United States: SEC Adopts Final Rules Implementing Section 307 of the Sarbanes-Oxley Act of 2002, Relating to Standards of Professional Conduct for Attorneys, and Revises Proposed Rules Relating to "Noisy Withdrawal" by Attorneys

Co-authored by Ashley Wakefield and Amy Goodman

The Securities and Exchange Commission ("SEC") recently adopted final rules implementing Section 307 of the Sarbanes-Oxley Act of 2002 (the "S-O Act"), which required the SEC to issue rules setting forth minimum standards of professional conduct for attorneys appearing and practicing before the SEC in the representation of issuers. The release containing the rules appears at http://www.sec.gov/rules/final/33-8185.htm. The final rules include a rule requiring attorneys to report evidence of misconduct up-the-ladder to an issuer's chief executive officer, chief legal officer and board of directors. In addition, the rules:

• permit issuers to create a "Qualified Legal Compliance Committee" as an alternative procedure for reporting evidence of misconduct;
• set forth circumstances under which an attorney may disclose confidential information to the SEC without the consent of the issuer-client;
• create a safe harbor from private liability for violations of the rules; and
• provide a transition period (180 days) for compliance with the rules.

At the same time it adopted the final rules, the SEC revised, and extended the comment period for, its proposed rules relating to "noisy withdrawal" by attorneys. The release containing the proposed rules appears at http://www.sec.gov/rules/proposed/33-8186.htm. As initially proposed, the "noisy withdrawal" rules would require attorneys to withdraw and report their withdrawal to the SEC if the issuer's board failed to respond appropriately to evidence of misconduct. In response to comments, the SEC modified the proposed rules to provide an alternative approach under which the issuer (not the attorney) would be required to disclose a notification by one of its attorneys of his or her withdrawal or failure to receive an appropriate response.

The final and proposed rules raise a number of significant issues, many of which are highlighted in the discussion below. As always, the SEC will be guided in adopting final "noisy withdrawal" rules by comments it receives in response to the proposed rules. Comments must be received by the SEC on or before April 7, 2003.

The final rules are set forth in new Part 205 of Title 17, Chapter II of the Code of Federal Regulations. They require attorneys "appearing and practicing" before the SEC in the representation of issuers to report evidence of a material violation of law or breach of fiduciary duty by the issuer or its agent up-the-ladder to the chief legal counsel ("CLO") or to both the CLO and the chief executive officer ("CEO"). If the CLO or CEO fails to provide an "appropriate response" to the evidence, the attorney must report the evidence to the audit committee, another independent committee, or the full board of directors.

As set forth in Section 205.1, the rules supplement standards of professional conduct maintained by states and other jurisdictions and are not meant to limit states from imposing additional obligations not inconsistent with the rules. Where state standards conflict with the rules, however, the rules will govern. Preemption of state standards is most likely to arise with respect to disclosure of confidential client information, as discussed below.

The rules apply to attorneys appearing and practicing before the SEC in the representation of issuers. The term "appearing and practicing" is defined in Section 205.2(a)(1) to include:

• transacting any business with the SEC, including communications in any form;
• representing an issuer in SEC administrative proceedings or in connection with any SEC investigation, inquiry, information request or subpoena;
• providing advice with respect to the federal securities laws or SEC rules thereunder regarding any document that the attorney has notice will be filed with or submitted to the SEC; and
• advising an issuer as to whether information or a statement, opinion or other writing is required to be filed with or submitted to the SEC.

Section 205.2(a)(2) explicitly provides that the rules will not apply to an attorney who engages in the above activities other than in the context of providing legal services to an issuer with whom the attorney has an attorney-client relationship. Thus, attorneys at public broker-dealers and other issuers who are licensed to practice law and who may transact business with the SEC, but who are not in the legal department and do not provide legal services within the context of an attorney-client relationship, are not covered by the rules. The adopting release emphasizes, however, that attorneys need not serve in an issuer's legal department to be covered if they are providing legal services within the context of an attorney-client relationship.

The rules also will not apply to non-appearing foreign attorneys. The term "non-appearing foreign attorney" is defined in Section 205.2(j) as an attorney who: (1) is admitted to practice law in a jurisdiction outside the United States; (2) does not hold himself or herself out as practicing, or giving legal advice regarding, U.S. federal or state law; and (3) conducts activities that would constitute appearing and practicing before the SEC only incidentally to a foreign law practice or in consultation with U.S. counsel. A foreign attorney must satisfy all three parts of the definition to be excluded from the rules. The rules also contain a provision, in Section 205.6(d), stating that an attorney practicing outside the United States will not be required to comply with the rules to the extent that compliance is prohibited by applicable foreign law.

Under Section 205.3(b)(5), an attorney who is retained or directed by an issuer to investigate evidence of a material violation will be deemed to be "appearing and practicing" before the SEC. Sections 205.3(b)(6) and (7) have been modified, however, to relieve attorneys retained or directed to investigate or litigate reports of violations from reporting up-the-ladder under certain circumstances. Specifically, Section 205.3(b)(6) provides that an attorney retained by the CLO to investigate evidence of a material violation will not be obligated to report that evidence up-the-ladder if: (1) the attorney reports the results of the investigation to the CLO, and the CLO reports the results to the board, an independent board committee or the QLCC; or (2) the attorney was retained or directed to assert a colorable defense on behalf of the issuer or the issuer's agent in any investigation or judicial or administrative proceeding relating to the evidence, and the CLO reports the progress and outcome of the proceeding to the board, an independent board committee or the QLCC. Section 205.3(b)(7) provides that an attorney retained by a QLCC will not have an obligation to report evidence of a material violation up-the-ladder if the attorney was retained: (1) to investigate such evidence; or (2) to assert a colorable defense on behalf of the issuer or the issuer's agent in any investigation or judicial or administrative proceeding relating to the evidence.

The rules set forth an objective standard for what types of evidence will trigger an attorney's reporting obligations. Under Section 205.2(e), these obligations will be triggered only if the attorney has "credible evidence" based upon which it would be unreasonable for a prudent and competent attorney not to conclude that it is "reasonably likely" that a material violation has occurred, is occurring, or is about to occur. The adopting release indicates that to be "reasonably likely," a material violation must be more than a mere possibility but need not be "more likely than not."

The term "material violation" is defined in Section 205.2(i) to include a material violation of U.S. federal or state securities law, a material breach of fiduciary duty, or a similar material violation of any U.S. federal or state law. The term "breach of fiduciary duty" refers to any breach of fiduciary or similar duty recognized under an applicable U.S. federal or state statute or at common law, including misfeasance, nonfeasance, abdication of duty, abuse of trust, and approval of unlawful transactions.

Upon receiving evidence of a material violation, the CLO must initiate an appropriate inquiry into the evidence to determine whether the alleged violation has occurred, is occurring, or is about to occur. If the CLO determines that no material violation exists, he or she must notify the reporting attorney and advise him or her of the basis for such determination. Unless the CLO reasonably believes that no material violation exists, however, he or she must take "all reasonable steps" to cause the issuer to adopt an appropriate response, and must advise the reporting attorney of the response.

In lieu of initiating such an inquiry, the CLO may refer a report of evidence to the QLCC (discussed below), but only if the issuer has established the QLCC prior to the report.

As noted above, an attorney who does not receive an "appropriate response" from the CEO or CLO after reporting evidence of misconduct will be required to report the evidence to the issuer's audit committee, another board committee consisting solely of directors who are not employed by the issuer, or the full board of directors (if the board has no committee consisting solely of directors who are not employed by the issuer). Section 205.2(b) provides that an "appropriate response" is one that leads the reporting attorney to reasonably believe:

• that no material violation has occurred, is occurring, or is about to occur;
• that the issuer has adopted appropriate remedial measures to stop ongoing violations, prevent future violations, and remedy or otherwise address past violations; or
• that the issuer (with the consent of the board, an independent board committee or the QLCC) has retained or directed an attorney to review the reported evidence and either (i) has substantially implemented any remedial recommendations made by such attorney, or (ii) has been advised that such attorney may assert a colorable defense on behalf of the issuer or its agent in any investigation or proceeding relating to the reported evidence.

The adopting release states that the circumstances a reporting attorney might weigh in assessing whether he or she could "reasonably believe" that an issuer's response was appropriate would include the amount and weight of evidence of a material violation, the severity of the apparent material violation, and the scope of the investigation into the report.

The rules authorize an issuer to create a Qualified Legal Compliance Committee ("QLCC") as an alternative procedure for reporting evidence of material violations. This alternative procedure permits, but does not require, an attorney to report evidence of a material violation directly to a QLCC, if the issuer has previously formed such a committee. Under Section 205.3(c), an attorney who reports evidence to a QLCC will be deemed to have satisfied his or her reporting obligations and will not be required to assess the issuer's response to the evidence.

As defined in Section 205.2(k), the QLCC may be a separate committee of the issuer's board of directors, or it may be an audit or other standing committee of the board. In any event, the QLCC must consist of at least one member of the issuer's audit committee and two or more additional directors who are not employed by the issuer and who are not, in the case of a registered investment company, "interested persons." The adopting release states that the SEC does not intend for service on a QLCC to increase the liability of any member of the board under state law.

The QLCC must adopt written procedures for the confidential receipt, retention and consideration of any report of evidence of a material violation. In addition, the QLCC must have the authority and responsibility:

• to inform the issuer's CLO and CEO of any report of evidence of a material violation;
• to determine whether an investigation is necessary and, if so, to (i) notify the audit committee or the full board, (ii) initiate an investigation, and (iii) retain additional expert personnel as the QLCC deems necessary;
• at the conclusion of any such investigation, to (i) recommend (by majority vote) that the issuer implement an appropriate response, and (ii) inform the CLO, CEO and board of the results of the investigation and the appropriate remedial measures to be adopted; and
• acting by majority vote, to take "all other appropriate action."

The adopting release clarifies that although the QLCC must have the authority and responsibility to recommend that an issuer implement an appropriate response, the QLCC is not required to direct the board or the issuer to take action. Under Section 205.2(k)(4), however, the QLCC must have the authority to notify the SEC if the issuer fails to implement an appropriate response that the QLCC has recommended.

Proposed documentation requirements, which would have imposed mandatory record-keeping obligations upon issuers and attorneys, were eliminated from the final rules. As the adopting release indicates, however, the SEC believes that voluntary documentation of attorney reports and issuer responses may be appropriate in many cases.

Section 205.3(a) provides that an attorney appearing and practicing before the SEC in the representation of an issuer owes his or her professional and ethical duties to the issuer as an organization, not to the issuer's individual officers, directors or employees. The reference in the proposed rules to an attorney having a duty to act in the "best interests" of the issuer and its shareholders was not included in the final rules.

An attorney who has reported evidence of a material violation may use that report (and any response to the report) in connection with any investigation, proceeding or litigation in which the attorney's compliance with the rules is at issue. In addition, Section 205.3(d)(2) provides that an attorney may, without the issuer's consent, reveal to the SEC confidential information related to the representation to the extent that the attorney reasonably believes necessary:

• to prevent the issuer from committing a material violation that is likely to cause substantial injury to the financial interests or property of the issuer or investors;
• to prevent the issuer, in an SEC investigation or administrative proceeding, from committing perjury or another illegal act that is likely to perpetrate a fraud on the SEC; or
• to rectify the consequences of a material violation by the issuer that caused, or may cause, substantial injury to the financial interests or property of the issuer or investors, in furtherance of which the attorney's services were used.

As noted above, the rules are not intended to restrict states from imposing higher obligations not inconsistent with the rules. To the extent that state standards conflict with the rules, however, Section 205.1 provides that the rules will govern. This is particularly significant in jurisdictions, such as the District of Columbia, that bar the disclosure of information permitted to be disclosed under the SEC rules.

Under Section 205.4, a "supervisory attorney" (including a CLO) must make reasonable efforts to ensure that any subordinate attorney whose actions are supervised or directed by the supervisory attorney conforms to the rules. To the extent that a subordinate attorney appears and practices before the SEC in the representation of an issuer, that attorney's supervisory attorneys also appear and practice before the SEC. Furthermore, a supervisory attorney is responsible for complying with the rules' reporting requirements when a subordinate attorney has reported to the supervisory attorney evidence of a material violation.

A "subordinate attorney" will be deemed to have complied with the reporting requirements if the subordinate attorney reports to his or her supervisory attorney evidence of a material violation of which the subordinate attorney has become aware. The rules provide, however, that an attorney who appears and practices before the SEC under the direct supervision of a CLO is not considered a subordinate attorney and therefore must comply with the reporting requirements.

The rules provide that an attorney who violates the rules will be subject to all civil penalties and remedies available to the SEC under the federal securities laws.

The rules provide a safe harbor to protect attorneys, law firms and issuers from private liability for violations of the rules. Section 205.7 states that the rules are not intended to, and do not, create a private right of action based upon compliance or non-compliance with rule provisions.

Attorneys and issuers will be required to comply with the rules beginning on August 5, 2003. The rules may be modified during the transition period in accordance with the proposed rules discussed below.

In its release proposing "noisy withdrawal" and other rules (discussed below), the SEC is soliciting additional comments on the final rules. In particular, the SEC seeks comments on whether any aspect of the final rules should be revised if the proposed rules are adopted.

The SEC initially proposed to include "noisy withdrawal" provisions in its rules implementing Section 307. These provisions, which would require an attorney to withdraw and report his or her withdrawal to the SEC under certain circumstances, were not adopted as part of the final rules discussed above. Instead, the SEC decided to defer final action on the "noisy withdrawal" provisions, revise the proposed rules to provide an alternative reporting-out approach, and extend the comment period for an additional 60 days.

The proposed rules prescribe actions to be taken by an attorney who has not received an appropriate response to his or her report of a material violation. Specifically, proposed Section 205.3(d)(1) provides that where an attorney who has reported evidence of a material violation to the board does not receive an appropriate response in a reasonable time, and the attorney reasonably believes that a material violation is occurring or about to occur and is likely to result in substantial injury to the financial interests or property of the issuer or investors:

• An outside attorney must (i) withdraw from representing the issuer, indicating that the withdrawal is based on professional considerations, (ii) within one business day, notify the SEC in writing of the withdrawal, and (iii) promptly disaffirm to the SEC any document (or the like) filed with or submitted to the SEC that the attorney prepared or assisted in preparing and that the attorney reasonably believes is or may be materially false or misleading.
  An in-house attorney must (i) within one business day, notify the SEC in writing that he or she intends to disaffirm a document (or the like) filed with or submitted to the SEC that the attorney prepared or assisted in preparing and that the attorney reasonably believes is or may be materially false or misleading, and (ii) promptly disaffirm to the SEC any such document.

For material violations that already have occurred and are likely to have resulted in substantial injury to the financial interests or property of the issuer or investors:

• An outside attorney who has not received an appropriate response from the board may (i) withdraw, indicating that the withdrawal is based on professional considerations, (ii) notify the SEC in writing of the withdrawal, and (iii) disaffirm to the SEC any document (or the like) filed with or submitted to the SEC that the attorney prepared or assisted in preparing and that the attorney reasonably believes is or may be materially false or misleading.
• An in-house attorney who has not received an appropriate response from the board may (i) notify the SEC in writing that he or she intends to disaffirm a document (or the like) filed with or submitted to the SEC that the attorney prepared or assisted in preparing and that the attorney reasonably believes is or may be materially false or misleading, and (ii) disaffirm to the SEC any such document.

An issuer's CLO would be required to inform any attorney retained or employed to replace a withdrawing attorney that the previous attorney's withdrawal was based on professional considerations.

The proposed rules provide, in proposed Section 205.3(d)(3), that any notification to the SEC prescribed by the rules would not breach the attorney-client privilege. The SEC is inviting comments on any aspect of the proposal, including whether any reporting-out provision should be adopted, whether "noisy withdrawal" should be mandatory in some circumstances and permissive in others, and whether it is appropriate to distinguish between ongoing and past violations and between in-house and outside counsel. The SEC is particularly interested in learning how common it is for attorneys to alert their issuer-clients' management or board to evidence of violations but to receive either no response or an inappropriate response.

The proposed "noisy withdrawal" rules were heavily criticized by attorneys, issuers, bar associations and others during the SEC's initial comment period. In response to these criticisms, the SEC decided to extend the comment period and propose alternative reporting-out rules, which are designed to eliminate the ethical concerns raised by having attorneys report to the SEC. Under the alternative proposal, the issuer (not the attorney) would be required to disclose on Form 8-K, within two business days, a notification by one of its attorneys of his or her withdrawal for professional considerations (outside attorneys) or failure to receive an appropriate response to a report of a material violation (in-house attorneys).

The alternative proposal would eliminate the "noisy withdrawal" provisions and require attorney action only where the attorney reasonably concludes that there is substantial evidence that a material violation is occurring or about to occur and is likely to cause substantial injury to the financial interests or property of the issuer or investors. In such cases, where the attorney has not received an appropriate response from the board within a reasonable time:

• An outside attorney would be required to withdraw and notify the issuer in writing that the withdrawal is based on professional considerations.
• An in-house attorney would be required to "cease forthwith any participation or assistance" in any matter concerning the violation and notify the issuer in writing that he or she believes the issuer has not provided an appropriate response to the evidence.

As noted above, an issuer receiving notification under these provisions would be required to publicly disclose such notification, and the related circumstances, on Form 8-K within two business days.

The alternative proposal would require the issuer's CLO to notify any attorney retained or employed to replace an attorney who has given notice to an issuer that the previous attorney has withdrawn for professional considerations or ceased to participate or assist. In addition, the alternative proposal would permit an attorney, if the issuer did not comply with the reporting-out rules, to inform the SEC that he or she had provided the issuer with notice under the rules.

The SEC is soliciting comments on any aspect of the alternative proposal, including whether the required attorney determinations are appropriate, whether failing to apply mandatory withdrawal to past violations adequately protects investors, whether the alternative proposal is more compatible with existing state standards than the "noisy withdrawal" proposal, and whether investors and issuers will be adequately protected if the rules contain no reporting-out requirement. In addition, the SEC seeks comments on whether an issuer should be permitted not to disclose an attorney's notification where a committee of independent directors of the issuer's board determines, based on the advice of disinterested counsel: (1) that the attorney providing the notification acted unreasonably; or (2) that the issuer has, subsequent to such notification, implemented an appropriate response.

The final "up-the-ladder" reporting rules place potentially significant new burdens on issuers and their CEOs, CLOs and in-house attorneys. Companies should consider taking the following steps to facilitate compliance with the rules:

• Decide whether to establish a QLCC. Creating a QLCC takes the burden off of the CLO to investigate and respond to reports of potential material violations. It also relieves the reporting attorney of his or her obligation to assess the adequacy of the response and, potentially, to withdraw and report the withdrawal to the SEC. It puts a new burden, however, on the board members who are designated to serve on the QLCC. Many companies will be reluctant to further burden their directors in this way, and directors may not want to assume the responsibilities associated with serving on a QLCC. Keeping directors informed of material violations is good corporate governance; each company should consider whether a QLCC is the appropriate reporting mechanism for its board.
• Provide to all in-house attorneys a written summary of the new reporting obligations. Companies should prepare and distribute to all in-house attorneys a written summary of the reporting obligations set forth in Part 205. The summary should be updated if and when additional SEC rules are adopted, and companies should provide reminders of the reporting obligations on a periodic basis.
• Identify the in-house attorneys who may be covered by the rules. Companies should use the 180-day transition period to identify the in-house attorneys who may be viewed as "appearing and practicing" before the SEC. At a minimum, this list would include attorneys who are involved in drafting SEC reports and filings. Companies should be aware that this list may change from time to time. For example, environmental attorneys may become involved in preparing SEC disclosure material when an environmental problem develops, and thus may be viewed as appearing before the SEC in connection with that material. Companies also should recognize that attorneys who are not part of the legal department but who provide legal advice may be viewed as appearing before the SEC in some circumstances.
• Develop appropriate training programs. Once a company has determined which in-house attorneys will have reporting obligations, it should begin developing appropriate training programs for those attorneys. In addition, the CEO, CLO and board should be informed of their obligations to review and assess reports of potential material violations and to develop appropriate responses within a reasonable period of time.
• Consider adopting written procedures for the CLO and the board. Companies may want to develop written procedures for the CLO, the board and, where relevant, the QLCC to follow upon receiving a report of a material violation. These procedures might address, for example, the circumstances under which the CLO or the board would conduct an internal investigation and the circumstances under which the CLO or the board might consider hiring an outside attorney to review the report.
• Establish guidelines for subordinate and supervisory attorneys. Companies can give effect to the rules concerning subordinate and supervisory attorneys by developing procedures for the reporting of evidence by subordinate attorneys, and by informing supervisory attorneys of their additional oversight and reporting obligations.
• Consider sanctions. Companies should consider what the sanctions will be if an attorney fails to fulfill his or her reporting obligations, or if a CLO fails to respond appropriately to a report of a material violation.

Although the final rules permit disclosure of confidential information in certain circumstances, both in-house and law firm attorneys should recognize that ethical problems may arise if they make such disclosures. Some state bars have indicated that they do not believe the SEC has the authority to preempt their rules governing the attorney-client privilege and protection of client confidences.

The compliance burdens imposed by the new rules, as well as potential ethical problems, will be impacted significantly by what the SEC decides to do regarding the proposed "noisy withdrawal" rules. Requiring the company (rather than the attorney) to report a withdrawal, as contemplated by the alternative proposal, would mitigate to some degree the ethical problems associated with noisy withdrawal. Even requiring the company to make the report, however, could have a chilling effect on attorney-client communications.

• Submit comments on the proposed rules. We strongly encourage companies to submit comments on the proposed "noisy withdrawal" rules and the alternative proposal. As noted above, the comment period expires on April 7, 2003. Gibson, Dunn & Crutcher attorneys are working with a number of our clients to prepare comment letters and are available for consultation if you wish to respond to the SEC's request for comments. Comments on the proposals should be submitted in triplicate to: