Why Compliance Officers Have Even More to Worry About

Finally, North should not be sanctioned for a typo-type mistake. One of North's arguments is that he  made "a single scrivener's error" because he used a template that did not contain a percentage or sample size number.

'Should Have Known' Liability

The court should find that FINRA did not prove its case. While the SEC's brief articulated the correct "should have known" precedent, it did not apply that standard.

• "Whatever knowledge inquiry would have produced"

The SEC stated that "should have known" liability "requires inquiry" and that "the law treats a person as possessing whatever knowledge inquiry would have produced."

In other words, red flags require follow-up, and people are assumed to have the knowledge they would have gained if they followed up. Thus, if that follow up would have yielded evidence of wrongdoing, then that knowledge is imputed.

Unfortunately, the SEC's brief didn't apply that standard. Instead it applied strict liability and concluded with no evidence that North's "failing to even question [the RR] about the agreement or the invoices," meant that he "failed to fulfill his [FINRA rule] obligation."  The SEC's conclusion is misplaced.

First, the SEC ignored the basic question: if North followed up, what would he have learned?  Instead, the SEC assumed that North would have learned that an SDP was associated with the firm. Without analyzing that question, the SEC used a strict liability approach, which is inconsistent with "should have known" liability.

Second, there is no evidence that North would have learned facts to allow him to notify FINRA about the issue. The Hearing Panel found that if North had investigated, he "likely would have learned" about the relationship. That falls short of the DC Circuit precedent cited by the SEC in its brief, which requires analyzing what "knowledge [the] inquiry would have produced."

The Hearing Panel applied the wrong standard and its findings are not supportable. North could have asked the RR about the agreement, but if he did, the RR likely would have continued to keep the relationship a secret. FINRA, in fact, charged the RR for her deception.

The RR benefited from keeping the arrangement a secret, earning substantial commissions from her relationship with the SDP. Given these facts, it was not reasonable to conclude that North "likely would have" learned about the relationship by questioning the RR.

In certain circumstances, if someone follows up on red flags, such as reading a flagged email, then that inquiry will lead to knowledge. But FINRA established only that North could possibly have learned about the relationship, and such a finding is insufficient to support a "should have known" charge.

In its brief, the SEC ignored these evidentiary gaps. The SEC asserted that if North had followed up, then he would have learned about the SDP, but the SEC did not explain how or present evidence to support its argument. Instead, the SEC concluded that North is strictly liable because he didn't follow up.

• "Do not intentionally avoid becoming aware"

The SEC also failed to consider the relevant standard of care. During the rulemaking process, someone asked whether the "should have known standard" was "too demanding." In response, the SEC stated, "[t]he purpose of the 'should have known' standard is to ensure that members do not intentionally avoid becoming aware of a reportable event."

Despite this standard, FINRA failed to present evidence that North "intentionally avoid[ed] becoming aware" of the relationship. To the contrary, the evidence shows that North did not act with bad intent. He reviewed the relevant documents, and did not see anything "illegal or immoral."

There is also no evidence that he received kickbacks from the RR or the SDP, or that he would have suffered repercussions if he had become aware of the relationship. Thus, under the proper standard of care, the DC Circuit should not find North liable.

FINRA brought, and the SEC sustained, troublesome charges against North. Considering the repercussions of enforcement actions against compliance officers, regulators must exercise great care and discretion before bringing such cases.

Here, the DC Circuit should articulate a clear standard for when a CCO is liable for procedural failures of her firm. In addition, it should reject a strict liability standard for "should have known" charges.  If the court denies North's petition, then compliance officers will be unable to do their jobs without fearing unintended consequences.

Brian Rubin is a partner with Eversheds Sutherland (US) LLP. Michelle McIntyre is an associate with the firm.