Personal Exposure of Directors and Management During Regulatory Investigations

When a regulator investigates a company, directors and senior officers may assume that the corporate form shields them from personal scrutiny. Equally, some notices attribute responsibility to every member of management without identifying individual conduct. Both assumptions are unsound. Personal exposure depends on the relevant statutory provision and a defensible account of authority, knowledge and action.

Office alone does not answer every liability question

Some regulatory laws impose duties directly on directors, chief executives, compliance officers or persons controlling regulated functions. Others require participation, consent, connivance, neglect or a failure to discharge a defined duty. The correct test must be read from the applicable statute. A director's title should not substitute for an allegation identifying what the person was required to do and what conduct or omission is attributed to them. Conversely, an officer who actually directed unlawful activity cannot necessarily avoid responsibility by pointing to the company's separate identity.

Board records can support or undermine the defence

Minutes, delegations, committee charters, management reporting and dissenting opinions may establish who authorised a transaction or knew of a deficiency. Generic board resolutions prepared after the event cannot rewrite the historical chain of authority. A director relying on lack of executive involvement should examine whether regulatory duties nonetheless required oversight. A chief executive should be able to identify the compliance information received and the steps taken in response. The documentary record is more important than broad statements of good faith.

Conflicts require separate representation decisions

The company's interest in showing institutional compliance may differ from an individual's interest in contesting personal responsibility. Common representation is not always appropriate where the alleged breach concerns actions taken by one officer or instructions given to another. Counsel should consider privilege, access to records, potential witness positions and whether individual statements may prejudice the company. Investigation interviews should be managed carefully, with accurate notes and a clear distinction between personal recollection and corporate records. Destruction or alteration of material after notice may create a separate and serious concern.

Respond to the actual legal elements

A substantive response should organise each alleged contravention by provision, period, responsible function, documentary evidence and proposed consequence. If the regulator relies on an individual-liability clause, the response must address its specific elements rather than treat the dispute as solely corporate. Where an officer exercised reasonable oversight or took documented corrective steps, those facts should be placed before the decision-maker. Where a genuine breach occurred, remediation may be relevant to sanction but should not be inaccurately presented as proof that no breach existed.

Responsibility must be individual

The dividing line is the legal duty borne by the individual and the evidence of its discharge or breach. Management should maintain real delegations and reporting systems before any investigation, not create them retrospectively. In a live matter, distinct corporate and personal legal positions must be assessed at the outset.