regulations on the prudential treatment of cryptoasset exposures based on the Basel Committee on Banking Supervision’s Prudential treatment of cryptoasset exposures standard. According to the consultation paper, for the purpose of the prudential treatment of cryptoasset exposures, cryptoassets will be defined as private digital assets that depend on cryptography and distributed ledger technologies or similar technologies. The HKMA has scheduled a preliminary consultation on the proposed amendments to the rules in the second half of 2024 and aims to put new standards into effect no earlier than July 1, 2025.
  • EU Co-Legislators Reach Provisional Agreement on EMIR 3. On February 6, the EU co-legislators reached a provisional political trilogue agreement on the EMIR 3. On the issue of an active account requirement, while the agreement is based on the less punitive operational active account with representativeness approach proposed by the Council of the EU, the European Parliament has proposed that counterparties should clear at least five trades through an EU CCP in each of the most relevant subcategories. The original approach proposed by the council only required one trade per relevant subcategory. On the topic of supervision, the agreement includes a new role for the European Securities and Markets Authority (ESMA) as co-chair of CCP supervisory colleges alongside national competent authorities and a coordinating role in an emergency.
  • ESA’s Joint Board of Appeal Confirms ESMA’s Decision to Withdraw the Recognition of Dubai Commodities Clearing Corporation. On February 6, the Joint Board of Appeal of the European Supervisory Authorities (the ESAs) unanimously decided to dismiss the appeal brought by Dubai Commodities Clearing Corporation (DCCC) against ESMA and to therefore confirm the ESMA decision to withdraw its recognition. The application was brought in relation to ESMA’s Decision, adopted under Article 25p of Regulation (EU) No 648/2012 (EMIR), to withdraw the recognition of DCCC as a Tier 1 third-country CCP. The decision is a consequence of the United Arab Emirates (UAE) being included by the European Commission on the list of high-risk third countries presenting strategic deficiencies in their national anti-money laundering and counter financing of terrorism (AML/CFT) regime, provided for in the Commission Delegated Regulation (EU) 2016/1675. The Joint Board of Appeal of the ESAs had decided to suspend the ESMA decision in October 2023 until the outcome of the appeal was concluded. With today’s publication, the suspension has expired and the ESMA decision has become fully operational.

New Industry-Led Developments

  • ISDA Responds to FCA on Commodity Derivatives. On February 15, ISDA and the Association for Financial Markets in Europe (AFME) submitted a joint response to the UK Financial Conduct Authority (FCA) consultation on the reform of the UK commodity derivatives regulatory framework. The consultation sought to remove unnecessary burdens on firms and strengthen the supervision of the UK’s commodity derivatives markets. The associations indicated that they strong support the FCA’s proposal to apply a narrower position limits regime that it views as more proportionate to the risks associated with certain commodity derivatives contracts. However, the associations expressed concern over the proposed approaches for setting position limits and adding additional reporting obligations. They noted that the complex and burdensome frameworks proposed can, in their view, discourage participation in UK trading venues by non-UK participants and may have a negative impact on the competitiveness of UK markets. The response also recommends a longer implementation period of at least 24 months, based on the association’s perception of the scale of the operational and technical changes required. [NEW]
  • ISDA Responds to Australian Treasury on Financial Market Infrastructure Reforms. On February 9, ISDA and the Futures Industry Association submitted a joint response to the Australian Treasury’s draft financial market infrastructure reform package. In the response, the associations considered the proposed crisis resolution regime, which would provide the Reserve Bank of Australia (RBA) with powers to step in and resolve a crisis affecting a domestic CCP, with the aim of ensuring the continuity of critical clearing functions and maintaining financial stability in Australia. The associations expressed concerns with some of the provisions contemplated in the draft regime and asked if the issues highlighted in the response (such as the ability of the RBA or statutory manager to direct and make changes to the operating rules, the lack of explicit definitions of and safeguards on resolution powers and the interaction with close-out netting) could be addressed.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The revised Notice introduces new chapters on market definition in specific circumstances, notably markets characterized by significant R&D, multi-sided platforms, and digital ecosystems.

On 8 February 2024, the European Commission (“Commission”) updated its Market Definition Notice (“Notice”) for the first time since its initial publication in 1997. The revised guidance softens the rigidity of the Commission’s earlier approach and grants it more flexibility in competition assessments – particularly in relation to digital and R&D intensive markets. Companies active in these sectors should see the update as a tool to support the Commission’s stricter enforcement agenda.

A.   Background

  • The 1997 Notice

The original Notice was published over 25 years ago. It aimed to provide companies with official guidance on how the Commission applies the concepts of relevant product and geographic market in its enforcement of EU competition law. To this day, market definition plays a pivotal role in competition enforcement. Competition authorities define the relevant market as a first step in both behavioral cases and merger control. It provides a framework for analyzing the competitive situation and identifying potential competitive constraints.

  • Commission’s evaluation of the 1997 Notice

The Commission acknowledged that, since publication of the 1997 Notice, there have been significant societal and technological changes, including the rise of digitalization. These changes, in conjunction with developments in EU case law and the Commission’s decisional practice, warranted re-evaluation of the Market Definition Notice.

The results of the evaluation were published in July 2021:

  • Despite calls from stakeholders for a more progressive approach, the Commission confirmed that, in general, market definition (and the principles on which it rests) will remain of central importance going forward.
  • Nevertheless, the Commission recognized the need for changes in, or additions to, individual areas, notably: digitalization, innovation, geographic market definition, and quantitative techniques. This largely follows the direction of EU court case law and the Commission’s own practice.

A revised draft of the Notice was published for consultation in November 2022. More than 100 stakeholders responded. On 8 February 2024, the final version was adopted.

B.   Key takeaways of the revised Notice

While the Commission’s fundamental approach to market definition remains the same (i.e., examining demand- and supply-side substitution, product and geographical market), the revised Notice introduces the following key changes:

  • Relevance of non-price comparators. While the 1997 Notice focused on price as the main parameter of competition for market definition, the revised Notice adopts a broader approach. For example, it considers that the SSNIP test[1] may be ill-suited to cases where undertakings compete on parameters other than price.[2] In such instances, non-price factors such as product characteristics (including product quality or level of innovation), functionalities and intended use, might be more determinative for demand substitution.[3] This might be particularly relevant in situations involving multi-sided platforms.[4] In such cases, the Commission suggests analyzing switching behavior of customers in response to a Small but Significant Non-transitory Decrease of Quality (“SSNDQ”).[5]
  • Forward-looking assessment to capture market dynamics. The revised Notice states that, in markets undergoing structural transition (such as regulatory or technological changes) or where a forward-looking assessment may be appropriate, future market shares may be estimated to reflect those expected changes.[6] This chimes with the Commission’s recent merger control practice. Notably, the revised Notice states that internal ordinary course documents or independent industry reports may be particularly relevant for conducting a forward-looking assessment.[7]

Along with general guidance, the revised Notice also provides specific direction on the Commission’s approach to market definition in cases where there is: (i) significant differentiation, (ii) discrimination between customers or customer groups, (iii) significant R&D, (iv) multi-sided platforms, (v) after-markets, bundles and (digital) ecosystems.

We consider the Commission’s guidance on (iii)-(v) in more detail below.

  • Market definition in specific circumstances

(1) Market definition in the presence of significant R&D

Examples of industries characterized by significant R&D include pharmaceuticals, chemicals, electrical equipment, and hardware technology. The Commission explains that, while the specificities of highly innovative industries are usually taken into account during the competitive assessment, they may also be relevant for market definition. In particular, the Commission may factor in various potential outcomes of innovation efforts in its assessment of market definition.

For ‘pipeline’ products (where products are not yet available to customers), the Commission notes that there may be sufficient visibility to establish which other products are likely to be substitutable with the pipeline product. In such cases, the Commission can conclude on whether the pipeline products belong to an existing product market or a new product market.[8] However, where an R&D project is in the early stages of development,[9] the Commission concedes that it may be difficult to identify a relevant product market. However, it may still be possible to delineate the boundaries within which companies compete in early innovation efforts.[10] Factors that may be taken into account include the nature and scope of innovation efforts, the objectives of the research, and the specialization of the teams involved.

(2) Market definition in the presence of multi-sided platforms

The Commission uses the term multi-sided to refer to platforms which support interactions between different groups of users. It considers that often, demand from one group of users will have an influence on demand from others i.e., indirect network effects. Examples include payment card systems, online marketplaces, advertising-sponsored platforms, social networking services, and general search services.

The revised Notice is intended to afford the Commission with the flexibility to define a relevant product market in a way that encompasses all (or multiple) user groups, or to define separate relevant markets for the products offered on each side of the platform.[11] This will depend on factors such as the nature of the platform, the degree of product differentiation on each side, and the behavior of each user group (such as multi-homing i.e., using multiple platforms in parallel), among other things.

The Commission explains that multi-sided platforms often supply products at a monetary price of zero, a fact that it considers will render application of the SSNIP test more challenging. It also highlights that, when a product is supplied at a monetary price of zero, non-price elements become more relevant as does evidence on hypothetical substitution, and barriers or costs of switching such as interoperability.[12]

(3) Market definition in the presence of after-markets, bundles and digital
ecosystems

The Notice defines an after-market as a market where customers who buy a primary product are likely to buy a connected or complementary follow-on (secondary) product. Examples include cars and auto parts/repair services, printers and ink cartridges, etc.[13] In these circumstances, the Commission will also consider the competitive constraints imposed by market conditions in the respective connected markets when defining the relevant market(s).

The Commission lists three possible ways to define relevant product markets in the case of primary and secondary products: (i) as a system market comprising both the primary and the secondary product, (ii) as multiple markets, namely a market for the primary product and separate markets for the secondary products associated with each brand of the primary product, and (iii) as two markets, namely the market for the primary product on the one hand and the market for the secondary product on the other hand.

The Notice also makes reference to digital ecosystems.[14] This section of the revised Notice is likely to play a significant role in the coming years, considering the Commission’s increased scrutiny on interoperability in its recent decisional practice.[15]

C.  Conclusion

How markets are defined will continue to play a central role in competition assessments. Market definition will remain the first step in the Commission’s analysis of any proposed transaction and any potential behavioral case. How the Commission views the relevant markets will lay the groundwork for all subsequent analysis, including on the existence of a dominant position and potential anticompetitive effects.

The revised Notice introduces new chapters on market definition in specific circumstances, notably markets characterized by significant R&D, multi-sided platforms, and digital ecosystems. The Notice leaves many questions open and seeks to allow for a less rigorous and more speculative assessment in order for the Commission to enjoy greater flexibility to pursue stricter enforcement in digital and R&D-intensive markets. Time will tell if such speculative analysis will withstand scrutiny from the Courts.

__________

[1] “Small but Significant and Non-transitory Increase in Price”.

[2] Revised Market Definition Notice, para. 30.

[3] Revised Market Definition Notice, para. 48.

[4] Revised Market Definition Notice, para. 98.

[5] At footnote 54 of the Notice, the Commission refers to case AT.40099 Google Android as an example of a case in which it used the SSNDQ test to determine the boundaries of the relevant market.

[6] Revised Market Definition Notice, para. 113.

[7] Revised Market Definition Notice, para. 77.

[8] At footnotes 121 and 122 of the Notice, the Commission refers to i) case M.7275 Novartis/GlaxoSmithKline Oncology Business as an example of a case in which it included pipeline products still under development in an existing relevant market, alongside products that were already marketed; and, conversely, ii) case M9461 AbbVie/Allergan as an example of a case in which it identified a new relevant market limited to a specific type of inhibitor for the treatment of ulcerative colitis and Crohn’s disease, even though no such inhibitor was, at the time, marketed by any supplier.

[9] The Commission makes clear at footnote 9 of the Notice that the term “product” also covers technologies.

[10] At footnote 125 of the Notice, the Commission refers to case M.7932 Dow/DuPont as an example of a case in which it applied the concept of innovation space to determine that the merging parties were involved in innovation competition.

[11] At footnote 129, the Commission refers to case M.8124 Microsoft/LinkedIn as an example of a case in which it defined a single market which included user groups on either side of the platform.

[12] See for instance Cases M.7217 Facebook/Whatsapp, AT.39740 Google Search (Shopping), M.8124 Microsoft/LinkedIn, AT.40099 Google Android.

[13] OECD, Competition issues in aftermarkets, June 2017 available here.

[14] At footnotes 142 and 143, the Commission refers to i) the judgment in Google and Alphabet v Commission T-604/18, where the General Court defined a digital ecosystem and noted the complementarity/interoperability of the products which would form such an ecosystem, highlighting the potential competitive constraints which such a system may give rise to; and ii) case AT.40099 Google Android as an example of a case where the conditions necessary to give rise to an ecosystem comprising app stores and smartphone operating systems were not present.

[15] E.g., European Commission, Mergers: Commission clears acquisition of VMware by Broadcom, subject to conditions, July 2023 available here.


The following Gibson Dunn attorneys prepared this update: Christian Riis-Madsen, Nicholas Banasevic, Katherine Nobbs, Hayley Smith, Jonas Jousma, and Alex O’Donnell*.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding the issues discussed in this update. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Antitrust and Competition, Mergers and Acquisitions, Private Equity or Technology Transactions practice groups:

Antitrust and Competition:
Nicholas Banasevic* – Managing Director, Brussels (+32 2 554 72 40, [email protected])
Rachel S. Brass – San Francisco (+1 415.393.8293, [email protected])
Ali Nikpay – London (+44 20 7071 4273, [email protected])
Cynthia Richman – Washington, D.C. (+1 202.955.8234, [email protected])
Christian Riis-Madsen – Brussels (+32 2 554 72 05, [email protected])
Stephen Weissman – Washington, D.C. (+1 202.955.8678, [email protected])

Mergers and Acquisitions:
Robert B. Little – Dallas (+1 214.698.3260, [email protected])
Saee Muzumdar – New York (+1 212.351.3966, [email protected])

Private Equity:
Richard J. Birns – New York (+1 212.351.4032, [email protected])
Wim De Vlieger – London (+44 20 7071 4279, [email protected])
Federico Fruhbeck – London (+44 20 7071 4230, [email protected])
Scott Jalowayski – Hong Kong (+852 2214 3727, [email protected])
Ari Lanin – Los Angeles (+1 310.552.8581, [email protected])
Michael Piazza – Houston (+1 346.718.6670, [email protected])
John M. Pollack – New York (+1 212.351.3903, [email protected])

Technology Transactions:
Daniel Angel – New York (+1 212.351.2329, [email protected])
Carrie M. LeRoy – New York (+1 650.849.5337, [email protected])

*Nicholas Banasevic, Managing Director in the firm’s Brussels office and an economist by background, is not admitted to practice law.

*Alex O’Donnell, a legal trainee in the Brussels office, is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The SEC Staff advises that private fund sponsors that wish to exclude the impact of subscription credit facilities when showing a gross internal rate of return in their performance track records also must exclude such impact when showing the corresponding net internal rate of return.

On February 6, 2024, the staff of the U.S. Securities and Exchange Commission (the “SEC Staff”) updated its Marketing Compliance Frequently Asked Questions with respect to the Advisers Act Marketing Rule[1] (the “Marketing Rule”) to issue new interpretive guidance (the “FAQ”) regarding the presentation of investment performance for private investment funds that utilize fund-level subscription credit facilities.[2]

In particular, the SEC Staff advised that private fund sponsors that wish to exclude the impact of subscription credit facilities when showing a gross internal rate of return (“Gross IRR”) in their performance track records must also exclude such impact when showing the corresponding net internal rate of return (“Net IRR”).  According to the SEC Staff, doing otherwise would violate the Marketing Rule’s requirement that any presentation of Gross IRR must be accompanied by Net IRR that has been calculated over the same time period and uses the same type of return and methodology as the gross performance.

In addition, the SEC Staff also took the position that it would be impermissible under the general prohibitions set forth in the Marketing Rule[3] for a private fund sponsor to use performance presentation that shows only a Net IRR that includes the impact of a fund-level subscription credit facility without also including (i) a Net IRR that does not include the impact of such facility or (ii) “appropriate disclosures”[4] describing such facility’s impact on the provided net performance.[5]

In light of the FAQ, we advise that all private fund sponsors promptly review their PPMs, pitchbooks, and related marketing materials for compliance with the new interpretive guidance summarized above.

__________

[1] Rule 206(4)-1 under the Investment Advisers Act of 1940, as amended.

[2] “Subscription credit facilities” broadly include any borrowing secured by the unfunded capital commitments of a fund’s investors, such as subscription line financings, capital call facilities, and bridge lines.

[3] Rule 206(4)-1(a).

[4] The FAQ does not clarify what would constitute an “appropriate disclosure” in this context, though we believe it would include, at minimum, a clear statement that the Net IRR takes into account leverage, which may make the returns higher than what they would have been without the use of such leverage.

[5] A sponsor that complies with this requirement would not also need to show a corresponding gross figure, as the Marketing Rule does not generally require the inclusion of gross performance any time net performance is shown.


The following Gibson Dunn lawyers assisted in preparing this update: Kevin Bettsteller, Greg Merz, Shannon Errico, and Robert Harrington.

Gibson Dunn’s lawyers are available to assist with any questions you may have regarding the issues and considerations discussed above. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Investment Funds practice group:

Jennifer Bellah Maguire – Los Angeles (+1 213.229.7986, [email protected])
Kevin Bettsteller – Los Angeles (+1 310.552.8566, [email protected])
Albert S. Cho – Hong Kong (+852 2214 3811, [email protected])
Candice S. Choh – Los Angeles (+1 310.552.8658, [email protected])
John Fadely – Singapore (+65 6507 3688, [email protected])
A.J. Frey – Washington, D.C./New York (+1 202.887.3793, [email protected])
Shukie Grossman – New York (+1 212.351.2369, [email protected])
James M. Hays – Houston (+1 346.718.6642, [email protected])
Kira Idoko – New York (+1 212.351.3951, [email protected])
Gregory Merz – Washington, D.C. (+1 202.887.3637, [email protected])
Eve Mrozek – New York (+1 212.351.4053, [email protected])
Roger D. Singer – New York (+1 212.351.3888, [email protected])
Edward D. Sopher – New York (+1 212.351.3918, [email protected])
William Thomas, Jr. – Washington, D.C. (+1 202.887.3735, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

An overview of recent developments, including a U.S. Supreme Court case addressing Item 303 of Regulation S-K; significant Delaware corporate law cases; recent decisions involving special purpose acquisition companies; securities litigation involving ESG-related allegations; notable cryptocurrency cases; and other matters. 

This update provides an overview of the major developments in federal and state securities litigation since our 2023 Mid-Year Securities Litigation Update:

  • We discuss a major addition to the Supreme Court’s October Term, in which the Court will address the extent to which Item 303 of Regulation S-K can subject a filing company to private shareholder suits. We also discuss a lower-court development calling attention to a circuit split that may end up before the Supreme Court.
  • We review significant developments in Delaware corporate law, including those related to the high pleading bar plaintiffs must clear to successfully bring a duty of oversight (or Caremark) claim, advance notice bylaws, lost merger-premium provisions, books and records demands, and identity-based allocations of voting power. We also discuss a case with potentially significant implications for transactions involving controlling stockholders.
  • We review developments in federal securities litigation involving special purpose acquisition companies (“SPACs”), including two recent decisions addressing scienter in the SPAC context.
  • We examine several developments in securities litigation involving environmental, social, and corporate governance-related allegations.
  • We survey notable developments in cryptocurrency litigation and regulation and address certain technological developments in the industry as well.
  • We continue to monitor developments regarding the Supreme Court’s 2019 decision Lorenzo v. SEC, in which the Court expanded the scope of scheme liability by finding that even if the disseminator of a false statement did not “make” that false statement within the meaning of Rule 10b-5(b), they may still be liable under Rule 10b-5(a) and (c) if they disseminate a false statement with intent to defraud. As discussed in our prior updates, following Lorenzo, lower courts continue to grapple with what conduct is sufficient to maintain a scheme liability claim.
  • We provide an update on the long-running class certification dispute in Arkansas Teacher Retirement System v. Goldman Sachs Group, Inc. and discuss how district courts are applying the Supreme Court’s guidance.
  • Finally, we address several other notable developments including: Omnicare developments out of the Third and Second Circuits; the Second Circuit and the Southern District of New York declining to enforce control share acquisition provisions; the Ninth Circuit ruling that SEC Rule 16b-3 does not require purpose-specific board approval of transactions; and updates in the cybersecurity litigation arena.

I. FILING AND SETTLEMENT TRENDS

Data from a recent NERA Economic Consulting (“NERA”) study illustrates several trend changes.  Federal securities litigation filings in 2023 increased compared to filings in 2022 and 2021.  At the same time, “Health and Technology Services” and “Electronic Technology and Technology Services” filings—which represented over 50% of filings last year—decreased significantly on a relative basis.  Cryptocurrency filings also decreased, from 26 filings in 2022 to 16 filings in 2023.  Meanwhile, “Finance” sector filings increased to 18%, and “Producer and other Manufacturing” sector filings doubled on a relative basis.  Settlement values—excluding merger-objection cases, crypto unregistered securities cases, and cases settling for more than $1 billion or $0 to the class—stayed relatively consistent.  The average settlement value decreased from $37 million to $34 million, while the median settlement value increased from $13 million to $14 million.

A. Filing Trends

Figure 1 below reflects the federal filing rates from 1996 through 2023 (all charts courtesy of NERA).  228 federal cases were filed in the past year.  This is a slight increase in filings compared to 2022 and 2021, but still nowhere near the number of filings in the peak years of 2017-2019.  Note, however, that this figure does not include class action suits filed in state court or state court derivative suits, including those in the Delaware Court of Chancery.

Figure 1:

B. Mix Of Cases Filed In 2023

1. Filings By Industry Sector

The distribution of non-merger objections and non-crypto unregistered securities filings, as shown in Figure 2 below, had some slight variations this year compared to previous years.  Notably, the “Health and Technology Services” sector percentage was the lowest it has been in the last five years, dropping from 27% to 19% in the past year.  “Electronic Technology and Technology Services” filings also decreased compared with the two prior years.  Thus, while “Health and Technology Services” and “Electronic Technology and Technology Services” filings accounted for over 50% of filings in both 2021 and 2022, that total decreased to 41% this year.  Meanwhile, “Finance” sector filings increased steeply on a relative basis, from 8% to 18%, and filings related to the “Producer and Other Manufacturing” sector doubled on a relative basis from 3% to 6%.

Figure 2:

 

2. Merger Cases

As shown in Figure 3 below, there were seven merger-objection cases filed in federal court in 2023.  This continues the downward trend of merger objection filings, beginning in 2020.

Figure 3:

 

3. Cryptocurrency Cases

Figure 4 below illustrates the trends in cryptocurrency filings in federal court from 2016 through 2023.  This past year, there were 11 crypto unregistered securities filings and five crypto shareholder filings, matching the numbers for 2018.  The number of both types of crypto filings decreased from 2022, with the number of crypto shareholder filings cut in half and the number of crypto unregistered securities filings decreasing by 31%.

Figure 4:

C. Settlement Trends

As reflected in Figure 5 below, the average settlement value in 2023 reached $34 million, dropping compared to the average value in 2022 of $37 million.  (Note that the average settlement value excludes merger-objection cases, crypto unregistered securities cases, and cases settling for more than $1 billion or $0 to the class.)

Figure 5:

As for median settlement value, Figure 6 shows that the value remained relatively even for 2023 at $14 million.  This median value has been consistent over the past 5 years, excluding the low outlier in 2021.  (Note that median settlement value excludes settlements over $1 billion, merger objection cases, crypto unregistered securities cases, and zero-dollar settlements.)

Figure 6:

Figure 7:

Finally, as shown in Figure 7, Median NERA-Defined Investor Losses decreased slightly in 2023 to $923 million from $984 million in 2022.  This remains relatively high compared to prior years.  The Median Ratio of Settlement to Investor Losses continued to hold steady at 1.8% for the third straight year.

II. WHAT TO WATCH FOR IN THE SUPREME COURT

A. Pending Before The Supreme Court: Macquarie Infrastructure Corp. v. Moab Partners, L.P. – Private Actions Based On Violations Of Item 303

On January 16, 2024, the Supreme Court heard argument in Macquarie Infrastructure Corp. v. Moab Partners, L.P., a case with significant implications for securities class actions.  The petition in that case presented one question for the Court’s review:  whether a failure to make a disclosure required under Item 303 of SEC Regulation S-K can support a private claim under Section 10(b) of the Exchange Act and Rule 10b-5 promulgated thereunder, even in the absence of an otherwise-misleading statement.  Petition for a Writ of Certiorari at i, 1, Macquarie Infrastructure Corp. v. Moab Partners, L.P., No. 22-1165 (May 30, 2023).

As background, Item 303 is an SEC regulation that requires public companies to disclose in their filings with the SEC any “known trends or uncertainties that have had or that are reasonably likely to have a material favorable or unfavorable impact” on the company’s financial condition.  17 C.F.R. § 229.303(b)(2)(ii).  Although at least some courts have indicated that a violation of Item 303 does not give rise to a direct private right of action, see Carvelli v. Ocwen Fin. Corp., 934 F.3d 1307, 1330 (11th Cir. 2019), plaintiffs in this case pursued their Item 303 claim under Section 10(b) of the Exchange Act and Rule 10b-5.  Under those provisions, investors may bring a private action against a company to recover losses caused by, among other things, a the company’s material misrepresentations or omissions.  City of Riviera Beach Gen. Emps. Ret. Sys. v. Macquarie Infrastructure Corp., 2021 WL 4084572, at *6-7 (S.D.N.Y. Sept. 7, 2021).

Plaintiffs alleged that defendant Macquarie Infrastructure and related parties violated Section 10(b) and Rule 10b-5 by virtue of a “host of . . . misstatements and omissions” about a then-anticipated marine fuel regulation that could affect Macquarie’s financial condition.  Id. at *2, *6-7.  Specific allegations included that defendants were required under Item 303 to disclose some uncertainty regarding the pending regulation, and that the failure to disclose any uncertainty was a materially misleading omission actionable under Rule 10b-5.  See id. at *10.

On September 7, 2021, a district judge in the Southern District of New York dismissed plaintiffs’ case in its entirety.  Id. at *13.  As to plaintiffs’ theory of omissions under Item 303, the district court found that plaintiffs had not alleged any “uncertainty that should have been disclosed”; “in what SEC filing or filings Defendants were supposed to disclose it”; that any uncertainty was material enough that it needed to be disclosed under Item 303; or the time at which “Defendants ‘actually kn[ew]’” of any uncertainty that should have been disclosed earlier than February 2018.  Id. at *4, *10.  But on appeal, the Second Circuit vacated the district court’s dismissal.  Moab Partners, L.P. v. Macquarie Infrastructure Corp., 2022 WL 17815767, at *2 (2d Cir. Dec. 20, 2022).  It explained that “[t]he failure to make a material disclosure required by Item 303 can serve as the basis for . . . a claim under Section 10(b) if the other elements have been sufficiently pleaded” and held that plaintiffs had met that pleading standard.  Id.

The Second Circuit’s ruling in Macquarie raised an opportunity for the Supreme Court to review an apparent split between the Second Circuit’s approach and that of the Third, Ninth, and Eleventh Circuits.  Those courts held that, because Item 303 relies on a different disclosure standard than Rule 10b-5, an Item 303 violation does not, on its own, constitute an actionable omission under Rule 10b-5.  See Carvelli, 934 F.3d at 1331; In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1056 (9th Cir. 2014); Oran v. Stafford, 226 F.3d 275, 288 (3d Cir. 2000).  The Court had granted certiorari in an earlier case presenting this issue, but the parties in that case, Leidos, Inc. v. Indiana Public Retirement System, No. 16-581, agreed to a settlement before the Court heard oral argument.  See Petition for a Writ of Certiorari at 1, Macquarie Infrastructure Corp. (citing Leidos); Gibson Dunn Client Alert (Apr. 3, 2017)Macquarie, now fully briefed and argued, is thus expected to bring clarity to this area.

B. Lower Court Development: SEC v. Govil Deepens Circuit Split

On October 31, 2023, the Second Circuit issued its opinion in SEC v. Govil, highlighting a circuit split between the Second and Fifth Circuits on the nature of the disgorgement remedy available under the Exchange Act.  86 F.4th 89 (2d Cir. 2023).  For a more detailed discussion of the facts and holding of Govil, please see our November 16, 2023 Client Alert.

The split arises from the courts’ different interpretations of the Supreme Court’s 2020 decision in SEC v. Liu and Congress’ subsequent amendment of the Exchange Act.  591 U.S. ___, 140 S. Ct. 1936 (2020); 15 U.S.C. §§ 78u(d)(5) & 78u(d)(7).  In Liu, the Supreme Court interpreted the term “equitable relief” in 15 U.S.C. § 78u(d)(5), which since 2002 had been recognized as expressly authorizing disgorgement as a remedy for violations of securities law.  Liu, 140 S. Ct. at 1940; see also Govil, 86 F.4th at 99.  The Court in Liu held that certain equitable limits apply to this disgorgement remedy, including that a proper disgorgement award must be “awarded for victims” and must not “exceed a wrongdoer’s net profits.”  Liu, 140 S. Ct. at 1940, 1947.  Then, six months after Liu was decided, Congress enacted 15 U.S.C. § 78u(d)(7), which expressly permits the SEC to “seek,” and federal courts to “order,” the remedy of “disgorgement.”

Before Govil, the Second and Fifth Circuit reached competing views of the effect of that statutory amendment.  First, in SEC v. Hallam, the Fifth Circuit held that § 78u(d)(7) did not codify Liu’s more stringent evidentiary and procedural requirements; instead, Congress’ action was “consistent with a desire to curtail” Liu’s impact, so that the SEC could seek “disgorgement in a legal—not equitable—sense” under § 78u(d)(7), as it could before Liu.  42 F.4th 316, 334-35, 338-41 (5th Cir. 2022).  The following year, in SEC v. Ahmed, the Second Circuit interpreted “disgorgement” under § 78u(d)(7) to be subject to the same limitations that Liu imposed on “equitable relief” under § 78u(d)(5).  72 F.4th 379, 296 (2d Cir. 2023).  In doing so, the Second Circuit expressly disagreed with the Fifth Circuit’s approach in HallamSee id. at 395 & n.7.

In Govil, the Second Circuit followed Ahmed, applying § 78u(d)(7) as cabined by LiuGovil, 86 F.4th at 101-02.  Govil thus held that, before ordering disgorgement, the district court was required to find that investors defrauded by a defendant’s actions had suffered pecuniary harm.  Id. at 94, 105.  In the absence of a finding of harm, the Second Circuit held that the district court abused its discretion by ordering disgorgement as a remedy.  Id.  Further, even if investors were found to have been harmed, the district court also erred by not “undertaking a valuation” of the securities defendant had already surrendered to the company.  Id. at 110-11.  In issuing the disgorgement order without valuing the assets already turned over to potential victims, the district court order risked “forcing [the] defendant to pay disgorgement twice,” which would “amount[] to a penalty” impermissible under LiuId. at 107.  Accordingly, the Second Circuit vacated the district court’s judgment and remanded with instructions to find whether “the defrauded investors suffered pecuniary harm.” Id. at 111.

In reaching this decision, the court explicitly noted the circuit split, reviewing the Hallam decision and recognizing that the Fifth Circuit’s reasoning had relied on “familiar principles of statutory interpretation.”  Id. at 100-02.  The court also noted that the split could be outcome-determinative in cases like Govil because the Hallam rule “might authorize disgorgement” on Govil’s facts, even without a finding that affected investors were “victims” who had suffered pecuniary loss.  Id. at 102 n.13.

Although it follows Second Circuit precedent in recognizing a narrower path for the SEC to seek—and courts to grant—disgorgement, Govil highlights both the existence of the post-Liu circuit split on disgorgement and its potential stakes for defendants.

III. DELAWARE DEVELOPMENTS

Delaware law has continued to develop apace over the last six months, and significant new developments are expected in the year ahead.  In December 2023, the Delaware Supreme Court heard oral argument in a case that could substantially alter the landscape for transactions involving a controlling stockholder.  Delaware courts also continued issuing decisions in the wake of the SEC’s Universal Proxy rule, which we discussed in our 2023 Mid-Year Securities Litigation Update; so far, Delaware courts have taken a measured approach.  Courts continue to confront Caremark claims and reiterate the relatively narrow circumstances in which such claims arise.  Other recent decisions applied traditional Delaware law principles to emerging dynamics—e.g., the application of case law regarding books and records demands when the demand is by a potential activist investor, and the application of Sections 151(a) and 212(a) to a certificate of incorporation that provides greater voting power to a subset of entities and individuals than to other stockholders.  Finally, the Delaware Court of Chancery recently narrowed the enforceability of a “Con Ed” provision allowing a target company to seek lost stockholder premium as damages resulting from an acquiror’s breach in a failed merger.

A. The Delaware Supreme Court Considers Burdens In Conflicted Controller Transactions

In December 2023, the Delaware Supreme Court heard oral argument in In re Match Group, Inc. Derivative Litigation, a case that could clarify when burdens of proof and standards of review shift in allegedly conflicted controller transactions.

At issue in In re Match Group, Inc. Derivative Litigation is a “multi-step reverse spinoff initiated by a controller.”  2022 WL 3970159, at *1 (Del. Ch. Sept. 1, 2022). After concluding that “the process as pled satisfied MFW,” the Court of Chancery applied the deferential business judgment standard and dismissed the case.  Id.  MFW, which involved a squeeze-out merger, provided that, “in controller buyouts, the business judgment standard of review w[ould] be applied if and only if” several factors were met.  Kahn v. M & F Worldwide Corp., 88 A.3d 635, 645 (Del. 2014).  Among them is the requirement that a controller “condition[] the procession of the transaction on the approval of both a Special Committee and a majority of the minority stockholders.”  Id.

Plaintiffs then appealed to the Delaware Supreme Court.  Relevant here, they argued that the Court of Chancery erred in concluding that MFW can be satisfied when less than the entire special committee is independent.  Appellants’ Opening Brief at 18-22, In re Match, 2022 WL 3970159, Dkt. 24 (Dec. 2, 2022).

In response, a group of defendants argued that plaintiffs should carry the burden when something less than MFW is satisfied in conflicted controller transactions outside the merger squeeze-out context.  See, e.g., Corrected Answering Brief of IAC Defendants at 8-10, In re Match, 2022 WL 3970159, Dkt. 57 (Jan 12, 2023).  In their view, the Supreme Court should put an end to “MFW creep”—i.e., the gradual “expan[sion of] MFW’s scope.”  Id. at 1-2.

After the initial round of briefing, the Delaware Supreme Court requested supplemental briefing on the issue.  See Supplemental Briefing Order, In re Match Grp., Inc. Deriv. Litig. at 3, No. 368, 2022 (Del.), Dkt. 58  (requesting briefing on “whether the Court of Chancery judgement should be affirmed because [the at-issue] [t]ransactions were approved by either (a) [a special committee] or (b) a majority of the minority stockholder vote?”).

Affirming on the basis that the transactions were approved by either a special committee or a majority of the minority stockholder vote in the context of a conflicted controller transaction other than a squeeze-out merger would indicate that plaintiffs bear the burden when something less than MFW is satisfied.  But whichever path it takes—confining MFW to controller squeeze-out mergers or endorsing its application to other contexts—the Supreme Court’s opinion, should it rule on this basis, could alter the playing field considerably.

B. Delaware Courts Begin Addressing Advance Notice Bylaws In The Wake Of The SEC’s Universal Proxy Rule

Since the Universal Proxy rule—discussed in our 2023 Mid-Year Update—took effect, the Delaware Court of Chancery “has only begun to hear disputes involving the wave of new and amended advance notice bylaws.”  Kellner v. AIM Immunotech Inc., — A.3d —, 2023 WL 9002424, at *15 (Del. Ch. Dec. 5, 2023).  Although early days, the decision discussed below indicates that Delaware courts are taking a measured approach.  See, e.g., id. at *15 (“[I]t is apparent that the court must—more than ever—carefully balance the competing interests at play.”).

In Kellner v. AIM Immunotech Inc., the Court of Chancery reviewed a set of bylaws prompted, in part, by prior “activist activity.”  2023 WL 9002424, at *9.  According to counsel for AIM, the group of activists had “engag[ed] in efforts to conceal who was supporting and who was funding the nomination efforts and to conceal the group’s plans for the Company.”  Id.  This decision arises out of a “renewed nomination attempt” made by a similar group, albeit one described as “smarter” “in many ways” “than the preceding effort.”  Id. at *1.

In the end, the decision “is a tale of wins and losses on both sides.”  Id.  For plaintiff, for example, the court concluded that his notice “contravened valid bylaws” and “suffer[ed] from the same primary defect as his predecessor’s: it obscure[d] obvious arrangements or understandings pertaining to the nomination.”  Id.

For defendants, certain bylaws were held invalid “because they inequitably imperil[ed] the stockholder franchise to no legitimate end.”  Id. at *1, *16.  To that end, the court reviewed the bylaws under enhanced scrutiny, asking first “whether the board faced a threat to an important corporate interest or to the achievement of a significant corporate benefit,” and, second, “whether the board’s response to the threat was reasonable in relation to the threat posed and was not preclusive or coercive to the stockholder franchise.” Id. at *17 (citation and quotation marks omitted).

After concluding that the Board’s response was objectively reasonable at step one, the court found that the Board “failed to show that certain of the provisions [we]re proportionate in relation to [the Board’s] objectives.”  Id.  For example, one provision generally required “the disclosure of all arrangements, agreements, or understandings [“AAUs”] ‘whether written or oral, and including promises,’ relating to a Board nomination.”  Id. at *19.  In addition, the provision contained a “a bespoke 24-month lookback provision” and required “a nominating stockholder to disclose AAUs both with persons acting in concert with the stockholder and any”—broadly defined—”‘Stockholder Associated Person’ (or ‘SAP’).”  Id. at *20-21.  This latter requirement was where the provision went “off the rails,” as it created “an ill-defined web of disclosure requirements” more “akin to a tripwire than an information gathering tool.”  Id. at *22.  In short, it “render[ed] the AAU Provision overbroad, unworkable, and ripe for subjective interpretation by the Board.” Id.  In addition, the Board “presented no evidence to suggest that” it was “proportionate to its objective of preventing stockholders from misconstruing and evading the Amended Bylaws’ disclosure requirements.”  Id

As another example, the bylaws required “the nominator and nominees to list all known supporters.”  Id. at *23.  AIM argued that the bylaw was consistent with a prior decision, Rosenbaum v. CytoDyn, Inc., 2021 WL 4775140 (Del. Ch. Oct. 13, 2021).  (Discussed in our 2021 Year-End Update.)  The court disagreed, noting the provision went “farther than what the precedent supports.”  Kellner, 2023 WL 9002424, at *23.  Whereas, the court explained, CytoDyn concerned a bylaw mandating the disclosure of known financial supports, the bylaw at issue in AIM “s[ought] disclosure of any sort of support whatsoever, including that of other stockholders known by SAPs to support the nomination.” Id.  As a result, its “limits . . . [we]re ambiguous—both in the terms of the types of support and supporters one must disclose.”  Id.  Accordingly, it “impede[d] the stockholder franchise while exceeding any reasonable approach to ensuring thorough disclosure.”  Id.

This decision “hints at what coming activism disputes may bring,” id. at *1, and Gibson Dunn will follow future developments.

C. Delaware Courts Reiterate The Requirements For Pleading Caremark Claims

In In re ProAssurance Corp. Stockholder Derivative Litigation, the court dismissed duty of oversight—i.e., Caremark—and disclosure claims brought against the officers and directors of ProAssurance, a healthcare professional liability insurance provider.  2023 WL 6426294, at *1 (Del. Ch. Oct. 2, 2023).  In doing so, the court emphasized that Caremark claims are “reserved for extreme events.”  Id.  By contrast, the events underlying the litigation “quite obviously[] involve[d] a commercial decision that went poorly—the stuff that business judgment is made of.”  Id.  Together with Segway, discussed below, ProAssurance reaffirms the high pleading bar set by Caremark and its progeny.

Starting around 2015, the healthcare professional liability insurance “competitive marketplace shifted toward underwriting policies for larger physician groups, hospitals, and major national healthcare provider entities.”  Id. at *2.  Concomitantly, ProAssurance began to consider following—and ultimately did follow—that trend, which presented business risks and opportunities.  See, e.g., id. at *3-4.  Recognizing as much, ProAssurance focused on potential risks and worked with third parties to assess the same.  Id. at *3.  Indeed, the court found, ProAssurance’s “Board was consistently—even painfully—involved in monitoring the Company’s underwriting and reserves.”  Id. at *10.  Meanwhile, “[t]he Company. . . attest[ed] to the conservative nature of its loss reserves practices.”  Id. at *6.  Over time, however, claims grew, and in early 2020, ProAssurance publicly announced “adverse development[s]” related to “large national healthcare account.”  Id. at *9.

In dismissing the complaint on demand futility grounds, the court explained, among other things, that plaintiffs’ allegations fell far short of pleading either of the two “necessary conditions predicate for director oversight liability:  (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations.” Id. at *12. Among other things, the court highlighted that, in addition to failing to allege illegality or bad faith, the pleadings “detail[ed] the engagement of auditors and actuarial advisors, oversight of management charged with the Company’s underwriting functions, meetings to discuss severity trends and reserves, and Board-level updates on large accounts.”  Id. at *13.  As for plaintiffs’ disclosure claims, they were dismissed due to a lack of “any particularized allegations of scienter.”  Id. at 16.

In Segway Inc., v. Cai, the court dismissed at the pleading stage a Caremark claim brought against the former president and “in-house accountant” of Segway Inc., related to Segway’s “declining sales . . . and increased accounts receivable.”  2023 WL 8643017, at *1 (Del. Ch. Dec. 14, 2023).  The complaint alleged that the former president “knew or should have known that there were potential issues” with “some of [Segway’s] customers, which caused [Segway’s] accounts receivable to continuously rise.”  Id. at *3.  Thus, plaintiffs claimed, the former president “breached her fiduciary duties as an officer of Segway by ‘continuously ignoring’ these ‘issues (and the resulting impact on [Segway’s] profitability), fail[ing] to take any action to address them . . . and/or fail[ing] to advise [Segway’s] board.’”  Id. (alterations in original).

In dismissing Segway’s Caremark claim, the court took pains to correct a “distressing reading of” Delaware law—i.e., that “the high bar to plead a Caremark claim is lowered when the claim is brought against an officer.”  Id. at *1.  “[B]ad faith remains a necessary predicate to any Caremark claim,” the court explained, and “[l]iability can only attach in the rare case where fiduciaries knowingly disregard this oversight obligation and trauma ensues.”  Id.  Emphasizing that the Caremark doctrine is “not a tool to hold fiduciaries liable for everyday business problems,” the court dismissed Segway’s claims because they failed to adequately plead bad faith or illegality.  Id. at *5.

Both Segway and ProAssurance reinforce that, “[i]rrespective of the defendant’s corporate title, a Caremark claim is ‘possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment.’”  Id. at *5 (quoting In re Caremark Int’l Inc. Deriv. Litig., 698 A.2d 959, 967 (Del. Ch. 1996)).

D. Section 220 Demands In The Context Of Potential Stockholder Activism

In Greenlight Capital Offshore Partners, Ltd. v Brighthouse Financial, Inc., the court ruled largely in defendant’s favor in a case concerning a books and records demand under Section 220 of the DGCL.  2023 WL 8009057, at *1 (Del. Ch. 2023).  Although concluding that plaintiff Greenlight Capital’s purpose for the demand was proper, the court nonetheless found that Greenlight had “only proven that a narrow subset of the materials it request[ed] [we]re necessary and essential to its valuation purpose.”  Id. at *1, *8.

Greenlight, a hedge fund, owned shares of defendant Brighthouse Financial, Inc.  Id.  Brighthouse Financial, Inc. “is a public holding company that sells insurance products through private subsidiaries.”  Id.  “In 2020 and 2021, Brighthouse’s stock price jumped after [a subsidiary] . . . issued extraordinary dividends with the approval of the Delaware Department of Insurance.”  Id.  Those dividends, in turn, aroused Greenlight’s interest in that subsidiary and prompted Greenlight to “‘consider activism’ towards Brighthouse.” Id. at *1, *6.

After its FOIA request failed, Greenlight turned to a books and records demand with the stated purpose of “‘more accurately determin[ing] the value’ of its Brighthouse shares;” “[i]t sought, ‘[i]n particular[,] . . . to determine the true financial impact of [the dividend-issuing subsidiary] . . . on the value of’ the shares.”  Id. at *4.  To that end, Greenlight requested several categories of documents spanning a number of years.  Id.  Brighthouse rejected Greenlight’s demand for several reasons, including that they were overbroad, it could glean the information it sought from public filings, and its stated purpose was neither its real purpose nor, possibly, a proper purpose.  Id.

Greenlight then filed suit.  Id. To prevail on a Section 220 claim, a party must, among other things, offer a proper purpose for its request and demonstrate that the requested materials are “essential to accomplish[] the . . . articulated purpose.”  Id. at *5.

After trial, the court found that Greenlight’s stated purpose was “a proper purpose” under “settled law in Delaware” and rejected Brighthouse’s contention that Greenlight’s stated purpose was merely “a pretext [for] activism.”  Id. at *5-6.  The court explained that “[activism] is not . . . a purpose unto itself,” and because Greenlight demonstrated a proper primary purpose, any additional motivations were irrelevant.  Id. at *7.

Turning to Greenlight’s specific requests, the court found that it had “only proven that a narrow subset of the materials it request[ed] [we]re necessary and essential to its valuation purpose.”  Id. at *8.  This was partly due to Brighthouse’s and its subsidiary’s public filings and partly due to Greenlight’s requests seeking either stale information or information pertaining to “future potential dividend capacity”—both of which were “too attenuated from Greenlight’s purpose of more accurately determining the current value of its Brighthouse shares.”  Id. at *8-9.

E. Court Of Chancery Upholds Differential Voting Power Based On Identity

In Colon v. Bumble, Inc., the Delaware Court of Chancery upheld the validity of provisions that resulted in all shares of Bumble stock carrying one vote unless held by a “Principal Stockholder.”  — A.3d —-, 2023 WL 5920100, at *2-4, *9 (Del. Ch. Sept. 12, 2023).  Principal Stockholders (who are party to a separate, publicly disclosed stockholder agreement) are, by contrast, entitled to 10 votes per share.  Id. at *3-4.

Plaintiff claimed that the provisions giving rise to that dynamic violated Sections 151(a) and 212(a) of the DGCL.  Id. at *4.  In rejecting plaintiff’s challenge and concluding that it “is permissible” to “hav[e] the level of voting power turn on the identity of the owner,” id. at *9, the court explained that Delaware precedent already concluded that formula-based allocations of voting power are consistent with Delaware law, and the DGCL expressly permits voting power to “depend on facts ascertainable outside of the certificate of incorporation.”  Id. at *8.

As to Section 212(a), the court disagreed with plaintiff’s assertion—based not on Section 212(a)’s text but on an earlier Delaware Supreme Court opinion—that “a corporation cannot create a mechanism in which shares of the same class differ in their share-based voting power depending on who holds them.”  Id. at *9.  Among other things, it explained that despite the Supreme Court’s somewhat “puzzl[ing]” reasoning, it approved of provisions that are relevantly similar to the ones before the court.  Id. at *9-15.

As to Section 151(a), the court rejected the assertion that it requires “a class of stock [to] assign the same voting rights to all shares.”  Id. at *15.  Section 151(a), the court explained, does not require either that a formula “generate the same result for all shares,” or that different results can flow from the formula “but it must be a formula that gives any holder an opportunity to gain” its benefits.  Id.  Section 151(a) only requires that “the method”—”not the outcome”—”be identical across all shares in [a] class.”  Id. at *10 (“Section 151(a) expressly permits the use of formulas and procedures that apply across all shares but which can generate different results for different shares based on facts ascertainable outside of the charter (such as the identity of the holder).”).

F. Court Of Chancery Limits The Options For “Con Ed” Provisions

In October 2023, the court in Crispo v. Musk held that a so-called “Con Ed” provision in a merger agreement between Elon Musk and Twitter, Inc., which “purport[ed] to define a target company’s damages to include lost-premium damages,” was an unenforceable contract penalty.  304 A.3d 567, 584 (Del. Ch. 2023).  In this decision on plaintiff’s mootness fee petition, the court found that plaintiff lacked standing because the merger agreement did not confer third-party beneficiary status to stockholders and Twitter’s pursuit of a claim for specific performance of the merger agreement negated plaintiff’s ability to pursue damages under a theory that Lost-Premium Provision provided plaintiff with implicit third-party status.  Id. at 578.  In the course of determining the viability of plaintiff’s claim, the court also held that a Lost-Premium Provision that defines lost-premium damages as exclusive to the target, a damages-definition “Con-Ed” provision, is unenforceable as an unlawful contract penalty under Delaware Law.  Id. at 584.  We discussed this decision in greater detail in our November 8, 2023 Client Alert.

G. Court Of Chancery Invalides $55.8 Billion Equity Compensation Package

In Tornetta v. Musk, a court ruled in favor of Tesla stockholders who brought a derivative lawsuit challenging the multiyear compensation arrangement awarded to Tesla CEO Elon Musk.  — A.3d —, 2024 WL 343699, at *1 (Del. Ch. Jan. 30, 2024).  For more information, please see our February 5, 2024 Client Alert.

IV. FEDERAL SPAC LITIGATION

In 2023, the number of SPAC IPOs again declined, continuing a trend noted in our 2022 and 2023 Mid-Year Securities Litigation Updates.  Between January and November 2023, there were 28 SPAC IPOs, compared to 86 in 2022 and 613 in 2021.  2023 saw a corresponding decline in SPAC-related securities suits, with just 18 new SPAC-related federal securities complaints filed in 2023, down from 29 in 2022.

Although the filing of SPAC-related litigation has slowed, existing cases continue to make their way through the courts.  In September 2023, a pair of district courts considered whether allegations of scienter based on general incentives present in de-SPAC transactions were sufficient and found that they were not.

Phoenix Insurance Company, Ltd. v. ATI Physical Therapy, Inc., 2023 WL 5748359 (N.D. Ill. Sept. 6, 2023):  Investors brought a putative class action alleging securities fraud claims against a physical therapy services company that went public via a de-SPAC, the company’s former CEO and CFO, and the former CEO of the SPAC.  Id. at *1.  Plaintiffs alleged that defendants made misleading statements and omissions in proxy statements issued before the merger relating to the attrition rate of the company’s physical therapists.  Id. at *4, *8.  Investors alleged that the former CEO of the SPAC, who was also the former CEO of the target, acted with scienter based in part on the theory that officers of a SPAC have incentives to “present a target company in a misleadingly favorable light to ensure the company is acquired,” allowing the officers of the SPAC to “gain favorable employment in the post-merger company rather than returning the funds to the investors.”  Id. at *2, *15 (internal quotations omitted).

The court found that these “exceedingly generic” motive allegations did “not contribute much to a strong inference of scienter” because they said “nothing about the motivations, circumstances, and factors particular to” the former SPAC CEO.  Id. (emphasis in original).  Ultimately, the court dismissed the claims against the former CEO of the SPAC, finding plaintiffs fell “far short of pleading a strong inference of scienter.”  Id. at *20.  The claims against the company and its former executives survived.

In re Danimer Scientific, Inc. Securities Litigation, 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023):  We first reported on this case in our 2022 Year-End Securities Litigation Update.  Danimer, a bioplastics company, went public in 2020 via a de-SPAC merger.  Id. at *1-2.  Danimer stockholders brought a class action asserting securities fraud claims against the company and several of its directors and officers, including one director who was previously the CEO of the SPAC.  Id.  During the period between announcing the merger agreement and the shareholder vote, defendants made allegedly misleading statements in investor presentations and press releases regarding the biodegradability of Danimer’s products, production capacity, product demand, and managerial success of Danimer’s CEO.  Id. at *4-5.

The court granted defendants’ motion to dismiss because plaintiffs failed adequately to allege scienter.  Id. at *1, *10-12.  Plaintiffs asserted that, given the limited lifespan of a SPAC, Danimer’s former CEO was incentivized to complete the de-SPAC merger to avoid returning the money the SPAC had raised from its investors.  Id. at *11.  The court characterized what it described as plaintiffs’ “bet the company theory” of scienter as “still far too generalized . . . to allege the proper concrete and personal benefit required” under Second Circuit precedent, rejecting the idea that “the SPAC model of taking a company public puts unique pressures on . . . management to complete a bad deal[.]”  Id. (internal citation omitted).  Plaintiffs further asserted that the company and two of its directors were motivated to close the de-SPAC merger because it would provide the only available means of funding Danimer’s plans to expand its facilities.  Id. at *11.  Plaintiffs’ scienter allegations fell short there as well, the court explained, as defendants shared “a goal possessed by virtually all corporate insiders[,]” which “remains true even if a company decides to raise capital through merging with another company.”  Id. (internal citations omitted).  Thus, plaintiffs failed to meet the PSLRA’s scienter pleading standards because they invoked only “incentives supposedly faced by SPACs generally.”  Id. (citing Phoenix Ins., 2023 WL 5748359, at *15).

Gibson Dunn represents defendants in this action.

V. ESG CIVIL LITIGATION

A growing number of lawsuits have been filed challenging public companies’ environmental, social, and governance (“ESG”) disclosures and policies.  The following section surveys notable developments in pending cases that involve ESG allegations.

A. Environmental Litigation

In re Danimer Scientific, Inc. Securities Litigation, 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023):  As noted above, plaintiffs in this action alleged that defendants made misleading statements in investor presentations and press releases regarding, among other things, the biodegradability of Danimer’s products.  ECF No. 44 at 2-3.  They further alleged that when an article published in The Wall Street Journal claimed that the timing in which the company’s product would biodegrade was more variable than suggested, the company’s stock price allegedly dropped.  Id. at 11-13.  As noted, the court concluded that plaintiffs had not adequately alleged scienter and entered an order dismissing the complaint with prejudice on September 30, 2023.  In re Danimer Sci., Inc. Sec. Litig., 2023 WL 6385642 (E.D.N.Y. Sept. 30, 2023).  Gibson Dunn represents the defendants in this action.

General Retirement System of the City of Detroit v. Verizon Communications Inc., No. 23-cv-05218 (D.N.J. Aug. 18, 2023):  In this case, plaintiffs allege that Verizon made false or misleading statements regarding its responsibility for “an extensive network of lead cables . . . around the country, causing harm and posing the risk of further harm to the environment, Company employees, and surrounding communities.”  ECF No. 1, at 5.  The amended complaint alleges that Verizon’s stock price dropped after The Wall Street Journal released an article profiling workers who claimed they were sick from lead exposure.  Id. at 35-39.  A motion to dismiss the amended complaint is due by February 27, 2024.  ECF No. 34. A similar case was filed in the Western District of Pennsylvania on August 1, 2023, and was voluntarily dismissed on October 27, 2023.  See Meehan v. Verizon Commc’ns, Inc., No.  23-cv-01375 (W. D. Pa. Aug. 1, 2023).

Brazinsky v. AT&T Inc., No. 23-cv-04064 (D.N.J. July 28, 2023):  In this case, plaintiff alleged that AT&T misled investors by failing to disclose ownership of lead cables around the United States, which pose risks of environmental harm.  ECF No. 1, at 9.  AT&T has neither answered nor moved to dismiss this complaint.  AT&T filed a motion to transfer the case to the Northern District of Texas, which remains pending before the court.  ECF. No. 43.

In re Oatly Group AB Securities Litigation, No. 21-cv-06360 (S.D.N.Y. July 26, 2021):  A putative class action complaint has been filed against Oatly Group AB, the world’s largest oat milk company, and several of its officers and directors.  Plaintiffs allege that Oatly made false or misleading statements related to the sustainability of its product.  ECF No. 91, at 29-34.  More specifically, plaintiffs allege that Oatly overstated its substantiality practices and minimized its environmental impact, which led to an inflated share price.  Id.  Oatly has not answered or filed a motion to dismiss the complaint.  On November 3, 2023, the parties disclosed an intent to settle the litigation.  ECF No. 95.  On February 16, 2024, plaintiffs moved for preliminary approval of settlement, and the parties are scheduled to appear before the court to discuss the settlement on February 21, 2024.  ECF No. 99, at 1-2.

City of St. Clair Shores Police and Fire Retirement System v. Unilever PLC, No. 22-cv-05011 (S.D.N.Y. June 15, 2022):  We reported on this case in our 2022 Year-End Securities Litigation Update and our 2023 Mid-Year Securities Litigation Update.  The allegations against Unilever arose from a proposed Ben & Jerry’s board resolution purporting to end the sale of Ben & Jerry’s products in areas deemed “to be Palestinian territories illegally occupied by Israel.”  ECF No. 1, at 6.  Plaintiffs alleged that Ben & Jerry’s parent company made misleading statements to investors by failing to adequately disclose the business risks associated with the resolution.  Id. at 10-18.  Defendants in Unilever filed a motion to dismiss these allegations.  ECF No. 31.  The court granted the motion to dismiss, holding plaintiffs failed to plead scienter because the complaint lacked plausible allegations that defendants knew implementation of the board resolution “was a certainty or at least probable.”  City of St. Clair Shores Police and Fire Ret. Sys. v. Unilever PLC, 2023 WL 5578090, at *3-5 (S.D.N.Y. Aug. 29, 2023).

Wong v. New York City Employee Retirement System, No. 652297/2023 (N.Y. Sup. Ct., N.Y. Cnty. May 11, 2023):  We first reported on this case in our 2023 Mid-Year Securities Litigation Update.  Plaintiffs in this case filed breach of fiduciary duty claims against three New York City pension funds that divested approximately $4 billion in fossil fuel investments.  NYSCEF No. 2.  The divestment allegedly caused the pension fund to lose out on the energy’s sector significant growth, and therefore lucrative returns, over the past few years and was undertaken for political reasons unrelated to the retirement interests of plan participants.  Id. at 19.  Plaintiffs seek an injunction, requiring the pension fund to cease the ongoing divestment and make decisions regarding fuel-related and other potential investments “exclusively on relevant risk-return factors.”  Id. at 25.  Defendants filed a motion to dismiss the complaint, arguing that the plaintiffs lack standing and fail to state a claim because the complaint does not contain any allegations showing that the funds’ trustees acted disloyally or carelessly and the decision to divest was made based on relevant financial considerations.  NYSCEF No. 20, at 6-7.  The motion to dismiss is pending before the court.  Gibson Dunn represents plaintiffs in this case.

Exxon Mobile Corp. v. Arjuna Capital, No. 24-cv-00069 (N.D. Tex. Jan. 21, 2024):  ExxonMobil filed a complaint seeking a declaratory judgment that it may exclude activist investors’ shareholder proposal from Exxon’s 2024 proxy statement.  ECF No. 1, at 25.  The complaint alleges that defendants’ proposal, requesting Exxon to accelerate greenhouse gas emissions reductions, “does not seek to improve ExxonMobil’s economic performance or create shareholder value.”  Id. at 3-4.  Exxon asserts that it may properly exclude defendants’ proposal under the ordinary business (Rule 14a-8(i)(7)) and resubmission exclusions ((i)(12)).  Defendants responded to the complaint by withdrawing their proposal and agreeing not to propose it again in the future.  The litigation is continuing.  Gibson Dunn represents plaintiff in this action.

Securities Industry & Financial Markets Association v. Ashcroft, No. 23-cv-04154 (W.D. Mo. Aug. 10, 2023):  In June 2023, the Missouri Securities Division adopted new rules requiring investment professionals to obtain client signatures before providing advice that “incorporates a social objective or other nonfinancial objective.”  ECF No. 24, at 22-33.  In August 2023, plaintiff filed a lawsuit challenging these rules.  ECF No. 1, at 41.  Plaintiff alleges that the rules are preempted by the National Securities Markets Improvement Act of 1996 and the Employee Retirement Income Security Act, violate the First Amendment, and are unconstitutionally vague.  ECF No. 24, at 33-42.  On January 5, 2024, the court denied defendant’s motion to dismiss, allowing this matter to proceed to discovery.  ECF No. 39.

B. Diversity And Inclusion

Ardalan v. Wells Fargo & Co., No. 22-cv-03811 (N.D. Cal. July 28, 2022):  We first reported on this case in our 2023 Mid-Year Securities Litigation Update.  After the district court dismissed the initial complaint, ECF Nos. 112, at 15, plaintiffs filed an amended complaint.  ECF No. 116.  In the amended complaint, plaintiffs allege that Wells Fargo conducted interviews for positions that had already been filled to comply with its disclosed intent that 50 percent of interviewees be diverse for most roles above a certain salary threshold.  ECF No. 116, at 9-10.  In particular, the amended complaint alleges that diverse interviewees either did not have a legitimate chance to obtain the job for which they were interviewing or were interviewing for roles already filled.  Id. at 44-48.  Defendants filed a motion to dismiss the amended complaint, which is fully briefed and pending before the court.

National Center for Public Policy Research v. Schultz, 2023 WL 5945958 (E.D. Wa. Sept. 11, 2023):  In this derivative action, plaintiff alleged that directors and officers of Starbucks breached their fiduciary duties by rejecting a proposal (that plaintiff itself filed) challenging Starbucks’ diversity, equity, and inclusion (“DEI”) initiatives.  ECF No. 1-2, at 33-35.  Defendants filed a motion to dismiss the complaint, arguing that plaintiff does not fairly and adequately represent the interest of shareholders.  ECF No. 19, at 12-21.  The court granted defendants’ motions to dismiss, holding that plaintiff had filed this action “to advance its own political and public policy agenda” and failed to allege that the board’s rejection of its demand to retract the DEI initiatives was wrongful.  Nat’l Ctr. for Pub. Pol’y Rsch. v. Schultz, 2023 WL 5945958, at *3-4 (E.D. Wa. Sept. 11, 2023).

VI. CRYPTOCURRENCY LITIGATION

A. Class Actions

Risley v. Universal Navigation Inc., 2023 WL 5609200 (S.D.N.Y. Aug. 29, 2023):  On August 29, 2023, a U.S. District Judge dismissed a putative class action complaint against the developers of and investors in the Uniswap Protocol trading platform, a decentralized cryptocurrency exchange.  Id. at *1.  Plaintiffs, a class made up of individuals who each purchased certain of the tokens that were issued and traded on this exchange, brought claims under Section 12(a)(1) of the Securities Act and Section 29(b) of the Securities Exchange Act, alleging that they lost money after investing in what turned out to be “scam tokens.”  Id. at *1, *11.  The District Judge, in assuming (but not confirming) that the tokens were securities, dismissed the complaint in full, emphasizing that the identity of the issuers of the tokens was largely unknown both to plaintiffs and defendants due to the decentralized nature of the exchange.  Id. at *11.  The District Judge observed that plaintiffs are “looking for a scapegoat for their claims because defendants they truly seek are unidentifiable” and opined that whether “this anonymity is troublesome enough to merit regulation is not for the court to decide, but for Congress.”  Id. at *19.  This case is currently on appeal to the Second Circuit.  Risley v. Universal Navigation Inc., 2023 WL 5609200 (S.D.N.Y. Aug. 29, 2023), appeal docketed, No. 23-1340 (2d Cir. Sept. 28, 2023).

Ohman J:or Fonder AB v. NVIDIA Corp., 81 F.4th 918 (9th Cir. 2023): On August 25, 2023, the Ninth Circuit partially revived a putative class’s securities fraud claims against NVIDIA and its officers. In this case, the putative class of shareholders alleged that defendants knowingly or recklessly made materially “misleading and false statements regarding the impact of cryptocurrency sales on NVIDIA’s financial performance” in order to conceal the extent to which NVIDIA’s revenue growth depended on the demand for cryptocurrency, in violation of Sections 10(b) and 20(a) of the Exchange Act and Rule.  Id. at 923.  The U.S. District Court for the Northern District of California initially dismissed the amended complaint in its entirety.  However, on appeal, the Ninth Circuit, in a split opinion, reversed in part and remanded for further proceedings, finding that plaintiffs had stated claims against NVIDIA and its cofounder, President, and CEO, but not against the other officers.  Id. at 947.  The appellate court concluded that the complaint sufficiently alleged that the cofounder, President, and CEO knowingly or recklessly made false or misleading statements about the degree to which NVIDIA’s revenues were dependent on sales of GeForce GPUs to crypto miners, based on his repeated statements to investors and analysts throughout 2017 and 2018 downplaying the degree of such dependency.  Id. at 933-34, 937, 940.  Judge Gabriel Sanchez dissented, concluding that the complaint was entirely based on a post hoc, unreliable analysis done by an outside expert and that it did not allege with sufficient particularity information that would have put NVIDIA’s executives on notice that their public statements were false or misleading when made.  Id. at 947.  The petition for rehearing en banc was denied.  See E. Ohman J.:or Fonder AB v. Nvidia Corp., 2023 WL 7984780, at *1 (9th Cir. Nov. 15, 2023).  On December 5, 2023, the Ninth Circuit granted defendants’ motion to stay the mandate for ninety days.  See Order, E. Ohman J. or Fonder AB v. NVIDIA Corp., No. 21-15604 (9th Cir. Dec. 5, 2023).

B. Regulatory Lawsuits

SEC v. Binance Holdings Ltd., No. 23-cv-01599 (D.D.C. June 5, 2023):  As reported in our Securities Litigation 2023 Mid-Year Update, on June 5, 2023, the SEC filed a 13-claim complaint against Binance Holdings Limited, BAM Trading Services Inc., BAM Management Holdings Inc. and Changpeng Zhao in D.C. federal court, alleging defendants engaged in unregistered offers and sales of crypto asset securities.  ECF No. 1.  On June 13, 2023, consistent with the arguments set forth in defendants’ briefing, the government admitted that it had no evidence that customer assets have been misused or dissipated and, as a result, defendants successfully prevented the SEC from obtaining the extensive relief it sought.  Instead, at the court’s direction, Binance, the SEC, and the other defendants in the action negotiated a consent order that will remain in place while the action is pending.  ECF No. 71.  After the entry of the Consent Order, defendants filed motions to dismiss.  ECF No. 114.  Primarily, defendants argued that the cryptocurrencies at issue are not “investment contracts” under SEC v. W.J. Howey Co., 328 U.S. 293 (1946) (“Howey”) and that the major-questions doctrine bars the SEC from unilaterally deciding it can regulate the burgeoning cryptocurrency industry.  ECF Nos. 117-1, 118.  Judge Amy Berman Jackson heard oral argument on the pending motions to dismiss on January 22, 2024.

In the backdrop of this ongoing SEC litigation, Binance and related entities entered into settlements with the DOJ and CFTC.  On November 21, 2023, Binance and its CEO entered a guilty plea to resolve its outstanding DOJ litigation.  See Binance and CEO Plead Guilty to Federal Charges in $4B Resolution, Dep’t of Just. (Nov. 21, 2023).  Subsequently, on December 18, 2023, a federal court approved a separate settlement with the CFTC.  See Federal Court Enters Order Against Binance and Former CEO, Zhao, Concluding CFTC Enforcement Action, Commodities Futures Trading Comm’n (Dec. 18, 2023).

Gibson Dunn represents Binance Holdings Limited.

SEC v. Schueler, No. 23-cv-05749 (E.D.N.Y. July 31, 2023):  On July 31, 2023, the SEC charged Richard Schueler (otherwise known as “Richard Heart”) and three affiliated companies for the unregistered offer and sale of securities as well as the misappropriation of investor assets.  According to the SEC’s complaint, Heart created and marketed his “Hex” token to investors, promising them a 38% annual return on investment in the form of future Hex tokens if they “staked,” or locked up, their existing Hex tokens.  ECF No. 1, at 7.  Through the “staking” process, Heart purportedly hoped to inflate the price of Hex tokens.  Id.  The SEC also alleged that Heart developed Pulsechain and PulseX, a blockchain and crypto token, that each raised hundreds of millions of dollars from investors.  Id. at 16-18, 21.  Heart allegedly misappropriated at least 12.1 million dollars of investor assets in order to purchase luxury goods, including a 555-carat black diamond.  Id. at 19-20.  Accordingly, the SEC charged Heart both with fraud under Sections 10(b), 17(a)(1), and 17(a)(3) of the Exchange Act, as well as with failure to comply with the registration provisions of Section 5 of the Securities Act.  Id. at 4.  Defendants’ motion to dismiss is due by April 8, 2024 with Judge Carol Bagley Amon set to hear oral arguments on October 24, 2024.  Scheduling Order, SEC v. Schueler, No. 23-cv-05749 (E.D.N.Y. Jan. 18, 2024).

SEC v. Payward, Inc. and Payward Ventures, Inc., No. 23-cv-06003 (N. D. Cal. Nov. 20, 2023):  On November 20, 2023, the SEC filed a three-count complaint against Payward Ventures and Payward Trading, Ltd. (also known as “Kraken”) in the United States District Court for the Northern District of California for violations of Sections 5, 15(a), and 17A(b) of the Exchange Act.  ECF No. 1, at 4.  In its complaint, the SEC alleged that 11 assets that Kraken traded were “investment contracts represented by the underlying crypto asset” and that they are therefore subject to the Exchange Act’s regulations.  Id. at 15.  In addition to claiming that Kraken’s traded assets should have been registered, the SEC also alleged that the online trading platform acted as an exchange, broker, dealer, and clearing agency for crypto assets without first registering with the agency.  Id. at 18-35.  Further, the SEC alleged that Kraken’s failure to register enabled it to commingle its customers’ crypto assets along with fiat in its custodial accounts without ever disclosing that fact to customers.  Id. at 39.  Accordingly, the SEC seeks injunctive relief, disgorgement of gains with interest, and civil money penalties.  Id. at 4.  Defendants’ motion to dismiss is due on February 22, 2024.  ECF No. 21, at 1.

People v. Mek Global Ltd., d/b/a/ KuCoin, Index No. 450703/2023 (Sup. Ct. N.Y. Cnty. Dec. 12, 2023):  In March 2023, the New York Attorney General’s Office brought claims against the Seychelles-based crypto exchange KuCoin, alleging that KuCoin violated New York securities laws by unlawfully offering and selling cryptocurrency and by unlawfully representing itself as an “exchange.”  Stipulation and Consent Order at 1, People v. Mek Global Ltd., d/b/a/ KuCoin, Index No. 450703/2023 (Sup. Ct. N.Y. Cnty. Dec. 12, 2023).  On December 12, 2023, KuCoin agreed to return $16.7 million dollars to New York investors, pay $5.3 million in fines, take steps to close New York accounts within 120 days, and preclude the creation of new New York-based accounts.  Id. at 3-4.  KuCoin also admitted that it falsely represented itself as a registered exchange and that it operated in New York as an unregistered securities or commodities broker-dealer.  Id. at 2-3.  As a part of the consent order, KuCoin must update the Office of the Attorney General (“OAG”) on the number of New York customers that have withdrawn money and also provide the Office with detailed information on New York customers who have had an open account at KuCoin.  Id. at 10-11.  The consent order resolves the OAG’s claims against KuCoin.  Id. at 2.

SEC v. Terraform Labs Pte. Ltd., 2023 WL 8944860 (S.D.N.Y. Dec. 28, 2023):  As reported in our 2023 Mid-Year Litigation Update, the SEC brought an enforcement action early last year alleging that Terraform Labs and its founder perpetrated a multibillion dollar crypto asset securities fraud scheme by offering and selling crypto asset securities in unregistered transactions and misleading investors about the Terraform blockchain and its crypto assets.  On July 31, 2023, U.S. District Judge Jed S. Rakoff denied defendants’ motion to dismiss.  On December 28, 2023, Judge Rakoff granted summary judgment for the SEC, finding that Terraform’s crypto assets—UST, LUNA, wLUNA, and MIR—are securities because they are investment contracts under Howey, and that defendants offered and sold LUNA and MIR in unregistered transactions in violation of the federal securities laws.  2023 WL 8944860, at *12-16.  Judge Rakoff further held that defendants offered unregistered security-based swaps to non-eligible contract participants and effected transactions in security-based swaps with non-eligible contract participants in violation of the federal securities laws.  Id. at *17.  Trial on the remaining fraud claims is scheduled for late March of 2024.

C. Other Developments

1. SEC Grants Approval For Certain ETFs To Track Bitcoin

On January 10, 2024, the SEC granted approval for the first U.S.-listed exchange-traded funds (“ETFs”) to track bitcoin.  SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024).  The approval includes applications from 11 major entities like BlackRock, Ark Investments/21Shares, Fidelity, Invesco, and VanEck.  This marks a potentially significant development for Bitcoin as the world’s largest cryptocurrency and for the broader crypto industry.  Some consider the ETFs a pivotal development for Bitcoin, offering investors exposure to the cryptocurrency without directly holding it.  Analysts predict significant inflows, with estimates ranging from $50 billion to $100 billion this year alone.

This move marks a change for the SEC, which had previously rejected bitcoin ETFs.  Hannah Lang & Suzanne McGee, US SEC Approves Bitcoin ETFs in Watershed for Crypto Market, Reuters (Jan. 11, 2024).  However, SEC Chair Gary Gensler suggested that the approval was partly in response to a circuit court ruling that the SEC wrongly denied an application from Grayscale Investments to convert its existing Grayscale Bitcoin Trust into an ETF.  See SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024) (citing Grayscale Investments, LLC v. SEC, 82 F.4th 1239 (D.C. Cir. 2023)).  Gensler also emphasized that the action would not change the SEC’s enforcement of “non-compliance of certain crypto asset market participants with the federal securities laws,” nor does the SEC “approve or endorse crypto trading platforms or intermediaries, which, for the most part, are non-compliant with the federal securities laws and often have conflicts of interest.”  SEC, Statement on the Approval of Spot Bitcoin Exchange-Traded Products (Jan. 10, 2024).

2. Coinbase Petition For Rulemaking

On July 21, 2022, Coinbase filed a petition for rulemaking with the SEC seeking “new rules facilitating the use” of digital asset securities.  See Letter from Paul Grewal, Chief Legal Officer, Coinbase Glob., Inc., to Vanessa A. Countryman, Sec’y, SEC (July 21, 2022).  On December 15, 2023, in a 3-2 decision, the Commission denied Coinbase’s petition.  See Letter from Vanessa A. Countryman, Sec’y, SEC, to Paul Grewal, Chief Legal Officer, Coinbase Glob., Inc. (Dec. 15, 2023).  In its ruling, the Commission stated that it disagreed with the “assertion that application of existing securities statutes and regulations to crypto asset securities, issuers of those securities, and intermediaries in the trading, settlement, and custody of those securities is unworkable.”  Id.  In a statement supporting this decision, Chairman Gensler reaffirmed the SEC’s approach stating that “existing laws and regulations apply to the crypto securities markets.”  See Statement on the Denial of a Rulemaking Petition Submitted on behalf of Coinbase Global, Inc. (Dec. 15, 2023).

On December 15, 2023, Coinbase filed a petition for review with the U.S. Court of Appeals for the Third Circuit regarding the SEC’s order.  See Coinbase Inc. v. SEC, No. 23-3202 (3d Cir. Dec. 15, 2023), ECF No. 1.

Gibson Dunn represents Coinbase in its petition for review.

3. Non-fungible Tokens (NFTs)

Recent SEC enforcement actions indicate that NFTs may become part of the SEC’s increasing crypto asset enforcement efforts.  See, e.g., Press Release, SEC Charges Creator of Stoner Cats Web Series for Unregistered Offerings of NFTs (Sept. 13, 2023) (charging a company with conducting an $8 million unregistered offering in the form of NFTs); Press Release, SEC Charges LA-Based Media and Entertainment Co. Impact Theory for Unregistered Offering of NFT (Aug. 28, 2023) (settling with a company for conducting an unregistered offering of crypto asset securities).  In these cases, the SEC has generally relied on the Supreme Court’s test in Howey to contend that the NFTs that companies like Impact Theory sell are investment contracts, offered to investors with the process of “tremendous” future value.  See Order Instituting Cease and Desist Proceedings, In re Impact Theory, No. 3-21585 (Aug. 28, 2023).  The Commission’s position on NFT regulation is still unsettled with at least some commissioners objecting to the regulation of NFTs under Howey given that “NFTs were not shares of a company and did not generate any type of dividend for the purchasers.”  NFTs & SEC: Statement on Impact Theory, LLC (Aug. 28, 2023).

VII. LORENZO DISSEMINATOR LIABILITY

As previously discussed in our 2019, 2022, and 2023 Mid-Year Updates, in Lorenzo, the Supreme Court expanded the scope of scheme liability to include individuals who disseminate false or misleading information, but do not make misstatement(s), to potential investors with the intent to defraud.  139 S. Ct. 1094 (2019).  As a result, individuals who do not make false or misleading statements may nevertheless be subject to “scheme liability” under Rules 10b-5(a) and 10b-5(c) for disseminating the alleged misstatement(s) of another if plaintiff can show that the individual knew the alleged misstatement(s) contained false or misleading information.  Following Lorenzo, the Second Circuit found that defendants must do “something beyond” making material misstatements or omissions, such as disseminating the alleged misstatements, to be subject to scheme liability under Rules 10b-5(a) and (c).  SEC v. Rio Tinto plc, 41 F.4th 47, 54 (2d Cir. 2022); see also Client Alert (Gibson Dunn represents Rio Tinto in this litigation).

Although the Supreme Court and most circuit courts have not directly addressed the requirements for scheme liability after Lorenzo, several recent district court decisions have added to the debate.

In SEC v. Hwang, a case involving market manipulation claims against the CFO and principal of a family office stemming from alleged misrepresentations to counterparties in swap transactions, the Southern District of New York dismissed the scheme liability claims against the CFO while upholding the scheme liability claims against the principal.  2023 WL 6124041, at *5, *7-8, *18 (S.D.N.Y. Sept. 19, 2023).  In applying the Rio Tinto “something beyond” standard, the court dismissed the scheme liability claims against the CFO because he merely directed his subordinates to craft the alleged misrepresentations and he did not participate in the dissemination of the misrepresentations himself.  Id. at *8.  Unlike the claims against the CFO, the court upheld scheme liability claims against the principal because the court accepted the SEC’s allegations that the principal “directed Archego’s staff to trade in a manner that would artificially inflate the price of [his company’s] holdings.”  Id. at *9.

In another case in the Southern District of New York, SEC v. Farnsworth, the court sustained scheme liability claims against former executives of MoviePass, Farnsworth and Lowe, for making public statements that MoviePass was seeing a natural drop off in users, when MoviePass was allegedly manufacturing a decrease in users by artificially interfering with its own users’ ability to take full advantage of the services MoviePass offered.  2023 WL 5977240, at *1-2, *18 (S.D.N.Y. Sept. 14, 2023).  Specifically, the court found that allegedly resetting customers’ passwords or subjecting them to ticket-verification procedures to discourage usage of the subscription service was sufficient additional conduct to sustain scheme liability claims under Lorenzo and Rio Tinto.  Id. at *18.

In a case from the United States District Court for the District of Columbia, In re Bed Bath & Beyond Corporation Securities Litigation, the court cited positively to Rio Tinto, although it did not explicitly adopt the Second Circuit’s “something beyond” standard.  2023 WL 4824734, at *12 (D.D.C. July 27, 2023).  In that case, the court sustained scheme liability claims against Bed Bath & Beyond for allegedly delaying its SEC filings to stimulate trading of its stock to piggyback off the alleged misstatements of an activist investor.

In a recent case from the Northern District Court of Texas, the Court found that the allegedly inflated valuations contained in internal planning documents were sufficient to sustain a scheme liability claim.  Yoshikawa v. Exxon Mobil Corporation, 2023 WL 5489054, at *8-9 (N.D. Tex. Aug. 24, 2023).  Plaintiffs alleged that an employee instructed her team to manipulate internal valuations of certain assets to support the company’s allegedly prior misleading public statements regarding the growth potential of certain assets to investors.  Id. at *4-5, *8-9.  Defendants argued that plaintiffs failed to plead deceptive conduct beyond misstatements and omissions, but, citing to Rio Tinto, the Court disagreed and denied the motion to dismiss with respect to the scheme liability claim.  Id. at *9.  The Court otherwise dismissed 10b-5(b) misstatement and omissions claims in their entirety for failure to adequately plead scienter with respect to the challenged statements.  Id. at *10.

In another case from the Northern District Court of Texas, Linenweber v. Southwest Airlines Co., the court, citing Rio Tinto, granted defendants’ motion to dismiss, concluding that “misstatements and omissions alone do not suffice for scheme liability.”  2023 WL 6149106, at *14 (N.D. Tex. Sept. 19, 2023) (quoting SEC v. Rio Tinto plc, 41 F.4th 47, 48 (2d Cir. 2022)).  In the case, plaintiffs claimed that defendants’ scheme was “portraying Southwest’s aircraft as safe and compliant while concealing a wide-range of safety hazards and regulatory non-compliance issues.”  Id. at *14.  The court dismissed plaintiffs’ scheme liability claims because plaintiffs failed to identify any fraudulent or deceptive acts beyond the misleading statements portraying Southwest’s aircraft as safe while allegedly concealing other safety hazards.  Id.

VIII. MARKET EFFICIENCY AND “PRICE IMPACT” CASES

As discussed in our Client Alert and Mid-Year Update, the long-running class certification dispute in Arkansas Teacher Retirement System v. Goldman Sachs Group, Inc., 77 F.4th 74, 105 (2d Cir. 2023) (“ATRS”), ended this year, with the Second Circuit reversing the class certification order and remanding with instructions to decertify the class.  Following the class decertification—and more than a decade after the case was initially filed—the parties stipulated to a voluntary dismissal with prejudice.

The Second Circuit’s decision to decertify was based on guidance from the Supreme Court’s 2021 decision in Goldman Sachs Group, Inc. v. Arkansas Teacher Retirement System, 141 S. Ct. 1951 (2021) (“Goldman”), which we previously detailed in our 2021 Mid-Year Securities Litigation Update.  In Goldman, the Supreme Court held that courts analyzing whether to grant class certification should consider evidence, including expert evidence, of whether the alleged misstatements were too generic to affect the price of securities, even though that same evidence could be relevant to whether the alleged misstatements were material.  Goldman, 141 S. Ct. at 1960-61.  The Supreme Court also held that if a plaintiffs’ price impact theory is based on “inflation maintenance” (meaning the alleged misstatement did not cause the stock price to increase but instead prevented the price from dropping), then any mismatch between the generic nature of the challenged statements and the specificity of the alleged corrective disclosures is critical in determining whether defendants have rebutted the Basic presumption of class-wide reliance.  Id.

In ATRS, the Second Circuit considered—again—whether this class of investors was properly certified.  ATRS, 77 F.4th at 80-81.  Applying the Supreme Court’s “mismatch framework,” the Second Circuit held that when plaintiffs rely on the inflation-maintenance theory—like plaintiffs in ATRS did—they cannot simply “identify a specific back-end, price-dropping event” and match it to “a front-end disclosure bearing on the same subject” unless “the front-end disclosure is sufficiently detailed in the first place.”  Id. at 81, 102.  After examining the evidence in the case, the Second Circuit ultimately concluded that the mismatch between the generic nature of the alleged misstatements and the specificity of the alleged corrective disclosure was sufficient to “sever the link” between the statements and the stock price drop.  Id. at 104.

Following Goldman and ATRS, lower court decisions are engaging in a more searching analysis of all evidence of price impact, including scrutiny regarding whether the alleged corrective disclosure sufficiently matches the challenged statement.  See e.g., Ramirez v. Exxon Mobil Corp., 2023 WL 5415315, at *11-21 (N.D. Tex. Aug. 21, 2023); Del. Cnty. Emp. Ret. Sys. v. Cabot Oil & Gas Corp., 2023 WL 6300569, at *10-13 (S.D. Tex. Sept. 27, 2023); Hall v. Johnson & Johnson, 2023 WL 9017023, at *10-15 (D.N.J. Dec. 29, 2023).

In Ramirez, for example, a U.S. District Judge in the Northern District of Texas rejected six out of seven of plaintiffs’ alleged corrective disclosures for various reasons.  These reasons included that the experts found no statistically significant price change, Ramirez, 2023 WL 5415315, at *15, *17, *20, *21; there was a lack of analyst commentary about the alleged corrective disclosures, id. at *15-16; the negative price reaction was not properly attributable to the alleged corrective disclosures, id. at *16; and one of the alleged corrective disclosures did not offer any new corrective information, id. at *20.  The court held that the sole remaining alleged corrective disclosure sufficiently illustrated price impact but only in connection with some of the alleged misrepresentations.  Id. at *20.  Based on this analysis, the court certified a class covering a limited period and as to only a subset of challenged statements.  Id. at *22.

We will continue to monitor developments in this area.

IX. OTHER NOTABLE DEVELOPMENTS

A. Circuit Developments In Omnicare Cases

As noted in prior updates, in the nearly nine years since the Supreme Court issued its seminal decision concerning opinion statements in Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund, 575 U.S. 175 (2015), courts have regularly applied Omnicare, which was decided in the context of a Section 11 claim, to claims brought under the Exchange Act.

In a June 2023 decision, the Third Circuit joined the trend of applying Omnicare to claims brought under the Exchange Act, holding that Omnicare’s opinion-falsity framework applies to claims for violations of Rule 10b-5.  City of Warren Police and Fire Retirement Sys. v. Prudential Fin., Inc., 70 F.4th 668, 685 (3d Cir. 2023).  Plaintiff’s claims stemmed from announcements made by the publicly traded life insurance company, Prudential Financial, Inc. (“Prudential”), that it would need to increase its reserves by $208 million and that its earnings would be reduced by $25 million per quarter for the foreseeable future.  Id. at 676.  Plaintiff, a municipal retirement system and investor in Prudential, alleged that the company knew about problems with its reserves and misled investors about those issues.  Id.  The district court granted Prudential’s motion to dismiss the case for failure to state a claim, reasoning that plaintiff did not adequately plead falsity.  Id.

On appeal, plaintiff argued that four sets of statements were pleaded with particularity and were plausibly false or misleading.  Id. at 681.  The Third Circuit remanded one set of statements to the district court and affirmed the district court’s dismissal of the remaining three sets of statements.  Id. at 676-77.  In affirming the dismissal of claims related to one set of statements, the Third Circuit applied, for the first time, Omnicare’s bases of liability to a claim brought under Section 10(b).  In its ruling, the Third Circuit noted that “every other Court of Appeals to encounter the issue has applied the Omnicare framework for opinion falsity to claims for Rule 10b-5 violations.”  Id. at 685.  The Third Circuit ultimately held that defendant’s representations about the adequacy of its reserve were non-actionable opinions because plaintiff had failed to allege any of the three Omnicare situations in which a statement of opinion could form the basis for liability.  Id. at 686-87.

In an August 2023 decision, the Second Circuit held that a statement of opinion that reflects some subjective judgment must have a sufficient evidentiary basis in order to be non-actionable under OmnicareNew Eng. Carpenters Guaranteed Annuity & Pension Funds v. DeCarlo, 80 F.4th 158, 174 (2d Cir. 2023).  Plaintiffs’ claims stemmed from restatements made by the publicly traded property and casual insurance company, AmTrust Financial Services (“AmTrust”), of five years of financial results to correct “significant errors in its annual and quarterly reports.”  Id. at 165.  Specifically, AmTrust disclosed that it had improperly accounted for certain extended-warranty contracts and certain discretionary employee bonuses.  Id.  In response to the restatements, plaintiffs brought claims against AmTrust for allegedly misstating the company’s financial condition and results in violation of Sections 11, 12, and 15 of the Securities Act, Sections 10(b) and 20(a) of the Exchange Act, and Rule 10b-5.  Id.  The district court dismissed all claims as non-actionable statements of opinion.  Id.

On appeal, the Second Circuit affirmed the district court’s dismissal of plaintiffs’ Section 10(b) and Rule 10b-5 claims against AmTrust for failure to raise a strong inference of scienter.  Id. at 178-79. But the Second Circuit vacated the district court’s dismissal of (1) plaintiffs’ Section 11 claims related to AmTrust’s accounting for certain extended-warranty contracts and (2) plaintiffs’ Section 11 and Section 12(a)(2) claims related to AmTrust’s accounting of discretionary employee bonuses.  Id. at 172, 174-76.

First, the Second Circuit held that plaintiffs sufficiently alleged that AmTrust omitted material facts such that its financial statements related to warranty-contract revenue were misleading and reversed the district court’s dismissal of plaintiffs’ Section 11 claims arising from these statements.  Id. at 174 (citing Omnicare, 575 U.S. at 192).  The court rejected the argument that the accounting decision was a “judgment call” and thus non-actionable, reasoning that subjective judgments presume some historical evidence, and GAAP allows time-of-sale recognition only if evidence justifies doing so.  Id.

Second, the Second Circuit held that plaintiffs plausibly alleged that AmTrust’s statements regarding bonuses not being “probable” lacked sufficient evidentiary basis and reversed the district court’s dismissal of plaintiffs’ related Section 11 and Section 12(a)(2) claims.  Id. at 175 (citing Omnicare, 575 U.S. at 188-89).  In so doing, the Second Circuit noted that the district court should, at the pleading stage, accept plaintiffs’ claim that AmTrust had a practice of paying earned bonuses and that there was no reason to believe continued payment was not “probable.”  Id.

The Second Circuit did affirm the district court’s dismissal of plaintiffs’ Section 11 claims concerning certifications signed by AmTrust’s officers.  Id. at 176.  The court held that the certifications were opinions explicitly based on the officer’s knowledge and that plaintiffs failed to allege the officers had knowledge of the financial reporting’s alleged inaccuracy.  Id.  Specifically, the Second Circuit held that plaintiffs failed to establish a lack of a meaningful inquiry in order to create liability and further stated that opinions that “turned out to be wrong” are not necessarily actionable.  Id. (citing Omnicare, 575 U.S. at 186, 188).

B. Courts Decline To Enforce Control Share Acquisition Provisions

In 2023, two courts declined to enforce state control share acquisition statutes due to the statutes’ conflict with the guarantee of “one share, one vote” found in Section 18(i) of the Investment Company Act of 1940.  Section 18(i) requires that every share of stock “be a voting stock and have equal voting rights with every other outstanding voting stock.”  15 U.S.C. § 80a-18(i).  In contrast, control share acquisition statutes typically allow companies to alter or remove voting rights when a person acquires a certain minimum percentage of the company’s shares, with such minimum being determined by the specific state control share acquisition statute.  Generally, control share acquisition statutes apply exclusively to closed-end funds.  SEC, Control Share Acquisition Statutes, Staff Statement (May 27, 2020).  Roughly half of all states have corporate control share acquisition statutes in effect.  Id.

This past year, Saba Capital Management, LP and its affiliates (together, “Saba”) successfully challenged the enforceability of closed-ended funds’ and business trusts’ control share acquisition provisions on the grounds that they violate Section 18(i).  See Saba Cap. CEF Opportunities 1, Ltd. v. Nuveen Floating Rate Income Fund, 88 F.4th 103, 114 (2d Cir. 2023); Saba Cap. Master Fund, Ltd. v. BlackRock Mun. Income Fund, Inc., 2024 WL 43344, at *6 (S.D.N.Y. Jan. 4, 2024).  The Nuveen defendants were Massachusetts closed-ended investment funds; the BlackRock defendants were Maryland closed-ended mutual funds and individual trustees.  Defendants in both cases enacted bylaws which restricted the voting power of any person holding 10% or more of the funds’ shares.  Nuveen, 88 F.4th at 109; BlackRock, 2024 WL 43344, at *1.  Saba sued, claiming that these provisions violated Section 18(i)’s guarantee of “one share, one vote.”  Nuveen, 88 F.4th at 115; BlackRock, 2024 WL 43344, at *1.

In Nuveen and BlackRock, the Second Circuit affirmed a grant of summary judgment, and a district court in the Southern District of New York granted summary judgment, respectively, for Saba against the defendant funds.  In Nuveen, the Second Circuit rejected defendants’ contention that the provision restricted the shareholder, not the shares.  Nuveen, 88 F.4th at 11820.  In BlackRock, the district court rejected defendants’ argument that the control share resolutions fell under an exception Section 18(i) for provisions that are “otherwise required by law” because such provisions were authorized by Maryland’s Control Share Acquisition Act.  BlackRock, 2024 WL 43344, at *6.  The court did not find this argument persuasive, ruling that “[t]he fact that Maryland law allows funds to adopt such control share resolutions does not in any way mean that Maryland law requires as much.”  Id.  Furthermore, both courts noted that the Investment Company Act of 1940 defines “voting security” as “any security presently entitling the owner or holder thereof to vote for the election of directors of a company.”  Nuveen, 88 F.4th at 117; BlackRock, 2024 WL 43344, at *6 (emphasis added).  Consequently, the courts held that the restrictions denied shareholders the right to presently vote their shares, thus violating Section 18(i).  Nuveen, 88 F.4th at 11921; BlackRock, 2024 WL 43344, at *67.

Though other circuits have yet to test the conflict between state control share acquisition statutes and Section 18(i), these decisions suggests courts may be hesitant to allow voting restrictions placed on certain shares held by large shareholders.

C. Ninth Circuit Holds That SEC Rule 16b-3 Does Not Require Purpose-Specific Board Approval of Transactions

In a case of first impression, the Ninth Circuit held that SEC Rule 16b-3, which exempts from Section 16(b) liability transactions between an issuer and a director where the issuer’s board approves the transaction, does not require the board to approve the transaction for the “specific purpose” of exempting it from Section 16(b) liability.  Roth v. Foris Ventures, LLC, 86 F.4th 832, 835, 837 (9th Cir. 2023).  Roth reached the Ninth Circuit on a “rare” interlocutory appeal under 28 U.S.C. § 1292 after the district court denied defendants’ motion to dismiss the plaintiff’s claims under Section 16(b).  Id. at 836.

The Ninth Circuit reversed the district court’s ruling on the issue of board approval and held that Rule 16b-3(d) does not require purpose-specific approval of a transaction.  Id. at 837.  The court analyzed the plain text of the rule and explained that the only relevant question was whether the transaction was “approved by the board of directors of the issuer.” Id. at 836.  The court found that there was no indication in the rule that “the board must approve the transaction for the specific purpose of exempting it from Section 16(b) liability.”  Id. at 836-37.  In analyzing this issue, the Ninth Circuit reached the same conclusion as the Second Circuit did when presented with a similar question.  See Gryl v. Shire Pharms. Grp. PLC, 298 F.3d 136, 146 (2d Cir. 2002) (holding that “a securities transaction need not receive purpose-specific approval in order to qualify for the Board Approval Exemption of Rule 16b-3(d)(1)”).

The Ninth Circuit’s ruling clarifies a developing area of securities law concerning the scope of exemptions for “short-swing” stock trades by officers, directors and other corporate insiders.

D. Sixth Circuit Grants Interlocutory Appeal Of Class Certification Decision On Affiliated Ute/Comcast Issues

In November, the Sixth Circuit granted utility company FirstEnergy’s petition for interlocutory review of a class certification.  Order, In re FirstEnergy Corp., Nos. 23-0303/0304/0305/0306/0307 (6th Cir. Nov. 16, 2023).  The complaint alleged a large corruption and bribery scheme purportedly carried out by FirstEnergy in which the company paid out millions to various politicians in exchange for a bailout of its nuclear power plants.  In re FirstEnergy Corp. Sec. Litig., 2023 WL 2709373, at *2 (S.D. Ohio 2023).  The complaint further alleged that FirstEnergy made both affirmative misrepresentations (when it represented that it complied with all lobbying registration and disclosure requirements despite purportedly making clandestine contributions to state representatives) and fraudulent omissions (when it failed to disclose the purported scheme in its SEC registration statements).  Id. at *3, *5.  The district court certified a class under the Affiliated Ute presumption of reliance—which provides a mechanism for plaintiffs in cases involving omissions to show reliance on a class-wide basis—ruling that plaintiffs are entitled to the Affiliated Ute presumption so long as a court finds that defendants made any omissions of material fact.  Id. at *16-17, *19-20.  The court also held that predominance was satisfied because damages could be calculated via a statutory formula, thus satisfying Comcast Corp. v. Behrend, 569 U.S. 27 (2013), which requires plaintiffs to offer a class-wide model for calculating damages that “measure[s] only the damages attributable to [a] [p]laintiffs’ theory of liability.”  Id. at *15-16.

In its brief for petition for review of the class certification order, FirstEnergy first argued that the Sixth Circuit should clarify that the Affiliated Ute standard applies only where plaintiffs’ case primarily involves omissions and is inapplicable to cases that have a mix of both omissions and misrepresentations.  Reply Brief of Defendants at 3, In re FirstEnergy Corporation Securities Litigation, No. 23-0303 (6th Cir. May 2, 2023).  FirstEnergy also argued that the district court’s ruling contradicted Comcast by certifying plaintiffs’ Exchange Act class based on a damages methodology that was inconsistent with their theory of liability.  Id. at 6.

E. Companies Continue To Face Exposure For Alleged Misrepresentations Related To Purported Cybersecurity Vulnerabilities

Cybersecurity and data privacy concerns continue to be an area of activity for shareholders and the SEC.  In April 2023, a shareholder derivative suit was filed involving Okta, Inc., a cloud-based software company alleging that the company’s directors permitted Okta to issue misleading risk disclosures contained in its March 2022 Form 10-K.  Complaint, Buono v. McKinnon, 23-cv-00413 (D. Del. Apr. 14, 2023), ECF No. 1.  Plaintiff alleged that the warnings about cybersecurity incidents were misleading because they failed to disclose that the company was “susceptible and vulnerable to security breaches,” including one the company later disclosed.  Id. at 31-32, 35-36, 40.  The lawsuit, which is stayed by agreement of the parties, adopts allegations from a separate securities class action lawsuit in which the court dismissed securities fraud claims based on the same theory.  In re Okta, Inc. Sec. Litig., No. 22-cv-02990 (N.D. Cal. Mar. 17, 2023), ECF No. 73.

In the enforcement space, the SEC filed a cybersecurity-related complaint against SolarWinds Corporation and its chief information security officer in October 2023.  Complaint, SEC v. SolarWinds Corporation, No. 23-cv-9518 (S.D.N.Y. Oct. 30, 2023).  The complaint alleged that SolarWinds knew since 2018 that it had major cybersecurity deficiencies after internal assessments concluded that the company’s remote access virtual private network was “not very secure” and that the vulnerability, if exploited, would let someone “basically do whatever without [SolarWinds] detecting it until it’s too late.”  Id. at 5.  Between January 2019 and December 2020, SolarWinds suffered a cyberattack that compromised its flagship product and impacted thousands of its customers.  Id. at 2, 7.  The SEC alleged that SolarWinds therefore misled investors in its filings by disclosing only generic and hypothetical risks when in reality it knew the true extent of its own cybersecurity vulnerabilities and the increased risks the company faced.  Id. at 39.  In a press release related to the enforcement action, the SEC cautioned issuers to “implement strong [cyber] controls calibrated to your risk environments and level with investors about known concerns.”  Press Release, SEC, SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures (Oct. 30, 2023).

The SEC’s enforcement action against SolarWinds followed the implementation of new cybersecurity risk management rules that the SEC adopted in late July, which require companies to disclose (1) material cybersecurity incidents within four business days of the company’s determination that the cybersecurity incident is material and (2) the company’s “cybersecurity risk management, strategy, and governance.”  Press Release, SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (July 26, 2023).  For additional details on these new rules, please see the Gibson Dunn update published after the rules were adopted.


The following Gibson Dunn lawyers participated in preparing this update: Monica K. Loseman, Brian M. Lutz, Craig Varnen, Jefferson E. Bell, Christopher D. Belelieu, Michael D. Celio, Mary Beth Maloney, Lissa M. Percopo, Jessica Valenzuela, Allison K. Kostecka, Mark H. Mixon, Jr., Chase Weidner, Luke A. Dougherty, Tim Kolesk, Chase Beauclair, Trevor Gopnik, Lydia Lulkin, Dillon M. Westfall, Megan R. Murphy, Sophia Amir, Eitan Arom, Maura Carey*, Tawkir Chowdhury, Angela A. Coco, Dasha Dubinsky, Mason Gauch, John Harrison, Mary Karapogosian, Suzi Kondic, Neel Lakhanpal*, Ahin Lee*, Connor Leydecker, Daniel Liu, Riley Majeune, Zachary Montgomery, Narayan Narasimhan, Kate Oh, Ty Shockley, Alon H. Sugarman, and Hayato Watanabe.

Gibson Dunn lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any of the following leaders and members of the firm’s Securities Litigation practice group:

Christopher D. Belelieu – New York (+1 212.351.3801, [email protected])
Jefferson Bell – New York (+1 212.351.2395, [email protected])
Michael D. Celio – Palo Alto (+1 650.849.5326, [email protected])
Jonathan D. Fortney – New York (+1 212.351.2386, [email protected])
Monica K. Loseman – Co-Chair, Denver (+1 303.298.5784, [email protected])
Brian M. Lutz – Co-Chair, San Francisco (+1 415.393.8379, [email protected])
Mary Beth Maloney – New York (+1 212.351.2315, [email protected])
Jason J. Mendro – Washington, D.C. (+1 202.887.3726, [email protected])
Alex Mircheff – Los Angeles (+1 213.229.7307, [email protected])
Lissa M. Percopo – Washington, D.C. (+1 202.887.3770, [email protected])
Jessica Valenzuela – Palo Alto (+1 650.849.5282, [email protected])
Craig Varnen – Co-Chair, Los Angeles (+1 213.229.7922, [email protected])
Allison K. Kostecka – Denver (+1 303.298.5718, [email protected])
Mark H. Mixon, Jr. – New York (+1 212.351.2394, [email protected])

*Maura Carey, a recent law graduate in the Palo Alto office, and Neel Lakhanpal and Ahin Lee, recent law graduates in the New York office, are not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

The proposed information sharing system will help to bring Hong Kong in line with global trends and enhance the effectiveness of its mechanisms to combat fraud, money laundering and terrorist financing. 

On January 23, 2024, the Hong Kong Monetary Authority (“HKMA”) published the “Public Consultation on a Proposal for Information Sharing Among Authorized Institutions to Aid in Prevention or Detection of Crime” (“Consultation Paper”).[1] In short, the Consultation Paper proposes to facilitate information sharing among Authorized Institutions (“AIs”) in respect of personal bank accounts for the purpose of preventing or detecting fraud or money laundering and terrorist financing (“ML/TF”).  The proposal also considers the introduction of legislative amendments to provide “safe harbor” protection to AIs which share information for the purposes of preventing or detecting fraud or ML/TF, provided the AIs comply with appropriate safeguards.

I. Why encouraging information sharing between AIs?

While information sharing among AIs and law enforcement agencies has been successful in combatting a wide range of financial crimes, the HKMA recognizes that such arrangements may not, by themselves, be sufficient to fully address the risk of ML/TF via networks of accounts maintained or controlled by criminals (commonly referred to as “mule account networks”), since information might not be shared quickly enough to intercept illicit funds.  Delays in information sharing provides an opportunity for criminals to exploit information gaps between AIs to rapidly move and conceal illicit funds.  For example, by the time one AI has frozen the accounts maintained or controlled by criminals, those responsible may have already succeeded in moving their illicit funds to their mule accounts in another AI, which the first AI may not be able to quickly alert.

Therefore there has been a global trend towards encouraging information sharing among financial institutions  to combat crime and related ML/TF.  In Hong Kong, participating AIs can share information on corporate accounts with one another through the Financial Intelligence Evaluation Sharing Tool (“FINEST”) launched in June 2023.  However FINEST currently does not support information sharing on personal accounts due to concerns over data privacy.  The Consultation Paper points out that FINEST’s ability to prevent and detect crime would be enhanced if information sharing were extended to personal accounts because a significant portion of mule account networks involve bank accounts held by individuals.  As such, the importance of safeguarding data privacy and customer confidentiality should be balanced against the need for information sharing among AIs to detect or prevent crime and facilitate the interception of illicit funds.

II. What is the effect of the “safe harbor”?

The HKMA proposes to introduce legislative amendments to provide “safe harbor” protection to AIs which share information on personal accounts with other AIs solely for the purposes of preventing or detecting fraud or ML/TF.  The “safe harbor” would provide AIs with legal protection from breach of legal, contractual or other restrictions on disclosure of information, and AIs also will not be held liable for claimed loss arising out of disclosures made.  However the “safe harbor” will only apply if the AI complies with the safeguards discussed below.

III. What is the scope of information that could be shared between AIs?

While the scope of information to be shared will vary on a case-by-case basis, the Consultation Paper proposes that it could generally include:

  • Bank account numbers;
  • Personal data (e.g. name, date of birth, identity card number) of a customer or counterparty who is a natural person;
  • Personal data of any beneficial owners or connected party (e.g. a director, partner, or trustee, as applicable) of a customer who is a legal person, a trust, or a legal arrangement similar to a trust;
  • Personal data of any person purporting to act on behalf of a customer (e.g. acting under power of attorney, or an account signatory);
  • Details of relevant transactions including counterparties;
  • Reasons why the transactions or activity may be involved in fraud or ML/TF.

IV. Is information sharing mandatory or voluntary?

Under the proposed system, information sharing by AIs will be made by participating AIs on a voluntary basis.

V. Will changes be made to the STR regime?

The HKMA proposes to introduce a legislative provision that will make clear for the avoidance of doubt that information sharing among AIs under the proposed arrangements will not constitute the offence of “tipping off” under the Organized and Serious Crimes Ordinance (Cap. 455) (“OSCO”) and the Drug Trafficking (Recovery of Proceeds) Ordinance (Cap. 405) (“DTROP”).[2]  The obligation to file STRs will remain unchanged.

VI. What safeguards will be implemented?

The HKMA recognizes the importance of protecting the data privacy and customer confidentiality of legitimate customers.  The HKMA therefore proposes that the “safe harbor” should only apply where appropriate safeguards are complied with, as summarized below:

  • The information is shared solely for the purpose of detecting or preventing financial crime;
  • AIs receiving information are required to treat it in the same manner, and to the same standards of confidentiality, as other confirmation information;
  • Onward sharing of information received by an AI to another AI is only permitted if is for the purpose of detecting or preventing financial crime, and subject to the same requirements regarding confidentiality;
  • Information sharing will only be permitted via secure channels such as FINEST (and AIs will need to demonstrate that they are technically and operationally ready and have implemented appropriate systems and controls in order to be permitted to access such platforms);
  • An AI should only request for information from another AI where the requesting AI has reasonable grounds to believe that the other AI is able to provide information which will assist with preventing or detecting financial crime (including in deciding whether to file an STR);
  • To prevent “fishing expeditions,” requests for information must be specific and identify the subject of the request, relevant transactions and reasons for suspecting that an activity is connected with financial crime;
  • Sharing of information will be on a need-to-know basis, i.e. an AI will only be permitted to request or disclose information where they have observed suspicious activity that may indicate that a person, account or transaction may be involved in fraud or ML/TF;
  • AIs need to adopt a risk-based approach with respect to information shared under the “safe harbor”, e.g. AIs should not terminate a customer relationship merely because the customer is included in information shared or requested (instead, an AI should always conduct its own risk assessment before deciding on the appropriate action to take).

The HKMA proposes to set out the specific requirements in the legislative amendments and the HKMA will also issue statutory guidance setting out its expectations on complying with the relevant requirements.  The information sharing mechanism would be supervised by the HKMA, and the HKMA proposes to have the power to impose penalties on AIs that fail to comply with the relevant requirements.

VII. Conclusion

The proposed information sharing system will help to bring Hong Kong in line with global trends and enhance the effectiveness of its mechanisms to combat fraud and ML/TF.  The HKMA notes that the United States, United Kingdom and Singapore have already introduced legislation to allow financial institutions to share information concerning individuals and entities where financial crime is suspected.  While the specific requirements under each jurisdiction differs, they all provide a safe harbor for financial institutions which disclose information where financial crime is suspected.

The HKMA aims to issue its consultation conclusions and prepare the necessary legislative amendments in the second half of 2024.  Interested parties are encouraged to provide feedback by March 29, 2024.

__________

[1] Available at: https://www.hkma.gov.hk/media/eng/regulatory-resources/consultations/Consultation_on_AI-AI_info_sharing_en.pdf.

[2] Under section 25A(5) of OSCO and DTROP, a person commits an offence if, knowing or suspecting that an STR has been filed, the person discloses to another person any matter which is likely to prejudice any investigation which might be conducted following the filing of the STR.


The following Gibson Dunn lawyers prepared this client alert: William Hallatt, Arnold Pun, and Jane Lu*.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. If you wish to discuss any of the matters set out above, please contact any member of Gibson Dunn’s Global Financial Regulatory team, including the following members in Hong Kong and Singapore:

William R. Hallatt – Hong Kong (+852 2214 3836, [email protected])
Grace Chong – Singapore (+65 6507 3608, [email protected])
Emily Rumble – Hong Kong (+852 2214 3839, [email protected])
Arnold Pun – Hong Kong (+852 2214 3838, [email protected])
Becky Chung – Hong Kong (+852 2214 3837, [email protected])

*Jane Lu is a paralegal (pending admission) in the firm’s Hong Kong office who is not yet admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

We are pleased to provide you with Gibson Dunn’s Accounting Firm Quarterly Update for Q4 2023. The Update is available in .pdf format at the below link, and addresses news on the following topics that we hope are of interest to you:

  • 2023: The Audit Enforcement Year in Review
  • PCAOB Publishes Enforcement Orders Against China-Based Firms, Even as Congress Contemplates Further Action
  • SEC Cybersecurity Disclosure Rules Go into Effect
  • SEC Approves 2024 PCAOB Budget
  • SEC Chief Accountant Issues Statements on Cash Flow Reporting and Professional Skepticism
  • Second Circuit Limits SEC’s Ability to Seek Disgorgement
  • Canadian Public Accountability Board Provides Insights on 2023 Audit Quality Assessment Results
  • UK Economic Crime and Corporate Transparency Act 2023 Goes into Effect While FRC Revises Corporate Governance Code
  • PCAOB Makes Personnel Changes
  • PCAOB Announces Staff Priorities for 2024 Inspections and Interactions with Audit Committees
  • FinCEN Corporate Transparency Reporting Goes into Effect
  • Other Recent SEC and PCAOB Enforcement and Regulatory Developments

Please let us know if there are topics that you would be interested in seeing covered in future editions of the Update.

Read More


Accounting Firm Advisory and Defense Group:

James J. Farrell – Co-Chair, New York (+1 212-351-5326, [email protected])

Monica K. Loseman – Co-Chair, Denver (+1 303-298-5784, [email protected])

Michael Scanlon – Co-Chair, Washington, D.C.(+1 202-887-3668, [email protected])

In addition to the Accounting Firm Advisory and Defense Practice Group Chairs listed above, this Update was prepared by David Ware, Timothy Zimmerman, Benjamin Belair, Adrienne Tarver, Monica Limeng Woolley, Douglas Colby, John Harrison, and Nicholas Whetstone.

© 2023 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

From the Derivatives Practice Group: This week, ISDA, ESMA, and the CPMI published reports on various derivatives initiatives and reforms.

New Developments

  • SEC Adopts Rule to Expand Definitions of “Dealers” and “Government Securities Dealers.” On February 6, the SEC adopted a rule that requires market participants to register as “dealers” or “government securities dealers” for the first time and become members of a self-regulatory organization (SRO). The final rule, codified in Exchange Act Rules 3a5-4 and 3a44-2, purports to define the phrase “as a part of a regular business” in Sections 3(a)(5) and 3(a)(44) of the Securities Exchange Act of 1934 to identify certain activities that would cause persons engaging in such activities to be “dealers” or “government securities dealers” and be subject to the registration requirements of Sections 15 and 15C of the Act, respectively. Under the final rule, any person that engages in activities as described in the rule is a “dealer” or “government securities dealer” and, absent an exception or exemption, required to: register with the SEC under Section 15(a) or Section 15C, as applicable; become a member of an SRO; and be subject to applicable SRO and Treasury rules and requirements. Notably, the rule is non-exclusive, meaning that even if a firm does not meet any of the criteria in the rule, the SEC claims that the firm could still be a dealer anyway depending on the “facts and circumstances.”
  • SEC and CFTC Adopt Amendments to Enhance Private Fund Reporting. On February 8, the SEC adopted amendments to Form PF, the confidential reporting form for certain SEC-registered investment advisers to private funds, including those that also are registered with the CFTC as commodity pool operators or commodity trading advisers. According to the SEC, the amendments, which the CFTC concurrently adopted, are designed to enhance the ability of the Financial Stability Oversight Council (FSOC) to monitor and assess systemic risk and to bolster the SEC’s oversight of private fund advisers and the agency’s investor protection efforts. The SEC and CFTC also agreed to a memorandum of understanding related to the sharing of Form PF data. The SEC stated that, among other things, the amendments to Form PF will enhance how large hedge fund advisers report investment exposures, borrowing and counterparty exposure, market factor effects, currency exposure, turnover, country and industry exposure, central clearing counterparty reporting, risk metrics, investment performance by strategy, portfolio liquidity, and financing and investor liquidity in an effort to provide better insight into the operations and strategies of these funds and their advisers and improve data quality and comparability. Further, the amendments will require additional basic information about advisers and the private funds they advise, including identifying information, assets under management, withdrawal and redemption rights, gross asset value and net asset value, inflows and outflows, base currency, borrowings and types of creditors, fair value hierarchy, beneficial ownership, and fund performance, which, according to the SEC, will provide greater insight into private funds’ operations and strategies, assist in identifying trends, including those that could create systemic risk, improve data quality and comparability, and reduce reporting errors. The amendments will also require more detailed information about the investment strategies, counterparty exposures, and trading and clearing mechanisms employed by hedge funds, while also removing duplicative questions.
  • CFTC Global Markets Advisory Committee Advances Key Recommendations. On February 8, the CFTC’s Global Markets Advisory Committee (GMAC), sponsored by Commissioner Caroline D. Pham, formally advanced eight recommendations to the CFTC that are intended to enhance the resiliency and efficiency of global markets, including U.S. Treasury markets, repo and funding markets, and commodity markets. To date, this is the largest number of recommendations advanced by a CFTC Advisory Committee in a single meeting. The GMAC’s Global Market Structure Subcommittee prepared four recommendations: (1) appropriately calibrated block and cap sizes under CFTC Part 43 swap data reporting rules, intended to enhance market liquidity and financial stability; (2) addition of certain central counterparties (CCPs) as permitted counterparties under CFTC Rule 1.25(d), intended to promote the well-functioning of the repo market; (3) expansion of cross-margining between the CME Group and the Fixed Income Clearing Corporation, intended to support greater efficiency in the U.S. Treasury markets; and (4) best practices for exchange volatility control mechanisms, intended to address market stress and market dislocation during periods of high volatility. The GMAC’s Technical Issues Subcommittee prepared four additional recommendations, as follows: (5) adoption of lessons learned from a global default simulation across CCPs, intended to address systemic risk and promote financial stability; (6) harmonization of the treatment of money market funds as eligible collateral, intended to improve market liquidity; (7) improvement of trade reporting for market oversight, intended to ensure international standardization and global aggregation and analysis of data to address systemic risk; and (8) improvement of trade reporting for market oversight, intended to facilitate data sharing across jurisdictions for systemic risk analysis.
  • CFTC Customer Advisory Alerts App and Social Media Users to Financial Romance Fraud. On February 7, the CFTC’s Office of Customer Education and Outreach (OCEO) issued a customer advisory alerting dating/messaging app and social media users to a scam asking for financial support or giving investment advice using the platforms. The Customer Advisory: Six Warning Signs of Online Financial Romance Frauds, reminds app and social media users to be wary of texts and messages from strangers that promote cryptocurrency investments. According to the OCEO, the text could actually be from international criminal organizations that trick victims into investing money in cryptocurrency or foreign currency scams only to defraud them. The OCEO stated that the scam can take advantage of even the savviest of investors because fraudsters develop relationships with their victims through weeks of seemingly authentic text messaging conversations, a practice known as “grooming.” The advisory points out several warning signs of a financial grooming fraud, which include fraudsters attempting to move conversations from a dating or social media platform to a private messaging app, as well as their claims of wealth from cryptocurrency or foreign currency trading due to insider information. The advisory also includes steps users can take to avoid financial grooming frauds.
  • CFTC Extends Public Comment Period on Proposed Rule on Protection of Clearing Member Funds. On February 2, the CFTC extended the deadline for the public comment period on a proposed rule to address protecting clearing member funds held by derivatives clearing organizations. The deadline is being extended to March 18, 2024. The CFTC stated that it provided the extension in response to a request by a commenter.
  • Commissioner Pham Announces Additional Executive Staff Appointments. CFTC Commissioner Caroline D. Pham announced new executive staff appointments in her Washington, D.C. office on February 1. Taylor Foy joins Commissioner Pham’s team as a Senior Advisor and Nicholas Elliot has joined as a Confidential Assistant and Policy Advisor.

New Developments Outside the U.S.

  • CPMI, IOSCO Publish Paper on Streamlining VM in Centrally Cleared Markets. On February 14, the Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) published a discussion paper on streamlining variation margin (VM) in centrally cleared markets. The discussion paper follows the review of margining practices, published in 2022 by the Basel Committee on Banking Supervision, the CPMI and IOSCO. The discussion paper sets out eight effective practices, covering intraday VM call scheduling and frequency, treatment of excess collateral, the pass-through of VM by central counterparties (CCPs) and transparency between CCPs, clearing members and their clients. The deadline for comment is April 14. [NEW]
  • ESMA Withdraws Euronext Authorization as a Data Reporting Service Provider Under MIFIR Upon the Entity’s Request. On February 13, ESMA withdrew the authorization of Euronext Paris SA (Euronext) as a Data Reporting Service Provider (DRSP) under the Markets in Financial Instruments Regulation (MiFIR). Euronext was authorized as both an Approved Reporting Mechanism and an Approved Publication Arrangement under MiFIR since January 3, 2018. MiFIR provides that ESMA shall withdraw the authorization of a DRSP where the DRSP expressly renounces its authorization. ESMA’s withdrawal decision follows the notification by Euronext of its intention to renounce its authorization under the conditions set out in Article 27e(a) of MIFIR. [NEW]
  • ESMA Publishes Latest Edition of its Newsletter. On February 13, ESMA published  its latest edition of the Spotlight on Markets Newsletter. The newsletter focused on the last ESMA consultation package related to the Markets in Crypto Assets Regulation (MiCA). ESMA invited stakeholders to send their feedback on reverse solicitation and classification of crypto assets as financial instruments by April 29, 2024. The newsletter also launched a call for candidates for ESMA’s Securities Markets Stakeholder Group and called interested parties who can give a strong voice to consumers, industry, users of financial services, employees in the financial sector, SMEs as well as academics to apply by March 18. [NEW]
  • Hong Kong Government Launches Consultation on Regulating OTC Trading of Virtual Assets. On February 8, the Hong Kong government launched a public consultation on legislative proposals to introduce a licensing regime for providers of over-the-counter trading services of virtual assets (VAs). Under the proposed licensing regime, any person who conducts a business in providing spot trading services of VAs-for-money or money-for-VAs will be required to be licensed by the Commissioner of Customs and Excise, irrespective of whether the services are provided through a physical outlet and/or digital platforms. Licensees will be required to comply with AML/CFT requirements and other regulatory requirements. The public consultation period ends on April 12, 2024.
  • HKMA Consults on Capital Treatment of Cryptoasset Exposures. On February 7, the Hong Kong Monetary Authority (HKMA) published a Consultation Paper on CP24.01 Cryptoasset Exposures setting out a proposal for implementing new regulations on the prudential treatment of cryptoasset exposures based on the Basel Committee on Banking Supervision’s Prudential treatment of cryptoasset exposures standard. According to the consultation paper, for the purpose of the prudential treatment of cryptoasset exposures, cryptoassets will be defined as private digital assets that depend on cryptography and distributed ledger technologies or similar technologies. The HKMA has scheduled a preliminary consultation on the proposed amendments to the rules in the second half of 2024 and aims to put new standards into effect no earlier than July 1, 2025.
  • EU Co-Legislators Reach Provisional Agreement on EMIR 3. On February 6, the EU co-legislators reached a provisional political trilogue agreement on the European Market Infrastructure Regulation 3. On the issue of an active account requirement, while the agreement is based on the less punitive operational active account with representativeness approach proposed by the Council of the EU, the European Parliament has proposed that counterparties should clear at least five trades through an EU CCP in each of the most relevant subcategories. The original approach proposed by the council only required one trade per relevant subcategory. On the topic of supervision, the agreement includes a new role for the European Securities and Markets Authority (ESMA) as co-chair of CCP supervisory colleges alongside national competent authorities and a coordinating role in an emergency.
  • ESA’s Joint Board of Appeal Confirms ESMA’s Decision to Withdraw the Recognition of Dubai Commodities Clearing Corporation. On February 6, the Joint Board of Appeal of the European Supervisory Authorities (the ESAs) unanimously decided to dismiss the appeal brought by Dubai Commodities Clearing Corporation (DCCC) against ESMA and to therefore confirm the ESMA decision to withdraw its recognition. The application was brought in relation to ESMA’s Decision, adopted under Article 25p of Regulation (EU) No 648/2012 (EMIR), to withdraw the recognition of DCCC as a Tier 1 third-country CCP. The decision is a consequence of the United Arab Emirates (UAE) being included by the European Commission on the list of high-risk third countries presenting strategic deficiencies in their national anti-money laundering and counter financing of terrorism (AML/CFT) regime, provided for in the Commission Delegated Regulation (EU) 2016/1675. The Joint Board of Appeal of the ESAs had decided to suspend the ESMA decision in October 2023 until the outcome of the appeal was concluded. With today’s publication, the suspension has expired and the ESMA decision has become fully operational.
  • ESMA Publishes Guidelines on CCP Recovery and Resolution. On February 2, ESMA published two sets of guidelines relating to the EU CCP Recovery and Resolution Regulation. The first set of guidelines provides EU authorities with guidance on the provisions that should be included in cooperation arrangements with third-country authorities, on matters such as the exchange of information for the preparation and maintenance of resolution plans, and on the mechanisms for prompt informing to parties before any early intervention power or resolution action. The second set of guidelines provides EU authorities with guidance on practical arrangements for the establishment and functioning of the resolution college for EU CCPs, and to facilitate the effective operation of the college.
  • ESAs Recommend Steps to Enhance the Monitoring of BigTechs’ Financial Services Activities. On February 1, the ESAs published a Report setting out the results of a stock take of BigTech direct financial services provision in the EU. The Report identifies the types of financial services currently carried out by BigTechs in the EU pursuant to EU licenses and highlights inherent opportunities, risks, regulatory and supervisory challenges. The stock take showed that BigTech subsidiary companies currently licensed to provide financial services pursuant to EU law mainly provide services in the payments, e-money and insurance sectors and, in limited cases, the banking sector. However, the ESAs have yet to observe their presence in the market for securities services. To further strengthen the cross-sectoral mapping of BigTechs’ presence and relevance to the EU’s financial sector, the ESAs propose to set-up a data mapping tool. The ESAs explained that this tool is intended to provide a framework that supervisors from the National Competent Authorities would be able to use to monitor on an ongoing and dynamic basis the BigTech companies’ direct and indirect relevance to the EU financial sector.

New Industry-Led Developments

  • ISDA Response to Australian Treasury on Financial Market Infrastructure Reforms. On February 9, ISDA and the Futures Industry Association submitted a joint response to the Australian Treasury’s draft financial market infrastructure reform package. In the response, the associations considered the proposed crisis resolution regime, which would provide the Reserve Bank of Australia (RBA) with powers to step in and resolve a crisis affecting a domestic central counterparty (CCP), with the aim of ensuring the continuity of critical clearing functions and maintaining financial stability in Australia. The associations expressed concerns with some of the provisions contemplated in the draft regime and asked if the issues highlighted in the response (such as the ability of the RBA or statutory manager to direct and make changes to the operating rules, the lack of explicit definitions of and safeguards on resolution powers and the interaction with close-out netting) could be addressed. [NEW]
  • ISDA Response on Anti-Greenwashing Rules. On January 26, ISDA submitted a response to the UK Financial Conduct Authority’s consultation on GC23/3: Guidance on the Anti-Greenwashing Rule. In the response, ISDA highlights that actual or perceived misrepresentation of sustainability features may have a detrimental impact on investor and consumer perceptions of sustainable finance products, and ISDA supports efforts to enhance trust in the market. ISDA considers that sustainability-linked derivatives, environmental, social and governance derivatives and voluntary carbon credits fall within the scope of the rule.

The following Gibson Dunn attorneys assisted in preparing this update: Jeffrey Steiner, Adam Lapidus, Marc Aaron Takagaki, Hayden McGovern, and Karin Thrasher.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Derivatives practice group, or the following practice leaders and authors:

Jeffrey L. Steiner, Washington, D.C. (202.887.3632, [email protected])

Michael D. Bopp, Washington, D.C. (202.955.8256, [email protected])

Michelle M. Kirschner, London (+44 (0)20 7071.4212, [email protected])

Darius Mehraban, New York (212.351.2428, [email protected])

Jason J. Cabral, New York (212.351.6267, [email protected])

Adam Lapidus – New York (+1 212.351.3869, [email protected])

Stephanie L. Brooker, Washington, D.C. (202.887.3502, [email protected])

Roscoe Jones Jr., Washington, D.C. (202.887.3530, [email protected])

William R. Hallatt, Hong Kong (+852 2214 3836, [email protected])

David P. Burns, Washington, D.C. (202.887.3786, [email protected])

Marc Aaron Takagaki, New York (212.351.4028, [email protected])

Hayden K. McGovern, Dallas (214.698.3142, [email protected])

Karin Thrasher, Washington, D.C. (202.887.3712, [email protected])

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.

For the sixth consecutive year, and following the publication of Gibson Dunn’s annual U.S. Cybersecurity and Data Privacy Outlook and Review in 2024, we offer this separate International Outlook and Review.

As every year, this Outlook and Review provides an overview of past and upcoming developments related to global privacy and cybersecurity laws.

In 2023, data protection laws continued to be adopted across numerous international jurisdictions. Switzerland, the United Kingdom, India, Vietnam and Saudi Arabia, among others, passed new laws, amendments or implementing regulations paving the way for a new round of significant data privacy regimes. It is expected that authorities will make full use of their powers in order to apply and enforce their respective data protection legislation in the near future.

In the European Union (“EU”), EU supervisory authorities continued to apply and enforce the General Data Protection Regulation (“GDPR”) vigorously while the European Data Protection Board (“EDPB”) issued and updated various guidelines providing useful interpretation of the GDPR.

Finally, we noted a significant number of developments in the European digital regulatory landscape.

We cover these topics and many more in this year’s International Cybersecurity and Data Privacy Outlook and Review.

I.  European Union

A.  EU-U.S. Data Privacy Framework

As we indicated in the 2023 International Outlook and Review, the EU-U.S. Privacy Shield was struck down on 16 July 2020, by the Schrems II ruling of the Court of Justice of the European Union (“CJEU”).[1] In order to replace the Privacy Shield and to safeguard cross-border data flows, the European Commission had launched the process to adopt an adequacy decision for the transfer of personal data between the EU and the U.S. (the “EU-U.S. Data Privacy Framework”). On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. This decision concludes that the United States ensures an adequate level of protection – comparable to that of the EU – for personal data transferred from the EU to U.S. companies under the new framework. The EU-U.S. Data Privacy Framework introduces new binding safeguards to address all the concerns raised by the CJEU, including limiting access to EU data by U.S. intelligence services to what is necessary and proportionate, and establishing a Data Protection Review Court (“DPRC”), to which EU individuals will have access.

U.S. companies are able to join the EU-U.S. Data Privacy Framework by committing to comply with a detailed set of privacy obligations.

B.  Network Information Security Directive

The Directive (EU) on measures for a high common level of cybersecurity across the Union 2022/2555[2] (“NIS 2 Directive”) entered into force on 16 January 2023 and replaced the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (“Network Information Security” or “NIS”).

The NIS 2 Directive sets the baseline for cybersecurity risk management measures, and reporting obligations across all sectors that are covered by the Directive, such as energy, transport, health and digital infrastructure (e.g., cloud computing service providers, data center service providers, providers of public electronic communications networks or services) and digital providers (e.g., providers of online marketplaces, providers of social networking services platforms).

In addition, the NIS 2 Directive sets the baseline for reporting obligations. In particular, if an incident has a significant impact on the provision of services covered by the Directive, an authority must be notified without undue delay.

The Member States will have to adopt and publish the measures necessary to comply with the NIS 2 Directive by 17 October 2024.[3]

C.  Data Governance Act

The Regulation (EU) 2022/868 on European data governance of 30 May 2022 (“Data Governance Act”)[4], entered into force on 24 September 2023. The Regulation seeks to increase trust in data sharing, strengthen mechanisms to increase data availability and overcome technical obstacles to the reuse of data, notably with public actors. In particular, the Data Governance Act allows new data intermediaries to act as trustworthy actors in the data economy and lays down rules to enable data altruism.

D.  The Digital Operational Resilience Act

The Regulation (EU) 2022/2554 of 14 December 2022 on  digital operational resilience for the financial sector, (“Digital Operational Resilience Act” or “DORA”),[5] which focuses on preventing and mitigating cyber threats, entered into force on 16 January 2023 and will apply from 17 January 2025 to financial entities (including credit and payment institutions, electronic money institutions, crypto-asset service providers), as well as information and communication technology (“ICT”) third-party service providers.

In particular, financial entities’ management body will be responsible to define, approve and oversee the management of ICT risks. Financial entities will also have requirements on reporting major ICT-related incidents to the competent authorities. In addition, DORA contains requirements in relation to the contractual arrangements concluded between ICT third-party service providers and financial entities.

E.  Data Act

On 22 December 2023, the Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data[6] was published in the Official Journal of the European Union. Most of the provisions of the Data Act will be applicable on 12 September 2025 but some will be applicable from 12 September 2026 and 12 September 2027.

Among the key measures of the Data Act, the Regulation imposes obligations on manufacturers and service providers to let their users (companies or individuals) access and reuse the data generated by the use of their products or related services. In addition, the Data Act aims at easing the sharing of user data to third parties and the switching between providers (portability). Finally, the Regulation prohibits unfair contractual terms in data sharing.

F.   Cyber Resilience Act

The proposal for a Regulation on cybersecurity requirements for products with digital elements of 15 September 2022 (“Cyber Resilience Act” Proposal) aims at protecting both consumers and businesses from products with inadequate security features and thereby ensure a better level of cybersecurity.

In particular, the Proposal introduces mandatory cybersecurity requirements and obligations for manufacturers as well as importers and distributors of products with digital elements within the EU. Any vulnerability contained in the product or any incident impacting its security will have to be reported by the manufacturer to the EU Agency for Cybersecurity (“ENISA”). The “critical products” (e.g., operating systems, firewalls or network interfaces) would be subject to a specific compliance procedure.

This Proposal, if adopted, will be directly applicable in all Member States. Sanctions for violation will depend on the concerned breach (up to €15 million or 2.5% of the company’s total worldwide annual turnover of the preceding financial year, whichever is higher).

On 30 November 2023, the Council and the European Parliament reached a provisional agreement on the proposed Regulation. The agreement reached is now subject to formal approval by both the European Parliament and the Council. Once adopted, companies will have two years to adapt to the new requirements.

G. EDPB Guidance

The EDPB updated its existing guidelines on various topics, including:

i.         Guidelines 04/2022 on the calculation of administrative fines under the GDPR,[7] which aim to provide a clear and transparent basis for the supervisory authorities’ setting of fines.

ii.         Guidelines 03/2021 on the application of Article 65(1)(a) GDPR,[8] which aim to clarify the applicable legal framework and main stages of the procedure, in accordance with the relevant provisions of the Charter of Fundamental Rights of the European Union, the GDPR and EDPB Rules of Procedure.

iii.         Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement,[9] which aim to inform about certain properties of facial recognition technology and the applicable legal framework in the context of law enforcement (in particular the Law Enforcement Directive).

iv.         Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority,[10] which aim to update the previous version of these guidelines since there was a need for further clarifications, specifically regarding the notion of main establishment in the context of joint controllership and taking into account the EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR.

v.         Guidelines 01/2022 on data subject rights – Right of access,[11] which aim to provide guidance on how the right of access has to be implemented in practice.

vi.         Guidelines 9/2022 on personal data breach notification under the GDPR,[12] which aim to update the previous version of these guidelines since there was a need to clarify the notification requirements concerning personal data breaches in non-EU establishments.

vii.         Guidelines 07/2022 on certification as a tool for transfer,[13] which aim to provide guidance as to the application of Article 46 (2) (f) of the GDPR on transfers of personal data to third countries or to international organisations on the basis of certification.

viii.         Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR,[14] which aim to clarify the scenarios for which the EDPB considers that the requirements of Chapter V should be applied. To that end, the EDPB has identified three cumulative criteria to qualify a processing operation as a transfer.

ix.         Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them,[15] which aim to offer practical recommendations to social media providers as controllers of social media, designers and users of social media platforms on how to assess and avoid so-called “deceptive design patterns” in social media interfaces that infringe on GDPR requirements.

The EDPB also issued guidelines for public consultation, including:

i.         Guidelines 2/2023 on Technical scope of Article 5(3) of ePrivacy Directive[16] which aim at conducting a technical analysis on the scope of application of Article 5(3) ePrivacy Directive, namely to clarify what is covered by the phrase ‘to store information or to gain access to information stored in the terminal equipment of a subscriber or user’.

ii.         Guidelines 01/2023 on Article 37 Law Enforcement Directive[17], which aim at providing guidance as to the application of Article 37 of the Law Enforcement Directive on transfers of personal data by competent authorities of EU Member States to third country authorities or international organisations competent in the field of law enforcement.

II.  Enforcement by Supervisory Authorities

In 2023, the GDPR and the Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (“e-Privacy Directive”)[18] continued to be applied and enforced by Member States’ supervisory authorities which imposed substantial fines. We have gathered below a list of important fines published in 2023:

  • On 15 June 2023, the French Supervisory Authority imposed a €40 million fine on a global adtech giant for a multitude of GDPR violations related to its targeted advertising practices.[19] The company specializes in “behavioural retargeting”, which consists of tracking the navigation of Internet users in order to display personalized advertisements. In particular, the Authority considered that the advertising company had failed to demonstrate that the data subjects gave their consent.
  • On 28 September 2023, the Italian Supervisory Authority imposed a fine of €10 million on an electricity and gas supplier, for the activation of unsolicited contracts in the free market through the processing of inaccurate and out-of-date customer data.[20] The Authority also ordered corrective actions, such as implementing a contract accuracy verification system, alert systems to identify improper data acquisition, and enhancing audit procedures against sales agencies.
  • On 13 April 2023, the Italian Supervisory Authority fined a telecommunications giant €7.6 million for unlawful processing of millions of individuals’ data for marketing purposes (namely calls without any consent or in spite of the called individuals being on a public opt-out register).[21]
  • On 5 October 2023, the Croatian Supervisory Authority fined a debt collection company €5.47 million for lack of appropriate technical measures to protect personal data, lack of legal basis and failure to inform data subjects about the processing of their health data and telephone records.[22]
  • The French Supervisory Authority published a decision issued on 17 April 2023, imposing a €5,2 million fine on a facial recognition company, for failing to comply with the injunction issued in its October 2022 sanction decision. Back in October 2022, the Authority had fined the company €20 million and enjoined the company to refrain from collecting and processing the data of individuals in France without a legal basis, and to delete the data of these individuals after responding to requests for access. The injunction was accompanied by a penalty of 100,000 euros per day of delay at the end of the two-month period. The Authority considered that the company had not complied with the order and imposed an overdue penalty payment[23].
  • On 12 June 2023, the Swedish Supervisory Authority imposed a SEK58 million fine (approx. €4,9 million) fine on a company providing an audio streaming service for shortcomings regarding the right of access.[24] The Authority considered that the company does not provide information about how it uses the personal data upon a request of access of individuals and specifies that this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual’s own native language. The Authority has further found that the company had failed in its handling of requests for access related to two out of three of the complaints examined.
  • On 28 August 2023, the Swedish Supervisory Authority fined an insurer SEK35 million (approx. €3 million) for exposing on its online portal sensitive data belonging to hundreds of thousands of customers.[25]
  • On 28 July 2023, the Spanish Data Supervisory Authority issued a €2,5 million fine on a banking institution for not complying with the data protection by design and by default requirements and for not implementing appropriate security measures to address potential risks.[26]
  • On 4 May 2023, the Croatian Supervisory Authority imposed a €2.26 million fine on a debt collection agency. The investigation revealed three violations of the GDPR, namely failure to inform data subjects about data processing activities, failure to have a data processing agreement with a processor and failure to implement appropriate technical and organisational measures.[27]
  •  On 27 November 2023, the Norwegian Supervisory Authority announced a NOK20 million (approx. €1.7 million) fine issued to the Norwegian public welfare agency because the safeguarding of confidentiality in the IT systems of the agency was unsatisfactory.[28]
  • On 27 June 2023, the Swedish Supervisory Authority fined a mass media company SEK13 million (approx. €1 million) for profiling customers and website visitors without consent (unlawfully trying to rely on legitimate interest).[29]
  • On 22 June 2023, the Italian Supervisory Authority announced that a  company in the motorway business was fined €1 million for violating the GDPR. In this ruling, the Authority considered that the company violated the principles of accuracy and transparency, given the failure to provide adequate information in relation to the processing, as well as the misclassification of the GDPR status.[30]

 III.  Developments in Other European Jurisdictions: UK, Switzerland and Turkey

A.  UK

1.  Online Safety Act

The Online Safety Bill received Royal Assent on 26 October 2023, becoming the Online Safety Act 2023. The Act introduces new obligations on the design, operation and moderation of platforms. The UK Office of Communications (“Ofcom”) will enforce the Act’s requirements on platforms and will release its plan to implement online safety laws into practice in the following three phases[31]: (i) illegal content; (ii) child safety, pornography, and protecting women and girls; and (iii) additional duties for categorised services. On 9 November 2023, Ofcom released its first guidance and draft code of practice under the Act that covers illegal content such as terrorism and child abuse material. Ofcom is currently “consulting on these detailed documents, hearing from industry and a range of experts as [Ofcom] develop[s] long-term, final versions that [Ofcom] intend[s] to publish in autumn [2024]”[32]. Responses to the consultation can be submitted until 23 February 2024.[33]

2.  Data Protection and Digital Information Bill No.2

The Data Protection and Digital Information Bill was first introduced in July 2022 and paused in September 2022 so that ministers could engage in a co-design process with business leaders and data experts.[34] The Data Protection and Digital Information (No. 2) Bill[35] (the “DPDI Bill”) was introduced on 8 March 2023 and aims to introduce a business-friendly framework[36], cut down paperwork for businesses and reduce unnecessary cookie pop-ups. The Information Commissioner’s Office (the “ICO”) responded to the DPDI Bill in May 2023, setting out general comments (such as welcoming the UK Government’s decisions that maintain the ICO’s high standards for the protection of individuals’ rights and freedoms), as well as targeted comments on specific clauses of the DPDI Bill.[37] The DPDI Bill is currently at the Committee stage in the House of Lords.

3.  UK-U.S. Data Bridge

On September 21, 2023 the UK Secretary of State for Science, Innovation and Technology laid regulations in the UK Parliament to give effect to the decision to establish a UK-U.S. Data Bridge. The decision was based on her determination that the UK-U.S. Data Bridge “maintains high standards of privacy for UK personal data”[38]. The UK-U.S. Data Bridge came into effect on 12 October 2023 and permits organizations in the UK to transfer personal data to U.S. organizations certified to the “UK Extension to the EU-U.S. Data Privacy Framework” without the need for further safeguards, such as international data transfer agreements (the UK version of the EU’s standard contractual clauses). There are requirements for both UK and U.S. organizations in order to implement the Data Bridge, such as updating privacy policies and certifying to the Data Privacy Framework List[39].

4.  AI and Data Protection

On 15 March 2023, the ICO announced that it had updated its guidance on artificial intelligence (“AI”) and data protection.[40] The ICO provides detailed guidance on how to apply the principles of the UK GDPR. The ICO indicates that the changes respond to requests from UK industry to clarify requirements for fairness in AI, and provides updated guidance in the areas of accountability and governance, transparency, lawfulness, accuracy, and fairness. The ICO also provides a toolkit regarding AI and data protection (that is designed to provide practical support to reduce risks to individuals’ rights and freedoms caused by an organisation’s own AI systems)[41] and a data analytics toolkit (to assist organisations to recognise the rights and freedoms of individuals created by the use of data analytics)[42].

5.  Data Scraping

On 24 August 2023, the ICO released a joint statement on data scraping and the protection of privacy with data protection and privacy authorities from Australia, Canada, Hong Kong, Switzerland, Norway, New Zealand, Columbia, Jersey, Morocco, Argentina and Mexico.[43] The statement calls for the protection of people’s personal data from unlawful data scraping taking place on social media sites. It also sets expectations for how social media companies should protect individuals’ data from unlawful data scraping.

6.  Direct Marketing and Regulatory Communications Guidance for Regulated Private Companies

In March 2023, the ICO issued guidance to businesses operating in regulated private sectors (i.e., “sectors where a statutory regulator has oversight”[44] such as the finance, pension, communications and energy sectors) on direct marketing and regulatory communications. The guidance aims to help businesses identify when a regulatory communication message might count as direct marketing. It also covers what businesses need to do to comply with data protection and ePrivacy law in sending messages that qualify as direct marketing.

B.  Switzerland

On 1 September 2023, the Federal Act on Data Protection 2020 (“FADP”)[45] and the Ordinance on the Federal Act on Data Protection (“FODP”)[46] entered into force. Following this new regulation, the Federal Data Protection and Information Commissioner (“FDPIC”) introduced a “DataBreach Portal” designed for reporting security vulnerabilities, an online registration system for the contact details of DPOs and a portal for Federal bodies to report their data processing activities to the FDPIC.[47]

On 4 April 2023, the FDPIC issued a statement on the use of ChatGPT and comparable artificial intelligence supported apps. In particular, the FDPIC recognised the opportunities of using AI-supported applications such as ChatGPT for society and the economy. However, it emphasises that the processing of personal data using these new technologies also entails risks for privacy and informational self-determination.[48]

In Switzerland, the Federal Administration is evaluating various approaches to regulating AI by the end of 2024.

Finally, the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) was adopted in July 2023 so that participating US organisations will be deemed to provide adequate privacy protection as required for receiving personal data from Switzerland under the FADP. However; to date, personal data from Switzerland cannot be transferred to U.S. organisations in reliance on the Swiss-U.S. DPF until the Swiss Federal Administration issues an adequacy decision recognizing that the Swiss-U.S. DPF ensures data protection consistent with Swiss law.

C.  Turkey

On 13 October 2023, the Personal Data Protection Authority (“KVKK”) published guidelines on considerations in the processing of genetic data. In particular, the KVKK provides guidance for controllers to process personal data based on correct legal basis and to fulfil their obligations in accordance with the regulation.[49]

On 26 October 2023, the KVKK announced that it signed a cooperation and information sharing protocol with the Competition Authority. In particular, the KVKK considered that the increasing processing of personal data through big data technologies may raise significant concerns in terms of competition and the protection of personal data, making cooperation between the relevant authorities inevitable.[50]

IV.  Developments in Asia-Pacific

A.  Australia

As explained in previous editions of the International Outlook and Review, the Australian Government commenced a wholesale review of the Privacy Act 1988 (“Privacy Act”) in 2020, with a view to implementing significant reforms to the country’s privacy regime. After nearly three years and multiple rounds of consultation, the Attorney-General released the final report on 16 February 2023 (“Privacy Act Review Report”).[51] The Government subsequently considered the Privacy Act Review Report and released its proposed response on 28 September 2023.[52]

The Privacy Act Review Report puts forward 116 proposals, aimed at clarifying the scope of the Privacy Act, uplifting protections for individuals, providing clarity for regulated entities and enhancing enforcement mechanisms. In its response, the Government agreed to 38 of those proposals, agreed in-principle to a further 68 and noted the remaining 10. Where the Government “agreed in-principle” with a proposal, it has indicated that its agreement is subject to further engagement with industry and a comprehensive impact analysis to strike a balance between the protection of individual privacy and the resulting cost to businesses. What this means in practice remains to be seen.

Key reforms that the Government has agreed or agreed in-principle to include:

  • expanding the definition of personal information to include inferred or generated information, and clarifying that de-identification is a process rather than an outcome;
  • introducing a new definition of sensitive information that includes genomic information, and requiring explicit consent for its collection, use and disclosure;
  • strengthening the consent requirements by making consent clear, specific, informed, unambiguous, freely given and easy to withdraw;
  • creating new rights for individuals, such as the right to access and correct their personal information, the right to delete their personal information, the right to data portability and the right to object to certain processing activities;
  • enhancing the obligations for entities, such as requiring them to conduct privacy impact assessments for high-risk practices, to implement privacy by design and default principles and to adopt data minimisation and retention policies;
  • increasing the enforcement and oversight powers of the regulator, including by enabling it to issue infringement notices, civil penalties, enforceable undertakings, injunctions and compensation orders; and
  • establishing a mechanism to recognise countries and certification schemes that provide adequate or comparable protection to personal information transferred from Australia, and developing standard contractual clauses for cross-border data flows.

The Attorney-General will lead the next stage of reform required to implement the proposals in the Privacy Act Review Report, including the following:

  • developing legislative proposals which are ‘agreed’ and conducting further targeted consultation with entities on proposals which are ‘agreed in-principle’ to explore whether and how they could be implemented so as to proportionately balance privacy safeguards with the corresponding regulatory burdens;
  • developing a detailed impact analysis, to determine potential compliance costs for industry and other potential economic costs or benefits of the revised regime (including for consumers); and
  • progressing further advice to Government in 2024, including outcomes of additional consultation and legislative proposals.

The Government has indicated that it will consider appropriate transition periods as part of the development of legislation as well as appropriate guidance and other supports which could be developed to help entities understand their compliance requirements. Legislative reforms to the Privacy Act will also be complimented by other reforms that are being progressed by the Government, including the Digital ID, the National Strategy for Identity Resilience and Supporting Responsible AI in Australia.

In this context, the Government released the 2023-2030 Australian Cyber Security Strategy and Action Plan on 22 November 2023.[53] The Strategy and Action Plan set out a vision for Australia to become a world leader in cyber security by 2030. As part of this, the Government has proposed key legislative reforms, including:

  • introduction of a no-fault, no-liability ransomware reporting regime for businesses;
  • amendments to the existing data retention requirements in Australia, with a focus on non-personal data;
  • amendments to the Security of Critical Infrastructure Act 2018 (Cth) to extend its application to data storage systems and business critical data, increase Government management, review and remedy powers and impose more onerous cyber obligations and reporting requirements on entities operating certain critical infrastructure;
  • introduction of a limited use obligation for cyber incident information provided to the Australian Signals Directorate (ASD) and the National Cyber Security Coordinator, restricting how such information can be used by other Government entities (including regulators);
  • establishment of a Cyber Incident Review Board to conduct no-fault incident reviews and share findings with the Australian public; and
  • introduction of mandatory secure-by-design standards for Internet of Things (IoT) devices, a voluntary labelling scheme for consumer-grade smart devices and a voluntary code of practice for app stores and app developers.

The Government has committed $586.9 million to the Strategy. In December 2023, the Department of Home Affairs released a Consultation Paper providing further detail with respect to certain proposed legislative reforms contemplated in the Action Plan.[54] The Consultation Paper is open for public consultation and submissions will close on 1 March 2024.

B.  China

China’s Personal Information Protection Law (“PIPL”) continued to take shape in 2023 as the Cyberspace Administration of China (“CAC”) issued further implementing regulations and guidelines in both draft and final form. Notable regulations and guidelines that were issued include the following:

  • Measures on the Standard Contract for the Export of Personal Information – In February 2023, the CAC released the final version of the Measures on the Standard Contract for the Export of Personal Information[55] along with the Standard Contract for the export of personal information.[56]
    • The Measures and Standard Contract supplement Article 38(3) of the PIPL and establish requirements for Chinese controllers and foreign recipients in relation to the export of personal information from China. While the new requirements came into effect on 1 June 2023, controllers had a six-month grace period (which expired on 30 November 2023) to ensure compliance.
    • Controllers are only permitted to utilise the Measures where they are not a critical information infrastructure operator (“CIIO”) and do not otherwise meet certain volume thresholds with respect to their data processing or exports. Prior to relying on the Measures, eligible controllers must also undertake the following:
      • confirm that they are eligible to utilise the Standard Contract (i.e., do not meet the prescribed thresholds);
      • conduct and complete a personal information protection impact assessment (“PIPIA”);
      • negotiate and execute the Standard Contract with the foreign recipient based on the template issued by the CAC; and
      • file the completed PIPIA report along with the executed Standard Contract with the CAC.
  • Guidelines for the filing of Standard Contracts for Exporting Personal Information – In May 2023, the CAC published new Guidelines for the filing of Standard Contracts for Exporting Personal Information.[57] These guidelines echo the filing requirements set out in the Measures described above and provide an outline of the filing process that controllers are required to undertake pursuant to the Measures.
  • Draft Administrative Measures for Compliance Audit of Personal Information Protection – In August 2023, the CAC published the draft Administrative Measures for Compliance Audit of Personal Information Protection for public comment.[58] The draft Measures set out requirements for compliance audits under Articles 54 and 64 of the PIPL, which stipulate that controllers must regularly conduct compliance audits to ensure compliance with the PRC’s laws and administrative regulations and otherwise authorise responsible authorities to mandate compliance audits.
  • Draft Provisions on Regulating and Promoting Cross-Border Data Transfers – In October 2023, the CAC published draft Provisions on Regulating and Promoting Cross-Border Data Transfers.[59] These Provisions appear to be an attempt by CAC to reassure foreign businesses regarding compliance with the onerous data export restrictions imposed by those Measures implementing Article 38 of the PIPL.
    • The draft Provisions contemplate the following:
      • introduction of a potential waiver (exercisable by CAC) of the requirement to conduct a Security Assessment for controllers that export the personal information of more than 100,000 but less than 1 million people;
      • clarification that data will only be regarded as “important data” if it is explicitly designated as such by regulators or local authorities; and
      • exemption of specified cross-border data transfers from the transfer mechanisms set out in Article 38, including (i) for personal information that is not collected or generated within the PRC; (ii) where it is necessary for the performance of a contract to which the data subject is a party to; (iii) employee data cross-border transfers that are necessary for HR management in accordance with legally formulated labour policies or collective employment contracts; (iv) cross-border data transfers by controllers that expect to transfer the personal information of less than 10,000 individuals out of the PRC within a year; and (v) cross-border data transfers falling outside the negative list to be formulated by Free Trade Zones.
    • Public comment on the draft Provisions ended on 15 October 2023, however, the CAC has not yet issued a final version of the Provisions.
  • Practical Guidelines on Cross-border Personal Information Protection Requirements – In November 2023, China’s National Information Security Standardisation Technical Committee (“TC260”) published the draft Practical Guidelines on Cross-border Personal Information Protection Requirements in the Guangdong-Hong Kong-Macau Greater Bay Area (“Draft GBA Guidelines”).[60] The Draft GBA Guidelines propose a certification regime for cross-border data transfers within the GBA (i.e., cities in the Guangdong province and Hong Kong). Further details and the implications of the Draft GBA Guidelines outside of China are described in the Hong Kong summary below.

C.  India

After several years and multiple proposed bills, the Indian Government finally enacted a comprehensive data protection law in 2023. The Digital Personal Data Protection Act, 2023 (the “DPDP Act”) received royal assent on 11 August 2023 and will come into force in phases (on dates to be notified), effecting wholesale changes to the processing and protection of personal data in the world’s most populated country.[61]

The DPDP Act represents a more streamlined and focused approach to data protection regulation than prior iterations, departing from the 2022 draft which was criticised as being overly prescriptive and compliance-heavy, and for providing undue access to data by state and law enforcement agencies. While the DPDP Act sets out a framework for India’s new data protection regime, many of the details are pending the release of implementing regulations which the Government plans to finalise in due course.

Key features of the DPDP Act include the following:

  • Extraterritorial application – the DPDP Act will apply to processing conducted outside of India if performed in connection with offering goods or services to data subjects in India (referred to as “data principals”).[62] Unlike equivalent foreign data protection regimes (such as the GDPR and CCPA), the DPDP Act does not also apply extraterritorially to processing conducted to monitor the behaviour of data subjects located in India. Further, in light of India’s substantial inbound outsourcing industry, the provisions of the DPDP Act setting out the obligations of controllers (referred to as “data fiduciaries”), rights of data subjects and restrictions on data exports for processing will not apply to the processing of foreign individuals’ personal data carried out in India pursuant to a contract between a controller and a person located outside of India.[63]
  • Sensitive personal data – the DPDP Act does not contain any supplemental obligations with regard to the processing of specific types of data (e.g., what would be considered “special category personal data” under the GDPR or “sensitive personal information” under the CCPA). Despite this, the DPDP Act requires that controllers obtain consent from a parent or lawful guardian when processing the personal data of children (being those under the age of 18) or persons with disabilities.[64]
  • Consent to processing – the DPDP Act imposes a notice and consent regime for the processing of personal data.[65] Consent must be free, specific, informed, unconditional and unambiguous, and should be given through clear affirmative action. When obtaining consent, controllers must provide a clear and plainly worded privacy notice to data subjects stating (i) the type of personal data being processed; (ii) the purpose of the processing; and (iii) how data subjects can exercise certain rights under the DPDP Act, including to withdraw their consent and file a complaint with the regulator. Consent is not required in certain prescribed circumstances, including when processing is necessary to undertake a merger or similar corporate action.
  • Grounds for processing – the DPDP Act provides a limited set of legitimate grounds for processing in the absence of consent,[66] including: (i) for fulfilling any obligation under law; (ii) in order to respond to a medical emergency; and (iii) where the data subject has voluntarily provided their personal data to the controller and has not indicated an objection to the use of their personal data. Notably, the reasonable purposes and public interests grounds contained in the 2022 draft were excluded from the final version of the DPDP Act.
  • Obligations of controllers – the DPDP Act imposes broad obligations on controllers,[67] including to (i) ensure processors’ compliance with the act; (ii) establish a mechanism for addressing data subject complaints; (iii) ensure the accuracy and completeness of data; and (iv) delete data if the data subject has withdrawn consent or if it is reasonable to assume that the purpose for processing is not or no longer being served. Controllers designated as “Significant Data Fiduciaries” by the Government (on the basis of factors such as the volume or sensitivity of personal data processed) are also required to (i) appoint a data protection officer and an independent data auditor; and (ii) conduct periodic audits and data protection impact assessments.[68]
  • Cross-border transfers and data localisation – the DPDP Act permits cross-border transfers of personal data to any country unless specifically restricted by the Indian Government.[69] This departs from the 2022 draft, which contemplated a whitelist for this purpose. The DPDP Act also excludes data storage and localisation requirements contained in the 2022 draft that were heavily criticised by commentators and industry groups.
  • Penalties for non-compliance and enforcement – the DPDP Act imposes penalties for non-compliance depending on the type and nature of breach up to a maximum of 250 crore rupees (~USD 30 million).[70] The newly formed Data Protection Board (“DPB”) is responsible for enforcement of the DPDP Act, although its composition and functioning remains subject to the Government’s release of implementing legislation.
  • Government blocking powers – the DPDP Act permits the Government to block public access to a controller’s platform on the recommendation of the DPB, provided that doing so is necessary or expedient in the interests of the public and the controller has had an opportunity to respond.

D.  Indonesia

As explained in the 2023 International Outlook and Review, 2022 was a landmark year for data protection in Indonesia in light of the enactment of Law No.27 of 2022 on Personal Data Protection (“PDP Law”). While the reform agenda in 2023 was necessarily more muted, the Ministry of Communications and Informatics (“MOCI”) publicly released the draft Government Regulation on the Implementation of the Personal Data Protection Law (“Draft Regulation”) on 31 August 2023.[71] Public consultation on the Draft Regulation closed on 14 September 2023 and the Government is expected to release a final version prior to the PDP Law coming into effect later in October 2024.

The Draft Regulation further clarifies the provisions of the PDP Law, setting out binding obligations for covered entities in order to ensure their compliance. The Draft Regulation is extensive (arguably unnecessarily so, comprising 245 articles over 180 pages), however, notable provisions include the following:

  • Scope of personal data – the Draft Regulation provides the MOCI with the discretion to designate certain data as “specific personal data” if the processing of such data has the potential to have a harmful impact on data subjects, potentially widening the scope of the PDP Law in the future.
  • PDP Agency – the Draft Regulation specifies the detailed responsibilities of the PDP Agency, which will supervise the implementation of the PDP Law. These responsibilities include supervising the compliance of covered entities with the PDP Law and its regulations, investigating and tracking alleged violations and imposing administrative sanctions against covered entities where violations are found to have occurred. Despite its extensive mandate, the Government has yet to formally establish the PDP Agency.
  • Consent to processing – the Draft Regulation clarifies that where processing is undertaken on the basis of consent, data subjects must have been provided with a privacy notice and given their explicit lawful consent (including the consent of a parent or lawful guardian where the processing is in relation to personal data of children or persons with disabilities).
  • Grounds for processing – the Draft Regulation provides that controllers intending to undertake processing of personal data on the basis of legitimate interest (as provided for in the PDP Law) must first conduct a legitimate interest assessment to assess the balance between its own interests and the rights of data subjects. Despite this, the Draft Regulation does not provide further clarification or examples as to what would constitute a “legitimate interest” for the purposes of the PDP Law.
  • Data subject rights – the Draft Regulation further details the rights of data subjects contemplated in the PDP Law. The Draft Regulation also provides a short ‘3 x 24’ hour timeframe for controllers to respond to requests by data subjects to exercise their rights.
  • Appointment of a data protection officer (DPO) – the Draft Regulation requires appointment of a DPO where a controller or processor: (i) processes personal data for public service purposes; (ii) engages in core activities that involve regular and large-scale systematic monitoring of personal data; and (iii) conducts large-scale processing of personal data related to specific personal data and/or criminal offenses. Appointment of a DPO is otherwise not mandatory.
  • Cross-border transfers – the Draft Regulation specifies that the PDP Agency will issue a list of countries deemed to have equal or higher levels of personal data protection than those under the PDP Law (thereby permitting offshore data transfers from Indonesia to those countries without obtaining consent from data subjects or otherwise requiring the recipient of the data to implement adequate and binding personal data protection measures). The Draft Regulation also clarifies that controllers may only rely on consent as a basis for cross-border transfers in limited circumstances, including that the transfer is not recurring, involves a limited number of data subjects and the controller has informed the PDP Agency and data subject about the transfer and the legitimate interests of making it.
  • Data Protection Impact Assessments (DPIAs) – the Draft Regulation provides detailed guidance on the processing of high-risk personal data, including on the requirements for undertaking a DPIA. In particular, the Draft Regulation obligates controllers, as part of a DPIA, to systematically describe their personal data processing activities, assess the necessity and proportionality of the processing, conduct a risk assessment to safeguard the rights of data subjects and document the measures taken to protect data subjects from identified risks.

E.  Hong Kong

Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”) has not undergone any substantive amendment since changes were introduced in 2021 to combat doxxing acts which intrude on personal data privacy. Despite this, it is expected that the Hong Kong Government will – in coming years – seek to update the PDPO to bring it in line with more robust international privacy regimes such as the PIPL and GDPR.

On 29 June 2023, China’s CAC and Hong Kong’s Innovation, Technology and Industry Bureau (“ITIB”) signed a memorandum of understanding (“MoU”) for data transfers within the Great Bay Area (“GBA”, covering cities in the Guangdong province and Hong Kong). The contents of the MoU were not made public, however, in a press release, the ITIB indicated that it is intended to facilitate data flows between the PRC and Hong Kong and to provide a convenient channel for this purpose.[72]

Subsequent to agreement of the MoU – and as noted in the summary for China above – the National Information Security Standardization Technical Committee (“TC260”) published the Draft GBA Guidelines, proposing a draft certification regime for cross-border data transfers within the GBA.[73] The Draft GBA Guidelines ease certain PIPL requirements for cross-border data transfers, however go beyond those under the PDPO by requiring data exporters to enter into a legally binding agreement, comply with additional security and notification requirements and take substantive steps to prevent the onward transfer of data to third countries. In light of this, utilisation of the certification regime in its current form is likely to be limited to PRC-based data exporters with affiliates in Hong Kong – whereas Hong Kong-based data exporters with affiliates in the PRC will presumably eschew certification in favour of the less restrictive PDPO regime. In any event, the precise application of the regime proposed under the Draft GBA Guidelines remains to be seen, with details regarding the certification procedure and enforcement of the Draft GBA Guidelines yet to be published.

On the enforcement front, the Hong Kong Office of the Privacy Commissioner for Personal Data (“PCPD”) published its report on 1 June 2023 concerning the investigation of Softmedia Technology Company Limited for alleged failures to take adequate security measures to protect personal data stored in a credit reference platform. The PCPD found that Softmedia had breached Data Protection Principles 4 (Security) and 2(2) (Retention) by allowing access to credit data to at least eight lenders without obtaining evidence of the complainant data subject’s authorisation to do so and by retaining more than 50,000 credit records of borrowers who had completed their repayments over five years prior.[74] The PCPD’s findings clarify that:

  • “personal data” includes pseudonymised data for the purposes the PDPO;
  • Data Protection Principle 4 (Security) requires organisations to take active steps to secure personal data against unauthorised access where necessary (e.g., by restricting the frequency of access, requiring strong login passwords and/or imposing periodic password changes); and
  • Data Protection Principle 2(2) (Retention) places the onus on the controller and not data subjects to assess an appropriate data retention period (i.e., it was insufficient that Softmedia permitted data subjects to request removal of their credit from the platform from five years following repayment).

In response to the breaches, the PCPD issued an enforcement notice requiring Softmedia to take remedial and preventative actions, including deleting credit data in respect of which more than five years had elapsed and formulating policies and measures to restrict access to the credit reference platform.

F.   Japan

2023 saw limited domestic activity with regard to data protection in Japan.

In March, Japan’s Ministry of Internal Affairs and Communications sought public opinions on the revised draft of the Telecommunications Business Act. The draft changes to the law add guidelines to ensure the protection of personal information by telecommunications companies. Public consultation closed on 24 April 2023.[75]

Despite this, various joint initiatives between Japan and foreign governments and data protection authorities were announced in the second half of the year:

  • On 17 October 2023, Japan’s Personal Information Protection Commission and the UK’s Information Commissioner’s Office announced the signing of a Memorandum of Understanding (“MoU”) focused on data protection.[76] The MoU provides that the respective authorities will share certain information regarding investigations. The authorities will not share personal information under the MoU (other than in exceptional cases).
  • On 28 October 2023, Japan and the EU concluded a deal on cross-border data flows at the EU-Japan High Level Economic Dialogue.[77] Once ratified, the agreed provisions will be included in the EU-Japan Economic Partnership Agreement. The deal will allow both parties to “handle data efficiently without cumbersome administrative or storage requirements, and provide them with a predictable legal environment”. An important element of the deal is the removal of requirements for companies to physically store their data locally.
  • On 14 November 2023, the Japan-U.S. Economic Policy Consultative Committee released a joint statement indicating their joint desire to continue collaborating to facilitate cross-border data flows and effective data and privacy protections globally.[78] In support of their efforts to do so, the two nations plan to coordinate bilaterally and multilaterally on outreach to partners to promote expansion of the Global Cross-Border Privacy Rules (CBPR) Forum.

G. New Zealand

Following the recommendations of New Zealand’s Ministry of Justice in its 2022 consultation paper (summarised in the 2023 International Outlook and Review), the Government introduced a Privacy Amendment Bill into New Zealand Parliament in October 2023, proposing new notification requirements related to the indirect collection of personal data.[79]

If the Bill is passed, organisations will need to take reasonable steps to ensure that data subjects are aware of certain details regarding the indirect collection of their personal data, including that their personal data has been collected, why it has been collected, who it will be shared with and what their rights are. Organisations must take these steps as soon as is reasonably practicable after the indirect collection of the relevant personal data, unless the individual has already been made aware of the required matters (e.g., by the entity which performed the direct collection). The Bill also provides for exemptions in certain circumstances – for example, where non-compliance would not prejudice the interests of the individual, compliance would prejudice the purposes of the collection or compliance would not be reasonably practicable in the circumstances. If passed, the changes in the Bill will be subject to a grace period and will not apply to personal data collected before 1 June 2025. The Bill nonetheless remains subject to public comment, as well as the various steps of the New Zealand legislative process.

H.  Philippines

On 7 November 2023, the National Privacy Commission (“NPC”) issued Advisory No. 2023-01 (the “Advisory”), which provides further clarity on how personal information controllers (“PICs”) and personal information processors (“PIPs”) should avoid practices involving deceptive design patterns, which refer to “design techniques embedded on an analog or digital interface that aim to manipulate or deceive a data subject to perform a specific act”, in connection with the processing of personal data.[80] The Advisory reminds PICs and PIPs to abide by the principle of fairness, and to ensure that personal data is processed in a manner that is “neither manipulative nor unduly oppressive to a data subject”.

The Advisory covers best practices concerning both Appearance-Based and Content-Based Deceptive Designs, and provides a non-exhaustive list of prevalent deceptive design patterns to avoid, including, among others, purposely complicating or muddling a data subject’s choices relating to the processing of personal data and the use of ambiguous language to nudge data subjects into making a choice that is detrimental or violative of their rights as a data subject.

I.  Singapore

On 18 July 2023, Singapore’s Personal Data Protection Commission (“PDPC”) published draft Advisory Guidelines on the use of Personal Data in AI Recommendation and Decision Systems.[81] The Guidelines aim to clarify how the Personal Data Protection Act 2012 (“PDPA”) applies to the collection and use of personal data by organisations in order to develop and deploy systems that embed machine learning (“ML”) models which are then used to make decisions autonomously or to assist a human decision-maker through recommendations and predictions (“AI Systems”). The Guidelines are advisory in nature and are not legally binding, however provide a useful indication as to how the PDPC intends to interpret the PDPA in light of the increasingly important intersection between AI and data privacy.

The Guidelines clarify that where organisations intend to use personal data to develop, test or monitor AI Systems, they may be able to rely on either the business improvement and/or research exemptions under the PDPA in place of obtaining data subjects’ consent. The Guidelines set out relevant considerations for organisations intending to rely on either exception, but clarify that in doing so, organisations must nonetheless adopt appropriate technical, process and/or legal controls for data protection as required by the PDPA. The Guidelines also recommend that organisations deploying AI Systems should ensure that they provide individuals with information on how their personal data is used in deployed AI Systems.

In addition to the release of the Guidelines, enforcement decisions published by the PDPC in 2023 generated important takeaways in the context of the PDPA, including that:

  • organisations should implement multi-factor authentication for admin accounts with access to confidential or sensitive personal data or large volumes of personal;[82] and
  • broad catch all obligations to comply with data protection standards may not be a sufficient administrative protection in the context of engaging third-party vendors and organisations may need to include specific obligations as relevant to the individual engagement.[83]

Consistent with the global trend in uplifting online content and child safety regulations, Singapore’s Info-communications Media Development Authority (“IMDA”) released the final version of the Code of Practice for Online Safety on 17 July 2023.[84] The Code applies since 18 July 2023 to designated social media services. The Code imposes specific obligations on these social media services with respect to user safety, user reporting/resolution and accountability. The maximum penalty for non-compliance with the Code is SGD 1 million, however, it remains to be seen how the IMDA will enforce its provisions in practice other than via the online safety reports that covered providers are required to submit on an annual basis.

On 12 December 2023, the Cyber Security Agency of Singapore (“CSA”) announced a public consultation that ended on 15 January 2024 to seek views on its draft amendments to the Cybersecurity Act 2018, which is the legislative framework that governs the oversight and maintenance of national cybersecurity in Singapore.[85] Notably, these amendments extend the Commissioner of Cybersecurity’s oversight to include Foundational Digital Infrastructure (FDI) such as data centres, cloud computing providers and internet exchanges, and enhance its powers to authorise an onsite inspection to ascertain compliance. In addition, the CSA has sought to expand the scope of reportable incidents for providers to include incidents involving other computers or computer systems which are controlled by owners or providers of essential services, irrespective of whether such systems are interconnected to, or communicate with, critical information infrastructures.

J.   South Korea

Amendments and enforcement decrees to the Personal Information Protection Act (“PIPA”) came into force on 15 September 2023.[86]  The amendments are considered a major overhaul in Korea’s data protection law, and will notably “streamline inconsistencies in data processing standards disparately applied to online and offline businesses” to help prepare the industry for a “full-fledged digital transformation”.

Key amendments include the following:

  • Rights of Data Subjects – The Personal Information Protection Commission (“PIPC”) will implement more flexible data processing procedures where there is an urgent need to collect, use or provide personal data in order to protect data subjects from physical threats or to mitigate public health crises. Furthermore, privacy-related dispute resolution procedures have been revised to streamline the process of providing appropriate remedies to data subjects whose rights may have been infringed. Most notably, both public institutions and private companies are now mandated to participate in dispute resolution proceedings.
  • Regulations Governing Online and Offline Entities – The inconsistent standards which have been applied to online and offline businesses have been streamlined and are now subject to the same set of regulations, including (1) a reporting and notification timeline for data breaches, (2) a requirement to obtain consent from legal guardians for collection and use of personal data of children under 14 and (3) application of consistent criteria for imposing administrative sanctions.
  • Public Institutions Handling Large Data Sets – Data safety measures have been strengthened for operators of major public systems that handle large amounts of personal data of Korean citizens. Under the new measures, covered entities are required to: (1) conduct more robust analysis and inspection of access records, (2) designate a manager responsible for each system and (3) make notifications regarding incidents involving unauthorised access to personal data using public systems.
  • Cross-Border Data Transfers – The amendment addresses the conditions for cross-border data transfers and the penalties for the associated transgressions. The transfer of personal data to other countries is permitted if (1) the destination country provides the same level of data protection as Korea or (2) the transfer is made to “certain certified companies”. Concerning the associated penalties, the amendment changes the basis for calculating the maximum penalty from “total revenue related to the violation” to “total revenue minus the amount of revenue incurred from activities not related to the violation”. This amendment was introduced to prevent penalties from becoming excessive and beyond the scope of the associated transgression.

K.  Sri Lanka

The Sri Lankan Government continued to take steps to implement the Personal Data Protection Act No. 9 of 2022 – announcing plans in September 2023 to establish a Data Protection Authority and to finalise additional cybersecurity legislation.[87]

The Sri Lankan Government also commenced a unique identity card project in 2023, involving the collection of biographic and biometric information from citizens, including facial, iris and fingerprint data. According to Sri Lankan Government officials, the project is expected to store the personal data of all individuals in a centralised system for the purpose of issuing identification cards. India has provided aid of 450 million Indian rupees to fund the project.

L.  Thailand

On 25 December 2023, Thailand’s Personal Data Protection Committee (the “PDPC”) published two notifications, the Adequacy Country Notification and the Appropriate Safeguard Notification, which regulate cross-border transfers of personal data under Sections 28 and 29 of the Thailand’s Personal Data Protection Act (the “PDPA”).[88] The notifications are expected to take effect on 24 March 2024.

  • The Adequacy Country Notification establishes the rules for determining whether a destination country or other international organisation meets the minimum requirements for cross-border transfers. The assessment involves (1) assessment of the destination country’s legal safeguards against the PDPA, including in areas such as security, data subject rights and legal remedies, and (2) confirmation that a competent and independent regulatory body has been established in the destination country that is capable of enforcing relevant data protection laws. The PDPC also has the power to establish a whitelist of approved destination countries and retains the power to determine the adequacy of a destination country as a data transfer recipient.
  • The Appropriate Safeguard Notification serves as an exception to the Adequacy Country Notification, and allows for data transfers through Binding Corporate Rules (“BCRs”) in instances where the transferee is affiliated with the transferor. A covered entity must obtain the approval of PDPC to the terms of BCRs prior to adopting them. In instances where: (1) a destination country or other international organisation does not meet the minimum requirements for receiving personal data transfers; and (2) BCRs cannot be adopted, the Appropriate Safeguard Notification mandates the implementation of other safeguards before initiating any cross-border personal data transfers, such as by entering into standard contractual clauses.

On the enforcement front, multiple decisions by the Expert Committee (formed under the PDPA) in October and November 2023 indicate that the authority is likely to take a more proactive approach to enforcement going forward. The de facto grace period that followed the PDPA taking effect on 1 June 2022 now appears to be over and the Expert Committee may consider utilising its enforcement powers to impose administrative fines and penalties for non-compliance.

M.  Vietnam

As explained in the 2023 International Outlook and Review, the Vietnamese data protection framework has historically been fragmented across various different laws. In order to consolidate the obligations of covered entities into a single omnibus law, the Vietnamese Government issued the Decree on Personal Data Protection (“PDPD”) as Decree No. 13/2023/ND-CP on 17 April 2023.[89]  Notably, the PDPD will not replace but continue to exist concurrently with other existing laws.

Key features of the PDPD include the following.

  • Scope of the Law – The PDPD applies to Vietnamese individuals and organisations (including those operating offshore) and also to foreign entities operating in Vietnam, or directly engaging in or relating to personal data processing activities in Vietnam.
  • Classification of Personal Data – The PDPD classifies personal data into two groups of “basic personal data” and “sensitive personal data”. The list of sensitive personal data is broad and non-exhaustive, including any personal data associated with an individual’s privacy that, when infringed, directly affects their rights and interests.
  • Classification of Processing Entities – As implied under the draft Cybersecurity Administrative Sanctions Decree, the PDPD recognises the concepts of “personal data controller” and “personal data processor” which are broadly consistent with the equivalent terms under the GDPR. It also introduces the concept of “personal data controlling and processing entity” (which has the functions of both a controller and the processor).
  • Processing Principles – The PDPD introduces eight principles for the processing of personal data: lawfulness, transparency, purpose limitation, data minimisation, accuracy, integrity, confidentiality and security, storage limitation and accountability. While these principles are also enshrined in the GDPR, the PDPD departs from the EU model insofar as it does not recognise the principle of “legitimate interests”.
  • Consent – The PDPD adopts a consent-centric approach, requiring controllers to obtain consent to data subjects and to notify the data subject about the purpose, nature and scope of processing. A data subject must express their consent clearly and specifically in writing, by voice, by ticking a consent box, by text message, by selecting consent technical settings, or via another action which demonstrates the same. Processing of personal data without consent is nonetheless permissible in certain limited circumstances (e.g., where necessary to protect the life or health of the data subject, in accordance with law or to fulfil the contractual obligations of the data subject).
  • Cross-Border Data Transfers – The PDPD imposes new requirements for cross-border data transfers, including that the transferor must create a Dossier of Impact Assessment for the Cross-Border Transfer of Personal Data (“TIA Dossier”) before transferring personal data out of Vietnam. The TIA Dossier must contain the information prescribed by the PDPD and be made available at all times for the inspection and evaluation by the authority. In addition, the transferor must submit one original copy of the TIA Dossier to the Department of Cybersecurity and Hi-Tech Crime Prevention (“A05”), an authority under the Ministry of Public Security of Vietnam (“MPS”) within 60 days from the date of the personal data processing. Notably, the MPS has the power to halt cross-border data transfers if (i) the data is used for activities that violate the interests and national security of Vietnam; (ii) the transferor fails to complete or update the TIA Dossier; or (iii) the personal data of Vietnamese citizens is disclosed or lost.
  • Rights of Data Subjects – Eleven rights of the data subject are enshrined in the PDPD, including (i) the right to be informed, (ii) the right to consent, (iii) the right to access, (iv) the right to withdraw consent, (v) the right to delete data, (vi) the right to restrict data processing, (vii) the right to data provision, (viii) the right to object to data processing, (ix) the right to complain and denounce and/or initiate lawsuits, (x) the right to claim compensation for damages and (xi) the right to self-defence. Responses to requests for the exercise of the rights set out in (iii), (v), (vi), (vii) and (viii) are subject to a 72-hour deadline.

The PDPD took effect on 1 July 2023 without any grace period (other than a two-year grace period for the appointment of a data protection officer or department by small- and medium-sized enterprises). While it is uncertain whether the authorities will enforce the PDP’s requirements during the unavoidable transitional period following its implementation, covered entities should nonetheless begin preparing plans for compliance.

In this regard, the Vietnamese Government established the National Portal on Personal Data Protection, allowing entities to take streamlined measures for compliance with the new law, including online submission of data protection impact assessments and data breach notifications.[90]

V.  Developments in Africa

A.  Kenya

Following a petition to introduce a Bill on Robotics and AI on 29 November 2023, politicians and stakeholders are currently debating AI regulation in Kenya. The Bill foresees the creation of a professional regulating body overseeing the activities of AI practitioners and imposing license fees for those working in the sector, whilst guaranteeing government funding for AI research and development.[91]

B.  Nigeria

On 14 June 2023, the Nigerian Data Protection Bill 2023 (available here) entered into force. It sets out general principles for the processing of personal information, including the processing of sensitive information, controller obligations, such as breach notifications, Data Protection Impact Assessments and the appointment of a data protection officer (“DPO”). Furthermore, the Bill imposes restrictions on cross-border transfer of personal information and establishes data subject rights, namely, the right to object, withdraw consent, data portability and the right not to be subject to a decision based solely on the automated processing of personal data.

On 15 December 2023, the National Data Protection Bureau (“NDPB”) issued a code of conduct for data protection compliance organisations (“DPCO”). In particular, the code outlines registration requirements for DPCOs, personal and professional requirements of their DPOs.[92]

C.  Tanzania

On 1 May 2023, the Personal Data Protection Act 2022 entered into force.[93] Complementing that, the Ministry of Information, Communication and Information Technology published Regulations on the collection and processing of personal data and a complaints handling procedure.[94]

D.  Other African Jurisdictions

After its adoption by the African Union (“AU”) in 2014, the African Union Convention on Cyber Security and Personal Data Protection (also known as “Malabo Convention”) came into effect on 8 June 2023, after Mauritania was the 15th country to ratify it on 9 May 2023. To date, 15 of the AU’s 55 countries have signed and ratified the treaty, and 12 more have already signed it.[95]

In Algeria, the Law Relating to the Protection of Individuals in the Processing of Personal Data came into force on 11 August 2023, applying to the processing of personal data by public bodies or private individuals.[96]

In Malawi, the Parliament introduced Bill No. 22 for the Data Protection Act, 2023 on 7 December 2023, aiming to provide a comprehensive legal framework for the regulation of personal data.[97]

VI.  Other Developments in the Middle East

A.  Israel

Following last year’s review, Israeli privacy protection regulations on data transfers from the European Economic Area were published in their final form on 7 May 2023.[98] Furthermore, a corresponding Q&A has been issued.[99]

The Privacy Protection Authority (“PPA”) published a guidance paper on Internet of Things (“IoT”) products and smart homes. It requires companies to secure their databases in accordance with the requirements of the Protection of Privacy Regulations (Data Security) 5777-2017 (“Data Security Regulations”).[100]

Jointly, the Ministry of Innovation, Science, and Technology, the Office of Legal Counsel and Legislative Affairs at the Ministry of Justice published Israel’s recent policy on Artificial Intelligence Regulations and Ethics 2023, aiming to foster responsible innovation in the private sector.[101]

B.  Saudi Arabia

The Council of Ministers approved amendments to the data protection law, previously introduced by the Saudi Data and Artificial Intelligence Authority (“SDAIA”). These include the right to data portability, legitimate interests as a legal basis for processing in some particular circumstances, permitting the processing of personal data for marketing purposes where a clear mechanism is provided to allow the target recipients to request the cessation of the processing, permitting data transfers outside Saudi in specific circumstances and in accordance with certain conditions; and a requirement to keep records of the operations performed on personal data and set rules to restrict access to such data.[102]

On 14 September 2023, the Personal Data Protection Law (“PDPL”), the Regulations on Personal Data Transfers and several implementing regulations entered into force. Compliance will be mandatory one year later.[103]

On the same day, the SDAIA published their Artificial Intelligence Ethics Framework 2.0, focusing on helping companies develop responsible AI-based solutions and limiting negative implications of AI systems, while encouraging innovation.[104]

On 27 November 2023, the SDAIA announced the launch of various initiatives, including the National Data Governance Platform, serving to register entities falling under the scope of the PDPL.[105]

On 20 December 2023, the SDAIA announced the publication of a guide on generative AI in an effort to raise the level of awareness about the importance of AI technologies.[106]

C.  Other Middle East Jurisdictions

In several countries, various laws on digital regulation and data protection have been published, entered into force or are under review:

  • On 15 November 2023, the Abu Dhabi Global Market (“ADGM”) Office of Data Protection (“ODP”) issued and adopted an Addendum to the European Commission’s Standard Contractual Clauses (“EU SCCs”) for personal data transfers.[107] Companies who had already implemented the EU SCCs shall be able to use the Addendum as a data transfer mechanism to comply with the ADGM Data Protection Regulations 2021. In addition, the ODP also issued guidelines to support businesses in implementing the Addendum to their existing EU SCCs.[108]
  • Dubai International Financial Centre’s (“DIFC”) Regulation 10 on Processing Personal Data Through Autonomous and Semi-Autonomous Systems (amending the Data Protection Regulations 2020) entered into force on the date of its publication on 1 September 2023.[109] Additional guidance has been updated accordingly.[110]
  • Jordan finalised and published its Personal Data Protection Law in its Official Gazette on 17 September 2023. The law will enter into force six months after its publication.[111]
  • In Oman, the Data protection law entered into force on 13 February 2023, one year after its publication in the Official Gazette.[112]
  • The Qatar Financial Centre (“QFC”) issued a third version of the QFC Data Protection Rules on 10 December 2023.[113] Although broadly similar to the previous rules, the introduction of new requirements for the use of Corporate Rules for transfers of personal data outside the QFC constitutes a key change.

VII.  Developments in Latin America and in the Caribbean Area

A.  Argentina

On 5 April 2023, the Argentinian data protection authority (“AAIP”) published its 2022 management report, including a new Personal Data Protection Bill, largely in line with the draft bill released in November 2022. On 30 June 2023, the draft has been passed to Congress, where it may be subject to further changes.[114] Upon passing, according to the current draft, its provisions will enter into force 180 days after its publication in the Official Gazette, except for the section on administrative sanctions, which will enter into force once it has been published.

On 17 April 2023, the AAIP deposited the instruments of ratification of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (also known as “Convention 108+”), strengthening individual data protection.[115]

On 26 September 2023, it was announced that the Uruguayan data protection authority had signed a cooperation agreement with the AAIP, including an exchange of investigation results. Furthermore, the agreement is aimed at coordinating strategies and activities to strengthen data protection in Uruguay and Argentina. Additionally, the agreement shall facilitate collaboration in various areas such as the preparation of recommendations, guides and other documents.[116]

On 18 October 2023, the AAIP published approved Standard Contractual Clauses (“SCCs”) for international data transfers, as proposed by the Ibero-American Network for the Protection of Personal Data (“RIPD”). These clauses are part of a guide for the implementation of model contractual clauses for the international transfer of personal data, facilitating the transfer of personal data from countries that are members of the RIPD to other jurisdictions.[117]

B.  Brazil

1.  AI Act (Brazil)

In December 2022, the Brazilian Senate’s Commission of Jurists approved a draft for the Brazilian AI Act, which was converted into Bill No. 2338/2023 in the beginning of 2023. The Brazil’s draft relies on a risk-based approach and has several points of interaction with the Brazilian General Data Protection Law (“LGPD”). Besides, it foresees specific rights to people affected by AI systems, including the right to be informed about interactions with AI systems, the right to contest decisions, the right to human participation and the right to explanation. If approved, the Brazilian AI Act will define sanctions for non-compliance with the law, such as a simple fine of up to BRL 50,000,000 (approx. USD 1 million) per violation – for private legal entities, of up to 2% of the total revenue its group or conglomerate in Brazil obtained in the previous fiscal year (excluding taxes) – as well as the temporary or permanent suspension (partial or total) of the development, supply or operation of AI systems, and a prohibition on processing related databases.[118]

For any regulatory and enforcement matters the National Data Protection Authority (“ANPD”) has already positioned itself offering to act as the key authority. On 3 October 2023, the ANPD also published a call for contributions on its regulatory sandbox pilot program, consisting of a controlled environment to test technologies associated with AI developed by participants.

Currently, the draft is being processed in the Federal Senate in an internal committee to resolve open questions.[119] Besides national efforts to regulate AI, the states Ceará in 2021 and Alagoas in November 2023 already passed first laws regulating AI.[120]

2.  Other Developments in Brazil

On 27 February 2023, the ANPD published its finalised resolution on the application of the administrative sanctioning system for violations of personal data law. It comprises a multi-layered system including warnings, simple fines, daily fines, the blocking and/or deletion of personal data relating to the offence, as well as partial or total bans on activities related to data processing. It also provides a tiered classification system and outlines various criteria and parameters that will be considered when imposing sanctions.[121]

Throughout the year, the ANPD issued various clarifications on debated topics, including inter alia:

  • The clarification that the LGPD only applies to the processing of personal data of living natural persons and that data relating to a deceased person does not constitute personal data and is therefore not subject to the LGPD’s protection; and[122]
  • Open questions on DPO compliance and performance under LGPD. The requirements associated with conducting Data Protection Impact Assessments (“DPIA”) were addressed too.[123]

C.  Chile

Chile’s regulation on the protection of privacy and personal data is currently under a lengthy reformation process, drawing inspiration from the EU GDPR. In 2023, the proposed new bill has been passed to the Senate, where it is now subject to further discussion. To date, the proposal has been referred to a Joint Committee at the beginning of January 2024 to resolve disagreement between the two Chambers over articles.[124]

D.  Colombia

On 6 July 2023, the Colombian data protection authority (“SIC”) announced its decision to fine a company COP 1,306,289,600 (approx. USD 336,000), which is the highest fine relating to the violation of data protection laws to date.[125] The SIC furthermore issued a corrective order for violation of general provisions protecting personal data. The fine was based on a failure to implement adequate and sufficient measures to obtain referral telephone numbers from its customers via a marketing campaign with prior, express and informed consent of the data subjects.

On 4 August 2023, the SIC also published its Official Guide to Personal Data Protection.[126]

On 31 August 2023, the Chamber of Representatives of Colombia initiated the legislative process to adopt a general regime for the protection of personal data (“Bill 156/2023C”). It shall further cover the protection of fundamental rights, including the fundamental right of personal data protection, under the terms described in Article 15 and Article 20 of the Colombian Constitution.[127]

E.  Mexico

On 7 February 2023, the National Institute for Access to Information and Protection of Personal Data (“INAI”) published its interpretation criteria for personal data law.[128]

In the course of the publication of its 2024 budget, the INAI also published plans to review and amend the Federal Law on Protection of Personal Data Held by Private Parties in light of the recent developments in generative AI.[129]

F.   Paraguay

On 29 August 2023, the Chamber of Deputies of Paraguay announced that the Commission of Industry, Commerce, Tourism, and Cooperativism issued a favourable opinion on the bill on the Protection of Personal Data of the Republic of Paraguay, which was presented first in 2021.[130]

G. Peru

The Ministry of Justice and Human Rights is currently conducting a review of the regulations of the law on transparency and access to public information, aiming to optimise the current regulation and integrate improvements to the procedure for access to information, as a comprehensive review of current regulations is deemed necessary.[131] Furthermore, it announced a draft for Law No. 29733 on Personal Data Protection. In particular, the draft aims to raise the regulatory standards for the protection of personal data compared to the previous regulations.[132]

H.  Uruguay

On 21 November 2023, the Uruguayan data protection authority (“URCDP”) published a favourable Adequacy Resolution No. 63/2023 on data protection for cross-border data transfers with South Korea and entities under the EU-U.S. Data Privacy Framework [133] . The adequacy decision from the URCDP followed similar decisions by the European Commission on data transfers between South Korea and the EU-U.S. Data Privacy Framework.

VIII.  Developments in Other Latin American and Caribbean Jurisdictions

A.  Bermuda

Following an announcement of the Bermuda Office of the Privacy Commissioner (“PrivCom”) in June 2023, the Personal Information Protection Act 2016 (“PIPA”) will be officially implemented on 1 January 2025. Entities operating in Bermuda were therefore given 18 months to prepare for the full implementation of PIPA.[134]

To strengthen its resources, PrivCom announced on 24 February 2023, that it had entered into international enforcement cooperation agreements with the Global Privacy Enforcement Network and the Global Privacy Assembly’s Enforcement Cooperation Arrangement.[135]

B.  Bolivia

The general regulation of data protection is currently subject of a fierce debate in Bolivia, which is currently lacking a comprehensive legal framework on this topic. In this debate, on 31 March 2023, the Agency of Electronic Government and Information and Communication Technologies presented a new data protection bill to the Bolivian Senate, seeking to introduce, inter alia, a new data protection agency.[136] Separately, a motion for the reintroduction in the Legislative Assembly of bill No. 349/2020-2021 for the protection of personal data was filed, on 3 March 2023.[137]

C.  Costa Rica

On 10 November 2023, the Ministry of Science, Technology and Telecommunications has published its national cybersecurity strategy.[138]

D.  Grenada

On 10 May 2023, the Grenada Data Protection Act, No. 1 of 2023 has been published in the Official Gazette. It covers, inter alia, the protection of personal data processed by public and private bodies, provides legal bases for processing personal data and sensitive personal data, as well as data protection principles and data subject rights and a penalty system.[139]

E.  Guatemala

On 28 April 2023, the President of the Transparency and Probity Commission issued their opinion on Bill No. 6105 of 23 June 2022, for the Approval of the Personal Data Protection Law. Following that, the bill has been returned to Congress and is now subject to further discussions.[140]

F.   Guyana

On 16 August 2023, the Data Protection Act No.18 of 2023 has been published in the Official Gazette of Guyana and received Presidential assent.[141]

G. Jamaica

After the Jamaican Data Protection Act entered into force on 1 December 2023, the Information Commissioner granted controllers a six-month grace period for registration under the Data Protection Act.[142]

__________

[1]         See http://curia.europa.eu/juris/document/document.jsf;jsessionid=2BDC80771D0FB7EA8B6F60B9A3C4F572?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=20032710.

[2] See https://eur-lex.europa.eu/eli/dir/2022/2555.

[3]  Id.

[4] See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32022R0868.

[5] See https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554.

[6] See https://eur-lex.europa.eu/eli/reg/2023/2854.

[7] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-calculation-administrative-fines-under_en.

[8] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032021-application-article-651a-gdpr_en.

[9] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052022-use-facial-recognition-technology-area_en.

[10] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-82022-identifying-controller-or-processors-lead_en.

[11] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en.

[12] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en.

[13] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072022-certification-tool-transfers_en.

[14] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052021-interplay-between-application-article-3_en.

[15] See https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_en.

[16] See https://edpb.europa.eu/our-work-tools/documents/public-consultations/2023/guidelines-22023-technical-scope-art-53-eprivacy_en

[17] See https://edpb.europa.eu/our-work-tools/documents/public-consultations/2023/guidelines-012023-article-37-law-enforcement_en

[18] See https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&from=FR.

[19] See https://www.cnil.fr/fr/publicite-personnalisee-criteo-sanctionne-dune-amende-de-40-millions-deuros.

[20] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9943230.

[21] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9895080.

[22] See https://azop.hr/debt-collection-agency-eos-matrix-d-o-o-imposed-with-administrative-fine-in-the-amount-of-5-47-million-euros/.

[23] See https://edpb.europa.eu/news/national-news/2023/facial-recognition-french-sa-imposes-penalty-payment-clearview-ai_en

[24] See https://www.imy.se/nyheter/sanktionsavgift-mot-spotify/.

[25] See https://www.imy.se/nyheter/sanktionsavgift-pa-35-miljoner-mot-trygg-hansa/.

[26] See https://www.aepd.es/documento/ps-00331-2022.pdf

[27] See https://edpb.europa.eu/news/national-news/2023/croatian-sa-imposed-administrative-fine-debt-collection-agency-b2-kapital_en.

[28] See https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-gebyr-og-palegg-til-nav/.

[29] See https://www.imy.se/nyheter/fel-anvanda-kunders-personuppgifter-for-profilering-utan-samtycke/.

[30] See https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9910120.

[31] See https://www.ofcom.org.uk/news-centre/2023/safer-life-online-for-people-in-uk.

[32]See https://www.ofcom.org.uk/news-centre/2023/tech-firms-must-clamp-down-on-illegal-online-materials?utm_source=tw_graphic&utm_medium=social_org&utm_campaign=onlinesafety23&utm_content=condoc1_press.

[33]See https://www.ofcom.org.uk/consultations-and-statements/category-1/protecting-people-from-illegal-content-online.

[34] See https://bills.parliament.uk/bills/3322.

[35]See https://bills.parliament.uk/bills/3430.

[36]See https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr.

[37]See https://ico.org.uk/media/about-the-ico/consultation-responses/4025316/response-to-dpdi-bill-20230530.pdf.

[38]See https://www.gov.uk/government/publications/uk-us-data-bridge-supporting-documents/uk-us-data-bridge-explainer#:~:text=The%20US%20data%20bridge%20will,required%20to%20maintain%20those%20standards.

[39] See https://www.dataprivacyframework.gov/.

[40] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/.

[41]See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/.

[42]See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/toolkit-for-organisations-considering-using-data-analytics/.

[43]See https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/08/joint-statement-on-data-scraping-and-data-protection/#:~:text=Scraping%20from%20social%20media%20creates,or%20used%20for%20identity%20fraud.

[44]See https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-and-regulatory-communications/#who.

[45] See https://www.fedlex.admin.ch/eli/cc/2022/491/en.

[46] See https://www.fedlex.admin.ch/eli/oc/2022/568/fr.

[47] See https://www.edoeb.admin.ch/edoeb/en/home/meldeportale.html.

[48] See https://www.edoeb.admin.ch/edoeb/de/home/kurzmeldungen/2023/20230404_chatgpt.html.

[49] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ai-and-data-protection-risk-toolkit/.

[50] See https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/toolkit-for-organisations-considering-using-data-analytics/.

[51] https://www.ag.gov.au/sites/default/files/2023-02/privacy-act-review-report_0.pdf.

[52] https://www.ag.gov.au/sites/default/files/2023-09/government-response-privacy-act-review-report.PDF.

[53] https://www.homeaffairs.gov.au/cyber-security-subsite/files/2023-cyber-security-strategy.pdf.

[54] https://www.homeaffairs.gov.au/help-and-support/how-to-engage-us/consultations/cyber-security-legislative-reforms.

[55] http://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm (in Chinese only).

[56] http://www.cac.gov.cn/2023-02/24/c_1678884831596384.htm (in Chinese only).

[57] http://www.cac.gov.cn/2023-05/30/c_1687090906222927.htm (in Chinese only).

[58] http://www.cac.gov.cn/2023-08/03/c_1692628348448092.htm (in Chinese only).

[59] http://www.cac.gov.cn/2023-09/28/c_1697558914242877.htm (in Chinese only).

[60] https://www.tc260.org.cn/upload/2023-11-01/1698813097992054356.pdf (in Chinese only).

[61] https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf.

[62] See section 3, DPDP Act.

[63] See section 17(1)(d), DPDP Act.

[64] See section 9, DPDP Act.

[65] See sections 4-6, DPDP Act.

[66] See section 7, DPDP Act.

[67] See Chapter II, DPDP Act.

[68] See section 10, DPDP Act.

[69] See section 16, DPDP Act.

[70] See section 33 and Schedule, DPDP Act.

[71] https://pdp.id/rpp-ppdp/1 (in Bahasa only).

[72] https://www.info.gov.hk/gia/general/202306/30/P2023063000219.htm.

[73] https://www.tc260.org.cn/upload/2023-11-01/1698813097992054356.pdf (in Chinese only).

[74] https://www.pcpd.org.hk/english/enforcement/commissioners_findings/files/r23_21242_e.pdf.

[75] https://www.soumu.go.jp/menu_news/s-news/01kiban18_01000188.html (in Japanese only).

[76] https://www.ppc.go.jp/files/pdf/ico_moc.pdf.

[77] https://ec.europa.eu/commission/presscorner/detail/en/ip_23_5378.

[78] https://www.commerce.gov/news/press-releases/2023/11/joint-statement-japan-us-economic-policy-consultative-committee.

[79] https://www.justice.govt.nz/assets/Documents/Publications/Privacy-Amendment-Bill-2023-Approval-for-introduction_FINAL.pdf.

[80] https://privacy.gov.ph/wp-content/uploads/2023/11/NPC-Advisory-No.-2023-01-Guidelines-on-Deceptive-Design-Patterns_7Nov23.pdf.

[81] https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Legislation-and-Guidelines/Public-Consult-on-Proposed-AG-on-Use-of-PD-in-AI-Recommendation-and-Systems-2023-07-18-Draft-Advisory-Guidelines.pdf.

[82] In the matter of an investigation under section 50(1) of the Personal Data Protection Act 2012 and Tokyo Century Leasing (Singapore) Pte. Ltd. [2023] SGPDPC 9 (https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Tokyo_Century_Leasing_040923.pdf).

[83] In the matter of an investigation under section 50(1) of the Personal Data Protection Act 2012 and Ascentis Pte. Ltd. [2023] SGPDPC 10 (see https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Ascentis_12092023.pdf).

[84] https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2023/imdas-online-safety-code-comes-into-effect.

[85] https://www.reach.gov.sg/docs/default-source/participate/public-consultation/cyber-security-agency-of-singapore-(csa)/public-consultations-paper—cybersecurity-amendment-bill.pdf.

[86] See https://www.pipc.go.kr/eng/user/ltn/new/noticeDetail.do?bbsId=BBSMSTR_000000000001&nttId=2331.

[87] https://economynext.com/sri-lanka-says-measures-taken-to-ensure-digital-security-of-indian-funded-unique-id-project-130540/.

[88] See https://www.dataprotectionreport.com/2024/01/thailand-the-regulation-with-respect-to-cross-border-transfer-of-personal-data/.

[89] https://www.dataguidance.com/news/vietnam-decree-protection-personal-data-enters-force; https://thuvienphapluat.vn/van-ban/EN/Cong-nghe-thong-tin/Decree-No-13-2023-ND-CP-dated-April-17-2023-on-protection-of-personal-data/564343/tieng-anh.aspx.

[90] https://rouse.com/insights/news/2023/vietnam-government-launches-national-portal-on-personal-data-protection#:~:text=Vietnam%3A%20Government%20Launches%20National%20Portal%20on%20Personal%20Data%20Protection,-Published%20on%2018&text=In%20line%20with%20Article%2029.2,vn%2F%20(PDP%20Portal).

[91] See here (press release) or here (bill proposal).

[92] See here.

[93] See here (Swahili).

[94] See here and here (Swahili).

[95] See here for full text and status list.

[96] See here.

[97] See draft here.

[98] See here, in Hebrew and English.

[99] See here (Hebrew).

[100] See here (Hebrew).

[101] See here.

[102] See previous proposals here.

[103] See here for PDPL; here for the Implementing Regulation; here (Arabic) for the Regulations on Transferring Personal Data.

[104] See here.

[105] See here (press release, Arabic).

[106] See here (Arabic).

[107] See here.

[108] See here.

[109] See here (press release).

[110] See here, for example the updated DIFC EDMRI Guidance – December 2023.

[111] See here (Arabic).

[112] See here (Arabic).

[113] See here.

[114] See here.

[115] See here (press release).

[116] See here (Spanish).

[117] See here (Resolution, Spanish).

[118] For draft, see here (Portuguese).

[119] See here, for the status of the legislative progress (Portuguese).

[120] Lei 607/2023 (Alagoas) available here; Lei Nº 17.611, 11 de Agosto de 2021(Cearà) available here (Portuguese).

[121] See here (Portuguese).

[122] See here (Technical Note, Portuguese).

[123] See here (press release).

[124] See here (Spanish).

[125] See here (press release, Spanish).

[126] See here (Spanish).

[127] See here, available for download here (Spanish).

[128] Available for download here (Spanish).

[129] See here (Spanish).

[130] For legislative status, see here (Spanish).

[131] See here (Spanish).

[132] See here (Spanish).

[133] See here (Spanish).

[134] See here.

[135] See here.

[136] See here (press release, Spanish).

[137] See here (Spanish).

[138] See here.

[139] Available for download here.

[140] See here.

[141] Available for download here.

[142] See here (press release).


The following Gibson Dunn lawyers assisted in preparing this alert: Ahmed Baladi, Vera Lukic, Joel Harrison, Connell O’Neill, Clémence Pugnet, Thomas Baculard, Hermine Hubert, Sarah Villani, Anastasia Katsari, Marcus Seete*, Grace Chong, Nick Hay and QX Toh.

Gibson Dunn lawyers are available to assist in addressing any questions you may have about these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any leader or member of the firm’s Privacy, Cybersecurity & Data Innovation practice group:

Europe:
Ahmed Baladi – Co-Chair, Paris (+33 (0) 1 56 43 13 00, [email protected])
Joel Harrison – Co-Chair, London (+44 20 7071 4289, [email protected])
Nicholas Banasevic* – Managing Director, Brussels (+32 2 554 72 40, [email protected])
Kai Gesing – Munich (+49 89 189 33-180, [email protected])
Vera Lukic – Paris (+33 (0) 1 56 43 13 00, [email protected])
Lars Petersen – Frankfurt/Riyadh (+49 69 247 411 525, [email protected])
Robert Spano – London/Paris (+44 20 7071 4000, [email protected])

Asia:
Connell O’Neill – Hong Kong (+852 2214 3812, [email protected])
Jai S. Pathak – Singapore (+65 6507 3683, [email protected])

United States:
S. Ashlie Beringer – Co-Chair, Palo Alto (+1 650.849.5327, [email protected])
Jane C. Horvath – Co-Chair, Washington, D.C. (+1 202.955.8505, [email protected])
Rosemarie T. Ring – Co-Chair, San Francisco (+1 415.393.8247, [email protected])
Ryan T. Bergsieker – Denver (+1 303.298.5774, [email protected])
Gustav W. Eyler – Washington, D.C. (+1 202.955.8610, [email protected])
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650.849.5203, [email protected])
Svetlana S. Gans – Washington, D.C. (+1 202.955.8657, [email protected])
Lauren R. Goldman – New York (+1 212.351.2375, [email protected])
Stephenie Gosnell Handler – Washington, D.C. (+1 202.955.8510, [email protected])
Natalie J. Hausknecht – Denver (+1 303.298.5783, [email protected])
Martie Kutscher Clark – Palo Alto (+1 650.849.5348, [email protected])
Kristin A. Linsley – San Francisco (+1 415.393.8395, [email protected])
Timothy W. Loose – Los Angeles (+1 213.229.7746, [email protected])
Vivek Mohan – Palo Alto (+1 650.849.5345, [email protected])
Ashley Rogers – Dallas (+1 214.698.3316, [email protected])
Alexander H. Southwell – New York (+1 212.351.3981, [email protected])
Eric D. Vandevelde – Los Angeles (+1 213.229.7186, [email protected])
Benjamin B. Wagner – Palo Alto (+1 650.849.5395, [email protected])
Debra Wong Yang – Los Angeles (+1 213.229.7472, [email protected])

*Nicholas Banasevic, Managing Director in the firm’s Brussels office and an economist by background, is not admitted to practice law.

*Marcus Seete, a legal trainee in the Brussels office, is not admitted to practice law.

© 2024 Gibson, Dunn & Crutcher LLP.  All rights reserved.  For contact and other information, please visit us at www.gibsondunn.com.

Attorney Advertising: These materials were prepared for general informational purposes only based on information available at the time of publication and are not intended as, do not constitute, and should not be relied upon as, legal advice or a legal opinion on any specific facts or circumstances. Gibson Dunn (and its affiliates, attorneys, and employees) shall not have any liability in connection with any use of these materials.  The sharing of these materials does not establish an attorney-client relationship with the recipient and should not be relied upon as an alternative for advice from qualified counsel.  Please note that facts and circumstances may vary, and prior results do not guarantee a similar outcome.