SEC Issues Proposed Regulations Governing Lawyers Under Sarbanes-Oxley

December 4, 2002

Although McGuireWoods’s Privilege Points e-mail alert service try to provide very succinct (limited to three paragraphs) tips about new privilege and work product matters, the SEC’s recent issuance of proposed regulations of lawyers under Sarbanes-Oxley justifies a one-week exception.

Attached is a summary of the proposed regulations that McGuireWoods may already have circulated to some of you.

From an attorney-client privilege and work product standpoint, the most interesting part of the proposed regulations are the provisions purporting to avoid waiver of the protections based on lawyers’ disclosure of information to the SEC. It is difficult to understand how the SEC can give such assurances, in the face of state law (and some federal law) to the contrary. It will be interesting to see what commentators say about these provisions and whether courts ultimately hold that these new provisions somehow “trump” existing privilege and work product waiver principles under state and federal law.

As required by Section 307 of the Sarbanes-Oxley Act, the SEC has issued proposed rules for lawyers who appear or practice before the Commission—Securities Act Release No. 33-8150. The rules will be set forth in a new Part 205, “Standards of Professional Conduct for Attorneys Appearing and Practicing before the Commission in the Representation of an Issuer.” The SEC is soliciting comments by December 18, 2002 and must issue final rules by January 26, 2003.

This brief report highlights the most important parts of the proposed Rules.

  • The proposed rules broadly cover U.S. and foreign lawyers involved in preparing filings or submissions to the SEC, or advising clients that filings need not be made.
  • In-house or outside lawyers must report to the issuer’s chief legal officer (“CLO”) any “evidence” of a material violation of federal or state securities laws or a material breach of fiduciary duty, or a similar material violation.
  • Issuers’ CLOs must investigate any reports (unless the issuer has established a “QLCC”—described below).
  • If the CLO does not make an “appropriate” response to the report, the lawyer must report further “up the ladder” to the audit committee or the board. All of this information must be documented.
  • If the board does not make an “appropriate” response: outside lawyers dealing with ongoing or future violations must make a “noisy” withdrawal from the representation; and inside lawyers must disaffirm any false filings but need not withdraw. Outside and in-house lawyers may (but are not required to) undertake such steps if the violation has already occurred and is not ongoing.
  • Issuers may establish a “qualified legal compliance committee” (“QLCC”) composed of independent directors, in which case the reporting lawyer can fulfill all of his or her obligations by reporting to the QLCC and allowing it to investigate and take any required remedial action (except, if the issuer fails in any material respect to take any remedial measures directed by the QLCC, then the CLO (and each member of the QLCC and the CEO) has whistle-blowing duties.
  • In-house or outside lawyers may reveal confidences to the SEC to prevent an issuer’s future crime that will cause substantial financial injury to others or to rectify past crimes that are not ongoing in which the lawyers’ services have been used.
  • Supervisory lawyers (CLOs or outside law firm partners) must ensure that subordinate lawyers comply with the rules (the SEC “expects” them to establish written internal procedures).
  • The rules provide for civil remedies but do not include criminal sanctions or private causes of action.
  • The rules contain some provisions that conflict with existing state ethics’ rules and attorney-client privilege principles. The SEC asserts that the rules will preempt existing conflicting state law, but this position may be challenged.
Scope of the Rules

The proposed rules would cover all in-house and outside lawyers (including foreign lawyers) who: (1) personally appear before the Commission; (2) help in any way with the preparation of any writing that the lawyer “has reason to believe” will be incorporated into any filing or submission to the Commission; or (3) advise anyone that a writing need not or should not be incorporated or filed.

“Up the Ladder” Reporting Requirement

The proposed rules would require that any lawyer (outside or in-house) covered by the rules report “evidence of a material violation” by the issuer, or any of its officers, directors, employees or agents (including underwriters) of any violation of federal or state securities laws, a breach of fiduciary duty, or a “similar” violation.

The lawyer must report the evidence “up the ladder” to the issuer’s chief legal officer (“CLO”), or to both the CLO and the chief executive officer (“CEO”). The reporting lawyer must document any report.

The disclosure obligation is any that would be triggered by evidence that would lead a lawyer reasonably to believe that a material violation has occurred, is occurring, or is about to occur. A lawyer covered by the rules must report evidence of such violations even if the lawyer is not involved in the matter.

The rules do not require the reporting lawyer to investigate. The rules are not intended to “inhibit the consultative process.” The Release provides the following examples of situations which would not require reporting “up the ladder”: (1) the lawyer discovers that the issuer controls special-purpose entities that do not qualify for the accounting treatment they have been given (because the incorrect accounting treatment by itself does not establish a “material violation” likely to result in “substantial injury” to the issuer); (2) an issuer plans to take some action that has been ruled illegal in other states where the issuer does not do business, even if the lawyer believes that a court in the states where the issuer does business might find the conduct illegal (because the action is “not clearly illegal”); and (3) an officer tells the lawyer that the issuer will engage in conduct that the lawyer believes is illegal (because the officer might reconsider, and the reporting obligation arises only if the lawyer is “sure” that the issuer will actually engage in the “illegal course of action”).

Chief Legal Officer’s Investigation Duty

Upon receipt of a lawyer’s report, a CLO (or the CEO, if there is no CLO) must investigate the report.

If the CLO reasonably believes after the investigation that no material violation has occurred, is occurring or is about to occur, the CLO must advise the reporting lawyer in writing. If the CLO finds a material violation, the CLO must take steps to correct and rectify it, and advise the reporting lawyer, the CEO and the audit committee or the full board.

In-house or outside lawyers assisting in such an investigation must themselves comply with the rules. The investigation and the results must be documented.

If the issuer fails to take remedial measures (including any remediation ordered by the CLO), the CLO must notify the Commission and disaffirm in writing any documents the CLO reasonably believes are false or materially misleading.

Reporting Lawyers’ Additional “Up the Ladder” Disclosure Requirements

A reporting lawyer may have additional “up the ladder” reporting requirements if the CLO does not make an “appropriate response” to the lawyer’s report, or does not respond at all.

The proposed rules indicate that an “appropriate” response might be securing an opinion from a “reputable law firm” that there has been no violation. In contrast, an appropriate response does not include the CLO’s assurance to the reporting lawyer that the matter is “not cause for concern,” without providing any factual or legal support for such a conclusion. In addition, an “appropriate response” might fall short of the necessary rectification (the rules provide the example of past misconduct that has an “ongoing impact,” such as a false filing that investors may continue to rely upon.)

If the CLO does not make an “appropriate response,” the reporting lawyer must report the evidence to the issuer’s audit committee, another independent board committee, or the full board. The reporting lawyer may make such a direct report immediately if the lawyer believes it would be futile to initially report the evidence to the CLO or to the CEO.

Lawyers’ Possible Obligation to “Blow the Whistle” on the Client

A reporting lawyer may have an obligation to “blow the whistle” on the issuer—depending on the response of the audit committee or the full board.

A reporting lawyer receiving an “appropriate response” from the committee or the board need not take any further steps (as long as the lawyer has documented the report and the response).

The proposed rules provide guidance for what the Commission describes as “truly extraordinary” circumstances—if the issuer’s board does not make an “appropriate response,” or makes no response at all.

In those circumstances, the rules provide different guidance to outside and in-house lawyers—depending on whether the violation has occurred, is occurring, or has not yet occurred.


In-house lawyers must make the same disaffirmation, but need not withdraw.

In the case of past violations that are not ongoing but have resulted in such substantial injury, outside lawyers “may” withdraw, give notice to the Commission and disaffirm any materially false or misleading statements. Similarly, in-house lawyers “may” notify the Commission and disaffirm materially false or misleading statements.

Either outside or in-house lawyers who are fired after reporting evidence of a material violation, but before being required to report to the Commission, “may” notify the Commission and disaffirm any materially false or misleading statements.

The rules indicate that any notice to the Commission does not “breach” the attorney-client privilege.

Alternative Reporting Procedure—the “QLCC”

As an alternative to a reporting lawyer’s obligation to report “up the ladder” to the CLO or CEO, then to part or all of the board (and ultimately to the Commission), a reporting lawyer may instead report to what the new rules call a “qualified legal compliance committee” (“QLCC”). In addition, CLOs can refer any report to the QLCC instead of conducting investigations themselves.

A QLCC must consist of at least one member of the board’s audit committee and two or more independent members of the board. Issuers may establish QLCCs to: investigate any lawyers’ reports; inform the CLO, CEO, audit committee, or full board of the results; retain experts; and direct appropriate remedial measures (including all necessary disclosures). The QLCC must establish written procedures for its work.

If the issuer has established such a QLCC, a lawyer reporting to that body does not have to assess the issuer’s response, report to the full Commission, and make a “noisy withdrawal” in the case of an inappropriate response. In essence, the reporting lawyers fulfill all of their obligations by reporting to the QLCC.

If the issuer fails in any material respect to take remedial measures directed by the QLCC, each member of the QLCC, as well as the CLO and the CEO, is individually responsible for notifying the Commission and disaffirming any materially false or misleading documents.

Additional “Whistle-Blowing” at the Lawyer’s Discretion

The proposed rules allow lawyers to reveal client confidences to defend themselves.

In addition, lawyers governed by the rules “may” (but need not) reveal confidences to the Commission: (1) to prevent the issuer from committing an “illegal act that the attorney reasonably believes is likely to result in substantial injury to the financial interest or property of the issuer or investors”; (2) to prevent an illegal fraud upon the Commission; or (3) to rectify the consequences of the issuer’s illegal act in the furtherance of which the attorney’s services had been used.

The rules indicate that a lawyer exercising this discretion to disclose would not violate any state ethics rules otherwise prohibiting such disclosure. On the other hand, lawyers practicing in states that require such disclosure must comply with their states’ mandatory reporting requirements.

Any disclosures under this provision do not waive any privileges if made under a confidentiality agreement with the Commission.

Duties of Supervisory and Subordinate Lawyers

The proposed rules contain provisions governing supervisory and subordinate lawyers in law departments or outside law firms. The provisions generally follow the ABA Model Rules.

The proposed rules require all supervisory lawyers (defined as lawyers “directing or having supervisory authority” over other lawyers) to ensure that subordinate lawyers comply with the rules and with other applicable SEC regulations. Supervisory lawyers are responsible for complying with the reporting requirements set forth in the rules, and must document any conclusion that a reported violation does not require further reporting.

The proposed rules indicate that the Commission expects supervisory lawyers to establish written internal procedures for reporting evidence of material violations.

Subordinate lawyers must comply with the rules even if they are acting at the direction of another lawyer. However, they are not required to report their supervisor’s failure to comply with the reporting requirements. Instead, they “may” (but need not) report to the CLO, CEO, or the QLCC.


The proposed rules define “improper professional conduct” meriting sanctions as: (1) intentional or knowing (including reckless) conduct; and (2) negligent conduct (in the form of a single instance of highly unreasonable conduct or “repeated instances of unreasonable conduct”).

The proposed rules do not include criminal penalties, and do not create a private cause of action. Possible sanctions would include equitable relief, civil monetary penalties, cease-and-desist orders and bars against practicing before the SEC.