INDUSTRY NEWS
SEC Commissioner Hester Peirce is set to leave the Commission in October 2026.[1] Commissioner Peirce directed the SEC’s Crypto Task Force and was an outspoken advocate for the crypto industry.[2] She was also staunchly opposed to “regulation by enforcement” and favored guidance and clarity to registrants.[3] Commissioner Peirce’s departure will leave the Commission with only two sitting members, Chairman Paul Atkins and Commissioner Mark Uyeda.
Steven Levine, a former SEC attorney and current general counsel and senior adviser for the Council of Economic Advisers, has been mentioned in the press as a possible replacement.[4] It has also been speculated that the Commission will operate with just two commissioners. While historically two commissioners have constituted a quorum, the Commission notably amended its rules to allow for a quorum to be present with only one commissioner on October 2.[5]
On September 18, SEC Director of Enforcement David Woodcock spoke at the University of Texas Government Enforcement Institute, where he again emphasized a back-to-basics enforcement approach focused on individual wrongdoers and returning money to harmed investors.[6] He highlighted what he characterized as bread-and-butter offering fraud enforcement actions, including one in which a company and its founder and CEO were charged with raising at least $425 million from more than 1,300 investors in a crypto-based Ponzi scheme.
He also noted Commission actions to disrupt non-domestic bad actors targeting US markets and investors, including a Colorado action against 38 entities (many non-US) that allegedly used false SEC filings to solicit US investors. Director Woodcock also stated that SEC Staff will be paying closer attention to 8-K filings, media reports, and other sources to identify potential enforcement actions and encouraged defense counsel to self-report before receiving outreach from SEC Staff. He also encouraged SEC Staff to consider taking testimony before document production, where appropriate, in the interest of efficiency in investigations.
ENFORCEMENT ACTIONS
Regulators Focus on Cybersecurity
Two September enforcement actions underscore continued federal and state interest in cybersecurity controls, including those governing third-party vendors and the remediation of deficiencies identified through examinations.
On September 22, the SEC settled charges against a broker-dealer for violations of Regulation Systems Compliance and Integrity (Regulation SCI) in connection with the firm’s alternative trading system for over-the-counter securities.[7] According to the SEC, from August 2016 through March 2025 the broker-dealer had failed to establish, maintain, and enforce written policies and procedures required by Regulation SCI, including policies addressing system security, access controls, and application vulnerability management, testing, and remediation.
Significantly, these deficiencies had been previously identified by EXAMS, but the firm allegedly failed to promptly resolve them. The firm agreed to a cease-and-desist order, censure, and $575,000 civil penalty.[8]
On September 17, Massachusetts Secretary of the Commonwealth William F. Galvin announced a consent order imposing a $750,000 administrative fine on a broker-dealer (to be paid in three installments) following a July 2024 data breach involving a third-party online chat service.[9] According to the Division, an unauthorized actor gained access to customer PII through a vendor, potentially affecting 14,543 individuals, including 346 Massachusetts residents.[10]
The Division found that the broker-dealer failed to establish, implement, and maintain reasonable cybersecurity controls for assessing third-party provider risk, and failed to follow its own requirements for vendor diligence and oversight.[11] In addition to a fine and restitution to victims, the broker-dealer was also ordered to retain an independent cybersecurity compliance consultant to review its policies and recommend changes.[12]
Focus on Accounting and Financial Reporting
Consistent with Director Woodcock’s focus on financial statement fraud and accounting issues, which we also covered in our August Roundup, the SEC brought several notable accounting and financial reporting cases in September.
On September 11, the SEC instituted cease-and-desist proceedings against a China-based company, alleging that it engaged in sham advertising and marketing transactions that caused it to overstate net revenue by approximately $80 million and operations and support costs by approximately $81 million.[13] The transactions, which the SEC found were conducted primarily to meet revenue targets, allowed the company to report revenue within previously issued guidance.
The company identified the transactions through a routine internal audit, conducted an independent review, disclosed the issue, disciplined employees, terminated implicated customer and supplier contracts, enhanced controls, and voluntarily provided Commission Staff with detailed narratives and documents.
Without admitting the findings, the company agreed to cease and desist from violations of the reporting, books-and-records, and internal-accounting-controls provisions and pay a $500,000 civil penalty. The Commission expressly noted that the penalty was not higher based on the company’s cooperation.[14]
On September 30, the SEC filed a settled action against a timeshare company, alleging that from October 2019 through February 2021 the company made materially misleading statements and omissions concerning two undisclosed projects that improved key performance measures for its timeshare loan portfolio.
According to the complaint, from May 2019 to at least December 2020 the company rescinded more than 2,900 customer loans totaling approximately $77 million, and reversed the associated accounting entries as if the loans had never been made.
The SEC alleges that the company set internal targets for rescissions to help meet publicly disclosed guidance for its loan loss provision percentage but did not disclose the projects or their effect on that metric, instead attributing improvements in part to other factors. Without admitting the allegations, the company consented to a final judgment enjoining it from violations of the Securities Act and the Exchange Act and agreed to pay a $975,000 civil penalty.
SEC ISSUES INDUSTRY BANS IN ITS ADMINISTRATIVE FORUM
The SEC banned a number of individuals from the securities industry this month, empowered by a recent federal court decision (covered in our January Roundup) that determined the US Supreme Court’s decision in Jarkesy[15] does not bar the SEC from issuing industry bans via its administrative tribunal.[16]
Recent bans include the very individuals who had litigated the issue at the DC Circuit and lost.[17] These actions confirm predictions that, while Jarkesy curtailed the agency’s ability to seek certain monetary remedies without a jury trial, the SEC can and will continue to use its administrative forum to impose other discipline.
SEC FINES ADVISER FOR INADEQUATE CONFLICTS DISCLOSURE ON REFERRAL ALGORITHM
In another matter, a financial firm running a referral service that algorithmically matches investors with investment advisers based on answers to a set of questions[18] also had an asset management platform, and as such was incentivized to recommend this platform over unaffiliated advisers.[19] Though the referral algorithm does not consider whether advisers are on its affiliated platform, salespeople often make additional recommendations separate from those generated by the algorithm.[20]
The SEC alleged that the firm failed to disclose the conflict of interest inherent in these human recommendations and inaccurately disclosed that it made recommendations based only on its algorithm.[21] The firm was fined $450,000 on September 28.[22] The case reflects that disclosing or removing conflicts within the four corners of algorithmic or AI services may be insufficient if there are potential conflicts in related human interactions.
SEC APPROVES FINRA’S OVERHAUL OF RULES FOR OUTSIDE BUSINESS ACTIVITIES FOR BROKER-DEALER PERSONNEL
As we covered in a recent LawFlash, on September 15 the SEC approved FINRA’s rule proposal to significantly modify existing requirements for the outside activities of broker-dealer personnel.[23] The rule change comes as part of the FINRA Forward rule modernization initiative.[24]
The new Rule 3290 replaces two existing rules—Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person)—and eliminates the reporting of non–investment-related activities. Generally, Rule 3290 modifies the treatment of outside investment adviser activities by replacing the existing supervision and recordkeeping framework with notice and upfront assessment requirements, while retaining heightened obligations for outside securities transactions involving sales compensation.
FINRA’s announcement noted that “Rule 3290 will enhance efficiency while preserving protections for investors and members.”[25] FINRA stated it will announce the rule’s effective date in a forthcoming Regulatory Notice.[26]
THE SEC’S DIVISION OF EXAMINATIONS PUBLISHED AN EXAM HANDBOOK
The SEC’s Division of Examinations (EXAMS) also recently published a new Exam Handbook, The SEC Exam Handbook: A Practical Guide on Process and Engagement, to provide greater transparency to registrants regarding how SEC examinations are selected, conducted, and resolved.[27]
The Handbook replaces a 2023 brochure previously published by EXAMS that touched on these issues. While not creating new obligations or procedures, the Handbook provides registrants a roadmap for managing the examination process.
Highlights from the Handbook include:
- EXAMS favors early ongoing engagement with EXAMS Staff, including regarding production issues and remediation.
- Initial document requests typically provide about two weeks for production, with extensions available where appropriate, and Staff may permit rolling productions.
- Firms asserting privilege should provide a detailed privilege log.
- EXAMS Staff do not record or transcribe meetings with registrants, and EXAMS does not consent to the use of recording, transcription, artificial intelligence notetaking tools, or other similar technologies by registrants.
- Disposition letters generally must be issued within 180 days after completion of any on-site work and receipt of all requested records. Registrants typically have 30 days to respond to a deficiency letter, and Staff will strive to provide comments within 60 days after receiving the response.
- Prompt remediation may be considered as a mitigating factor in determining whether to make an Enforcement referral.
