Toolkit · Corporate

The Securities Litigation and Enforcement Toolkit

15 U.S.C. §§ 77

Type
Toolkit
Jurisdiction
National
Date
2026-07-14
Topic
Corporate

This toolkit is the front door to securities litigation and enforcement on UpLaw. It maps the whole exposure cycle — the statutory architecture of the 1933 and 1934 Acts, the disclosure obligations where liability is born, the elements of the private Rule 10b-5 action, the PSLRA machinery of lead plaintiff appointment and heightened pleading, the class certification fight over fraud-on-the-market, Securities Act Sections 11 and 12, insider trading under the classical and misappropriation theories, SEC investigations from subpoena through Wells notice to remedy, parallel criminal proceedings, derivative suits and D&O insurance, and the compliance programs that prevent the whole sequence. Each pillar gives you plain-English doctrine, the anchor authority, the traps that catch sophisticated companies, and a link into UpLaw's deeper guides and checklists. A running example follows one fictional Nasdaq issuer, Vantage Orthopedics, from a single optimistic sentence in an earnings call through every forum that sentence can reach. Use it as a research map: skim the landscape, jump to the pillar you need, follow the links down.

The Securities Litigation and Enforcement Toolkit

Corporate > Securities Litigation | Published 14 July 2026 - Updated 11 August 2026 | UpLaw - uplaw.us

Almost every securities case in America begins with a sentence someone said out loud, believing it was true enough. What follows — the stock drop, the class action, the subpoena, the derivative demand, the coverage fight — is the machinery this toolkit maps.

Keywords: securities litigation, Rule 10b-5, PSLRA, lead plaintiff, scienter, loss causation, fraud-on-the-market, class certification, Section 11, insider trading, SEC enforcement, Wells notice, disgorgement, derivative suit, D&O insurance

How to read this toolkit

Securities litigation is not one body of law. It is a stack of overlapping regimes — private class actions, agency enforcement, criminal prosecution, and state fiduciary litigation — that can all be triggered by the same corporate misstep, run simultaneously, and reach different answers. A company that badly needs one map instead finds four. This toolkit is that one map.

It walks eleven pillars, in the order a real problem travels through them: what the statutes actually are, where disclosure obligations come from, how the private fraud claim is built, how the class action machinery grinds, what happens at certification, what the strict-liability registration claims add, how insider trading works, what the SEC actually does, when DOJ shows up, how the board gets sued, and what compliance would have prevented. Each pillar is a research map, not a treatise: plain-English doctrine, the anchor authority, the classic traps, and a link into UpLaw's deeper guide or checklist where the detail lives.

Use it three ways. Read it straight through once to build the mental model of how exposure propagates. Jump to a pillar when you have a live problem — "do we have scienter?", "what is a Wells notice?", "will the D&O tower pay for this?" — and follow the deep-dive links. Or use the consolidated gated checklist near the end as an audit of a live matter or an entire disclosure program.

A running example keeps it concrete. Meet Vantage Orthopedics, Inc. (Nasdaq: VNTG), a fictional mid-cap spinal implant maker. On its Q3 earnings call, Vantage's CEO says the company's new device, Meridian, is "on track" for FDA clearance and that record distributor revenue is "driven by strong end-user demand." Neither statement was quite true: the FDA had sent a deficiency letter three weeks earlier, and the sales team had been loading distributors with inventory they could not move. Two weeks after the call, the CFO sold 40,000 shares. Four months later, a short seller published the deficiency letter, the stock fell 41% in a day, and every regime in this toolkit switched on at once. We will follow Vantage through all of them.

For the doctrinal foundation beneath the private claim, keep Securities Fraud Litigation: A Comprehensive Guide to Rule 10b-5 Private Actions open in the next tab; for the government side, SEC Enforcement: A Comprehensive Guide to Investigations, Wells Notices, and Remedies.

The securities-liability landscape at a glance

  1. Statutory architecture — The 1933 Act polices the offering; the 1934 Act polices the market. (15 U.S.C. §§ 77a et seq., 78a et seq.)
  2. Disclosure obligations — Periodic reports, Reg S-K line items, Reg FD, and the duty to update or correct. This is where liability is born.
  3. The private 10b-5 action — Six elements: misstatement, scienter, connection, reliance, economic loss, loss causation. (Dura)
  4. Class action mechanics — PSLRA lead plaintiff, particularized pleading, strong inference of scienter, automatic discovery stay. (15 U.S.C. § 78u-4)
  5. Class certification — Fraud-on-the-market under Basic, and the price-impact fight under Halliburton II and Goldman Sachs.
  6. Securities Act §§ 11 and 12 — Near strict liability for registration statement defects; the due diligence defense; traceability.
  7. Insider trading — Classical theory, misappropriation, tippee liability, and Rule 10b5-1 plans. (Chiarella, Dirks, O'Hagan, Salman)
  8. SEC enforcement — MUI, formal order, subpoenas, testimony, Wells notice, settlement or litigation, remedies. (Jarkesy, Liu)
  9. Parallel criminal proceedings — DOJ, wire and securities fraud, the Fifth Amendment stay problem, individual accountability.
  10. Derivative suits and D&O — Demand futility, Caremark oversight claims, indemnification, and the insurance tower.
  11. Compliance — Disclosure controls, insider trading policy, 10b5-1 plans, and the internal investigation that gets there first.

Pillar 1 — The statutory architecture: the 1933 and 1934 Acts

Everything in this toolkit descends from two statutes passed two years apart, and the difference between them is the single most useful thing a lawyer can internalize.

The Securities Act of 1933 governs the sale of securities — the offering. Its animating idea is disclosure at the point of issuance: register the offering, deliver a prospectus, or fit an exemption. Its liability provisions — Section 11 (false registration statement, 15 U.S.C. § 77k), Section 12(a)(1) (unregistered sale, § 77l(a)(1)), and Section 12(a)(2) (false prospectus, § 77l(a)(2)) — impose something close to strict liability. No scienter. No reliance, ordinarily. The plaintiff need only show a material misstatement or omission in the registration statement and that she bought registered shares. For the exemption side of the 1933 Act — how private companies raise money without registering at all — see Raising Capital: A Startup Securities Toolkit and Raising Capital Legally: A Comprehensive Guide to Securities Exemptions for Startups.

The Securities Exchange Act of 1934 governs the trading market — everything after the offering. It creates the SEC, mandates periodic reporting (§ 13), regulates proxy solicitation (§ 14) and tender offers (§ 14(e)), disgorges insider short-swing profits (§ 16(b)), and — through Section 10(b) and the SEC's Rule 10b-5 (17 C.F.R. § 240.10b-5) — supplies the general antifraud provision on which the entire private securities class action bar is built. Section 10(b) requires scienter, reliance, and loss causation. It is hard. That difficulty is not an accident.

Three threshold questions gate everything:

  • Is it a security? SEC v. W.J. Howey Co., 328 U.S. 293 (1946): an investment of money in a common enterprise with an expectation of profits derived from the efforts of others. The Howey test still decides live fights about tokens, revenue-share agreements, and fractional interests.
  • Is it domestic? Morrison v. National Australia Bank Ltd., 561 U.S. 247 (2010), confined § 10(b) to transactions in securities listed on a domestic exchange or domestic transactions in other securities. The "conduct and effects" test is dead for private claims (Congress restored it for SEC and DOJ actions in Dodd-Frank § 929P(b)).
  • Are you a purchaser or seller? Blue Chip Stamps v. Manor Drug Stores, 421 U.S. 723 (1975): only actual purchasers and sellers have standing under Rule 10b-5. Investors who held on a lie have no federal claim (they may have a state fiduciary claim — see Pillar 10).

Trap. The two Acts are cumulative, not alternative. Herman & MacLean v. Huddleston, 459 U.S. 375 (1983), holds that a plaintiff who could sue under Section 11 may also sue under Rule 10b-5 on the same facts. Sophisticated plaintiffs' firms plead both and let the defendant explain the difference to the jury.

Pillar 2 — Disclosure obligations: where liability is born

No securities case starts in court. It starts in a document. The Exchange Act reporting regime — Forms 10-K, 10-Q, and 8-K under § 13(a) and Rules 13a-1, 13a-11, and 13a-13 — plus the content requirements of Regulation S-K, is the surface on which nearly all liability forms.

The line items that generate the most litigation are few and predictable:

Source What it requires Why it generates claims
Reg S-K Item 105 (Risk Factors) Material factors making an investment speculative or risky Warning of a risk as hypothetical when it has already materialized is a classic misstatement
Reg S-K Item 303 (MD&A) Known trends or uncertainties reasonably likely to have a material effect The "known trend" that management saw and did not disclose
Reg S-K Item 408 Disclosure of Rule 10b5-1 trading arrangements adopted or terminated by directors and officers Ties insider sales to the disclosure record
Reg FD (17 C.F.R. §§ 243.100–243.103) No selective disclosure of material nonpublic information Analyst calls, investor conferences, one-on-one meetings
Form 8-K, Item 1.05 Material cybersecurity incidents, on a four-business-day clock A newer, actively enforced trigger; confirm the current text and any staff guidance before relying on it
SOX §§ 302, 404 CEO/CFO certifications; ICFR assessment Converts a disclosure failure into a personal certification failure

The critical doctrinal point, and the one most often gotten wrong: there is generally no free-floating duty to disclose everything material. A duty arises when (1) a statute or rule requires the disclosure, (2) the company is trading on the information (Pillar 7), or (3) the company has said something that would be misleading without it — the "half-truth." The Supreme Court sharpened this in Macquarie Infrastructure Corp. v. Moab Partners, L.P., 601 U.S. 257 (2024), holding that a pure omission — even of something Item 303 required — is not actionable under Rule 10b-5(b); the plaintiff must identify an affirmative statement the omission rendered misleading. That does not make the omission lawful (the SEC can still charge a reporting violation); it means the private plaintiff needs a statement to hang it on.

Materiality is the gate. Under TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976), and Basic Inc. v. Levinson, 485 U.S. 224 (1988), a fact is material if there is a substantial likelihood a reasonable investor would view it as significantly altering the "total mix" of available information. It is contextual, not quantitative: Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27 (2011), rejected a bright-line statistical-significance rule for adverse event reports.

Vantage. The CEO's "on track for clearance" statement is not a pure omission — it is an affirmative present-tense representation about regulatory status, made three weeks after the FDA deficiency letter landed. And Vantage's 10-K risk factor warned that the company "may receive requests for additional information from regulators," phrased as a possibility. It had already happened. That is the single most reliably actionable pattern in securities law.

Run the disclosure program itself against Public Company Disclosure and Reporting: A Practical Checklist.

Pillar 3 — The private 10b-5 action and its elements

A private Rule 10b-5 claim has six elements. Plaintiffs' firms plead them in this order; defense firms attack them in reverse.

  1. A material misrepresentation or actionable omission. Puffery ("world-class," "committed to excellence") is not actionable. Opinions are actionable only on the Omnicare framework (Pillar 6). Forward-looking statements may be immunized entirely by the PSLRA safe harbor, 15 U.S.C. § 78u-5(c): identified as forward-looking and accompanied by meaningful cautionary language, or made without actual knowledge of falsity. Boilerplate cautionary language is not meaningful; it must be substantive and tailored to the specific risk.
  2. Scienter. Ernst & Ernst v. Hochfelder, 425 U.S. 185 (1976): negligence is not enough. Intent to deceive, or (in every circuit to decide it) recklessness — an extreme departure from the standards of ordinary care presenting a danger so obvious the defendant must have been aware of it.
  3. Connection with the purchase or sale of a security.
  4. Reliance. Actual reliance, or the Basic fraud-on-the-market presumption, or the Affiliated Ute Citizens v. United States, 406 U.S. 128 (1972), presumption for claims that are primarily omissions.
  5. Economic loss.
  6. Loss causation. Dura Pharmaceuticals, Inc. v. Broudo, 544 U.S. 336 (2005): pleading that the plaintiff paid an inflated price is not enough. The plaintiff must connect the revelation of the truth to the decline in value. This is the "corrective disclosure" requirement, and it is where a great many cases die.

Two structural limits define who can be a defendant. Central Bank of Denver v. First Interstate Bank of Denver, 511 U.S. 164 (1994), abolished private aiding and abetting liability under § 10(b) (Congress restored it for the SEC in Exchange Act § 20(e)). Stoneridge Investment Partners v. Scientific-Atlanta, 552 U.S. 148 (2008), then rejected "scheme liability" against business counterparties whose conduct the market never saw — no reliance. And Janus Capital Group v. First Derivative Traders, 564 U.S. 135 (2011), held that only the "maker" of a statement — the person with ultimate authority over it — can be liable under Rule 10b-5(b). But Lorenzo v. SEC, 587 U.S. 71 (2019), then held that someone who knowingly disseminates a false statement he did not make can still be liable under Rule 10b-5(a) and (c). The Janus shield is narrower than it looks.

Finally, Section 20(a) control-person liability reaches those who control a primary violator — typically officers and directors, and sometimes a controlling shareholder or parent — subject to a good-faith defense.

Limitations. 28 U.S.C. § 1658(b): the earlier of two years after discovery of the facts constituting the violation or five years after the violation. Merck & Co. v. Reynolds, 559 U.S. 633 (2010), holds that "discovery" includes discovery of facts showing scienter, so the two-year clock does not start on the first bad headline. The five-year outer limit is a statute of repose and is not tolled by a pending class action.

The full doctrinal walkthrough — element by element, circuit split by circuit split — is in Securities Fraud Litigation: A Comprehensive Guide to Rule 10b-5 Private Actions.

Pillar 4 — Class action mechanics: PSLRA lead plaintiff, pleading, and the discovery stay

The Private Securities Litigation Reform Act of 1995 rebuilt the procedure of the securities class action so thoroughly that the procedure now drives outcomes more than the doctrine does.

Lead plaintiff. The first-filed complaint triggers a published notice; class members have 60 days to move for appointment. The court appoints the "most adequate plaintiff," presumptively the movant with the largest financial interest in the relief sought who otherwise satisfies Rule 23. 15 U.S.C. § 78u-4(a)(3). In practice this is an institutional investor — a public pension fund — and the fight over lead plaintiff is a fight over which plaintiffs' firm runs the case.

Heightened pleading. Two PSLRA layers sit on top of Fed. R. Civ. P. 9(b):

  • § 78u-4(b)(1): specify each statement alleged to be misleading, the reason why, and, for information alleged on information and belief, all facts on which that belief is formed.
  • § 78u-4(b)(2): state with particularity facts giving rise to a "strong inference" of scienter. Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308 (2007), tells courts to take the complaint's allegations collectively, consider plausible opposing inferences, and grant a motion to dismiss unless the inference of scienter is cogent and at least as compelling as any opposing innocent inference. No other area of civil litigation asks a court to weigh inferences on a Rule 12 motion. This one does.

The automatic discovery stay. § 78u-4(b)(3)(B): all discovery is stayed during the pendency of any motion to dismiss, absent particularized need to preserve evidence or prevent undue prejudice. The consequence is enormous — plaintiffs must plead a fraud case with no discovery at all. Which is why complaints are built from confidential witnesses (former employees), short-seller reports, government investigations, restatements, whistleblower filings, and insider-sale patterns.

Vantage. The consolidated complaint names Vantage, its CEO, and its CFO. Scienter is pleaded from four sources: the FDA deficiency letter, dated three weeks before the call; internal sales dashboards showing distributor inventory at 5.4 months of supply; three confidential witnesses from the sales organization; and the CFO's 40,000-share sale two weeks after the call. Vantage argues the innocent inference — a good-faith belief that a deficiency letter is a routine step, a CFO selling under a plan for liquidity. Under Tellabs, the court must weigh both. The court finds the inference of recklessness at least as compelling and sustains the complaint against the CEO and CFO.

For Rule 23's architecture and for the class device generally, see Class Action Litigation: A Comprehensive Guide to Rule 23 and The Class Action Toolkit. For the motion-to-dismiss and summary-judgment machinery that carries the case, The Civil Pretrial Toolkit: From Pleadings to Summary Judgment. Once the stay lifts, the document war is governed by ordinary federal practice — see The Federal Discovery Toolkit: A Roadmap From Rule 26(f) to Sanctions and Building a Privilege Log: A Practical Checklist.

Pillar 5 — Class certification and the fraud-on-the-market fight

Individual reliance would destroy any securities class — no two investors read the same documents. Basic Inc. v. Levinson, 485 U.S. 224 (1988), solved that with the fraud-on-the-market presumption: in an efficient market, price reflects all public material information, so an investor who buys at the market price is presumed to have relied on any public material misstatement.

To invoke it, a plaintiff must show the misstatement was public, that it was material, that the market was efficient, and that she traded between the misstatement and the corrective disclosure. Three Supreme Court cases then defined what actually gets litigated at Rule 23:

Halliburton II turned class certification into an event study contest. And Goldman Sachs Group, Inc. v. Arkansas Teacher Retirement System, 594 U.S. 113 (2021), sharpened it further: courts must consider all record evidence relevant to price impact, including evidence that overlaps with materiality, and the generic character of an alleged misstatement is relevant to whether a specific back-end price drop can be traced to it — the "inflation-maintenance" mismatch problem. The Court also confirmed that the defendant bears the burden of persuasion on price impact, by a preponderance.

The practical upshot: certification in a modern 10b-5 case is a battle of financial economists over an event study, fought under Fed. R. Civ. P. 23(b)(3) predominance and Comcast Corp. v. Behrend, 569 U.S. 27 (2013) (the damages model must match the liability theory), with Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011), supplying the "rigorous analysis" command.

Vantage. Vantage's expert argues that the "strong end-user demand" statement was generic corporate optimism and that the 41% drop reflected the short seller's new disclosure of the deficiency letter, not the maintenance of inflation by the demand statement. The plaintiffs' expert isolates the demand-related component of the drop. Under Goldman, the mismatch argument gets a real hearing.

Work the mechanics from either side with Moving for Class Certification: A Practical Checklist and Opposing Class Certification: A Defense Checklist. Because certification is expert-driven, also keep Challenging an Expert Under Daubert and Rule 702: A Practical Checklist in hand. When the case resolves — and the overwhelming majority do — see Settling a Class Action: A Rule 23(e) Approval Checklist, and for how the settlement number is actually built, The Litigation Damages Toolkit: Valuing and Proving Money Awards. Section 21D(e) caps 10b-5 damages using a 90-day lookback on the mean trading price after corrective disclosure — a limit that quietly disciplines every settlement model.

Pillar 6 — Securities Act Sections 11 and 12

If the misstatement appears in a registration statement, the plaintiff does not need Rule 10b-5 at all — and should not use it.

Section 11 (15 U.S.C. § 77k) imposes liability on the issuer, every person who signed the registration statement, every director, every named expert as to the portions he certified, and every underwriter, for any untrue statement of material fact or material omission in the registration statement as of its effective date. The plaintiff need not plead scienter or reliance. The issuer's liability is effectively strict.

Everyone else gets the due diligence defense: a non-expert defendant escapes by showing that, after reasonable investigation, he had reasonable ground to believe and did believe the statements were true. This is the doctrine underwriters' counsel are performing when they run a due diligence session at pricing; the classic judicial statement of how demanding it is comes from Escott v. BarChris Construction Corp., 283 F. Supp. 643 (S.D.N.Y. 1968), which held that signing directors and underwriters who relied on management's assurances without independent verification had not met the standard.

Two modern limits matter enormously:

  • Traceability. Slack Technologies, LLC v. Pirani, 598 U.S. 759 (2023): a Section 11 plaintiff must plead and prove that the shares she purchased are traceable to the allegedly defective registration statement. In a direct listing (or any market where registered and unregistered shares trade together), that may be impossible.
  • Opinions. Omnicare, Inc. v. Laborers District Council Construction Industry Pension Fund, 575 U.S. 175 (2015): a sincere statement of opinion is not "untrue" merely because it turns out to be wrong. It is actionable if (a) the speaker did not actually hold it, (b) it contains an embedded untrue fact, or (c) it omits material facts about the speaker's inquiry or knowledge that make the opinion misleading to a reasonable investor reading it in context.

Section 12(a)(2) (§ 77l(a)(2)) creates rescission liability against a statutory seller for a materially false prospectus or oral communication — generally confined to public offerings. Section 12(a)(1) imposes rescission liability for selling an unregistered security with no exemption; there is no due diligence defense to it, which is why exemption compliance in private markets is unforgiving. Section 15 adds control-person liability. Securities Act claims carry a shorter clock: one year from discovery, and a three-year repose from the bona fide public offering (§ 77m).

Forum. Under the Securities Litigation Uniform Standards Act (SLUSA, 15 U.S.C. § 78bb(f)), state-law securities class actions are precluded — but Cyan, Inc. v. Beaver County Employees Retirement Fund, 583 U.S. 416 (2018), held that state courts retain concurrent jurisdiction over 1933 Act class actions, and those cases cannot be removed. Issuers responded with federal-forum provisions in their charters, which the Delaware Supreme Court upheld as facially valid in Salzberg v. Sciabacucchi, 227 A.3d 102 (Del. 2020). Whether other states enforce them is a question of each forum state's own law, and the answer genuinely varies — confirm the law of the forum state before relying on the clause.

Vantage did a follow-on offering four months before the earnings call. The prospectus incorporated the same hypothetical risk factor. That opens a Section 11 track against the signing directors and the underwriters — no scienter required — for every investor who can trace her shares to that offering. If Vantage were still private, the analysis would run through the exemption framework in Raising Capital: A Startup Securities Toolkit; and if the misstatements had appeared in merger disclosures, the overlay in Mergers and Acquisitions: A Comprehensive Guide from Letter of Intent to Closing applies.

Pillar 7 — Insider trading

There is no statute called "the insider trading law." The prohibition is judge-made, built on Rule 10b-5's fraud language, and it has exactly one organizing principle: trading on material nonpublic information (MNPI) is fraud only when it breaches a duty.

  • Classical theory. Chiarella v. United States, 445 U.S. 222 (1980): a corporate insider who trades in his own company's stock on MNPI breaches a duty to the shareholders on the other side of the trade. But a stranger with no relationship of trust owes no duty and commits no fraud by silence.
  • Tippee liability. Dirks v. SEC, 463 U.S. 646 (1983): a tippee inherits the insider's duty only if the insider breached a duty by tipping — which requires a personal benefit to the tipper — and the tippee knew or should have known of that breach. Salman v. United States, 580 U.S. 39 (2016), confirmed that a gift of confidential information to a trading relative or friend is itself the personal benefit; no pecuniary quid pro quo is required. (United States v. Newman, 773 F.3d 438 (2d Cir. 2014), had suggested otherwise; Salman abrogated that aspect of it. Do not cite Newman's personal-benefit holding as good law.)
  • Misappropriation theory. United States v. O'Hagan, 521 U.S. 642 (1997): an outsider who misappropriates MNPI in breach of a duty to the source of the information — a lawyer trading on his firm's client's deal — commits § 10(b) fraud on the source. O'Hagan also upheld Rule 14e-3, which bars trading on MNPI about a tender offer with no duty requirement at all.
  • Rule 10b5-2 supplies non-exhaustive circumstances in which a family or personal relationship creates the requisite duty of trust for the misappropriation theory.
  • Rule 10b5-1 defines when a trade is "on the basis of" MNPI and provides the affirmative defense for a pre-established trading plan. The rule was substantially amended in 2022; the current version conditions the defense on cooling-off periods before trading may begin (longer for directors and Section 16 officers than for other employees), a good faith requirement that runs through the life of the plan, director and officer certifications, limits on overlapping plans and single-trade plans, plus quarterly and annual disclosure under Reg S-K Item 408. The specific day counts and conditions have changed once already and are periodically revisited — confirm the current rule text before advising on a plan.

Round it out with Section 16: § 16(a) reporting on Forms 3, 4, and 5, and § 16(b) short-swing profit disgorgement, which is strict liability — any purchase and sale (or sale and purchase) by an officer, director, or 10% holder within six months, with profits recoverable by the company regardless of intent or MNPI.

Vantage. The CFO's sale is the case's center of gravity. If the shares went out under a validly adopted 10b5-1 plan established before he learned of the deficiency letter, he has a defense — and the plaintiffs lose their best scienter fact. If he adopted the plan after the letter arrived, or modified an existing plan, the defense collapses and the sale becomes Exhibit A for both the class and the SEC.

Build the preventive side with Insider Trading Compliance and Rule 10b5-1 Plans: A Practical Checklist.

Pillar 8 — SEC investigations and enforcement

The SEC's Division of Enforcement runs on a predictable arc, and knowing where you are on it is most of the strategy.

  1. MUI (Matter Under Inquiry). Informal. Voluntary document requests. No compulsory process yet — but everything produced is permanent.
  2. Formal order of investigation. The Commission (or, by delegation, senior Enforcement staff) authorizes subpoenas for documents and testimony under Exchange Act § 21(b). Investigations are non-public and one-sided; there is no cross-examination and no right to see the staff's file.
  3. Testimony. On the record, under oath, with a court reporter. Counsel may attend but the scope of objections is narrow. A witness may assert the Fifth Amendment — but unlike in a criminal case, an adverse inference may be drawn against him in the civil proceeding.
  4. Wells notice. The staff advises that it intends to recommend an enforcement action and identifies the charges. The recipient may submit a Wells submission — a written argument on the law and facts. It is a genuine off-ramp, and also a discoverable admission-shaped document that the DOJ may later read. Never draft one without thinking about Pillar 9.
  5. Resolution. Settle (typically on a neither-admit-nor-deny basis, in a consented federal-court judgment), or litigate.

Remedies. Injunctions and obey-the-law orders; civil penalties under the three-tier structure of Exchange Act § 21(d)(3) (per-violation amounts are inflation-adjusted annually — always pull the current table, never a remembered number); disgorgement; officer-and-director bars (§ 21(d)(2)); trading suspensions; and, for accountants and lawyers, Rule 102(e) practice bars. Two decisions define the money:

  • Kokesh v. SEC, 581 U.S. 455 (2017), held disgorgement is a penalty subject to the five-year limitations period of 28 U.S.C. § 2462. Congress responded in the FY2021 National Defense Authorization Act by writing disgorgement authority explicitly into Exchange Act § 21(d) with a longer period for scienter-based claims — check the current statutory text, which post-dates most treatise discussions of Kokesh.
  • Liu v. SEC, 591 U.S. 71 (2020), confined equitable disgorgement to a wrongdoer's net profits after legitimate expenses, ordinarily to be returned to victims.

Forum, after Jarkesy. For years the SEC could choose between federal court and its own administrative proceedings before an ALJ. Lucia v. SEC, 585 U.S. 237 (2018), held SEC ALJs are Officers who must be constitutionally appointed. Then SEC v. Jarkesy, 603 U.S. 109 (2024), held that when the SEC seeks civil penalties for securities fraud, the Seventh Amendment guarantees a jury trial, so the claim must be brought in an Article III court. The practical effect is that contested fraud-and-penalty cases now go to federal district court. For how agency adjudication and judicial review work after Jarkesy, Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024) (overruling Chevron; courts decide statutory meaning de novo), and Corner Post, Inc. v. Board of Governors (2024) (APA limitations accrual), see Administrative Law: A Comprehensive Guide to Agency Action and Judicial Review and The Administrative Law Toolkit.

Whistleblowers. Exchange Act § 21F (Dodd-Frank § 922) pays awards to whistleblowers whose original information leads to sanctions above a statutory threshold, in a percentage band set by statute, and forbids retaliation. Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018), limited the Dodd-Frank anti-retaliation protection to people who actually reported to the SEC (internal-only reporters must look to SOX § 806 instead). Assume a whistleblower exists. Very often one does.

Manage the process with Responding to an SEC Investigation and Wells Notice: A Practical Checklist and, for compulsory process generally, Responding to a Government Subpoena or Investigation: A Practical Checklist.

Pillar 9 — Parallel criminal proceedings

The same conduct that supports a Rule 10b-5 claim can support criminal securities fraud under Exchange Act § 32(a) (willful violations), 18 U.S.C. § 1348 (securities and commodities fraud), and the workhorses — wire fraud (18 U.S.C. § 1343), mail fraud, false statements (18 U.S.C. § 1001), obstruction (18 U.S.C. §§ 1505, 1512, 1519), and conspiracy (18 U.S.C. § 371). SOX § 906 makes a knowingly false CEO/CFO certification a crime in its own right; SOX § 304 requires a CEO and CFO to reimburse the company for bonuses and trading profits following a restatement caused by misconduct, and Exchange Act Rule 10D-1 (Dodd-Frank § 954) requires exchange-listed issuers to maintain a compensation recovery policy clawing back erroneously awarded incentive compensation after an accounting restatement — even absent misconduct.

The criminal threshold is willfulness and proof beyond a reasonable doubt, which is why the SEC charges many cases DOJ declines. But when DOJ is in, the parallel-proceeding problems are severe and they arrive immediately:

  • The Fifth Amendment squeeze. An individual defendant who invokes the privilege in the civil case faces an adverse inference; if he testifies, he arms the prosecutor. Courts sometimes stay the civil case, but a stay is discretionary and never guaranteed.
  • The joint defense / separate counsel problem. The company's interests and the CFO's interests diverge the moment cooperation credit enters the picture. Separate counsel, early, is not a courtesy — it is a necessity.
  • The Upjohn warning. Every interview of an employee by company counsel must make clear that counsel represents the company, not the employee, and that the company alone controls the privilege.
  • Cooperation credit. The company's decision to disclose, remediate, discipline, and hand over individual conduct is the single biggest lever on corporate outcome — and it is a decision the board, not management, should make.

The corporate criminal framework, cooperation, and the mechanics of internal investigations are in White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

Pillar 10 — Derivative suits, D&O exposure, and insurance

The class action sues the company. The derivative suit sues the board, on the company's behalf, for allowing it to happen — and here the federal frame drops away entirely. Derivative litigation is governed by the internal affairs doctrine: the corporate law of the state of incorporation, not federal securities law. Delaware supplies the default vocabulary below because most public issuers are Delaware corporations and because its case law is the most developed — but it is not a national rule. Nevada, Texas, and other states have materially different exculpation, demand, and oversight regimes, and a growing number of issuers have reincorporated precisely to get them. Always check the charter and the state of incorporation before importing a Delaware answer.

Demand and demand futility. Fed. R. Civ. P. 23.1 and its state analogues require the plaintiff to make a pre-suit demand on the board or plead with particularity why demand would be futile. Delaware consolidated its old Aronson/Rales tests into a single three-part inquiry in United Food & Commercial Workers Union v. Zuckerberg, 262 A.3d 1034 (Del. 2021): director by director, would the director face a substantial likelihood of liability, does the director lack independence from someone who would, and did the director receive a material personal benefit from the challenged transaction? If half or more of the board fails, demand is excused.

The claims.

  • Caremark oversight. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and Stone v. Ritter, 911 A.2d 362 (Del. 2006): directors breach the duty of loyalty by acting in bad faith — either by utterly failing to implement any reporting system, or by consciously ignoring red flags from a system that exists. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), sharpened the first prong for mission-critical risks. This is famously "possibly the most difficult theory in corporation law," but the modern cases show it is no longer theoretical.
  • Brophy claims. Insider trading by a fiduciary, brought derivatively for the company's benefit.
  • Section 14(a) proxy claims and Section 16(b) short-swing recovery, both of which can be pleaded derivatively.

Books and records first. The disciplined path is a DGCL § 220 demand for books and records — board minutes, materials, and, increasingly, officer-level communications — before filing. Delaware courts have repeatedly dismissed complaints filed without one for failure to plead particularized facts. Section 220 is the derivative plaintiff's substitute for the discovery the PSLRA denies him.

Exculpation, indemnification, and insurance. DGCL § 102(b)(7) charter provisions exculpate directors (and, since a 2022 amendment, certain officers, with limits) from monetary liability for duty of care breaches — but never for duty of loyalty, bad faith, or improper personal benefit, and not from federal securities claims. DGCL § 145 permits and sometimes mandates indemnification and advancement.

That leaves the D&O tower, which is where these cases actually get paid:

  • Side A — direct coverage for individuals where the company cannot indemnify (insolvency; derivative settlements, which are generally non-indemnifiable).
  • Side B — reimbursement of the company for indemnification it provides.
  • Side C — entity coverage for the company's own securities claims liability.

A caution before the exclusions: insurance coverage law is state law, and there is no national D&O rule. Whether an exclusion is enforced, how ambiguity is construed against the drafter, whether "final adjudication" means a judgment after trial or something less, whether defense costs erode limits, whether late notice forfeits coverage absent prejudice, and whether disgorgement or a "restitutionary" payment is insurable as a matter of public policy — all of these are answered differently in different states, and the policy's choice-of-law and arbitration provisions can decide the case before the merits are reached. New York, Delaware, and California law diverge on several of these points. Identify the governing state's law first; treat what follows as the shape of the fight, not the outcome.

The recurring coverage fights: the conduct exclusions (fraud/personal profit, typically requiring a final adjudication), the insured-vs-insured exclusion and its derivative carve-back, allocation between covered and uncovered claims, rescission for misstatements in the insurance application (which is why the application should never be signed by someone who is about to be a defendant), erosion of limits by defense costs, and notice under a claims-made policy — where late notice can forfeit the whole tower. The doctrine, exclusion by exclusion, is in Insurance Coverage Law: A Comprehensive Guide for Policyholders.

Vantage. A § 220 demand yields board minutes showing the Audit Committee was briefed on the FDA deficiency letter — before the earnings call. That single fact converts a weak Caremark claim into a red-flags claim, excuses demand as to the three directors on that committee, and moves the derivative case from nuisance to leverage. The derivative settlement will be governance reforms plus a Side A payment; the class settlement will be Side C plus company cash. The fiduciary framework behind all of it is in Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers.

Pillar 11 — Compliance programs that prevent the cycle

Every dollar in this toolkit was spent because a control failed. The controls that actually prevent securities litigation are unglamorous and cheap relative to the alternative:

  • Disclosure controls and procedures (Exchange Act Rule 13a-15) and a real disclosure committee that reads the risk factors against current reality every quarter — including the question nobody wants to ask: has any risk we describe as hypothetical already happened?
  • Earnings call discipline. Scripted remarks reviewed by counsel; a Q&A prep book; a rule that no one answers a question about an unannounced regulatory matter.
  • An insider trading policy with blackout windows, pre-clearance, a designated compliance officer, and 10b5-1 plans adopted only in open windows with the full statutory cooling-off period observed.
  • Reg FD training for everyone who speaks to analysts or holds investor one-on-ones.
  • A whistleblower channel that works, is publicized, and is not routed through the person most likely to be the subject of the report — plus an ironclad no-retaliation rule.
  • Board minutes that show the board actually looked. In a Caremark case, the minutes are the defense. See Board Governance, Minutes, and Corporate Formalities: A Practical Checklist.
  • A rehearsed internal investigation protocol — privilege, Upjohn warnings, a litigation hold issued within hours, and a pre-identified outside firm reporting to a committee of independent directors rather than to the general counsel.

Program design, testing, and escalation live in The Corporate Compliance Toolkit.

The landscape as a working checklist

Gate 1 — Disclosure hygiene (before anything happens)

  • [ ] Risk factors re-read each quarter against actual events; no "may occur" language for events that already occurred.
  • [ ] MD&A tested for known trends and uncertainties management has actually identified.
  • [ ] Disclosure committee minutes exist and reflect real deliberation.
  • [ ] Insider trading policy current; 10b5-1 plans adopted in-window with the full cooling-off period; Item 408 disclosure prepared.
  • [ ] Reg FD training completed by everyone who talks to the market.

Gate 2 — The event (stock drop, short report, restatement, whistleblower)

  • [ ] Litigation hold issued immediately; auto-deletion suspended; personal devices and ephemeral messaging addressed.
  • [ ] Internal investigation scoped, privileged, and reporting to independent directors.
  • [ ] Disclosure obligations re-run: does the company now have a duty to correct or update, and what does the 8-K say?
  • [ ] Insurance notice given under every applicable policy and layer — do not wait for a complaint.

Gate 3 — The private class action

  • [ ] Identify every alleged misstatement and its speaker (Janus "maker"; Lorenzo disseminator).
  • [ ] PSLRA safe harbor: was the statement forward-looking and accompanied by meaningful, tailored cautionary language?
  • [ ] Scienter: run the Tellabs balance — and confront the insider-sale pattern honestly.
  • [ ] Loss causation: what exactly was corrected, and what did the market do that day (Dura)?
  • [ ] Move to dismiss and hold the discovery stay.
  • [ ] At certification, build the price-impact record early (Halliburton II; Goldman Sachs).

Gate 4 — Registration-statement claims

  • [ ] Any offering in the class period? Section 11 track opens against signers, directors, and underwriters.
  • [ ] Traceability: can these plaintiffs trace their shares (Slack)?
  • [ ] Due diligence file: does it show a reasonable investigation, not a reliance-on-management memo?
  • [ ] Opinion statements analyzed under Omnicare — including the omitted-basis prong.
  • [ ] Forum: Cyan state-court exposure; does the charter have a federal-forum provision?

Gate 5 — Government

  • [ ] Formal order? Preserve everything; assume every document is produced.
  • [ ] Separate counsel for individuals before the first interview.
  • [ ] Wells submission drafted with the parallel criminal case fully in mind.
  • [ ] Remedies modeled: penalties (current inflation-adjusted tiers), disgorgement of net profits (Liu), O&D bars.
  • [ ] Post-Jarkesy: expect a contested fraud-penalty case in federal district court, with a jury.

Gate 6 — Board and coverage

  • [ ] Anticipate the § 220 books-and-records demand; the minutes are the case.
  • [ ] Assess Caremark exposure on the red-flags prong, not just the no-system prong.
  • [ ] Confirm the state of incorporation — Delaware answers do not travel automatically.
  • [ ] Map the D&O tower: Side A / B / C, exclusions, allocation, erosion, notice — and identify which state's insurance law governs the policy before predicting any coverage outcome.
  • [ ] Model the SOX § 304 and Rule 10D-1 clawbacks against executive compensation.
  • [ ] Sequence the class, derivative, and government resolutions so no settlement forecloses coverage for another.

Primary Authority

Statutes and rules

Cases

A currency warning. Several things in this area move, and a remembered number is a malpractice risk:

  • SEC civil penalty amounts are adjusted for inflation annually — always pull the current table, never a figure from a treatise or from memory.
  • Rule 10b5-1 cooling-off periods and disclosure conditions were amended in 2022 and remain under review; confirm the current rule text before advising on a plan.
  • The SEC's disgorgement authority now rests on post-Kokesh statutory text rather than on the equitable cases alone; read the current § 21(d).
  • Form 8-K Item 1.05 (cybersecurity) and the Reg S-K Item 408 disclosure requirements are recent and actively being interpreted by staff guidance.
  • Where a securities matter touches an adjacent regulatory regime, that regime's numbers move even faster than its doctrine. HSR merger-notification thresholds and filing fees are revised annually; tariff rates and trade-remedy duty margins change with each proceeding and executive action; and OFAC sanctions lists and the BIS Entity List are updated continuously. Never state one of those figures from memory in a disclosure document, a diligence memo, or a risk factor — re-verify the current published value on the day you rely on it. For the frameworks behind them, see The Antitrust and Competition Toolkit and The International Trade and Sanctions Toolkit.
  • Administrative-law currency. Do not rely on any source describing Chevron deference as good law. Chevron was overruled by Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024); courts now decide questions of statutory meaning de novo, giving an agency's interpretation only Skidmore-style respect to the extent it has the power to persuade. Together with SEC v. Jarkesy and Corner Post, that materially changes how an SEC rule or enforcement theory can be attacked.

Secondary Sources

  • Loss, Seligman & Paredes, Securities Regulation — the standard treatise
  • Bromberg & Lowenfels on Securities Fraud
  • Wright & Miller, Federal Practice and Procedure (Rule 23, Rule 23.1)
  • ALI Principles of Corporate Governance; Restatement (Third) of Agency (for attribution and scienter imputation)
  • Cornerstone Research / NERA annual securities class action filings and settlements studies — the empirical baseline for settlement modeling

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This toolkit is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Securities law changes frequently — penalty amounts, rule conditions, and controlling case law all move — and state corporate law varies; verify current requirements and consult qualified counsel before acting.