Handling confidential information – proposed ASIC best practice guidelines

Senior associate Stephen Layburn comments on the Australian Securities & Investment Commission's proposed best practice guidelines for handling confidential information in corporate transactions which, once finalised, New Zealand regulators may also seek to adopt.

In December 2009, the Australian Securities & Investment Commission (ASIC) released a consultation paper on proposed best practice guidelines for the handling of confidential information in corporate transactions. The guidelines are aimed at the listed company sector and are particularly relevant to price-sensitive information about capital raisings and M&A transactions.

Objectives

The proposed guidelines are aimed at helping (primarily) listed companies and their advisers, including investment banks to raise the bar, particularly in relation to internal policies and procedures for the handling of (price-sensitive) confidential information, with the objectives of protecting price-sensitive confidential information and avoiding any unintentional or deliberate misuse of that information. However, it is important to note that the guidelines are also intended to ensure an evidential trail is created to allow investigation of leaks (and insider trading) when required.

The publication of the proposed guidelines has been driven off a project undertaken by ASIC which identified a number of abnormal stock trading patterns (and a correlation to media leaks) immediately prior to the announcement of transactions. In particular, ASIC is concerned to ensure non-public, price-sensitive (confidential) information is not misused.

ASIC acknowledges that current market practice around the protection of confidential information varies considerably in Australia, and in many respects falls short of practice in other jurisdictions such as the United States, United Kingdom and Hong Kong. ASIC claims that the guidelines, if adopted, will bring Australia into line with international best practice and enable companies and advisers to benchmark their policies and practices. New Zealand listed companies (not just those listed on ASX) will wish to monitor this development not only because of the harmonisation of the law on insider trading with that in Australia but also because of the increasingly practical reality of the existence of one trans-Tasman market for securities trading. There is also the prospect that, with the current review of our securities laws, New Zealand regulators may become more proactive in seeking to guide the market on best practice including by proposing similar guidelines.

Key proposals

The proposed guidelines, which should be seen as part of a composite set of checks and balances that also incorporate the existing fiduciary and legal obligations of affected parties, include:

• Internal corporate polices and procedures: Companies should have clear, documented policies which establish the standards of behaviour and procedures for handling confidential information that all employees are expected to comply with. To assist with implementation, there should be a clear allocation of responsibility for overseeing these policies and procedures and the effectiveness of the policies should be reviewed regularly.

• The need-to-know principle: Only people who strictly require confidential information to undertake their business role should be given access to the information. Companies should take steps to minimise the risk of outsiders finding out about or speculating on an impending transaction. The guidelines identify a number of steps, such as physical separation of employees and procedures for information barriers, physical document management and information technology controls.

• Classification of documents: In the case of major transactions, information created by or given to a company should be classified according to the level of protection it requires. Such a system could prescribe the specific requirements for creating, distributing and storing each class of confidential information.

ASIC states that even basic security measures can greatly reduce the mismanagement of confidential information.

• Insider lists: Companies should maintain a register of all people (both internal and external) who are "insiders" on sensitive transactions. Third party advisers should be required to provide the company with up-to-date lists of all people within their firm who have access to the confidential information.

ASIC believes insider lists will help to limit the number of staff privy to confidential information by promoting the "need-to-know" principle.

• Leak investigations: Companies should have written polices and procedures on how a suspected leak is to be investigated and employees are to be made aware that such a process may be undertaken. Best practice requires that, w hen a leak is confirmed, each party with access to the information (including advisers and other third parties) should consider whether to conduct a formal (but proportionate) leak investigation to identify the source of the leak and take appropriate action. Whilst it is not clear what is meant by "proportionate", it is clear that such investigations are intended to be an internal matter only.

ASIC sees such a practice would act as a deterrent to employees who may otherwise be tempted to misuse a company's confidential information. The discussion paper also notes that, without being seen to have conducted an investigation, an organisation may have difficulty in asserting that there is insufficient evidence to suggest that a leak came from within their organisation.

• Umbrella agreements: It is proposed that companies that are active participants in M&A activities or capital raisings and who use the services of investment bankers and other external advisers on a regular basis should consider setting up umbrella agreements. These agreements would set out in advance the general practices and principles to be adhered to by the adviser, including the handling of confidential information.

ASIC sees such umbrella agreements acting as a sort of 'longstop' in the event that a specific confidentiality undertaking is overlooked in respect of a specific transaction or where an engagement letter is not signed immediately.

• Confidentiality agreements: Notwithstanding the presence of an umbrella agreement, all advisers s hould be required to enter into transaction-specific confidentiality agreements.

ASIC notes that companies should not rely on past dealings and expectations about the professionalism of advisers and that confidentiality agreements should cover related issues such as conflicts of interest and dealings with the press.

• Individual obligations: The discussion paper notes that highly sensitive transactions require more stringent policies and procedures and may trigger a requirement for employees to sign individual confidentiality agreements.

ASIC sees such an approach as being aimed at focussing the employee's mind on their responsibilities rather than relying on implicit or undocumented policies.

• Personal account dealing: The discussion paper proposes restrictions on employees with confidential information trading on the companies financial products (securities) with provision for pre-approval of trades, confirmation that that the trade has been completed and staff in sensitive roles being required to disclose their holdings on a regular basis (which extend to persons or entities over whom they have control).

ASIC sees such measures as part of a package of checks and balances to enable employees to satisfy themselves that they have done all they can to ensure that employees are not acting improperly. In large measure, such requirements are aimed at protecting reputation damage to the employer. In a New Zealand context, some of the disclosure issues are already dealt with by the comprehensive director and officer disclosures required by Part 2 of the Securities Markets Act 1988.

Advisers who regularly deal with price-sensitive confidential information relating to transactions from a range of parties should have controls over trading in financial products, and these should apply to all employees.

• Beauty parades: Conducting a "beauty parade" to select advisers for a specific confidential transaction is viewed by ASIC as involving a high risk of leaks. Potential advisers should sign confidentiality agreements before any confidential information is released to prospective advisers. Where possible, companies should keep the number of parties invited into beauty parades to a minimum (albeit recognising the importance of maintaining competitive tension in selecting advisers).

• Market soundings: The discussion paper notes that m arket soundings increase the risk of price-sensitive confidential information being misused. As a result, soundings should be a formal process that is well understood by the company and other participants. It is recommended that companies should require investment banks to seek their consent to sound the market. The discussion paper proposes a number of specific practices governing such soundings, including that soundings only take place when the market is closed or the particular security is in a trading halt, and the use of a formal script to govern soundings.

ASIC also proposes that, when a party is "brought over the wall" by means of a sounding, the investment bank should obtain written confirmation (e.g. by email) from the institution on various matters, including undertakings to comply with confidentiality and insider trading restrictions.

Perhaps most controversially, ASIC also proposes that details of soundings (including the parties who have been sounded out) should be notified to ASIC within 48 hours.

Legal risks

The risk areas identified by ASIC in relation to the handling of confidential information include:

• a confidential transaction (or an important aspect such as pricing) will be jeopardised or the company will have its business or reputation damaged;

• a director or employee engaging in insider trading; and

• the company being in breach of continuous disclosure obligations under stock exchange listing rules.

Whilst a failure to comply with the guidelines will not necessarily crystallise those risks, one of the key impacts of the guidelines is that (from an enforcement perspective) the records required by the guidelines would allow easier investigation of potential contraventions of the law.

Impact statement

The discussion paper notes that many companies (and their advisers) already have policies and procedures in place governing the handling of confidential information. As a result, it is stated that the guidelines are not expected to increase the compliance burden. However, the guidelines exceed most current understanding of best practice in Australia (and New Zealand).

Next steps

Submissions on the discussion paper closed on 21 February and a final regulatory guide is expected to be released in April.

As noted above, if the proposed guidelines are adopted, listed companies in New Zealand (and advisers) should consider following their Australian counterparts by reviewing their current policies and practices.

We will update you with any further developments.

Enquiries and information

For more information on any of the cases, articles and features in Commercial Quarterly, please email Diane Graham or call her on 64 9 916 8849.