SEC Actions in Review: What Officers and Directors Should Know for 2025

As the regulatory landscape continues to evolve, public company officers and directors must stay abreast of the enforcement priorities and expectations of the Securities and Exchange Commission (SEC). Over the past year, the SEC has brought various enforcement actions that involve the oversight and reporting obligations of management and boards. These cases highlight potential blind spots in corporate compliance programs. This article summarizes recent enforcement actions related to director independence, cybersecurity, insider “shadow” trading, internal investigations, executive compensation beneficial ownership and insider transaction reports, and Artificial Intelligence, which despite the change in administration, public company officers and directors should view as potential areas of continued SEC focus over the upcoming year.

Director Independence

In September 2024, the SEC announced it had settled^[1] charges against a director of an NYSE-listed consumer packaged goods company for violation of the proxy rules, for failure to disclose in his D&O questionnaire information about his close friendship with an executive officer, which caused the company to falsely list him as an independent director in its proxy statement.^[2] This undisclosed relationship included multiple domestic and international paid vacations with the executive.^[3] The director also allegedly provided confidential information to the executive about the company’s CEO search and instructed the executive to withhold information about their personal relationship to avoid the impression that the director was biased toward the executive becoming CEO of the company.^[4] The director agreed to a civil penalty of $175,000, a five-year officer and director bar, and a permanent injunction from further violations of the proxy rules.

Takeaway: For directors, this case underscores the importance of being “honest, truthful, and forthright”^[5] when completing D&O questionnaires and not treating them as mere formalities that are rolled forward from one year to the next. This enforcement action further shows that material misstatements and omissions in the D&O questionnaire can give rise to a direct violation of the proxy disclosure rules against the director for causing a company’s proxy statements to contain false and misleading statements. The determination of independence can be complex. However, directors are not tasked with making that determination themselves; they merely must disclose all relevant facts in their D&O questionnaires, including social relationships with management.

Cybersecurity

In October 2024, the SEC announced settlements with four issuers for misleading disclosures regarding cybersecurity risks and intrusions. ^[6] These cases stemmed from an ongoing investigation of companies impacted by the two-year long cyberattack against a software company, which the SEC charged a year earlier for failure to accurately convey its cybersecurity vulnerabilities and the extent of the cyberattack.^[7] Each issuer charged by the SEC in October 2024 utilized this company’s software and discovered the actor likely behind the software company’s breach also had accessed their systems, but according to the SEC, their public disclosures minimized or generalized the cybersecurity incidents. Specifically, two of the issuers failed to disclose the full scope and impact of the cyberattack, including the nation-state nature of the threat actor, the duration of the malicious activities, and in one case^[8]the number of compromised files and the large number of customers whose information was accessed, as well as in another case the percentage of code that was compromised.^[9] The other two issuers failed to update their risk disclosures in SEC filings and instead framed cybersecurity risks and intrusions as general and not material^[10] or in hypothetical terms^[11] rather than disclosing the actual malicious activities and their impact on the company.

The SEC charged each issuer with violations of Sections 17(a)(2) and 17(a)(3) of the Securities Act (which prohibit misleading statements or fraud in connection with the offering or sale of securities) and Section 13(a) of the Exchange Act and Rules 13a-1, 13a-11, 13a-13, and 13a-15(a) thereunder (rules related to required filings for public companies, including requirements that such filings include any material information to ensure filings are not misleading, and companies have internal controls and procedures over financial reporting). One of the companies also was charged with disclosure controls and procedures violations. While each issuer received credit for cooperating in the SEC investigation, the settlements included civil penalties ranging from $990,000 to $4 million.

Takeaway: When a cybersecurity breach is identified, the board and management must ensure their company’s disclosures are accurate, current, and tailored to the company’s “particular cybersecurity risks and incidents.”^[12] Indeed, the SEC’s cybersecurity disclosure rules, adopted on July 26, 2023, specifically require registrants to, among other things, report on Form 8-K any cybersecurity incident deemed to be material and to disclose on Form 10-K the registrant’s processes for assessing, identifying, and managing material risks from cybersecurity threats, the material impacts of cybersecurity threats and previous incidents, and specific information relating to the role of the board and management in identifying and managing such risks.^[13] As the SEC stated, “Downplaying the extent of a material cybersecurity breach is a bad strategy”^[14] and, as these cases demonstrate, can subject the company to an enforcement investigation and action. Navigating cybersecurity disclosure obligations, however, especially when the breach is ongoing and the origin and impact is not fully understood, presents unique challenges for issuers. And despite the dissenting opinion in the October 2024 cybersecurity enforcement cases by two of the SEC commissioners, who believed the omitted details were not material to investors, the board and management must constantly evaluate whether their company’s cybersecurity risk disclosures, as well as the disclosed scope and impact of any material breach, are sufficiently detailed and remain accurate throughout the company’s investigation.

Insider “Shadow” Trading

In April 2024, the SEC won a jury verdict in an insider trading case based on a “shadow” insider trading theory.^[15] Shadow trading involves an insider’s misappropriation of confidential information about the insider’s company to trade in securities of another company where there is a sufficient “market connection” between the two companies. In this case, the SEC alleged, and the jury found, the defendant used confidential information about a potential acquisition of the biotech company he worked for to purchase call options in a second biotech company in the belief its stock price would materially increase after the deal involving his company was publicly announced. What was novel about this case is the lack of commercial connection between the two companies and the fact that the confidential information did not directly relate to the company whose securities the defendant traded in.^[16] The nexus between the two companies that served as the basis for the SEC’s insider trading charges was that they were both operating in a field where viable acquisition candidates were scarce, such that the announcement of the sale of the insider’s company was likely to drive up the stock price of the other company.

Takeaway: Officers and directors should take note of this case and, pending further judicial developments, should refrain from shadow trading when in possession of material non-public information (MNPI). Indeed, corporate insider trading policies and codes of conduct often prohibit trading in the securities of publicly-traded customers, vendors, and other commercial partners when an insider is in possession of MNPI. Further, the SEC’s success in this civil case, and the existence of criminal penalties for insider trading, creates an additional risk of criminal prosecution. In short, officers and directors should avoid becoming embroiled in allegations of shadow trading, which could be costly to defend, cause reputational damage, and lead to the imposition of significant sanctions.

Internal Investigations

The SEC has made clear that when a company fails to investigate and remediate wrongful conduct, it will hold officers and directors responsible even if they may not have been involved in the underlying violation. And when a board and management take prompt action to investigate, remediate, and self-report, the SEC will “reward [] meaningful cooperation to efficiently promote compliance” in the form of reduced charges and/or sanctions.^[17]

In September 2024, the SEC brought unsettled civil fraud charges in federal court against the former CEO, former CFO, and former director and audit committee chair of a bankrupt (formerly Nasdaq-listed) software company for their roles in an alleged scheme that resulted in the company overstating and misrepresenting its revenues in connection with two public stock offerings that raised $33 million.^[18] The SEC alleged that while the CEO initiated and directed the fraud, the CFO and director received a complaint from a senior company employee regarding revenue concerns about the main product disclosed in the offering materials, but other than consulting with outside counsel, they failed to investigate the employee’s concerns or correct the potential misstatements. As a result, both signed public filings that contained false and misleading statements and, in connection with the year-end audit, falsely represented to the outside auditors that they had no knowledge of any complaints regarding the company’s financial reporting. The SEC is seeking disgorgement of ill-gotten gains, civil penalties, and officer-and-director bars against each defendant. In its press release, the SEC warned, “This case should send an important signal to gatekeepers like CFOs and audit committee members that the SEC and the investing public expect responsible behavior when critical issues are brought to their attention.”^[19]

In stark contrast, in December 2024 the SEC declined to impose a civil penalty in a settled administrative cease-and-desist action against a publicly-traded biotechnology company due to its self-reporting, proactive remediation, and meaningful cooperation.^[20]The SEC credited the company’s board for (1) forming an independent special committee, which hired outside counsel to conduct an investigation into two anonymous complaints; (2) adopting the special committee’s remediation recommendations, including appointing an interim CEO, establishing a disclosure committee, and appointing two new independent directors; and (3) self-reporting the results of the internal investigation.^[21] The SEC filed separate settled charges against the former CEO and former CFO for misleading investors about the status of FDA reviews of the company’s drug candidates related to a follow-on public offering. Among other sanctions, the CEO and CFO agreed to civil penalties, and the CEO agreed to an officer-and-director bar.^[22]

Similarly, in a settled action announced in September 2024, the SEC credited a former publicly-traded technology manufacturer for conducting an internal investigation, self-reporting the investigation results, and implementing remedial measures.^[23] Despite the existence of fraudulent conduct by a high-level employee, the SEC charged the issuer with only non-fraud violations of the financial reporting, books and records, and accounting control provisions of the federal securities laws and did not impose any penalty. The SEC explained in its press release that “this kind of response by a corporate entity can lead to significant benefits including, as here, no penalty.”^[24] The SEC did bring civil fraud charges against the company’s finance director who perpetrated a fraud related to the company’s financial performance during a three-year period.^[25]

Takeaway: When accounting errors or improper conduct are discovered or alleged, a company and its board should take prompt action. Conducting an independent investigation, undertaking prompt remediation, and being transparent with the company’s outside auditors are critical to ensuring accurate disclosures, preventing further errors and misconduct, and mitigating regulatory and legal exposure. Failing to do so will increase business and legal costs, damage the company’s reputation, and expose officers and directors to individual liability. And where appropriate, with the advice of experienced counsel, companies should evaluate the pros and cons of self-reporting, which regulators will credit as a mitigating factor when considering charges, sanctions, and settlements.

Executive Compensation

In December 2024, the SEC announced it had settled charges against an NYSE-listed fashion retail company for failing to disclose within its definitive proxy statements $979,269 worth of executive compensation related to perks and personal benefits provided to a now-former CEO for fiscal years 2019, 2020, and 2021.^[26] These unreported personal benefits included expenses associated with the authorized use of chartered aircraft for personal purposes.^[27] The company’s failure to disclose these benefits resulted in it underreporting the “All Other Compensation” portion of its then-CEO’s compensation by an average of 94% of the three fiscal years.^[28] The SEC charged the company with violations of Sections 13(a) and 14(a) of the Exchange Act and Rules 12b-20, 13a-1, 13a-15(a), 14a-3, and 14a-9 thereunder (which prohibits companies from making false or misleading statements in proxy statements).^[29] The SEC imposed a cease-and-desist order and declined to impose a civil penalty, in part due to the company’s prompt remediation and self-reporting.^[30]

Takeaway: This case underscores the importance of companies having adequate processes, policies, and controls for identifying perks and personal benefits and ensuring they are included in executive compensation disclosures. SEC rules require, among other things, companies to disclose the total value of such benefits provided to named executive officers who receive at least $10,000 worth of such items in a given year. See Item 402 of Regulation S-K. Transparent disclosure not only fulfills a company’s regulatory obligations but also helps maintain public trust. Failing to fully report non-compensation benefits executives receive can lead to increased government scrutiny, reputational damage, and loss of investor confidence. And when a company falls short, prompt remediation is critical and can result in a reduction of regulatory sanctions.

Beneficial Ownership and Insider Transaction Reports

On September 25, 2024, the SEC announced charges against 23 officers, directors, and major shareholders for violating Sections 16(a), 13(d), and 13(g) of the Exchange Act, which requires reporting information concerning holdings and transactions in public company stock.^[31] In addition, the SEC charged two publicly-traded companies for their failure to report these insiders’ filing delinquencies or for contributing to these insiders’ failures to file.^[32] In its press release, the SEC explained the importance of complying with these reporting obligations: “To make informed investment decisions, shareholders rely on, among other things, timely reports about insider holdings and transactions and changes in potential controlling interests.”^[33] The settlements included penalties ranging from $10,000 to $200,000 for individuals and $40,000 to $750,000 for companies — totaling more than $3.8 million in penalties.^[34] The SEC used data analytics to identify individuals and entities with late required reports.

Takeaway: While it is unusual for the SEC to bring so many actions at once, the “SEC’s enforcement initiatives” are not surprising given the SEC’s continued focus on policing compliance.^[35] The SEC continues to send a clear signal to insiders and investors that they need to “commit necessary resources to ensure these reports are filed on time” or risk enforcement action.^[36] And as the SEC recently warned, “[T]hese reporting requirements apply irrespective of whether the trades were profitable and regardless of a person’s reasons for the transactions.”^[37] For public companies that assist insiders in complying with these filing requirements, the SEC actions further make clear companies are not immune and must stay abreast of amendments and ensure their monitoring processes and controls are working effectively to ensure timely reporting.

Artificial Intelligence

The SEC continued its crackdown on “AI-washing” by bringing a settled enforcement action on January 14, 2025 against a restaurant services technology company due to alleged misrepresentations concerning “critical aspects of its flagship artificial intelligence [] product[.]”^[38] According to the SEC, AI-washing is a deceptive tactic that consists of promoting a product or a service by overstating the role of artificial intelligence integration.^[39] The product at issue in the enforcement action employed AI-assisted speech recognition technology to automate aspects of drive-thru ordering at quick-service restaurants. Among other things, the SEC accused the company of disclosing a misleading reporting rate of orders completed without human intervention using the product.^[40] The company was charged with violations of Section 17(a)(2) of the Securities Act and Section 13(a) of the Exchange Act.^[41] The SEC declined to impose a civil penalty based on the company’s cooperation during the Staff’s investigation and remedial efforts, with the company consenting to a cease-and-desist order.

While this most recent enforcement against AI-washing led to a cease-and-desist order, the Commission’s enforcement cases in 2024 included steep penalties for violators.^[42] In an earlier enforcement action against two investment advisory companies, the SEC levied civil penalties of $400,000 for the company’s false and misleading statements concerning their purported use of artificial intelligence.^[43] Specifically, the companies were alleged to have marketed to their clients (and prospective clients) that they were using AI in certain ways when they were not.^[44] In the SEC’s press release, Chair Gary Gensler warned, “We’ve seen time and again that when new technologies come along, they can create buzz from investors as well as false claims by those purporting to use those new technologies. . . . Such AI washing hurts investors. . . . [P]ublic issuers making claims about their AI adoption must [] remain vigilant about [] misstatements that may be material to individuals’ investing decisions.”^[45]

Takeaway: It is evident that “[a]s more and more people seek out AI-related investment opportunities,” the SEC becomes more and more committed to “polic[ing] the markets against AI-washing[.]” ^[46] The SEC’s emphasis, that any claims regarding AI must be substantiated with accurate information, makes it essential for companies integrating AI to have clear and accurate ways to measure and assess its AI-supported products and/or services. For directors and executives, this means carefully reviewing public disclosures and press releases related to AI technologies to ensure that all AI-related statements are supported by verifiable information. Without this verifiable information, a company opens itself up to significant penalties from enforcement actions brought pursuant to Section 17 of the Securities Act, which may also result in lost trust from shareholders around a company’s AI-related technologies.

Closing

The news for boards and management isn’t all bad; the number of SEC enforcement actions dropped significantly in 2024, and there is reason to believe that this drop may continue into 2025. In 2024, there were 583 SEC enforcement proceedings, compared to between 697 and 862 for each of the prior five years.^[47] While the SEC touted record financial remedies for 2024,^[48] over half of that amount came from a single case.^[49] Signals from the new administration indicate reduced enforcement activity is likely to continue, given the administration’s focus on deregulation and government efficiency, which will likely lead to fewer resources available to the SEC. There also is an expectation that the SEC will avoid “regulation by enforcement” and take a “friendlier” view of certain activities that the outgoing SEC administration sought to reign in, such as with the crypto industry.^[50] An additional factor pointing toward changes in enforcement approach is that the SEC is no longer able to try certain cases in administrative proceedings and instead must adjudicate such matters in federal jury trials.^[51] This could result in the SEC choosing to pursue fewer actions or lesser sanctions, particularly given that it has historically been less successful in federal courts compared to in-house proceedings.^[52] Nonetheless, the SEC’s enforcement actions involving public companies over the past year serve as a reminder to officers and directors of the importance of complying with their duties and obligations and ensuring strong internal controls and reporting practices. Staying ahead of compliance requirements is not just a matter of risk mitigation — it is essential for preserving shareholder trust and corporate integrity.

If you have questions about these and other SEC enforcement actions, contact the authors or your Foley & Lardner attorney.

[1] Typically with settled SEC actions, the settling party neither admits nor denies the SEC’s findings. See 17 CFR § 202.5.

[2] https://www.sec.gov/newsroom/press-releases/2024-161.

[3] See id.

[4] See id.

[5] See id.

[6] https://www.sec.gov/newsroom/press-releases/2024-174.

[7] https://www.sec.gov/newsroom/press-releases/2023-227. In July 2024, most of the SEC’s claims were dismissed; most notably, the court held that charges of internal accounting controls failures do not extend to cybersecurity deficiencies. See https://www.foley.com/insights/publications/2024/08/down-but-not-out-federal-court-curbs-sec-cybersecurity-enforcement-authority/.

[8] See https://www.sec.gov/newsroom/press-releases/2024-174.

[9] See id.

[10] See id.

[11] See id.

[12] Release Nos. 33-10459, 34-82746 (Feb. 21, 2018) (“We expect companies to provide disclosure that is tailored to their particular cybersecurity risks and incidents”).

[13] See Release Nos. 33-11216, 34-97989 (July 26, 2023); see also https://www.foley.com/insights/publications/2023/08/sec-adopts-new-cybersecurity-disclosure-rules/.

[14] https://www.sec.gov/newsroom/press-releases/2024-174.

[15] See https://www.sec.gov/enforcement-litigation/litigation-releases/lr-25970; see also https://www.sec.gov/enforcement-litigation/litigation-releases/lr-25170.

[16] https://www.foley.com/insights/publications/2024/03/sec-v-panuwat-shadow-trading-insider-trading-trial/.

[17] https://www.sec.gov/newsroom/press-releases/2023-234.

[18] https://www.sec.gov/newsroom/press-releases/2024-131.

[19] Id.

[20] https://www.sec.gov/newsroom/press-releases/2024-189.

[21] https://www.sec.gov/files/litigation/admin/2024/33-11332.pdf.

[22] https://www.sec.gov/files/litigation/admin/2024/34-101796.pdf.

[23] https://www.sec.gov/newsroom/press-releases/2024-116.

[24] Id.