In the month since I last wrote about prediction markets, the CFTC has proposed to further define the term “swap” to include event contracts, including those based on sports, politics, cultural, and weather-related events. The CFTC’s announcement of the proposal notes that “these contracts are financial instruments that are commonly known to the trade as swaps and proposes to resolve any ambiguity regarding these contracts.” At the same time, the CFTC issued an interim final rule codifying the agency’s longstanding position that gambling products (e.g., bingo games, lotteries and sportsbook and casino gambling), are excluded from the definition of “swap.” As the Mayer Brown Free writings + Perspectives blog notes:
Taken together, the Interim Final Rule and the [Notice of Proposed Rulemaking] represent a coordinated effort to distinguish state-regulated gambling from federally regulated event contracts and to remove the argument that treating event contracts as swaps would federalize every sportsbook wager. The releases are the latest in a series of CFTC actions affecting the prediction markets, including the June 2026 proposed rulemaking discussed in our prior post.
The CFTC itself is under scrutiny for its workforce reductions, with NPR recently reporting that the agency’s staffing is down 21% by the end of 2025. The article notes that the Government Accountability Office is currently investigating the staffing reduction at the CFTC, after Senator Elizabeth Warren called for an investigation into the agency’s staffing and reduction in enforcement actions back in July.
If you found yourself in a pumpkin patch during this past weekend, I hope that you spent a few minutes reflecting on the fact that Cybersecurity Awareness Month is quickly slipping away. For all who celebrate, Cybersecurity Awareness Month is “a global initiative every October that raises awareness about online safety and empowers individuals and businesses to protect themselves from cybercrime.” According to the National Cybersecurity Alliance (NCA) and Cybersecurity and Infrastructure Security Agency (CISA), this year’s theme for Cybersecurity Awareness Month is “Don’t Make it Easy for Them.” The NCA notes:
Staying safe online isn’t about making one perfect decision. It’s about building habits and repeating them consistently in the small moments that happen every day. In doing this, we can all make life difficult for cybercriminals.
Small actions make a big difference. We recommend starting with four easy steps anyone can take to boost their online safety:
• Use strong passwords and a password manager
• Turn on multifactor authentication
• Recognize and report scams
• Update your software
According CrowdStrike’s 2026 Global Threat Report, cybersecurity awareness is more important than ever as we enter the “the age of the AI adversary.” CrowdStrike notes:
The world is operating in the agentic era. Artificial intelligence is embedded across the modern enterprise. Agents write code, analyze data, orchestrate workflows, and make decisions at machine speed. Every layer of the enterprise is becoming faster and more automated. The adversary is operating in the agentic era as well.
In 2025, AI-enabled adversaries increased attacks by 89% year-over-year. AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. It elevated less sophisticated threat actors and amplified the most advanced ones. It compressed the time between intent and execution.
AI has also introduced a new dimension of risk: adversaries targeting the very AI systems underpinning the modern enterprise. As AI is embedded into development pipelines, SaaS platforms, and operational workflows, AI systems themselves become part of the attack surface. Adversaries exploited legitimate AI tools by injecting malicious prompts that generated unauthorized commands. As innovation accelerates, exploitation follows. Security must parallel the slope of innovation. In the agentic era, cybersecurity is the foundational infrastructure required to protect AI itself.
Come to think of it, after reading CrowdStrike’s 2026 Global Threat Report, I might just head back to the pumpkin patch and hide out there for a while!
Despite the thoughtful guidance from NCA and CISA for Cybersecurity Awareness Month, all of the password changes and multifactor authentications in the world are not going to help when the agentic AI hackers are attacking the backbone of the internet. Last week, the creators of PHP – which is a programming language used by up to 70% of the internet – released security patches for what this WSJ article describes as “one of the most severe online bugs ever.”
Companies, governments and other organizations have been in a race to patch their websites since the vulnerabilities have been announced, given the threat that AI agents can move with lighting speed and precision in targeting known (and unknown) vulnerabilities. As the WSJ article notes, some website operators (including national governments) simply shut down their websites last week, rather than run the risk of being hacked.
In the “you can’t make this stuff up” category, this Techzine article notes that the PHP Foundation which provides critical infrastructure for approximately 70% of all websites is run entirely on donations and has only one full-time employee! The organization’s struggle to raise funds and lack of staffing underscores how fragile our electronic underpinnings can be, making it a target-rich environment for AI and human hackers.
Hunkering down in that pumpkin patch is not looking so bad now!
Yesterday, ISS announced that the comment period on proposed changes to its benchmark voting policies is now open and will run through 5 p.m. ET on November 4, 2026. ISS is seeking input from investors, companies, and other market participants on its proposed voting policy changes for the 2027 proxy season.
Here is a summary of the changes applicable to the U.S. market and all markets globally from the summary section of the request for comments:
Bylaw Amendments – Management Proposals to Ratify Existing Charter or Bylaw Provisions: Clarifies the policy for situations where a management proposal seeking ratification of an existing governance practice or provision addresses the same topic as a shareholder proposal and is used to exclude a shareholder proposal from the meeting ballot.
Executive Compensation – Option Valuation Model: Removes references to ISS’ binomial option pricing model, replacing it with Black-Scholes as the methodology to be used for ISS’ valuation of options to calculate Shareholder Value Transfer (SVT) from 2027.
Climate Board Accountability: A global update to the Climate Board Accountability policy for ISS benchmark policies worldwide, codifying a fully case-by-case approach to this topic for all markets.
Risk Oversight – Cybersecurity and AI: All ISS benchmark policies on director elections globally contain a provision where, under extraordinary circumstances, material failures of risk oversight may be addressed as governance failures or egregious actions through recommendations on director elections. This global change adds cybersecurity and artificial intelligence-related risks to the named examples of possible factors in assessing material failures of risk oversight.
The request for comments then includes marked copies of the policies showing the exact changes proposed plus a more detailed rationale for each change.
The changes applicable to the U.S. market seem pretty light compared to some prior years, and notably, quite a few topics addressed in ISS’s recent survey are not reflected in the proposed policy changes. That’s not particularly surprising for some survey questions that asked a “what if,” assuming pending SEC proposals are finalized as proposed.
ISS expects to release its 2027 benchmark voting policies, which will be effective for shareholder meetings occurring on or after February 1, 2027, in late November or early December.
While I’m very happy to be home from our “2026 Proxy Disclosure & 23rd Annual Executive Compensation Conferences,” coming back to a freeze warning, a pile of backed-up work and an extremely busy week of kid activities has part of me wishing I was still in Orlando soaking up the sun and all the wisdom our incredible speakers shared last week. I want to reiterate John’s thanks to our valued sponsors, inimitable speakers, and everyone at CCRcorp who made our conferences possible, as well as our attendees who joined us in person and virtually! I may be biased, but I think this year’s content was particularly valuable. (There was no shortage of things to talk about!) And whether we’re a stone’s throw from Disney World or not, seeing so many members of this community in one room is always fun and magical! I mean, look at these pictures! Some highlights for me this year, unrelated to the substance, are:
– Our “Scary Stories” panelists really leaning into the theme
– Super fun thematic backgrounds, like the private jet in the perks panel and the hearth making the “Fireside Chats” feel cozy
– Learning “Somewhere Over the Rainbow,” which I used to sing to my kids at bedtime, in sign language from NASPP’s keynote speaker, Mandy Harvey
Needless to say, I’m already looking forward to next year’s conferences and pleased that we get to enjoy some warm weather again. Here are some Jeopardy-style little-known facts about next year’s host city. Can you guess where we’re going? Find out in the next blog!
– This city is known as the birthplace of jazz.
– This city is home to the world’s oldest continuously operating streetcar.
– This city is famous for a season of celebration that begins in early January.
– This city used to have more miles of canals than Venice.
A quick logistical note: If you registered for the Conferences, archived videos and transcripts are coming soon! (Look out for an email.) And please share your feedback in this experience survey. We also welcome you to send suggestions to our editorial team directly at any time. Our contact information is always at the bottom of our daily blog emails and on the “About Us” page on TheCorporateCounsel.net.
If you were playing the little-known facts Jeopardy in my prior blog and thought, “What is New Orleans?” you’re exactly right! Get ready to visit the French Quarter, listen to some jazz and enjoy some po’ boys and beignets!
We’ll be gathering in New Orleans for our 2027 Proxy Disclosure & 24th Annual Executive Compensation Conferences on September 21 & 22 (Tuesday & Wednesday). Which means I don’t have to wait a whole year for the annual event I look forward to most, and – with the conferences happening before the end of Q3 – I suspect many of our members will have a much easier time traveling. Win-win! More info forthcoming!
When Glass Lewis announced an open comment period on the four perspectives that will underpin its research beginning in September 2027, it noted that it will continue to offer its Benchmark Voting Policy Guidelines for the 2027 Proxy Season, to be announced in October, with minimal expected changes (limited to significant regulatory and corporate governance developments). Those Benchmark Voting Policy Guidelines — which will apply to shareholder meetings held from January 1 through August 31, 2027 — were quietly released (I believe) late last week.
When you open the guidelines, you’ll immediately notice that they contain no “Summary of Changes.” That’s because there were no changes to the U.S. guidelines from 2026. The preface to the guidelines explains:
Glass Lewis’ single house policy has traditionally anchored the regional benchmark guidelines. Given Glass Lewis’ announced intention to move away from this single house policy, towards multiple perspectives representing varied viewpoints of its clients, policy development has entered a period of transition. As such, the Glass Lewis 2026 Benchmark Policy Guidelines will remain static for 2027.
Glass Lewis, however, remains committed to keeping policies current during this transition phase by ensuring that any relevant changes to regulation or corporate governance practices are reflected in the Benchmark Policy guidelines. A review of market-level regulatory and best practice changes over the preceding year concluded that these guidelines do not require revision for 2027
I went to the shareholder proposals section to remind myself how Glass Lewis approached the shifting shareholder-proposal environment last year. The document still provides that:
[T]he Benchmark Policy will generally approach these matters with the basic premise that shareholders should be afforded the opportunity to vote on matters of material importance. To be sure, the Benchmark Policy respects the limitations placed on shareholder proponents, as certain shareholder proposals can unduly burden companies or cross the line between the purview of shareholders and that of the board. It also recognizes that not all shareholder proposals serve the long-term interests of shareholders. Nonetheless, the Benchmark Policy views the basic right of shareholders to file proposals as critical to the proper functioning of our system of corporate governance and in the best economic interest of all shareholders.
A number of important corporate governance reforms, such as declassified boards and majority voting, would not have been achieved without shareholders’ willingness and ability to submit proposals, for which they bear the costs and only realize a portion of the benefits. Empirical evidence has shown that even withdrawn shareholder proposals, such as those on executive compensation, can encourage beneficial corporate practices, thereby benefiting all shareholders.
Like last year, it also notes that it will closely monitor regulatory changes and their ramifications and that the benchmark guidelines may be updated prior to or during the proxy season should regulatory changes warrant.
We’ll be posting related resources in our “Proxy Advisors” Practice Area. We’ve also already created the “2027 Resources” subsection of our “Proxy Season” Practice Area, which is always a treasure trove of helpful resources by the time proxy season is in full swing.
Yesterday, Corp Fin posted new, revised and withdrawn CFIs. Some of the updates are cleanup, and others provide clarification – particularly regarding when an Item 2.01 (Completion of Acquisition or Disposition of Assets) 8-K must be filed. Here are links to the CFIs (or redlines, where revised), along with a brief description of what’s new:
Securities Act Forms, Section 115 Form S-3. General Instructions 1.A.1 to I.A.8 – Registrant Requirements, Revised Question 115.02 & Regulation S-K, Section 115. Items 308 and 308T – Internal Control over Financial Reporting, Revised Question 115.02
Both CFI updates clarify the consequences of failing to provide management’s report on ICFR pursuant to Item 308(a) of Regulation S-K and the consequences of being current but untimely after the Form 10-K is amended to provide management’s report — specifically to include the implications for incorporating by reference on Form S-1 or S-11 and to remove references to transitional Item 308T.
Exchange Act Form 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.01
Explains that registrants need only apply the applicable paragraph in Instruction 4 to Item 2.01 of Form 8-K when determining whether an acquisition or disposition is deemed to involve a significant amount of assets. Specifically, (1) a business development company that did not acquire or dispose of a business as determined under Rule 11-01(d) of Regulation S-X would only apply paragraph (iii) of Instruction 4, (2) a registrant that acquired or disposed of a business as determined under Rule 11-01(d) of Regulation S-X would apply only paragraph (ii), and (3) a registrant that is not a business development company and did not acquire or dispose of a business as determined under Rule 11-01(d) of Regulation S-X would apply only paragraph (i).
Exchange Act Forms 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.02
Clarifies that Instruction 4 does not require registrants to include probable acquisitions of related businesses, real estate operations, and funds with the related businesses, real estate operations, and funds that have already been acquired when assessing aggregate significance for purposes of Item 2.01 reporting because Item 2.01 of Form 8-K only requires disclosure regarding completed acquisitions.
Exchange Act Forms 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.03
Provides that registrants should use their most recent balance sheet required to be filed at or prior to the date of the acquisition or disposition, which may be an interim balance sheet, to derive “the total assets of the registrant and its consolidated subsidiaries” required for the significance test outlined in paragraph (i) of Instruction 4 to Item 2.01 of Form 8-K.
Exchange Act Forms 8-K, Section 110. Item 2.06 Material Impairments, Withdrawn Question 110.02 reflects a housekeeping update, withdrawing a now-irrelevant CFI.
I realize third-party tokenization was already a reality before the SEC’s Innovation Exemption order. But it sure feels like we’ve opened a Pandora’s box in the last few weeks. Every time I open LinkedIn, I see tokenization discussions. Sure, that’s partly the work of my algorithm, but there are many considerations for issuers, including some John shared last week. Luckily, there are also new resources available and some news reports on company objections to TSV notifications. Here’s a somewhat random grab bag of those resources and developments:
Yesterday, the Staff in the SEC’s Division of Trading and Markets issued these FAQs on the Innovation Exemption and a list of entities that have submitted written notice to the SEC that they intend to operate as a TSV pursuant to the TSV Exemption.
Earlier this week, the Securities Industry and Financial Markets Association (SIFMA) submitted a comment letter to the SEC reflecting input from its broker-dealer and asset manager members, plus the public companies that own them. Among other recommendations, SIFMA believes that a third-party tokenized version of a company’s NMS stock should only trade on a TSV after the company has given affirmative consent (i.e., an opt-in, not an opt-out).
Late last month, Nasdaq released a series of FAQs on the exemption, which highlight that there’s no requirement in the exemption that the tokens be interoperable across TSVs and that the lack of requirements related to price transparency on TSVs “effectively creates a shadow market for equity securities that can become disconnected from the broader market in both pricing and price transparency.” Nasdaq warns that this “impairs an issuer’s ability to maintain a complete, accurate and contemporaneous understanding of the price and trading behavior of its own securities” and that investors with poor outcomes on TSVs may blame the issuer. It concludes with the note that “As an issuer ourselves, having carefully reviewed and weighed these current considerations of the Innovation Exemption, we intend for Nasdaq, Inc. (Nasdaq: NDAQ) to opt out of TSVs.”
A group called the Issuer Sponsored Token Coalition has been formed around the goal that tokenized public securities preserve the fundamental relationship between an issuer and its shareholders.
We also now know that a number of well-known large caps have objected to having tokenized versions of their shares traded on the TSV jointly launched by the crypto exchange OKX and NYSE’s parent, Intercontinental Exchange.
There’s also this announcement from Securitize that it will offer security entitlements to shares of twelve well-known companies. While the press release notes that these security entitlements are expected to be eligible for trading on TSVs eventually, apparently (I’m not going to pretend I fully get this!), the structure of the tokens and the fact that secondary market trading is availble “in a regulated manner through its broker-dealer” means that this development is initially not relying on the TSV exemption.
See also these nine more things you should know about tokenization from Broc on the Governance Beat blog. Panelists at our Proxy Disclosure Conference also said some companies are considering the issuer-sponsored token route to get ahead of demand for tokenized securities and maintain control, for example, through the issuer-focused Nasdaq Equity Token.
This Ashurst Perkins Coie memo shares key takeaways from discussions with SEC Staff in the Division of Enforcement early this month at Securities Enforcement Forum Central and the 46th Annual Ray Garrett Jr. Corporate & Securities Law Institute. Here’s my high level summary:
– The Division is “being very thoughtful” and “thinking long and hard” about pursuing cases and whether to charge companies, with a focus on “bread and butter” securities fraud and a “quality over quantity” approach.
– As expected, the Division seeks to pursue individual bad actors “with particular attention to gatekeepers.”
– The focus on bread and butter securities fraud doesn’t mean that the Division isn’t pursuing enforcement of regulatory violations, which can be “deliberate and intentional.”
– The Staff is “receptive” to self reporting, and “where a company has identified an issue, self-remediated, and caused no investor harm, staff may decline to pursue enforcement on a case-by-case basis.” However, companies should expect enforcement to be pursued in the event of repeat violations or where it was aware of a violation harming investors.
– The Division’s new Financial Reporting and Accounting Unit can be distinguished from the Division’s former Task Force because the unit has its own “staff, management structure, and resources.” The Unit is expected to pursue “public company accounting fraud, non-GAAP disclosure cases, and auditor/gatekeeper matters,” with a focus on life sciences companies.
– Pursuing insider trading cases is a priority of the Division, and prediction markets got a lot of attention during the discussions.
– AI-related fraud is another Division priority. Agentic AI systems were highlighted as a key risk. And “subpoenas may increasingly request information about a company or individual’s use of AI, including prompts and chatbot logs, raising novel privilege and preservation questions.”
– Investigative practice has shifted. “The SEC is increasingly using voluntary document requests, in part because formal orders of investigation are harder to obtain under the current administration. Panelists advised pushing for subpoenas where possible because subpoenas typically trigger directors and officers (D&O) insurance coverage obligations.”
