Remedies and Administrative Provisions

Remedies and administrative provisions cover 11% of the Series 66 — roughly 1 in 9 questions. The chapter tests what the state administrator can and cannot do, what civil remedies are available when securities law is violated, what criminal penalties apply, and where the jurisdictional lines fall.

The chapter is organized around three lenses. Section 1 covers the administrator's office, rule-making, investigations, cease-and-desist orders, and the procedural protections that constrain administrative action. Section 2 covers the civil right of action under USA §410 — rescission, damages, the rescission offer procedure, and statutes of limitations. Section 3 covers criminal penalties under USA §409, jurisdiction under §414, and judicial review under §412.

The administrator's office — USA §406 and §413

The state securities administrator is the senior securities regulatory official in each state. The role is established by USA §406, and the title varies by jurisdiction — Securities Commissioner, Director of the Securities Division, Director of the Division of Securities, Secretary of State (in states where securities regulation is housed in that office), or similar. Regardless of title, the office holds the same statutory powers and constraints.

Scope of the office:

• Administer the state's blue sky law — oversee registration of securities, broker-dealers, agents, investment advisers, and investment adviser representatives
• Adopt rules under USA §413 — including rules of general applicability, exemption orders, interpretive orders, and procedural rules for hearings
• Investigate suspected violations within the state and, with cooperation, beyond state lines
• Take administrative action — deny, suspend, revoke, condition registrations, issue cease-and-desist orders, impose administrative sanctions
• Refer matters for criminal prosecution when warranted — the administrator does not prosecute crimes directly
• Cooperate with the SEC, FINRA, and other states — share information and coordinate enforcement

What the administrator cannot do: Make arrests, prosecute crimes, impose criminal penalties, or issue injunctions. These are judicial functions. The administrator works through the court system for any of these outcomes — referring criminal matters to the state attorney general or local prosecutor, and seeking injunctive relief through civil court filings.

Investigative powers — USA §407

USA §407 grants the administrator broad investigative authority to determine compliance with the state's securities laws. The investigative power is the foundation for all administrative enforcement action.

Specific investigative tools:

• Subpoenas — compel attendance and testimony of witnesses (subpoena ad testificandum) and production of books, papers, contracts, agreements, and other records (subpoena duces tecum)
• Depositions — take testimony under oath, with the witness's right to counsel preserved
• Examinations — inspect books and records of registrants on-site during normal business hours
• Documentary requests — demand written responses or production of documents from third parties relevant to an investigation
• Cooperation with other administrators — the administrator can investigate violations occurring outside the state if they have any nexus with state residents or state securities markets

Procedural protections during investigations:

• Witnesses may be represented by counsel during testimony
• A witness may invoke privileges available under state and federal law, including the Fifth Amendment privilege against self-incrimination
• The administrator cannot grant judicial immunity to a witness — only a court can do that
• Subpoenas may be enforced through court order if the recipient refuses to comply

Cease-and-desist orders — USA §408

USA §408 authorizes the administrator to issue cease-and-desist (C&D) orders directing a person to stop engaging in violations of the state's securities laws. The C&D order is the administrator's primary tool for immediate enforcement that does not require revoking a registration or going through a criminal prosecution.

What a cease-and-desist order does:

• Directs the named person to stop the specific conduct alleged to violate the USA
• May be issued against any person — registered or unregistered, in-state or out-of-state — whose conduct violates the USA and affects the state
• Becomes effective upon issuance (subject to notice and hearing rights)
• Violation of a C&D order is itself a separate violation of the USA and may trigger additional sanctions, including referral for criminal prosecution

Procedural protections (USA §406):

• The administrator must provide prior written notice of the grounds for the proposed order, except in the case of summary orders described below
• The recipient has the right to a hearing, typically within 15 days of request
• The administrator must issue written findings of fact and conclusions of law
• Final orders are subject to judicial review (USA §412, covered in Section 3)

Administrative action process — USA §406

Before the administrator may deny, suspend, revoke, condition, or take any other adverse final action against a registration or against any person under the state's securities laws, USA §406 requires a three-step procedure designed to give the affected person notice and an opportunity to be heard.

Step 1: Prior written notice of the grounds. The administrator must specify in writing the conduct or omissions alleged to justify the action, the statutes or rules alleged to have been violated, and the action the administrator proposes to take.

Step 2: Opportunity for a hearing. The affected person may request a hearing — typically required to be held within 15 days of the request. The hearing is conducted before the administrator or a designated hearing officer, with the right to counsel, to present evidence, to cross-examine witnesses, and to submit briefs.

Step 3: Written findings of fact and conclusions of law. The administrator must issue a written final order setting out the factual findings, the legal conclusions, and the action taken. Findings must be supported by substantial evidence in the record. The written order is the document that triggers judicial review rights.

What this process protects:

• Due process — affected persons cannot have their registration or business taken away without a meaningful opportunity to contest the allegations
• Record building for judicial review — the court reviewing the administrator's order has a defined administrative record to consider
• Public accountability — the administrator's reasoning is documented and reviewable

Summary orders and emergency action

The standard notice-and-hearing process under USA §406 takes time. When the administrator concludes that immediate action is necessary to protect the public, the USA allows a narrow category of summary orders issued without prior notice or hearing.

When summary orders are available:

• The administrator must find that immediate action is necessary to protect investors or the public interest
• The order may summarily postpone or suspend a registration, or summarily prohibit specific conduct, pending a final determination on the merits
• Summary orders are typically issued for: ongoing investor losses, demonstrable fraud in progress, imminent flight or asset dissipation by the respondent, or material false statements in registration filings

Procedural follow-up — the hearing must come promptly:

• A summary order must be accompanied by written findings explaining the immediate threat
• The affected person must be notified promptly after issuance and informed of the right to request a hearing
• Upon request, a hearing must be held promptly — typically within 15 days — on whether to make the summary order permanent, modify it, or vacate it
• If the administrator fails to provide the promised follow-up hearing, the summary order may be invalidated by a reviewing court

USA §410 — the civil right of action

USA §410 creates a private civil right of action for buyers of securities sold in violation of the state's blue sky law. The right of action is the most powerful enforcement tool in private hands — it lets a wronged buyer sue the seller directly without waiting for administrative or criminal action.

Conduct that triggers civil liability under §410:

• Selling an unregistered, non-exempt security in violation of USA §301
• Selling a security through an unregistered broker-dealer or agent in violation of USA §201
• Selling a security by means of an untrue statement of material fact or omission of a material fact (USA §101 anti-fraud parallels — the civil action does not require scienter, unlike criminal fraud)
• Selling a security in violation of an administrator's order or rule

Who can sue and who can be sued:

• Plaintiff: the buyer — the wronged purchaser of the security
• Defendants: the seller, AND any person who directly or indirectly controls the seller, partners/officers/directors of the seller, employees materially aiding the sale, and broker-dealers/agents who participated in the sale (joint and several liability under USA §410(b))

What the buyer must prove: The buyer must prove only the violation and the purchase. Scienter is NOT required — even an innocent or negligent violation of the registration or sales conduct rules creates civil liability. This is a major difference from federal Rule 10b-5 fraud actions, which require scienter.

Rescission — the buyer's primary remedy

Rescission is the legal undoing of a transaction. The buyer who still owns the security returns it to the seller, and the seller returns the purchase price plus interest, less any income the buyer received from holding the security. The transaction is treated as if it never happened.

The rescission formula:

Recovery = Purchase Price + Interest from Purchase Date − Income Received from the Security

Worked example: A buyer pays $10,000 for an unregistered, non-exempt security on January 1, 2024. The security pays $300 in dividends to the buyer during the year. On January 1, 2025, the buyer sues for rescission. Assume the legal interest rate is 6%.

• Purchase price returned: $10,000
• Interest (6% × 1 year): + $600
• Income received: − $300
• Total recovery: $10,300 — plus the buyer returns the security to the seller

Buyer must tender the security. Rescission requires the buyer to give back what they bought. If the buyer no longer owns the security — e.g., already sold it — rescission is no longer the available remedy. The buyer instead seeks damages (covered next).

Attorney's fees and costs: USA §410(a) generally allows the prevailing buyer to recover reasonable attorney's fees and court costs in addition to the rescission amount. This makes private civil actions economically viable even for smaller transactions.

Damages — when rescission is not available

When the buyer no longer owns the security — usually because the buyer already sold it before discovering the violation — rescission is unavailable as a matter of mechanics. The buyer cannot tender back a security they no longer hold. The USA preserves the right to a substantively equivalent recovery in the form of damages.

The damages formula:

Recovery = Purchase Price + Interest − Income Received − Sale Proceeds

This formula tracks the rescission amount, then subtracts the value the buyer already recovered by selling the security. The net result is the same dollar amount the buyer would have received through rescission.

Worked example: Same facts as the rescission example, but the buyer sold the security on December 1, 2024 for $7,500 (the security had declined in value). The buyer sues for damages on January 1, 2025.

• Purchase price: $10,000
• Interest: + $600
• Income received: − $300
• Sale proceeds: − $7,500
• Damages recovery: $2,800

The buyer is made whole — recovered the original investment as if the sale had never happened, with the actual sale proceeds credited against the calculation.

Why this matters: A securities law violation cannot be cured by waiting for the buyer to sell at a loss. The statute makes the buyer whole whether they still own the security or not.

The rescission offer procedure — USA §410(e)

USA §410(e) gives the seller a structured way to cure a securities law violation before facing a buyer's lawsuit. The mechanism is the formal rescission offer — a written offer to undo the transaction on the same financial terms a court would order under §410(a).

How a rescission offer works:

• The seller (or anyone else who might face civil liability) sends the buyer a written rescission offer
• The offer must specify the rescission amount — purchase price + interest − income, calculated as of the offer date
• The offer must disclose the basis on which it is being made (the suspected violation) and the buyer's rights
• The buyer has 30 days from receipt of the offer to accept

Effect of the offer:

• If the buyer accepts within 30 days, the transaction is unwound on the offered terms; the seller's civil liability under USA §410 is extinguished as to that buyer
• If the buyer rejects the offer or fails to accept within 30 days, the buyer waives the right to bring a §410 civil action for the violation covered by the offer
• If the buyer accepts but the seller fails to perform, the buyer's full §410 right of action is revived — the offer must be backed by actual ability to pay

Strategic significance: A rescission offer is a powerful settlement tool for sellers who discover an inadvertent violation. By offering the same recovery a court would order, the seller closes the door to future civil liability with no judicial intervention. The 30-day deadline puts the burden on the buyer to act quickly or lose the right to sue.

Control person and successor liability — USA §410(b)

USA §410(b) extends civil liability beyond the direct seller to a defined circle of persons who controlled or assisted the sale. The provision is designed to ensure that the buyer can recover even when the direct seller is insolvent or otherwise unreachable.

Joint and several liability extends to:

• Every person who directly or indirectly controls a seller liable under §410(a) — this includes parent companies, majority shareholders, control affiliates, and certain holding-company structures
• Every partner, officer, or director of the seller (or of a controlling person), and any person occupying a similar status or performing similar functions
• Every employee of the seller who materially aided the unlawful sale — including agents who solicited or executed the transaction
• Every broker-dealer or agent that materially aided in the sale

Defense available to control persons: A controlling person, partner, officer, director, or employee is NOT liable if they prove that they did not know — and in the exercise of reasonable care could not have known — of the existence of the facts giving rise to the liability. This is the so-called "reasonable care" defense, and the burden of proof is on the defendant claiming the defense.

Why this matters: A buyer who has been wronged can pursue not only the immediate seller but the entire chain of control and material participation. This dramatically expands the pool of solvent defendants and creates strong incentives for control persons to supervise their selling personnel.

Statutes of Limitations

Civil remedy for buyers: A buyer can seek rescission (return of the purchase price + interest from purchase date − any income received). This effectively reverses the transaction and makes the buyer whole.

Criminal penalties — USA §409

USA §409 establishes criminal penalties for willful violations of the state's blue sky law. Criminal penalties are imposed by a court following criminal prosecution by the state attorney general or local prosecutor — not by the administrator. The administrator's role is to refer matters for prosecution, not to bring criminal charges directly.

Standard criminal penalties under USA §409:

• Fines up to $5,000 per violation
• Imprisonment up to 3 years per violation
• Both fines and imprisonment may be imposed for the same violation at the court's discretion
• Multiple violations may be charged and penalized separately

Two critical elements for criminal liability:

• Willfulness — the defendant knew they were committing the act (the act was intentional, not accidental). Note: the defendant need not know the act violated the law. "Willful" in this context means the conduct was deliberate, not that the defendant was aware of every statute.
• A violation of the USA — the underlying conduct must violate a substantive provision of the Act (registration, anti-fraud, dishonest practices, or an administrator's order)

Affirmative defense: "no knowledge of the rule or order": A person prosecuted for violating an administrator's rule or order may not be imprisoned if they prove they had no actual knowledge of the rule or order. The defense applies to rules and orders, not to statutory provisions of the USA itself — you cannot defeat a securities fraud charge by claiming you didn't know fraud was illegal.

Statute of limitations: Criminal prosecution must be commenced within 5 years of the alleged violation.

Jurisdiction — USA §414

USA §414 defines when the state's blue sky law reaches a transaction. A state administrator has jurisdiction over an offer or sale of securities if any one of the following occurs in the state:

• An offer to sell is made in the state
• An offer to buy is made in the state
• An acceptance is made in the state

This "any-contact" jurisdictional reach means a transaction can be subject to multiple states' blue sky laws simultaneously. A New York seller making a phone call to a California buyer who accepts in California subjects the transaction to both New York and California jurisdiction.

Special rules under USA §414(b)-(c):

• Where offers are made: An offer is made in the state where it originates AND in the state where it is directed. A radio or television advertisement broadcast across state lines is deemed made in each state of reception.
• Where acceptances are made: Where the buyer's acceptance is communicated from. If a Florida resident calls a New York BD and says "I accept," the acceptance is made in Florida.
• Internet communications: Modern NASAA guidance treats internet offers as made in any state where they are accessible by residents, unless the offer is properly limited (e.g., includes a disclaimer that it is not directed to residents of specified states)

Two key exclusions from jurisdiction:

• Publications and broadcasts — offers contained in newspapers, magazines, radio, or television not produced or originated in the state are not subject to the state's jurisdiction (USA §414(c))
• Foreign issuers in qualifying transactions — certain offers solely outside the United States may be exempt from state jurisdiction

Judicial review — USA §412

USA §412 provides that any final order of the administrator is subject to judicial review in state court. The right of review is the constitutional backstop that prevents administrative action from becoming a final, unappealable adjudication.

How judicial review works:

• A person aggrieved by a final order may file a petition for review in the state court of competent jurisdiction (typically the state appellate court, depending on the state's procedural rules)
• The petition must be filed within a defined window after the final order — commonly 30 to 60 days, depending on state procedure
• The administrator must transmit the administrative record (notices, transcripts, exhibits, findings, and the order) to the reviewing court
• The court reviews on the record — new evidence is not generally admitted

Standard of review:

• Factual findings: reviewed under the substantial evidence standard — whether a reasonable person could conclude as the administrator did, based on the record
• Legal conclusions: reviewed de novo — the court is not bound by the administrator's interpretation of the law
• Discretionary determinations: reviewed for abuse of discretion — the court generally defers to the administrator's reasonable choices among permissible options

Stay of order pending review: A petition for judicial review does not automatically stay the administrator's order. The petitioner must specifically request a stay from the reviewing court, which decides whether to grant it based on traditional injunction factors (likelihood of success, irreparable harm, balance of equities, public interest).

Authority of the State Securities Administrator

The Administrator is the senior securities regulatory official in each state. Key powers include:

• Issue orders: Deny, suspend, revoke, or condition registrations
• Investigate: Subpoena power to require testimony and documents
• Issue cease and desist orders
• Cannot: Make arrests, impose criminal penalties, or issue injunctions (must go through a court for these)

Administrative Actions

Before denying, suspending, or revoking a registration, the Administrator must:

• Provide prior notice of the grounds
• Give the registrant an opportunity for a hearing
• Issue written findings of fact and conclusions of law

Exception — Summary (immediate) orders: The Administrator may summarily postpone or suspend a registration pending a final determination if there is imminent threat to the public interest. However, a hearing must follow promptly.

Penalties and Liabilities

Criminal Penalties

• Willful violations of the USA can result in fines up to $5,000 and/or up to 3 years imprisonment
• Statute of limitations: prosecution must begin within 5 years of the violation

Civil Liabilities

• Buyers can sue for rescission (return of purchase price + interest, minus any income received)
• Sellers can sue for damages
• Statute of limitations: within 3 years of the sale or 2 years after discovery of the violation, whichever comes first

Administrator Powers — Complete Framework

Memory trick: The Administrator is an administrative official, not a judge, prosecutor, or police officer. They can investigate, regulate, and sanction administratively — but for criminal penalties, injunctions, or arrests, they must go through the court system.