On March 12, 2018, the Securities and Exchange Commission (the “SEC”) issued a cease-and-desist order[1] against Credit Karma, Inc. (“Karma”) for failure to comply with the disclosure requirements of Rule 701 promulgated under the Securities Act of 1933 (the “Securities Act”). The enforcement action is notable in that it highlights the SEC’s continued focus on issuers’ compliance with the disclosure requirements of Rule 701(e).

Rule 701 provides an exemption from the registration requirements of Section 5 of the Securities Act and, in particular, permits companies that are not registered under the Securities Exchange Act of 1934 (the “Exchange Act”) to grant stock-based compensation (e.g., in the form of stock options or restricted stock units) to their employees and certain other enumerated persons without incurring the burden of public registration and reporting, provided that the relevant disclosure requirements of Rule 701 are complied with. Specifically, Rule 701(e) requires an issuer granting more than $5 million in securities over a 12-month period to deliver financial statements and risk factors disclosure, at a reasonable period prior to the time of the sale.

Karma, a private internet-based financial technology company, had been providing equity grants in the form of stock options to its employees since 2011. The SEC enforcement action concerned stock options issued by Karma to its employees in reliance on Rule 701 in the period from October 1, 2014 to September 30, 2015. The stock options granted during that period amounted to approximately $13.8 million, triggering the relevant Rule 701(e) disclosure obligations. According to the SEC, Karma executives continued to grant employees stock options and to permit the exercise of any vested stock options without providing the required financial information and risk factors disclosure, although such information was available. Specifically, the SEC found that in the summer of 2015 Karma had given a group of institutional investors access “to a virtual data room that contained certain audited and unaudited financial statements, as well as risk disclosure documents, such as material agreements and information regarding intellectual property, securities issuances, and disputes and litigation.” No such information was made available to employees who received the stock option grants. Karma had maintained that it did not provide the financial information to its employees because the information was highly confidential and proprietary.

The SEC concluded that in the period from October 1, 2014 to September 30, 2015, Karma violated Sections 5(a) and 5(c) of the Securities Act when it granted the stock options to its employees without having filed a registration statement and without being in a position to avail itself of another exemption from registration, as reliance on the Rule 701 exemption was improper.

While the SEC did not address, in its order, Karma’s position regarding the confidential and proprietary nature of the financial information that it had failed to disclose to its employees, the SEC and its staff have addressed the challenges faced by private companies exceeding the Rule 701(e) threshold. In the 1999 release adopting amendments to Rule 701, the SEC noted that “[p]rivate issuers can use certain mechanisms, such as confidentiality agreements, to protect competitive information . . . .”[2] In November 2017, the SEC staff published Compliance & Disclosure Interpretation 271.25, which noted concerns about potential disclosure of sensitive company information and set out certain parameters for delivery of the required information that would be consistent with Rule 701(e).[3]

This enforcement action is a useful reminder to domestic and non-U.S. companies without Exchange Act registration that full compliance with all the applicable requirements of the Rule 701 exemption is crucial to ensure the availability of the exemption. At a time when there are growing numbers of mature, privately held companies with valuations over $1 billion (so-called “unicorns”) that opt to remain private longer (and thereby extend the time before an initial public offering during which Rule 701 must be relied upon), the SEC remains vigilant and continues to scrutinize companies, in particular pre-IPO companies that may not have the same internal controls and governance systems as public companies, to ensure that the Rule 701(e) disclosure requirements are complied with.