Controlling Person: Securities Law Liability, Defenses, and Penalties

Under federal securities law, a controlling person is anyone with the power to direct a company’s management and policies, and that status carries personal, joint and several liability for securities violations committed by the entity or individuals they control. The label attaches through Rule 405 of the Securities Act and Rule 12b-2 of the Exchange Act, and the liability flows from Section 15 of the Securities Act and Section 20(a) of the Exchange Act. Officers, directors, majority shareholders, and parent companies are the obvious candidates, but the definition reaches lenders, contract counterparties, and family members who exercise real influence. Defenses exist, but they turn on what the controlling person knew and did before anything went wrong.

How Federal Law Defines Control

Rule 405 defines control as the power, directly or indirectly, to direct the management and policies of a person or entity, whether through voting securities, by contract, or by other means.¹ Rule 12b-2 under the Exchange Act uses nearly identical language. Two features of that definition drive most of what follows. It does not require ownership of a single share, so a lender whose loan covenants grant veto power over major decisions can qualify. And it covers the power to direct rather than the active use of that power, so sitting on unused authority still counts.

Who Typically Qualifies

Certain positions carry a near-automatic presumption of control. A CEO, CFO, or other senior officer typically qualifies because they set strategy, approve disclosures, and run daily operations. Directors hold collective authority to hire and fire executives, approve major transactions, and set corporate direction. A shareholder holding more than 50 percent of the voting stock can elect the entire board and dictate policy, making the analysis straightforward.

Parent companies are controlling persons over subsidiaries when they retain the right to oversee operations, approve budgets, or direct financial reporting. What matters is the real-world power dynamic, not the org chart. If a parent tells a subsidiary’s management what to do and management complies, the parent controls regardless of how governance documents are worded.

Even without a majority stake, a significant minority holder can qualify. When a 15 percent block effectively decides every board election because no other shareholder owns more than 1 percent, regulators and courts will treat that holder as a controlling person.

Control Without Ownership

Influence often runs through channels that never show up on a shareholder list. Contractual arrangements are the most common route. A lender whose credit agreement requires written consent before the borrower can change ownership, pay dividends, or take on new debt exercises meaningful control over the company’s financial path. Management contracts that hand an outside firm authority over hiring, compensation, or operational decisions do the same.

Family relationships matter too. A chief executive’s spouse or sibling who informally shapes policy from behind the scenes can be designated a controlling person if regulators can show the influence directed real outcomes. Courts look for what securities lawyers call shadow directors: people who function as decision-makers without ever holding a formal title. The test is practical. Did this person have the ability to make the company do what they wanted?

What Controlling Persons Can Be Liable For

Two federal statutes anchor the liability, and they operate slightly differently.

Section 15 of the Securities Act makes a controlling person jointly and severally liable to the same extent as the controlled person for violations of the registration and disclosure requirements under that Act.² If a company issues securities with a materially misleading registration statement, the people who controlled that company face the same damages the company does. Joint and several means a plaintiff can collect the entire judgment from any single defendant, not just a proportionate share.

Section 20(a) of the Exchange Act reaches a broader range of conduct. Anyone who controls a person or entity found liable under any provision of the Exchange Act or its rules shares that liability jointly and severally.³ That includes fraud claims under Rule 10b-5, reporting violations, and market manipulation. A controlling person can face multimillion-dollar judgments for misconduct they did not personally commit, based solely on their position of authority over the person who did.

Section 11(f) of the Securities Act provides a right of contribution among jointly liable defendants. A controlling person who pays more than their fair share can seek reimbursement from other liable parties. That right disappears, however, if the person seeking contribution was guilty of fraud while the other party was not.

Defenses

Both statutes provide affirmative defenses, and the standards differ.

Under Section 15, a controlling person escapes liability by showing they had no knowledge of, and no reasonable ground to believe in, the facts that gave rise to the controlled person’s violation.² The burden falls on the defendant, and courts scrutinize whether the person should have known given their position. A CEO claiming ignorance of a registration fraud run by the company’s general counsel will struggle to make that showing.

Under Section 20(a), the defense requires proof of both good faith and the absence of any direct or indirect inducement of the violation.³ Good faith generally means maintaining reasonable compliance systems, responding to red flags, and not looking away. A controlling person who put a compliance program in place, ran regular audits, and acted promptly on problems has a far stronger defense than one who delegated oversight and moved on.

Most controlling-person disputes are won or lost here. Whether control existed is usually easy to answer for senior officers and majority shareholders. The real fight is over knowledge and good faith, and that fight is shaped by decisions the controlling person made long before any lawsuit arrived.

What a Plaintiff Has to Prove

Federal courts split on the elements of a Section 20(a) claim. Every circuit requires two things: a primary securities violation by the controlled entity, and a showing that the defendant actually controlled that entity. The disagreement is over whether the plaintiff must also prove culpable participation, meaning the controlling person played some role in the underlying wrongdoing.

Most circuits, including the First, Fifth, Sixth, Seventh, Eighth, Ninth, and Tenth, say no. Control and a primary violation are enough, and the burden then shifts to the defendant to establish good faith. The Second and Third Circuits take the narrower view, requiring the plaintiff to show culpable participation before liability can attach. Where the case is filed can therefore change the outcome.

Civil Penalties

SEC civil monetary penalties run on a three-tier structure, adjusted annually for inflation. As of the January 2025 adjustment, the per-violation maximums for individuals are:⁴

Tier 1, for technical violations: up to $11,823 per violation.
Tier 2, for fraud or reckless disregard: up to $118,225 per violation.
Tier 3, for fraud causing substantial losses: up to $236,451 per violation.

The caps for entities are higher: $118,225 at Tier 1, $591,127 at Tier 2, and $1,182,251 at Tier 3. Because these are per-violation figures, a pattern of misconduct can generate totals well above any single cap. A separate provision aimed specifically at controlling persons in insider trading cases authorizes penalties up to $2,626,135.⁴

Broker-dealer firms and their supervisors also face FINRA enforcement for failure to supervise. FINRA Rule 3110 requires every member firm to maintain a supervisory system reasonably designed to achieve compliance with the securities laws, and sanctions for supervisory failures can include fines, suspensions, and permanent industry bars.⁵

Reporting and Trading Obligations

Controlling person status triggers several ongoing filing and trading rules, each with its own penalties for noncompliance.

Schedule 13D at the 5 Percent Threshold

Anyone who acquires beneficial ownership of more than 5 percent of a class of registered equity securities must file a Schedule 13D with the SEC within 10 days of crossing the threshold.⁶ The filing must disclose the acquirer’s identity, funding sources, and whether the purpose of the acquisition is to gain control. A buyer who intends to influence corporate direction has to say so on the public record.

Section 16 and Short-Swing Profits

Directors, officers, and anyone who beneficially owns more than 10 percent of a registered equity security fall under Section 16 of the Exchange Act. Section 16 requires reporting of holdings and transactions and imposes a strict-liability rule on short-swing profits. If an insider buys and sells, or sells and buys, the same company’s equity securities within any six-month window, any profit from that pair of transactions belongs to the company.⁷ Good faith and lack of intent are not defenses. Any shareholder can sue on the company’s behalf to recover.

Form 4 After Every Trade

When a Section 16 insider executes a transaction that changes their beneficial ownership, they must file a Form 4 with the SEC before the end of the second business day after the trade.⁸ Filings go through EDGAR electronically. The tight deadline means insiders need systems that flag reportable transactions the day they happen.

Rule 144 Volume and Holding Limits

Controlling persons who want to sell into the public market face volume limits under Rule 144. In any three-month period, an affiliate of the issuer cannot sell more than the greater of 1 percent of the outstanding shares or the average weekly trading volume over the preceding four weeks. For restricted securities, affiliates of reporting companies must hold at least six months before reselling; affiliates of non-reporting companies must wait a full year.⁹

Time Limits on Claims

Private securities-fraud lawsuits must be filed within two years of discovering the facts making up the violation, or within five years of the violation itself, whichever comes first.¹⁰ The five-year outer limit is a statute of repose, a hard cutoff. Even a well-concealed fraud that stays hidden for six years is beyond reach after that.

Section 20(a) claims are derivative of the primary violation, so they follow the same clock. If the underlying Rule 10b-5 claim is time-barred, the controlling-person claim built on top of it falls with it. The two-year discovery period means a lawsuit can arrive years after the fact, but the five-year repose period does eventually close the door.

1
eCFR. 17 CFR 230.405 – Definitions of Terms
2
Office of the Law Revision Counsel. 15 USC 77o – Liability of Controlling Persons
3
Office of the Law Revision Counsel. 15 USC 78t – Liability of Controlling Persons and Persons Who Aid and Abet Violations
4
U.S. Securities and Exchange Commission. Inflation Adjustments to the Civil Monetary Penalties Administered by the SEC
5
FINRA. Rule 3110 – Supervision
6
Office of the Law Revision Counsel. 15 USC 78m – Periodical and Other Reports
7
Office of the Law Revision Counsel. 15 USC 78p – Directors, Officers, and Principal Stockholders
8
U.S. Securities and Exchange Commission. Form 4 – Statement of Changes in Beneficial Ownership
9
eCFR. 17 CFR 230.144 – Persons Deemed Not to Be Engaged in a Distribution and Therefore Not Underwriters
10
Office of the Law Revision Counsel. 28 USC 1658 – Time Limitations on the Commencement of Civil Actions Arising Under Acts of Congress