Amicus Curiae Brief — Facebook, Inc., et al., Petitioners v. Amalgamated Bank, et al.

NO. 23-980

In the Supreme Court of the United States

FACEBOOK, INC., ET AL,

Petitioners,

v.

AMALGAMATED BANK, ET AL.,

Respondents.

On Writ of Certiorari to the United States

Court of Appeals for the Ninth Circuit

BRIEF OF THE SOCIETY FOR CORPORATE

GOVERNANCE AS AMICUS CURIAE IN

SUPPORT OF PETITIONERS

PAUL F. WASHINGTON

RANDI VAL MORRISON

C. EDWARD ALLEN

SOCIETY FOR CORPORATE

GOVERNANCE

52 Vanderbilt Avenue

New York, NY 10017

JESSICA P. CORLEY

MATTHEW B. ROSENTHAL

KING & SPALDING LLP

1180 Peachtree Street, NE

Atlanta, GA 30309

CHRISTOPHER E. DUFFY

Counsel of Record

ALLAN S. BRADLEY

KING & SPALDING LLP

1185 Avenue of the

Americas

New York, NY 10036

(212) 556-2100

cduffy@kslaw.com

Counsel for Amicus Curiae

Society for Corporate Governance

August 2024

i

TABLE OF CONTENTS

Statement of Interest of Amicus Curiae .................... 1

Introduction and Summary of Argument ................. 3

Argument .................................................................... 5

I.

The Ninth Circuit’s Misreading of the

Implications of a Forward-Looking Risk

Factor Ignores the Plain Text of Regulation SK, Item 105, and Common Understanding. ...... 5

II.

Materialized Risks or Trends Will Be

Properly Disclosed in Other Sections of a

Form 10-K If Necessary. .................................. 12

A.

Management Discussion and Analysis

– Item 303 .............................................. 13

B.

Description of Business – Item 101 ...... 16

C.

Legal Proceedings—Item 103 ............... 18

D.

Cybersecurity – Item 106 ...................... 20

E.

The Ninth Circuit Decision Would

Muddy the Respective Purposes of the

Form 10-K Sections and Undermine

the Utility of the Risk Factors. ............. 23

Conclusion ................................................................. 26

ii

TABLE OF AUTHORITIES

Cases

Emps.’ Ret. Sys. of City of Baton Rouge & Par.

of E. Baton Rouge v. MacroGenics, Inc.,

61 F.4th 369 (4th Cir. 2023) .................................. 7

In re Mylan N.V. Sec. Litig.,

No. 16-cv-7926 (JPO), 2018 WL 1595985

(S.D.N.Y. Mar. 28, 2018) ..................................... 10

Silverstrand Invs. v. AMAG Pharms., Inc.,

707 F.3d 95, 103 (1st Cir. 2013) ............................ 7

Statutes and Regulations

15 U.S.C. § 78m .......................................................... 6

17 C.F.R. § 229.101 ................................................... 16

17 C.F.R. § 229.103 ................................................... 18

17 C.F.R. § 229.105 ................................................. 6, 7

17 C.F.R. § 229.106 ..............................................21, 22

17 C.F.R. § 229.303 ..............................................13, 14

Other Authorities

85 Fed. Reg. 63726 (Oct. 8, 2020) ........................23, 24

Abbott Laboratories Form 10-K (Feb. 16,

2024), https://tinyurl.com/Abbott2310-K .......11, 12

iii

Allstate Corporation Form 10-K (Feb. 16,

2023), https://tinyurl.com/Allstate2210-K .....15, 16

AT&T Inc. Form 10-K (Feb. 23, 2024),

https://tinyurl.com/ATT2310-K ............................. 9

Bath & Body Works, Inc. Form 10-K (Mar. 22,

2024), https://tinyurl.com/BBW2310-K .............. 20

Black’s Law Dictionary (12th ed. 2024) ................. 6, 7

Blood, Michael R., California insurance market

rattled by withdrawal of major companies,

Associated Press (June 5, 2023),

https://tinyurl.com/3c44wx5n .............................. 15

Chewy, Inc. Form 10-K (Mar. 20, 2024),

https://tinyurl.com/Chewy2310-K ......................... 8

Exxon Mobil Corporation Form 10-K (Feb. 28,

2024), https://tinyurl.com/Exxon2310-K ........19, 20

FedEx Corp. Form 10-K (July 15, 2024),

https://tinyurl.com/fedex2310-k .......................... 17

Hester M. Peirce, Outdated: Remarks before

the Digital Assets at Duke Conference (Jan.

20, 2023), https://tinyurl.com/5n8s47h8 ............. 24

Kingsley, Dean, et al., SEC Risk Factors

Disclosure Analysis, Harvard Law School

Forum on Corporate Governance (Dec. 3,

2023), https://tinyurl.com/yxubyfhj..................... 24

iv

Levine, Matt, Everything Everywhere is

Securities Fraud, Bloomberg (June 26,

2019), https://tinyurl.com/4e4cuae7 .................... 24

Merriam-Webster Dictionary, Risk,

https://tinyurl.com/5n7pbwf6 ................................ 6

Merriam-Webster Dictionary, Speculative,

https://tinyurl.com/2a8t6b67 ................................. 7

Securities & Exchange Comm’n, How to Read

a 10-K/10-Q (Jan. 25, 2021),

https://tinyurl.com/3s5fuhdy ..........................14, 17

Sunoco LP Form 10-K (Feb. 17, 2023)

https://tinyurl.com/Sunoco2310-K ........................ 9

Sunoco LP Form 10-K (Feb. 16, 2024),

https://tinyurl.com/Sunoco2410-K ...................... 22

Uyeda, Mark T., Remarks at the “SEC Speaks”

Conference 2022 (Sept. 9, 2022),

https://tinyurl.com/bd9sj4d8; .............................. 24

1

STATEMENT OF INTEREST

OF AMICUS CURIAE1

Founded in 1946, the Society for Corporate

Governance (“Society”) is a professional association of

more than 3,700 corporate and assistant secretaries,

in-house counsel, outside counsel, and other

governance professionals who serve more than 1,000

public and private companies and non-profit

organizations of almost every size and industry. The

Society’s members support the work of corporate

boards and executive management regarding

corporate governance and disclosure, compliance with

corporate and securities laws and regulations, and

adherence to stock-exchange listing requirements.

The Society’s mission is to support corporate

governance

professionals

through

education,

collaboration, and advocacy, with the ultimate goal of

creating long-term shareholder value through better

governance.

The Society’s members are often responsible for

preparing corporate disclosures and other outwardfacing statements on behalf of public companies,

including Forms 10-K and 10-Q, proxy statements,

and other disclosures required by the Securities and

Exchange Commission (“SEC”). The Society provides

1 No counsel for any party authored this brief in whole or in part,

and no entity or person, aside from amicus curiae and its counsel,

made any monetary contribution intended to fund the

preparation or submission of this brief.

2

information to its members concerning regulatory

developments and best practices in such filings.

The Society has a direct and substantial

interest in this case because its members are directly

involved with the preparation of the types of

disclosures and public statements that are at the

heart of this dispute. In the opinion below, the U.S.

Court of Appeals for the Ninth Circuit held that

Respondents adequately pleaded falsity because the

Risk Factors section of Petitioner’s 2016 Form 10-K

described a prospective risk using purely hypothetical

terms. See Pet. App. 23a. As the leading American

association of corporate secretaries and other

governance professionals, the Society is wellpositioned to explain the practical implications of the

opinion below.

This case presents important legal questions

regarding how companies should understand and

follow the requirements of Regulation S-K and how

best to provide investors with accurate, useful

disclosures of business risk. In this brief, the Society

focuses on the particular purposes served by different

sections of Form 10-K filings and the negative

consequences that will occur if the Ninth Circuit’s

ruling is allowed to blur and undermine the important

conceptual and practical distinctions between the

Risk Factors and other 10-K sections. This Court

should reverse the judgment of the court of appeals to

avoid diluting the utility of the Risk Factors section to

investors, and to prevent the imposition of

unnecessary burdens on public companies and those

who assist in preparing their securities filings.

3

INTRODUCTION AND

SUMMARY OF ARGUMENT

1. Regulation S-K calls for public company

registrants to disclose “material factors that make an

investment in the registrant or offering speculative or

risky.”

It also calls for registrants to do so

“[c]oncisely.” And it instructs them to do so under the

heading “Risk Factors”—emphasizing a focus on

potential future events that have not yet materialized.

Nothing in Regulation S-K suggests that a Risk

Factors discussion must mention every operational

and reputational hiccup that a company has ever

encountered. As Judge Bumatay’s dissent below

correctly put it, prior case law likewise “does not

require that a company disclose every bad thing that

ever happened to it” in a discussion of risk factors.

Pet. App. 46a. And this makes sense; risk evaluation

is a forward-looking project, and Regulation S-K does

not call for a recitation of past negative events. The

decision below, however, misinterprets Regulation SK in a manner that, unless reversed, will incentivize

registrants to disclose those past events under what

would become an ever-lengthening Risk Factors

section. Investors, in turn, will encounter a deluge of

irrelevant information when they turn to the Risk

Factors section of a Form 10-K or 10-Q, depriving

them of the utility that it was designed to have.

That is not how registrants have viewed Risk

Factor disclosures under Regulation S-K. As shown

by the examples cited below, the focus of Risk Factor

discussions by registrants across a variety of

industries has been on risks that might materialize in

4

the future, not examples of similar situations that

have happened in the past. A Risk Factor section that

does not discuss prior circumstances where a stated

risk factor has materialized does not imply anything

about the past. No reasonable investor would read it

that way.

2. Contrary to what Respondents might argue,

reversing the decision below would not shield all

negative internal events from the eyes of investors. A

variety of other sections of periodic reports are far

better suited for discussions of material past negative

events or existing trends, including Management

Discussion and Analysis (Item 303), Description of

Business (Item 101, usually headlined “Business”),

Legal Proceedings (Item 103), and Cybersecurity

(Item 106).2 Their presence in periodic reports, as

well as the broader mix of information available to

modern investors, makes it inconceivable that any

reasonable investor would construe a discussion of

future risk factors to mean anything one way or the

other about whether a particular risk had

materialized in the past. As Judge Bumatay’s

dissenting opinion concluded, “if a reasonable investor

thought so based on Facebook’s 10-K statements, that

‘reasonable’ investor wasn’t acting so reasonably.”

Pet. App. 44a–45a.

2

References herein to Item numbers are to the respective Items

under Regulation S-K.

5

ARGUMENT

I.

The Ninth Circuit’s Misreading of the

Implications of a Forward-Looking Risk

Factor Ignores the Plain Text of

Regulation S-K, Item 105, and Common

Understanding.

In Petitioner’s Form 10-K filing for fiscal year

2016, Petitioner stated as a “Risk Factor” that

“improper access to or disclosure of our data or user

data … could harm our reputation and adversely

affect our business.” J.A. 439. Respondents allege

that this statement was false because it implied that

Petitioner had never suffered any improper access or

disclosure of user data, when in fact Cambridge

Analytica had misused Facebook user data to assist

the Ted Cruz presidential campaign. See J.A. 281–

283. The Ninth Circuit accepted this theory. See Pet.

App. 23a.

Respondents assert that Facebook

committed securities fraud as a result of making this

prospective statement about possible risk.

The decision below held that Facebook could

not rely on the forward-looking nature of the relevant

Risk Factor to disclaim the implication that there

were no past events of data misuse. See Pet. App.

23a–26a.

Rather, the Ninth Circuit held that

“Facebook represented the risk of improper access to

or disclosure of Facebook user data as purely

hypothetical when that exact risk had already

transpired.” See Pet. App. 24a.

This decision

misunderstands the different sections of periodic SEC

filings and their prescribed purposes under

6

Regulation S-K. If left uncorrected, the decision will

undermine the utility of Risk Factor disclosures in

filings required by 15 U.S.C. § 78m. If hypothetical

statements about risks that may materialize in the

future must be read as factual assertions about past

events or known trends in the present, then

companies—and the Society members who assist

them with Form 10-Ks and other disclosures—may

feel compelled to add lengthy recitations of all past

events, material or otherwise, to avoid potential

liability. Doing so would substantially dilute the

value to investors of Risk Factor disclosures.

The Risk Factors section of a periodic filing is

not the place for a public company to state past events

or existing trends because, by definition, it is forwardlooking. Regulation S-K requires registrants to

“provide under the caption ‘Risk Factors’ a discussion

of the material factors that make an investment in the

registrant or offering speculative or risky.” 17 C.F.R.

§ 229.105 (“Item 105”) (emphasis added). Black’s Law

Dictionary defines “risk” to mean “the uncertainty of a

result, happening, or loss; the chance of injury,

damage, or loss; esp., the existence and extent of the

possibility of harm.” Risk, Black’s Law Dictionary

(12th ed. 2024) (emphases added). Merriam-Webster

defines “risk” to mean the “possibility of loss or

injury,” or “the chance that an investment (such as a

stock or commodity) will lose value.” Risk, MerriamWebster Dictionary, https://tinyurl.com/5n7pbwf6

(emphasis added). These definitions show that the

regulation is focused on uncertainty and possible

7

outcomes—potential future events which are not

currently known.

Item 105 also uses the word “speculative,”

which further orients the Risk Factor disclosures

toward risks that might affect shareholders’ future

returns, not merely any negative event that could

happen to a business. Black’s Law Dictionary defines

“speculation” to mean “the buying or selling of

something with the expectation of profiting from price

fluctuations.” Speculation, Black’s Law Dictionary

(12th ed. 2024). Merriam-Webster’s definitions for

“speculative” include “theoretical rather than

demonstrable” and “of, relating to, or being a financial

speculation.”

Speculative,

Merriam-Webster

Dictionary, https://tinyurl.com/2a8t6b67. Under this

language, risks are properly described under Item 105

only insofar as they may affect the future value of a

shareholder’s investment. See, e.g., Emps.’ Ret. Sys.

of City of Baton Rouge & Par. of E. Baton Rouge v.

MacroGenics, Inc., 61 F.4th 369, 393 (4th Cir. 2023)

(explaining that risk factors should inform investors

“‘how the risks may affect their investment’”

(emphasis added)) (quoting Silverstrand Invs. v.

AMAG Pharms., Inc., 707 F.3d 95, 103 (1st Cir. 2013)).

Not all negative business events impact the

value of a business’s shares. Every company faces

day-to-day setbacks that do not make an investment

in that company risky. Just so in this case: When

Facebook issued its 2016 Form 10-K, Cambridge

Analytica’s misuse of data had already become public

knowledge, without any negative impact on the stock

price. See Pet. at 7 (citing Dist. Ct. Dkt. 146-10, at 2-

8

4). Previous incidents like the Cambridge Analytica

episode would be out of place under the “Risk Factors”

heading whether or not they affected the stock price,

because Item 105 is prospective. The Ninth Circuit’s

approach lacks any support in the plain language of

Item 105, which focuses on future risks, which are

presently hypothetical. Item 105 does not require

registrants to parse the materiality of past events at

all. Worse still, the Ninth Circuit’s approach would

call for a discussion of all prior circumstances where a

risk factor materialized, even where it had no effect on

the stock price.

Public filings by other companies reflect the

widespread understanding that Item 105’s focus

should be on hypothetical future events. Companies

often describe risks that “could” or “may” occur and

damage the business in the future. For example:

•

“Reputational value is based in large part on

perceptions of subjective qualities, and even

isolated incidents may erode trust and

confidence and have adverse effects on our

business and financial results … . Our

brand could be adversely affected if our

public image or reputation were to be

tarnished by negative publicity.” Chewy,

Inc. Form 10-K at 13 (Mar. 20, 2024),

https://tinyurl.com/Chewy2310-K.

•

“The potential physical effects of climate

change, such as increased frequency and

severity of storms, floods, fires, freezing

conditions, sea-level rise and other climate-

9

related events, could adversely affect our

operations, infrastructure and financial

results. Operational impacts resulting from

the potential physical effects of climate

change, such as damage to our network

infrastructure, could result in increased

costs and loss of revenue.” AT&T Inc. Form

10-K,

at

9

(Feb.

23,

2024),

https://tinyurl.com/ATT2310-K.

•

“Our financial condition and results of

operations are influenced by changes in the

prices of motor fuel, which may adversely

impact our margins, our customers’

financial condition and the availability of

trade credit. … General economic and

political conditions, acts of war or terrorism

and instability in oil producing regions,

particularly in the Middle East, South

America,

Russia and Africa

could

significantly impact crude oil supplies and

refined product petroleum costs.” Sunoco

LP Form 10-K, at 14 (Feb. 17, 2023)

https://tinyurl.com/Sunoco2310-K.

In each of these examples, the company’s

hypothetical phrasing conforms to Item 105’s focus on

uncertainty and possibilities, rather than describing

past events or known, current trends.

Under Respondent’s theory, each of these

disclosures could be deemed misleading on the basis

of a supposed implication that the risk has never

materialized before.

Cert. Br. in Opp. at 11

10

(“[T]reating a materialized risk as merely

hypothetical misleadingly implies that the risk has

not yet transpired.”)]. But the “could” and “may”

phrasing is inherently forward-looking, which is

consistent with Item 105. It cannot reasonably be

read as implying that such risks have not transpired

in the past. Indeed, it would be nonsensical to read

these Risk Factors and conclude that Chewy had never

once experienced “negative publicity,” or that acts of

war by Russia had not ever influenced motor fuel

prices for Sunoco in 2022, or that AT&T’s operations

had never been affected by storms, floods, fires, or

other climate-related events. Any reasonable investor

presumes, for example, that a nationwide service

provider like AT&T experiences many climate-related

disruptions to its operations, and a complete recitation

of such events would be pointless, unreasonably

burdensome on AT&T, and unhelpful to investors.

Similarly, the very next risk factor in Facebook’s 2016

Form 10-K after its user data risk disclosure reads,

“Unfavorable media coverage could negatively affect

our business.” J.A. 441. No reasonable investor would

read this disclosure as a claim that Facebook had

never before suffered unfavorable media coverage.

Insofar as forward-looking Risk Factors could

be misleading as to past events or existing conditions,

this Court should allow such a reading only where the

risk disclosure implies a specific fact that is incorrect.

For example, “a caution that ‘the price of our primary

input may rise above $5 next quarter’ could certainly

cause a reasonable investor to conclude that the price

was, at present, $4.99 or less.” In re Mylan N.V. Sec.

11

Litig., No. 16-cv-7926 (JPO), 2018 WL 1595985, at *9–

10 (S.D.N.Y. Mar. 28, 2018). But such specificity is

not the norm, and the Court should not extend

liability outside this narrow exception. Otherwise,

litigants will continue to deliberately misread

companies’ statements concerning hypothetical future

risks to mean that such risks have never materialized

in the past, subverting the plain, forward-looking

focus of Item 105.

To be sure, some public companies—influenced

by the uncertainty arising from reasoning like that in

the decision below—have noted in their Risk Factor

discussions that an identified risk has previously

materialized and may continue to affect business.

While some companies may choose to include this

information, it is not (and should not be) required. As

one example, Abbott Laboratories stated: “Fluctuation

in foreign currency exchange rates has adversely

affected and may continue to adversely affect Abbott’s

financial statements and its ability to realize projected

sales and earnings.” Abbott Laboratories Form 10-K,

at 13 (Feb. 16, 2024), https://tinyurl.com/Abbott2310K. This phrasing—that a risk “has affected” the

company—precludes any claim that the company has

implied that the risk never materialized previously.

But such phrasing does not tell a reasonable investor

anything substantive about what happened in the

past. For that information, reasonable investors may

look elsewhere in the same Form 10-K, and see that

Abbott is exposed to shifting foreign currency rates,

the scale of Abbott’s exposure, and recent gains and

losses related to foreign currency forward exchange

12

contracts. See Abbott Laboratories Form 10-K, at 22,

39–41,

62–65

(Feb.

16,

2024),

https://tinyurl.com/Abbott2310-K.

Thus, the “has

affected” phrasing in Abbott’s Risk Factors discussion

is repetitive of later sections in the same 10-K.

Respondent’s theory of liability is thin indeed if it

could be remedied by such minor wordsmithing.

Instead of abandoning the plain language of

Regulation S-K, and the common understanding

among practitioners who are Society members, the

Court should reaffirm that Item 105 calls for

prospective disclosures. Hypothetical phrasing about

the future does not generally imply the absence of past

incidents, and, as discussed next, other sections of the

Form 10-K will disclose already-materialized risks as

necessary.

II.

Materialized Risks or Trends Will Be

Properly Disclosed in Other Sections of a

Form 10-K If Necessary.

In contrast to the Risk Factors under Item 105,

several other sections of the Form 10-K require

companies to describe the recent activities and

condition of the company, including materialized

risks. Four sections are worth understanding in

context and practice: Management Discussion and

Analysis (Item 303, “MD&A”), Description of Business

(Item 101, usually headlined, “Business”), Legal

Proceedings (Item 103), and Cybersecurity (Item 106).

Whereas Risk Factors reflect uncertainty, possibility,

and unknown outcomes in the future, Regulation S-K

directs these other sections of a Form 10-K to describe

13

what is known about recent events and existing trends

and practices. Given the substantive allocation these

Items provide between the hypothetical and the

factual, reasonable investors will not misread futurefocused Risk Factors to imply that a particular risk

has not previously materialized.

A.

Management

Discussion

Analysis – Item 303

and

Regulation S-K states that the “objective of the

[management] discussion and analysis is to provide

material information relevant to an assessment of the

financial condition and results of operations of the

registrant … .” 17 C.F.R. § 229.303(a) (Item 303). To

comply with the Regulation, “[t]he discussion and

analysis must focus specifically on material events

and uncertainties known to management that are

reasonably likely to cause reported financial

information not to be necessarily indicative of future

operating results or of future financial condition.” Id.

Although Item 303 calls for some evaluation of risk in

this section, the “focus” on events and uncertainties

already “known” to management distinguishes the

MD&A from the perspective of the Risk Factors. Id.

Required disclosures under Item 303 include:

•

“Identify any known trends or any known

demands,

commitments,

events

or

uncertainties that will result in or that are

reasonably likely to result in the registrant’s

liquidity increasing or decreasing in any

material way.” Id. § 229.303(b)(1)(i).

14

•

“Describe any unusual or infrequent events

or transactions or any significant economic

changes that materially affected the amount

of reported income from continuing

operations and, in each case, indicate the

extent to which income was so affected.” Id.

§ 229.303(b)(2)(i).

•

“Describe

any

known

trends

or

uncertainties that have had or that are

reasonably likely to have a material

favorable or unfavorable impact on net sales

or revenues or income from continuing

operations.” Id. § 229.303(b)(2)(ii).

The SEC advises that, in total, the MD&A “gives the

company’s perspective on the business results of the

past financial year.” Securities & Exchange Comm’n,

How to Read a 10-K/10-Q (Jan. 25, 2021),

https://tinyurl.com/3s5fuhdy.

In practice, events or trends in the MD&A often

include materialized risks that correspond to

prospective risks described in the Risk Factors

section. If they are material, then known trends and

events that are not included in the Risk Factors can

often be found in the MD&A. For example, Allstate’s

Form 10-K for fiscal year 2022 included the following

Risk Disclosure:

Losses from changing climate and weather

conditions may adversely affect our financial

condition, profitability or cash flows

15

Climate change affects the occurrence of

certain natural events, such as increasing

the frequency or severity of wind, tornado,

hailstorm and thunderstorm events due to

increased convection in the atmosphere.

There could also be more frequent wildfires

in certain geographies, more flooding and

the potential for increased severity of

hurricanes due to higher sea surface

temperatures. As a result, incurred losses

from such events and the demand, price and

availability of reinsurance coverages for

automobile and homeowners insurance may

be affected.

Climate

change

may

also

impact

insurability by impairing our ability to

identify and quantify potential hazards that

will result in losses and offer our customers

products at an affordable price.

Allstate Corporation Form 10-K, at 28–29 (Feb. 16,

2023), https://tinyurl.com/Allstate2210-K.

Notably, Allstate stopped writing new

homeowners insurance policies in the state of

California in November 2022, due in part to increased

wildfire risk. See Michael R. Blood, California

insurance market rattled by withdrawal of major

companies, Associated Press (June 5, 2023),

https://tinyurl.com/3c44wx5n. Allstate’s 2023 Form

10-K did not mention this decision in its Risk

Disclosure, but insofar as Allstate’s decision to pause

its California homeowners business is material to

16

investors, it was not omitted from the Form 10-K.

Rather, it appeared in the MD&A, where Allstate

wrote: “Starting in the fourth quarter of 2022, we no

longer write new homeowners business in the state of

California, although we will offer continuing coverage

to existing customers. We also reduced homeowners

new business in Florida.” Allstate Corporation Form

10-K,

at

45

(Feb.

16,

2023),

https://tinyurl.com/Allstate2210-K.

The effect of Allstate’s Form 10-K was to divide

neatly (and appropriately) the concept of prospective,

hypothetical risk from that of existing, materialized

risk, and logically present them in separate sections.

This division follows the language of Item 303 and

Item 105, discussed above. It would be contrary to the

purpose and focus of Risk Factors to allow a plaintiff

to misread Allstate’s Risk Factor on climate change as

a factual assertion that Allstate had never incurred

losses from climate events, and in any event, the

material impacts of increased fire risk do appear in

the MD&A.

B.

Description of Business – Item 101

Item 101 of Regulation S-K directs companies

to “[d]escribe the general development of the business

of the registrant, its subsidiaries, and any

predecessor(s)” in a section of the Form 10-K generally

titled “Business.” 17 C.F.R. § 229.101(a). This

obligation is further described in numerous

subsections of Item 101. Distilling the section for

investors, the SEC advises: “‘Business’ requires a

description of the company’s business, including its

17

main products and services, what subsidiaries it owns,

and what markets it operates in. This section may

also include information about recent events,

competition the company faces, regulations that apply

to it, labor issues, special operating costs, or seasonal

factors.” Securities & Exchange Comm’n, How to

Read

a

10-K/10-Q

(Jan.

25,

2021),

https://tinyurl.com/3s5fuhdy. Broadly, this Business

section is an overview of the company’s anatomy and

operations, while the MD&A is focused on results. Id.

As with the MD&A, the Business section can

contain factual disclosures related to the past

materialization of certain forward-looking Risk

Factors. For example, FedEx Corporation noted as a

Risk Factor: “Our inability to quickly and effectively

restore operations following adverse weather or a

localized disaster or disturbance in a key geography

could adversely affect our business and results of

operations,” and cited climate change as contributing

to this risk. FedEx Corp. Form 10-K, at 34–35 (July

15,

2024),

https://tinyurl.com/fedex2310-k.

Meanwhile, in the “Business” section of the same 10K, FedEx stated that “facility resiliency” is

increasingly important “due to the physical risks of

climate change and the strain of electrification on the

grid.” Id. at 23. Therefore, “FedEx is conducting pilot

tests of various technologies to provide backup power

to our facilities.” Id. The Risk Factors disclose a

hypothetical problem which “could” occur, while the

“Business” section describes a present, factual trend.

18

C.

Legal Proceedings – Item 103

Item 103 of Regulation S-K, which requires

disclosure of legal proceedings, provides another

contrast to the forward-looking disclosures required

by Item 105. Item 103 requires a registrant to

“[d]escribe briefly any material pending legal

proceedings, other than ordinary routine litigation

incidental to the business, to which the registrant or

any of its subsidiaries is a party or of which any of

their property is the subject.” 17 C.F.R. § 229.103(a).

It also provides that a registrant should include “any

such proceedings known to be contemplated by

governmental authorities.” Id.

This plain language of Item 103 focuses on

presently existing conditions rather than hypothetical

future outcomes. It asks registrants to describe

“pending” legal proceedings to which a registrant “is”

a party. Id. Even where discussing a “contemplated”

proceeding, involving future uncertainty, the

regulatory text only seeks proceedings which are

“known” to be contemplated by governmental

authorities.

Id.

If the risk of litigation has

materialized into an open case or the company has

been threatened with an enforcement action, then the

place to disclose that fact to investors, and where they

would expect it, is in the Legal Proceedings section

prescribed by Item 103, not the Risk Factors

disclosures.

Public filings again reflect the proper

distinction, presenting investors with hypothetical

disclosures separately from known events and

19

information. For example, the Risk Factors section of

the FY 2023 Form 10-K of Exxon Mobil Corporation

(“Exxon”) made the following disclosures about

litigation:

We also may be adversely affected by the

outcome of litigation … by state and local

government actors as well as private

plaintiffs acting in parallel that attempt to

use the legal system to promote public policy

agendas (including seeking to reduce the

production and sale of hydrocarbon products

through litigation targeting the company or

other industry participants), gain political

notoriety, or obtain monetary awards from

the company.

Exxon Form 10-K, at 4 (Feb. 28, 2024),

https://tinyurl.com/Exxon2310-K. This description of

possible future harm does not identify known

lawsuits. In comparison, in its Legal Proceedings

disclosures pursuant to Item 103, Exxon describes a

materialized risk—litigation that has already been

filed:

State and local governments and other

entities in various jurisdictions across the

United States and its territories have filed a

number of legal proceedings against several

oil

and

gas

companies,

including

ExxonMobil, requesting unprecedented

legal and equitable relief for various alleged

injuries purportedly connected to climate

change. These lawsuits assert a variety of

20

novel, untested claims under statutory and

common law.

Exxon Form 10-K, at 104 (Feb.

https://tinyurl.com/Exxon2310-K.3

28,

2024),

Bath and Body Works, Inc. followed a similar

approach in its Form 10-K for FY 2023. The Risk

Factors described the company’s general exposure to

various consumer protection laws, including a

prohibition against printing too many digits of a credit

card on a receipt, and the Legal Proceedings section

listed three class actions alleging that exact violation.

See Bath & Body Works, Inc. Form 10-K at 18, 23

(Mar. 22, 2024), https://tinyurl.com/BBW2310-K.

Again, for both Exxon and Bath and Body

Works, and for public companies generally, the

division of these disclosures between Risk Factors and

Legal Proceedings reflects Regulation S-K’s clean,

logical division between prospective risks on the one

hand, and known facts and trends on the other.

D.

Cybersecurity – Item 106

The SEC updated Regulation S-K in 2023 to

add Item 106, regarding cybersecurity. Though this

rule was not operative when Facebook issued the

Form 10-K at issue in this case, Item 106 makes plain

that materialized risks from existing or previous data

breaches should appear in this new Cybersecurity

3 This disclosure is provided in Note 16 to Exxon’s Consolidated

Financial Statements, which is incorporated by reference in its

Legal Proceedings disclosures.

21

section. Item 106 requires a registrant to provide

various

disclosures

concerning

cybersecurity,

including, among other things, a description of:

•

“the registrant’s processes, if any, for

assessing, identifying, and managing

material risks from cybersecurity threats in

sufficient detail for a reasonable investor to

understand those processes”;

•

“whether any risks from cybersecurity

threats, including as a result of any previous

cybersecurity incidents, have materially

affected or are reasonably likely to

materially affect the registrant, including

its business strategy, results of operations,

or financial condition and if so, how”;

•

“the board of directors’ oversight of risks

from cybersecurity threats”; and

•

“management’s role in assessing and

managing the registrant’s material risks

from cybersecurity threats.”

17 C.F.R. § 229.106(b). Like Items 303, 101, and 103,

Item 106 focuses on current, known cybersecurity

issues, including risks caused by “previous

cybersecurity incidents.” Id. With this Item 106 in

place, it would not be reasonable for an investor to

conclude that a cybersecurity-related Risk Factor

worded in purely hypothetical terms must imply that

no such risk has ever materialized. Rather, if the

company has suffered the sort of cybersecurity

22

incident described in the Risk Factor disclosures, a

description of that event would appear in the

Cybersecurity section, if material. See 17 C.F.R.

§ 229.106(b)(2).

Though Item 106 is recent, public filings

already reflect the same practical approach of filing

prospective Risk Factors in Item 105, and known

events and trends under Item 106. For example, in its

FY 2023 Form 10-K, Sunoco LP disclosed Risk Factors

concerning

cybersecurity,

including

that

“[c]ybersecurity attacks, data breaches and other

disruptions affecting us, or our service providers,

could materially and adversely affect our business,

operations, reputation, and financial results.” See

Sunoco LP Form 10-K, at 21 (Feb. 16, 2024),

https://tinyurl.com/Sunoco2410-K. In contrast, in its

Cybersecurity section of the same Form 10-K, Sunoco

described a known state of vulnerability: “Due to the

number of acquisitions made by the Partnership over

the past few years and the time it takes to implement

technology standards across the enterprise, certain

assets may be in different stages of integration and

may have incomplete cybersecurity controls applied.”

Id. at 40. Though neither section reflects an actual

cybersecurity incident, the example demonstrates

again that materialized risks or trends properly

appear in the Cybersecurity section, rather than in

the Risk Factors section.

23

E.

The Ninth Circuit Decision Would

Muddy the Respective Purposes of the

Form 10-K Sections and Undermine

the Utility of the Risk Factors.

Reasonable investors will not benefit from a

holding that demands a litany of all previously

materialized risks in the Risk Factors section. Item

105 calls for the company to discuss hypothetical

circumstances under Risk Factors, but the Ninth

Circuit’s decision would allow plaintiffs to misread

them as being representations about past events.

Companies would be compelled to append a list of

every negative incident they ever suffered within the

scope of each Risk Factor, or else face liability for

supposedly misleading statements. The end result

would be an overstuffed Risk Factors section, akin to

a “document dump” that swamps a litigant with

irrelevant files, making it harder to identify what is

actually important.

Indeed, the SEC has stressed the importance of

succinctness in Risk Factor discussions. In a 2020

rulemaking, it wrote that Risk Factors should be

“concise,” and criticized the “lengthy and generic

nature of the risk factor disclosure presented by many

registrants.” See Modernization of Regulation S-K

Items 101, 103, and 105, 85 Fed. Reg. 63726, 63746

(Oct. 8, 2020). The SEC considered imposing a page

limit, and ultimately decided to encourage filers to be

concise by imposing a separate short-form summary

requirement for any Risk Factor discussions over 15

pages. Id. But surveys show that the rule change did

not achieve the goal of shortening Risk Factor

24

discussions, largely due to registrants’ fear of eventdriven litigation. See Dean Kingsley et al., SEC Risk

Factors Disclosure Analysis, Harvard Law School

Forum on Corporate Governance (Dec. 3, 2023),

https://tinyurl.com/yxubyfhj;

Modernization

of

Regulation S-K Items 101, 103, and 105, 85 Fed. Reg.

63726, 63743 (Oct. 8, 2020) (“Commenters …

attributed the growing length of risk factor disclosure

to the fear of litigation for failing to disclose risks if

events turn negative.”). The majority opinion below

did not address these concerns, nor reconcile its

approach with the plain text of Item 105. With no

statutory grounding, it expands the daunting threat of

fraud liability faced by public companies and the

people who manage them, and moves the law a step

closer to an absurdist nightmare where “everything,

everywhere is securities fraud,” as two SEC

Commissioners critically phrased the concept. Mark

T. Uyeda, Remarks at the “SEC Speaks” Conference

2022, (Sept. 9, 2022), https://tinyurl.com/bd9sj4d8; see

also Hester M. Peirce, Outdated: Remarks before the

Digital Assets at Duke Conference, (Jan. 20, 2023),

https://tinyurl.com/5n8s47h8 (“And although some

might suggest otherwise, everything, everywhere is

not securities fraud.”).4

Respondents’ theory of liability disregards that

the Risk Factors in a Form 10-K are prospective by

design, and ignores that if a negative business event

4 Both Commissioners cited Matt Levine, Everything Everywhere

is

Securities

Fraud,

Bloomberg

https://tinyurl.com/4e4cuae7.

(June

26,

2019)

25

is material, it can appear in a different section of a 10K. Unless reversed, the Ninth Circuit’s decision will

give plaintiffs a continuing license to graft

unreasonable inferences onto public companies’

assessments of their future risks. Companies, in turn,

will file ever-longer Risk Factor discussions, imposing

undue costs and burdens on filers while detracting

from the SEC’s goal of concise Risk Factors, ultimately

rendering them less useful to investors. The Court

should reverse.

26

CONCLUSION

For the foregoing reasons, the judgment of the

court of appeals should be reversed.

Respectfully submitted,

PAUL F. WASHINGTON

RANDI VAL MORRISON

C. EDWARD ALLEN

SOCIETY FOR CORPORATE

GOVERNANCE

52 Vanderbilt Avenue

New York, NY 10017

JESSICA P. CORLEY

MATTHEW B. ROSENTHAL

KING & SPALDING LLP

1180 Peachtree Street, NE

Atlanta, GA 30309

CHRISTOPHER E. DUFFY

Counsel of Record

ALLAN S. BRADLEY

KING & SPALDING LLP

1185 Avenue of the

Americas

New York, NY 10036

(212) 556-2100

cduffy@kslaw.com

Attorneys for Amicus Curiae

August 2024