Combating Regulation by Enforcement: A Strategic Framework for Responding to State Agency Overreach

This article was originally published in Corporate Compliance Insights on June 21, 2019.

In recent years, changes in the economic and political landscapes have created an environment ripe for increased scrutiny and oversight by state regulators of the activities of financial services firms, investment advisors and life insurers. Namely, the 2008 financial crisis and subsequent recession on the economic front and the Trump administration's deregulatory emphasis on the political front have caused some state regulators to significantly increase their regulatory enforcement and compliance activity toward such companies.

For example, after a change in the presidential administration and legal challenges constrained the Fiduciary Rule previously adopted by the United States Department of Labor, several states, including Connecticut, Maryland, New Jersey, New York and Nevada, have been pursuing state-level fiduciary requirements for investment advisors.¹ Although the SEC is working with such states to "craft a new framework that will eliminate any conflicts with state-level fiduciary rules," the trend continues toward states imposing some fiduciary standard on investment advisors.²

Furthermore, a recent U.S. Public Interest Research Group study explains that as the Consumer Financial Protection Bureau has adopted a more pro-business posture in recent years, state officials have begun to adopt stricter consumer protection regimes, with other state regulatory agencies poised to follow suit.³ Indeed, two states thus far – Pennsylvania and New Jersey – have established state-level CFPBs; Maryland has established a Financial Consumer Protection Commission to make recommendations on increased consumer protection related laws and policies; and Virginia's Attorney General's Office has reorganized and expanded its Consumer Protection Section.⁴

State Agency Regulation By Enforcement

Companies subject to enhanced state regulation face new challenges. Rather than determining how to comply with a single federal standard, companies often find that state compliance standards are not well articulated and fail to provide a roadmap — in advance — as to what companies need to do in order to comply with state law. Instead, state regulators attempt to pursue a "regulation by enforcement" path, where compliance standards are only articulated after the fact, at the conclusion of an examination or an enforcement action. In this environment, the likelihood that state agencies overstep their legal bounds increases; compliance standards are articulated on the fly and in the context of a particular enforcement action, without the constraints imposed by state statutes and Administrative Procedure Act (APA) requirements.

This regulation by enforcement regime allows regulators to create new compliance rules through the course of examinations and, in so doing, to fill the state treasury through monetary penalties against companies that are found not to be in compliance with rules that have never before been clearly articulated. When an enforcement action is concluded and an examination report presented, it may be the case that not only are the factual findings of the enforcement action questionable, but also that the legal standards that those findings are measured against are not supported by state law and have never previously been made clear. However, challenging those standards at the end of an examination can be both difficult and risky; at that point, the company's risk assessment may lead to the conclusion that it is not feasible to challenge the rules after findings have been announced and alleged monetary liability specified.

One area of state regulation that has witnessed such a regulation-by-enforcement dynamic in recent years is state agencies' regulatory overreach with respect to life insurers' escheatment requirements under state unclaimed property laws, which have reportedly yielded billions of dollars in multistate settlements by life insurers. Our recent experience challenging such overreach provides a roadmap for potential proactive approaches to preempting and challenging state agencies' regulation by enforcement. This serves two objectives: (1) clearly identifying the applicable rules so that an organization's prospective compliance obligations are clear and (2) invalidating those rules to the extent they are either inconsistent with state law or not promulgated in compliance with the state APA.

A Roadmap For Challenging Regulation By Enforcement

The best approach to efficiently addressing state agency regulation by enforcement includes the following steps:

1. Diligent ongoing monitoring with respect to agency rules and requirements applicable to your business and the stated basis for an agency's authority to promulgate such rules and requirements;
2. Engaging in an informal dialogue with an agency imposing a compliance standard or regulation that appears to exceed the scope of the agency's authority;
3. Strategic use of the declaratory ruling procedures in a state's APA for an advance determination regarding the substance and validity of a purported rule or requirement; and
4. If necessary, strategic use of state court litigation to challenge the validity of a purported rule or requirement.

Preemptively Addressing The Scope Of A State Agency's Authority

Too often, companies challenge the scope of a state agency's regulatory authority only after being subjected to extensive compliance audits and after the agency issues findings with which the company disagrees. While there are certainly justifiable strategic reasons to cooperate with state regulators, even aggressive ones imposing resource-intensive examination requirements, companies often fail to consider countervailing considerations that include:

1. The relatively efficient process, available under many state APAs, allowing regulated entities to obtain prospective clarity as to an agency's purported compliance obligations under state law.
2. The potential benefit of challenging, and thereby limiting, the scope of a regulator's authority before undergoing an extensive and expensive audit or examination;
3. The possibility that a company may have a stronger legal challenge with respect to a regulator's authority before the regulator issues potentially negative findings as a result of an audit or examination that arguably exceeded the state's authority.

Through ongoing diligence and informal communication with relevant regulatory agencies, potential regulatory overreach can often be resolved without undertaking a more formal challenge.

Ongoing Diligence

Companies must know not only what a state agency's requirements are (or purport to be), but also the stated basis for those rules, particularly where there is a substantial cost to compliance. Companies are entitled to this information, and, when state agencies are operating correctly, this information should be readily available in the agency's publicly available guidance. Companies should review such guidance and compare it with state law and promulgated regulations to ensure there is a lawful basis for any purported requirements.

Informal Communication With The State Agency

Where an agency attempts to impose requirements that exceed the agency's authority, for both prudential and substantive reasons, typically the first step should be to address these concerns through informal communications with the agency. By initially raising concerns with the agency informally, a company can: (1) assess whether the dispute is merely the result of a misunderstanding, (2) maintain a cooperative posture that is more likely to result in a speedy and positive resolution and (3) avoid unnecessarily antagonizing the regulating agency or its personnel. Furthermore, through such an informal inquiry, a company may receive a substantive and informative response, which can help in developing a record to use in a subsequent formal challenge.

Formally Challenging State Agency Regulatory Overreach

Where the informal process described above fails to result in a favorable outcome, more formal approaches to challenging state agency action may be necessary.

Seeking a Declaration of State Law Under the State APA

Most state APAs allow interested parties to petition the agency for a declaratory ruling with respect to the applicability of a statute, rule or order within the agency's jurisdiction. This underutilized provision can be an efficient and effective means by which a company can ascertain its legal obligations before it is subjected to costly audits/reviews or enforcement actions.

Our experience in seeking a declaratory ruling from the North Carolina Department of State Treasurer (NCDST) on behalf of our life insurance client is illustrative. There, the NCDST sought to audit our client for compliance with the requirement that it escheat unclaimed life insurance proceeds to the state. Before the audit began, we asked NCDST representatives to explain its interpretation of the timing of the trigger for the dormancy period — i.e., the time when the clock begins to run — as to whether or not unclaimed life insurance proceeds are abandoned and escheatable. As we were unable to resolve the disputed interpretation through informal communications with the NCDST, we filed a petition under the North Carolina APA seeking a declaratory ruling that our client's interpretation of the dormancy trigger was correct. Through this petition process we obtained a declaratory ruling from the North Carolina State Treasurer that our client's interpretation was in fact correct, and that our client could conduct its business going forward accordingly.

In contrast to seeking an informal resolution from an agency, declaratory rulings are binding upon the agency, providing certainty with respect to a company's legal obligations. And even where a petition for a declaratory ruling fails to achieve a favorable result, an unfavorable ruling typically can be appealed immediately to state court.

Appealing an Unfavorable Declaratory Ruling

If a company seeks a declaratory ruling and obtains an unfavorable result, state courts provide a final recourse for parties aggrieved by state agency regulatory overreach. Our experience challenging the Florida Department of Financial Services' (Florida DFS) regulatory interpretation of Florida law on our client's behalf provides another illustrative example. There, we again sought a declaratory statement that the dormancy trigger was not the date of the insured's death — rather, under Florida's unclaimed property statute, dormancy was triggered after life insurance proceeds became due and payable "as established from the records of the insurance company" or as a result of another specific provision of the statute not tied to the date of the insured's death. The Florida DFS issued an unfavorable declaratory statement in response, which we appealed directly to the Florida District Court of Appeal.

On appeal, we obtained a favorable and binding ruling, adopting our client's interpretation of Florida law. Once again, we achieved this result before our client was subjected to an extensive audit applying an improper interpretation. And because we first sought a declaratory ruling — and because the agency's interpretation and declaratory ruling was not supported by Florida law — we had a well-developed record that allowed the Florida appellate court to rule in our favor.

Seeking Declaratory Judgment That the Agency Has Adopted Invalid (or "Underground") Regulations Without Following the APA

Some states have well-defined laws making clear that agency rules that are in substance regulations, but that have not been adopted through formal state APA procedures, are invalid "desk drawer" or "underground" regulations. For example, in the words of a California Court of Appeals, "[I]f it looks like a regulation, reads like a regulation and acts like a regulation, it will be treated as a regulation whether or not the agency in question so labeled it." (State Water Res. Control Bd. v. Office of Admin. Law (1993) 12 Cal.App.4th 697, 702) Such underground regulations can directly result from agency attempts to implement a regime of regulation by enforcement. In those circumstances, a lawsuit seeking declaratory and injunctive relief to invalidate such underground regulations can be effective.

Our experience in challenging, on our client's behalf, the California State Controller's Office's (SCO) regulatory overreach with respect to insurers' requirements under California's unclaimed property law is illustrative. We filed suit seeking a determination that the SCO had adopted secret rules regarding the dormancy trigger and what life insurers needed to do in order to comply with California's unclaimed property law. We argued that although the SCO knew the standards by which it would measure life insurers' compliance, the SCO had never specified those rules and instead attempted to ambush life insurers by conducting examinations in which the rules were revealed for the first time as the basis for a finding of noncompliance. SCO's secret rules, we argued, amounted to improper "underground" regulations not promulgated in accordance with California's APA. Finding in our client's favor, the California state court invalidated SCO's underground regulations and enjoined SCO from applying them to any life insurer in California.

Going forward, if the SCO wants to go through the formal rulemaking process and formally adopt its underground rules as regulations, it can try to do so, but at that point it will need to establish that the rules are consistent with the substantive provisions of state unclaimed property law. Thus, our declaratory judgment action that invalidated the SCO's unspecified (and legally untested) compliance standards should prove to be an effective check against SCO' efforts to implement a regime of regulation by enforcement.

Raising a Constitutional Challenge to State Investigatory Overreach

Federal law allows parties to challenge any instance where an agency, "under color of any statute, ordinance, regulation, custom or usage of any State or Territory or the District of Columbia" takes an action that deprives anyone of "rights, privileges or immunities secured by" the United States Constitution, including due process of law. (42 U.S.C. § 1983) Many state constitutions also have due process clauses similar in purpose and form to those in the U.S. Constitution. When agencies attempt to regulate by enforcement, their information requests often are not tailored to the purported purpose of the agency's review and exceed their statutory jurisdiction and authority. Such requests may be appropriate for a constitutional due process challenge for at least two fairly common reasons:

1. The information requests are so broad that compliance is hugely burdensome and the requested information is untethered to any legitimate or appropriate exercise of the agency's authority; and
2. The information requests are so vague or arbitrary that even making an assessment of the basis for the request, much less complying with it, is not possible.

Ultimately prevailing on a due process challenge may be difficult, as courts often show deference to government agencies and their investigatory powers. But forcing a state agency to articulate, in a judicial proceeding, why its requests for information are not overly broad or arbitrary will often result in the agency narrowing such requests or making them more concrete as part of the agency's litigation posture. Thus, even where the regulated entity does not or will not ultimately prevail on such claims, such challenges can provide a substantial benefit to regulated entities seeking greater clarity regarding exactly what they must do to comply with the law.

Takeaways

The broadly applicable takeaways from our experience are as follows:

1. Understand the purported basis for a state agency's requirements. Companies must understand not only what state agency rules apply to them, but also the purported legal basis for these rules. In the present regulatory environment, healthy skepticism is appropriate, as state agencies seek to push the envelope by imposing obligations without legal basis.
2. Proactively challenge state agency overreach where possible. There are substantial benefits to proactively challenging state regulatory overreach before endeavoring to undertake extensive compliance examinations/audits and before being subjected to enforcement action. Doing so allows for a focused challenge, based on purely legal considerations, resulting in a more efficient and definitive resolution of questions regarding exactly what rules a company is obliged to follow.
3. Declaratory rulings can be an efficient and effective mechanism for challenging regulation by enforcement. Declaratory rulings are an underutilized mechanism to proactively address potential state regulatory overreach that may preclude the necessity of expensive state court litigation.
4. Be prepared to litigate if necessary. Notwithstanding the utility of the above-discussed prelitigation approaches, it may be necessary to seek relief from the courts through review of a denied declaratory ruling, seeking a declaratory judgment and/or raising constitutional challenges to state agency action. But by being prepared to credibly indicate that a company is prepared to go to court, if necessary, to vindicate its rights, this puts the company in a stronger position to first challenge informally a state agency's attempts to regulate by enforcement.

[1] Bernice Napach, "More States Advance Their Own Fiduciary Rules," ThinkAdvisor, Jan. 23, 2019: https://www.thinkadvisor.com/2019/01/23/more-states-advance-their-own-fiduciary-rules.

[2] "The SEC is Trying to Get Rid of State Fiduciary Rules," FINSUM, March 29, 2019: https://www.nasdaq.com/article/the-sec-is-trying-to-get-rid-of-state-fiduciary-rules-cm1122121.

[3] Ethan Lutz, "Positioned to Protect: How State and Local Authorities Can Fill the CFPB Void," U.S. PIRG Education Fund Report, December 2018.

[4] Id. at 3-5, 7-9.