Two years after proposing rules on climate change disclosure, the SEC has adopted new rules, predictably by a split 3-2 vote. The adopted rules maintain the core of the original proposals, requiring that both domestic companies and foreign private issuers disclose the actual and potential impacts of climate change as well as management and governance processes to address those impacts. In the face of public comments highlighting the costs, burdens, and practicality of some aspects of the proposals, and political opposition, the SEC materially paired back the proposals, most significantly dropping the requirement to disclose Scope 3 greenhouse gas (GHG) omissions data relating to downstream and upstream sources, such as by vendors and customers. However, as described in our recent report, California’s new rules will require Scope 3 information for companies doing business in California if implemented in their current form.

In May 2023, the SEC adopted final rules amending disclosure rules for public companies engaged in equity buy-back programs. We have detailed those rules in our client alert available here. 

The new rules were challenged in court, and on October 31, 2023, the Fifth Circuit Court of Appeals held that the SEC acted arbitrarily and capriciously, in violation of the Administrative Procedures Act (APA), because it did not respond to petitioners’ comments submitted to the SEC on its then-proposed rules, and failed to conduct a proper cost-benefit analysis in adopting final rules. The petitioners’ comments suggested ways to obtain relevant data on the costs and benefits of the then-proposed rules. 

In July 2023, the SEC adopted new cybersecurity disclosure rules for public companies, which include new 8‑K reporting requirements that are effective beginning December 18, 2023 and new 10‑K or 20‑F annual report disclosure requirements that are due for all fiscal years ending on or after December 15, 2023. Thus, all calendar year companies will have to include the new disclosure in their annual reports.