The OSC’s 2017 regulatory enforcement proceedings against Home Capital Group Inc. (TSX:HCG) and three of its executives were the result of a lengthy, extensive and highly confidential investigation. If the OSC decided to target your company, would your team know what to do?

A version of this article was recently published in Listed Magazine and documents the procedure of a typical OSC regulatory investigation. An analysis of the process allows directors, senior management and in-house counsel to be aware of what to expect in any investigation and provides information for them to proactively manage the risks ahead of time.

In April, staff of the Ontario Securities Commission (OSC) commenced headline-grabbing regulatory enforcement proceedings against Home Capital Group Inc. (TSX:HCG) and three of its current and former executives. OSC staff alleged that these parties failed to disclose a material change in Home Capital’s business and operations and misled investors as to the causes of the decline in the mortgage lender’s new mortgage originations. Without a doubt, these proceedings – since settled in an agreement in June – were the result of a lengthy, extensive, highly confidential regulatory investigation.

An OSC investigation can be triggered in different ways: whistleblower tips, investor complaints, competitors, self-reporting, newspaper stories, market surveillance technology, referrals from self-regulatory organizations (like the Investment Industry Regulatory Organization of Canada) – and the list goes on. Likewise, OSC staff can investigate a wide range of potential breaches of Ontario securities laws: disclosure violations, as in Home Capital’s case, as well as illegal distributions, fraud, market manipulation and illegal insider trading.

What do you need to know if the OSC investigators come knocking on your door? Are you obligated to speak to them? Could you end up in jail? Who can you tell? As a director, senior management or in-house counsel of a Canadian public company, it’s important for you to understand how the typical OSC regulatory investigation proceeds as well as key risks, opportunities and decision points.

First step, figure out whether you’re the subject of a “regulatory” or “quasi-criminal” investigation. An OSC investigation that leads to quasi-criminal proceedings means your case will be heard by a judge in court. The prosecutor in quasi-criminal proceedings will have a high standard to meet (beyond a reasonable doubt), but you could end up in jail if she is successful. On the other hand, an investigation that leads to a regulatory proceeding means the case will be heard by a panel of OSC commissioners. The standard of proof will be lower: OSC staff will have to prove their allegations on a simple balance of probabilities. And, while jail time is out of the question, the sanctions the hearing panel imposes could mean you lose your livelihood – bans from serving as a director or officer, cease trade orders and fines are all on the table.

You also have more protections in a quasi-criminal investigation. The Canadian Charter of Rights and Freedoms kicks in. You have a right against self-incrimination. You have the right to stay silent and you do not have to assist in the investigation. Regulatory investigations are different. OSC investigators can compel you to testify under oath. They can require that you produce documents or things. Let’s call it a quid pro quo for your “licence” to operate in the Canadian capital markets.

Next step, carefully consider the risks of sharing information voluntarily. Before OSC staff commence a formal investigation (by obtaining an “investigation order”), they will frequently request documents and information on a “voluntary” basis from the company and key individuals involved. Although cooperating with the regulator is often a good idea, acceding to these voluntary requests can be risky. Information and documents provided to OSC staff on a voluntary basis are not afforded the same protections (against self-incrimination) that compelled testimony and documents are. They can also be used without restriction in quasi-criminal proceedings.

OSC Investigation Checklist

Best practices to proactively manage the risk of an OSC investigation

• Review and update codes of conduct and compliance policies
• Ensure tone at the top signals the importance of strict compliance with policies
• Review and update document preservation policies
• Review and update insurance policies and indemnification obligations
• Develop a playbook for how to respond to a regulatory investigation

If an informal investigation turns into a formal regulatory investigation, expect a summons compelling you to testify. Here are five things to keep top of mind:

1. Ask for the order. If you receive a summons compelling you to testify and produce documents, you should request a copy of the OSC order commencing the investigation. It’s important to understand the scope and target of the investigation.
2. Shhhh, keep it quiet. A recipient of a summons shouldn’t disclose the summons to anyone other than legal counsel, not even to a spouse! It’s a breach of securities laws to disclose the existence of the summons or its contents, or the testimony or documents given in response to the summons. It doesn’t matter if your breach is inadvertent. In your compelled interview, it’s pretty standard for OSC investigators to probe and explore whether you disclosed the summons and to whom.
3. Don’t jeopardize your case in the U.S. The OSC and the Securities and Exchange Commission (SEC) frequently cooperate during investigations. Where a company is cross-listed, it is best to assume that regulators on both sides of the border are sharing information. There are critical differences between the rights against self-incrimination in each country and this can create issues. It is important not to lose sight of the risk that testimony compelled by the OSC in a regulatory investigation could be shared with the SEC where immunity against its use in criminal proceedings might not apply.
4. Prepare, prepare, prepare. If you are summonsed by OSC staff to give testimony under oath, go prepared. Anticipate that the OSC investigators have access to a wealth of documents and testimony, phone records, trading records and other information from multiple sources that they will not share with you. So, familiarize yourself with any relevant documents or critical timelines of events prior to the interview. The best advice is to have your legal counsel with you at the interview. She will prepare you in advance and ensure that your interests are protected during the interview by obtaining clarifications, protecting privilege and making sure that you have conveyed your evidence correctly. Remember to appropriately qualify your responses if you are unsure of relevant details because of the passage of time or a lack of documents to remind you.
5. Follow up. Best practice is to review the transcript of your interview and notify OSC staff of any corrections. If staff have any reason to believe that you have attempted to mislead them, which is itself an offence under securities laws, you can expect that this will form part of any subsequent enforcement proceedings that might be commenced.

When the OSC investigation is complete, what’s next? If OSC staff believe there has been a breach of securities laws, their practice is to issue a non-public enforcement notice (or so-called Wells notice) to the company or individuals against whom they believe enforcement proceedings should be brought. This enforcement notice typically sets out high-level details about the relevant facts as understood by OSC staff and how such facts amount to a breach of securities laws. In this context, you should explore these strategic, legal and pragmatic questions:

• How do you get OSC staff to see your side of the story? The enforcement notice gives the recipient an opportunity to make voluntary written submissions to OSC staff. Your goal is to attempt to influence the OSC staff’s understanding and perception of the relevant facts and the law. This is an important juncture that may allow you to avoid enforcement proceedings altogether or have them scaled back. Remember that your written submissions should be taken very seriously. If OSC staff ultimately commence enforcement proceedings, those submissions can be used against you as evidence of an admission against interest or (if factually inaccurate) as evidence of attempting to mislead OSC staff.
• Do you want to have a hand in shaping the message? If so, consider settling early. While it is possible to settle OSC regulatory enforcement proceedings at any time, a natural point for such settlements to occur is after an enforcement notice has been issued to the individual or the company but before public enforcement proceedings commence. Although any settlement reached with OSC staff must be approved by the OSC and will ultimately be public, reaching a settlement prior to the commencement of public enforcement proceedings can be beneficial because it permits the negotiation of an “agreed statement of facts” with OSC staff and an opportunity for input into what is ultimately filed in the public record.
• Can you settle without admitting liability? Discuss whether you qualify under the OSC’s newly implemented “no-contest” settlement program. So long as your conduct isn’t abusive, fraudulent or criminal and you’ve been cooperative or have self-reported, OSC staff can now reach a settlement agreement which doesn’t require an admission of facts or liability. Where a company is facing both the prospect of a civil class action and OSC regulatory enforcement proceedings, the possibility of settling with the OSC without making admissions of fact or liability is very attractive. But the limited number of no-contest settlements approved to date by the OSC have been in cases where the party pays a significant amount in compensation to the individuals harmed by the conduct in question. It is doubtful that no-contest settlements will be a practical option in anything but very narrow circumstances. Even if you don’t qualify for the no-contest settlement program, remember that the OSC’s “credit for cooperation” policy should allow you some reduction in sanctions for being cooperative with the regulator. Self-reporting or presenting a remedial plan showing the processes you will put in place to prevent the misconduct from recurring should both count.
• Is the company required to make public disclosure of the OSC investigation? Generally OSC staff don’t publicly disclose the existence of an investigation. But companies must consider it, and are obligated to do so if the investigation would constitute a “material fact” or “material change.” Remember that materiality may evolve and if the company decides not to disclose in the first instance, it will need to revisit the question as an investigation progresses.

Bottom line for directors, senior management and in-house counsel: be aware of the risks and opportunities that lie ahead if you become embroiled in an OSC regulatory investigation. But equally important, proactively manage the risks ahead of time and prepare for the worst.