Stone v. Ritter, 911 A.2d 362 (Del. 2006)

HOLLAND, Justice:

This is an appeal from a final judgment of the Court of Chancery dismissing a derivative complaint against fifteen present and former directors of AmSouth Bancorporation (“AmSouth”), a Delaware corporation. The plaintiffs-appellants, William and Sandra Stone, are AmSouth shareholders and filed their derivative complaint without making a pre-suit demand on AmSouth’s board of directors (the “Board”). The Court of Chancery held that the plaintiffs had failed to adequately plead that such a demand would have been futile. The Court, therefore, dismissed the derivative complaint under Court of Chancery Rule 23.1.

The Court of Chancery characterized the allegations in the derivative complaint as a “classic Caremark claim,” a claim that derives its name from In re Caremark Int’l Deriv. Litig.1 In Caremark, the Court of Chancery recognized that: “[generally where a claim of directorial liability for corporate loss is predicated upon ignorance of liability creating activities within the corporation ... only a sustained or systematic failure of the board to exercise oversight — such as an utter failure to attempt to assure a reasonable information and reporting system exists-will establish the lack of good faith that is a necessary condition to liability.”2

In this appeal, the plaintiffs acknowledge that the directors neither “knew [n]or should have known that violations of law were occurring,” ie., that there were no “red flags” before the directors. Nevertheless, the plaintiffs argue that the Court of Chancery erred by dismissing the derivative complaint which alleged that “the defendants had utterly failed to implement any sort of statutorily required monitoring, reporting or information controls that would have enabled them to learn of problems requiring their attention.” The defendants argue that the plaintiffs’ assertions are contradicted by the derivative complaint itself and by the documents incorporated therein by reference.

Consistent with our opinion in In re Walt Disney Co. Deriv Litig, we hold that Caremark articulates the necessary conditions for assessing director oversight liability.3 We also conclude that the Caremark standard was properly applied to evaluate the derivative complaint in this case. Accordingly, the judgment of the Court of Chancery must be affirmed.

This derivative action is brought on Am-South’s behalf by William and Sandra Stone, who allege that they owned Am-South common stock “at all relevant times.” The nominal defendant, AmSouth, is a Delaware corporation with its principal executive offices in Birmingham, Alabama. During the relevant period, AmSouth’s wholly-owned subsidiary, AmSouth Bank, operated about 600 commercial banking branches in six states throughout the southeastern United States and employed more than 11,600 people.

In 2004, AmSouth and AmSouth Bank paid $40 million in fines and $10 million in civil penalties to resolve government and regulatory investigations pertaining principally to the failure by bank employees to file “Suspicious Activity Reports” (“SARs”), as required by the federal Bank Secrecy Act (“BSA”)4 and various anti-money-laundering (“AML”) regulations.5 Those investigations were conducted by the United States Attorney’s Office for the Southern District of Mississippi (“USAO”), the Federal Reserve, FinCEN and the Alabama Banking Department. No fines or penalties were imposed on AmSouth’s directors, and no other regulatory action was taken against them.

The government investigations arose originally from an unlawful “Ponzi” scheme operated by Louis D. Hamric, II and Victor G. Nance. In August 2000, Hamric, then a licensed attorney, and Nance, then a registered investment ad-visor with Mutual of New York, contacted an AmSouth branch bank in Tennessee to arrange for custodial trust accounts to be created for “investors” in a “business venture.” That venture (Hamric and Nance represented) involved the construction of medical clinics overseas. In reality, Nance had convinced more than forty of his clients to invest in promissory notes bearing high rates of return, by misrepresenting the nature and the risk of that investment. Relying on similar misrepresentations by Hamric and Nance, the AmSouth branch employees in Tennessee agreed to provide custodial accounts for the investors and to distribute monthly interest payments to each account upon receipt of a check from Ham-ric and instructions from Nance.

The Hamric-Nance scheme was discovered in March 2002, when the investors did not receive their monthly interest payments. Thereafter, Hamric and Nance became the subject of several civil actions brought by the defrauded investors in Tennessee and Mississippi (and in which Am-

South also was named as a defendant), and also the subject of a federal grand jury investigation in the Southern District of Mississippi. Hamric and Nance were indicted on federal money-laundering charges, and both pled guilty.

The authorities examined AmSouth’s compliance with its reporting and other obligations under the BSA. On November 17, 2003, the USAO advised AmSouth that it was the subject of a criminal investigation. On October 12, 2004, AmSouth and the USAO entered into a Deferred Prosecution Agreement (“DPA”) in which Am-South agreed: first, to the filing by USAO of a one-count Information in the United States District Court for the Southern District of Mississippi, charging AmSouth with failing to file SARs; and second, to pay a $40 million fine. In conjunction with the DPA, the USAO issued a “Statement of Facts,” which noted that although in 2000 “at least one” AmSouth employee suspected that Hamric was involved in a possibly illegal scheme, AmSouth failed to file SARs in a timely manner. In neither the Statement of Facts nor anywhere else did the USAO ascribe any blame to the Board or to any individual director.

On October 12, 2004, the Federal Reserve and the Aabama Banking Department concurrently issued a Cease and Desist Order against AmSouth, requiring it, for the first time, to improve its BSA/AML program. That Cease and Desist Order required AmSouth to (among other things) engage an independent consultant “to conduct a comprehensive review of the Bank’s AML Compliance program and make recommendations, as appropriate, for new policies and procedures to be implemented by the Bank.” KPMG Forensic Services (“KPMG”) performed the role of independent consultant and issued its report on December 10, 2004 (the “KPMG Report”).

Aso on October 12, 2004, FinCEN and the Federal Reserve jointly assessed a $10 million civil penalty against AmSouth for operating an inadequate anti-money-laundering program and for failing to file SARs. In connection with that assessment, FinCEN issued a written Assessment of Civil Money Penalty (the “Assessment”), which included detailed “determinations” regarding AmSouth’s BSA compliance procedures. FinCEN found that “AmSouth violated the suspicious activity reporting requirements of the Bank Secrecy Act,” and that “[sjince April 24, 2002, AmSouth has been in violation of the anti-money-laundering program requirements of the Bank Secrecy Act.” Among FinCEN’s specific determinations were its conclusions that “AmSouth’s [AML compliance] program lacked adequate board and management oversight,” and that “reporting to management for the purposes of monitoring and oversight of compliance activities was materially deficient.” AmSouth neither admitted nor denied FinCEN’s determinations in this or any other forum.

It is a fundamental principle of the Delaware General Corporation Law that “[t]he business and affairs of every corporation organized under this chapter shall be managed by or under the direction of a board of directors....”6 Thus, “by its very nature [a] derivative action impinges on the managerial freedom of directors.”7 Therefore, the right of a stockholder to prosecute a derivative suit is limited to situations where either the stockholder has

demanded the directors pursue a corporate claim and the directors have wrongfully refused to do so, or where demand is excused because the directors are incapable of making an impartial decision regarding whether to institute such litigation.8 Court of Chancery Rule 23.1, accordingly, requires that the complaint in a derivative action “allege with particularity the efforts, if any, made by the plaintiff to obtain the action the plaintiff desires from the directors [or] the reasons for the plaintiffs failure to obtain the action or for not making the effort.”9

In this appeal, the plaintiffs concede that “[t]he standards for determining demand futility in the absence of a business decision” are set forth in Rales v. Blasband.10 To excuse demand under Rales, “a court must determine whether or not the particularized factual allegations of a derivative stockholder complaint create a reasonable doubt that, as of the time the complaint is filed, the board of directors could have properly exercised its independent and disinterested business judgment in responding to a demand.”11 The plaintiffs attempt to satisfy the Rales test in this proceeding by asserting that the incumbent defendant directors “face a substantial likelihood of liability” that renders them “personally inter.-- sted in the outcome of the decision on whether to pursue the claims asserted in the complaint,” and are therefore not disinterested or independent.12

Critical to this demand excused argument is the fact that the directors’ potential personal liability depends upon whether or not their conduct can be exculpated by the section 102(b)(7) provision contained in the AmSouth certificate of incorporation.13 Such a provision can exculpate directors from monetary liability for a breach of the duty of care, but not for conduct that is not in good faith or a breach of the duty of loyalty.14 The standard for assessing a director’s potential personal liability for failing to act in good faith in discharging his or her oversight responsibilities has evolved beginning with our decision in Graham v. Allis-Chalmers Manufacturing Company,15 through the Court of Chancery’s Caremark decision to our most recent decision in Disney.16 A brief discussion of that evolution will help illuminate the standard that we adopt in this case.

Graham was a derivative action brought against the directors of Allis-Chalmers for

failure to prevent violations of federal antitrust laws by Allis-Chalmers employees. There was no claim that the Allis-Chal-mers directors knew of the employees’ conduct that resulted in the corporation’s liability. Rather, the plaintiffs claimed that the Allis-Chalmers directors should have known of the illegal conduct by the corporation’s employees. In Graham, this Court held that “absent cause for suspicion there is no duty upon the directors to install and operate a corporate system of espionage to ferret out wrongdoing which they have no reason to suspect exists.”17

In Caremark, the Court of Chancery reassessed the applicability of our holding in Graham when called upon to approve a settlement of a derivative lawsuit brought against the directors of Caremark International, Inc. The plaintiffs claimed that the Caremark directors should have known that certain officers and employees of Caremark were involved in violations of the federal Anti-Referral Payments Law. That law prohibits health care providers from paying any form of remuneration to induce the referral of Medicare or Medicaid patients. The plaintiffs claimed that the Caremark directors breached their fiduciary duty for having “allowed a situation to develop and continue which exposed the corporation to enormous legal liability and that in so doing they violated a duty to be active monitors of corporate performance.”18

In evaluating whether to approve the proposed settlement agreement in Care-mark, the Court of Chancery narrowly construed our holding in Graham “as standing for the proposition that, absent grounds to suspect deception, neither corporate boards nor senior officers can be charged with wrongdoing simply for assuming the integrity of employees and the honesty of their dealings on the company’s behalf.”19 The Caremark Court opined it would be a “mistake” to interpret this Court’s decision in Graham to mean that:

To the contrary, the Caremark Court stated, “it is important that the board exercise a good faith judgment that the corporation’s information and reporting system is in concept and design adequate to assure the board that appropriate information will come to its attention in a timely manner as a matter of ordinary operations, so that it may satisfy its responsibility.”21 The Caremark Court recognized, however, that “the duty to act in good faith to be informed cannot be thought to require directors to possess detailed information about all aspects of the operation of the enterprise.”22 The Court of Chancery then formulated the following standard for assessing the liability of directors where the directors are unaware of employee

misconduct that results in the corporation being held liable:

As evidenced by the language quoted above, the Caremark standard for so-called “oversight” liability draws heavily upon the concept of director failure to act in good faith. That is consistent with the definition(s) of bad faith recently approved by this Court in its recent Disney24 decision, where we held that a failure to act in good faith requires conduct that is qualitatively different from, and more culpable than, the conduct giving rise to a violation of the fiduciary duty of care (i.e., gross negligence).25 In Disney, we identified the following examples of conduct that would establish a failure to act in good faith:

The third of these examples describes, and is fully consistent with, the lack of good faith conduct that the Caremark court held was a “necessary condition” for director oversight liability, i.e., “a sustained or systematic failure of the board to exercise oversight — such as an utter failure to attempt to assure a reasonable information and reporting system exists ....”27 Indeed, our opinion in Disney cited Caremark with approval for that proposition.28 Accordingly, the Court of Chancery applied the correct standard in assessing whether demand was excused in this case where failure to exercise oversight was the basis or theory of the plaintiffs’ claim for relief.

It is important, in this context, to clarify a doctrinal issue that is critical to understanding fiduciary liability under Caremark as we construe that case. The phraseology used in Caremark and that we employ here — describing the lack of good faith as a “necessary condition to liability”- — is deliberate. The purpose of that formulation is to communicate that a failure to act in good faith is not conduct that results, ipso facto, in the direct imposition of fiduciary liability.29 The failure to act in

good faith may result in liability because the requirement to act in good faith “is a subsidiary element[,]” i.e., a condition, “of the fundamental duty of loyalty.”30 It follows that because a showing of bad faith conduct, in the sense described in Disney and Caremark, is essential, to establish director oversight liability, the fiduciary duty violated by that conduct is the duty of loyalty.

This view of a failure to act in good faith results in two additional doctrinal consequences. First, although good faith may be described colloquially as part of a “triad” of fiduciary duties that includes the duties of care and loyalty,31 the obligation to act in good faith does not establish an independent fiduciary duty that stands on the same footing as the duties of care and loyalty. Only the latter two duties, where violated, may directly result in liability, whereas a failure to act in good faith may do so, but indirectly. The second doctrinal consequence is that the fiduciary duty of loyalty is not limited to cases involving a financial or other cognizable fiduciary conflict of interest. It also encompasses cases where the fiduciary fails to act in good faith. As the Court of Chancery aptly put it in Guttman, “[a] director cannot act loyally towards the corporation unless she acts in the good faith belief that her actions are in the corporation’s best interest.”32

We hold that Caremark articulates the necessary conditions predicate for director oversight liability: (a) the directors utterly failed to implement any reporting or information system or controls; or (b) having implemented such a system or controls, consciously failed to monitor or oversee its operations thus disabling themselves from being informed of risks or problems requiring their attention. In either case-, imposition of liability requires a showing that the directors knew that they were not discharging their fiduciary obligations.33 Where directors fail to act in the face of a known duty to act, thereby demonstrating a conscious disregard for their responsibilities,34 they breach their duty of loyalty by failing to discharge that fiduciary obligation in good faith.35

The plaintiffs contend that demand is excused under Rule 28.1 because AmSouth’s directors breached their oversight duty and, as a result, face a “substantial likelihood of liability” as a result of their “utter failure” to act in good faith to put into place policies and procedures to ensure compliance with BSA and AML obligations. The Court of Chancery found that the plaintiffs did not plead the existence of “red flags” — “facts showing that the board ever was aware that AmSouth’s internal controls were inadequate, that these inadequacies would result in illegal activity, and that the board chose to do nothing about problems it allegedly knew existed.” In dismissing the derivative complaint in this action, the Court of Chancery concluded:

board. This is a case where information was not reaching the board because of ineffective internal controls.... With the benefit of hindsight, it is beyond question that AmSouth’s internal controls with respect to the Bank Secrecy Act and anti-money laundering regulations compliance were inadequate. Neither party disputes that the lack of internal controls resulted in a huge fine— $50 million, alleged to be the largest ever of its kind. The fact of those losses, however, is not alone enough for a court to conclude that a majority of the corporation’s board of directors is disqualified from considering demand that AmSouth bring suit against those responsible.36

This Court reviews de novo a Court of Chancery’s decision to dismiss a derivative suit under Rule 23.1.37

The KPMG Report evaluated the various components of AmSouth’s longstanding BSA/AML compliance program. The KPMG Report reflects that AmSouth’s Board dedicated considerable resources to the BSA/AML compliance program and put into place numerous procedures and systems to attempt to ensure compliance. According to KPMG, the program’s various components exhibited between a low and high degree of compliance with applicable laws and regulations.

The KPMG Report describes the numerous AmSouth employees, departments and committees established by the Board to oversee AmSouth’s compliance with the BSA and to report violations to management and the Board:

The KPMG Report reflects that the directors not only discharged their oversight

responsibility to establish an information and reporting system, but also proved that the system was designed to permit the directors to periodically monitor Am-South’s compliance with BSA and AML regulations. For example, as KPMG noted in 2004, AmSouth’s designated BSA Officer “has made annual high-level presentations to the Board of Directors in each of the last five years.” Further, the Board’s Audit and Community Responsibility Committee (the “Audit Committee”) oversaw AmSouth’s BSA/AML compliance program on a quarterly basis. The KPMG Report states that “the BSA Officer presents BSA/AML training to the Board of Directors annually,” and the “Corporate Security training is also presented to the Board of Directors.”

The KPMG Report shows that Am-South’s Board at various times enacted written policies and procedures designed to ensure compliance with the BSA and AML regulations. For example, the Board adopted an amended bank-wide “BSA/AML Policy” on July 17, 2003 — four months before AmSouth became aware that it was the target of a government investigation. That policy was produced to plaintiffs in response to their demand to inspect AmSouth’s books and records pursuant to section 22038 and is included in plaintiffs’ appendix. Among other things, the July 17, 2003, BSA/AML Policy directs all AmSouth employees to immediately report suspicious transactions or activity to the BSA/AML Compliance Department or Corporate Security.

In this ease, the adequacy of the plaintiffs’ assertion that demand is excused depends on whether the complaint alleges facts sufficient to show that the defendant directors are potentially personally liable for the failure of non-director bank employees to file SARs. Delaware courts have recognized that “[m]ost of the decisions that a corporation, acting through its human agents, makes are, of course, not the subject of director attention.”39 Consequently, a claim that directors are subject to personal liability for employee failures is “possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment.”40

For the plaintiffs’ derivative complaint to withstand a motion to dismiss, “only a sustained or systematic failure of the board to exercise oversight — such as an utter failure to attempt to assure a reasonable information and reporting system exists — will establish the lack of good faith that is a necessary condition to liability.”41 As the Caremark decision noted:

The KPMG Report — which the plaintiffs explicitly incorporated by reference into their derivative complaint — refutes the assertion that the directors “never took the necessary steps ... to ensure that a reasonable BSA compliance and reporting system existed.” KPMG’s findings reflect

that the Board received and approved relevant policies and procedures, delegated to certain employees and departments the responsibility for filing SARs and monitoring compliance, and exercised oversight by relying on periodic reports from them. Although there ultimately may have been failures by employees to report deficiencies to the Board, there is no basis for an oversight claim seeking to hold the directors personally liable for such failures by the employees.

With the benefit of hindsight, the plaintiffs’ complaint seeks to equate a bad outcome with bad faith. The lacuna in the plaintiffs’ argument is a failure to recognize that the directors’ good faith exercise of oversight responsibility may not invariably prevent employees from violating criminal laws, or from causing the corporation to incur significant financial liability, or both, as occurred in Graham, Caremark and this very case. In the absence of red flags, good faith in the context of oversight must be measured by the directors’ actions “to assure a reasonable information and reporting system exists” and not by second-guessing after the occurrence of employee conduct that results in an unintended adverse outcome.43 Accordingly, we hold that the Court of Chancery properly applied Caremark and dismissed the plaintiffs’ derivative complaint for failure to excuse demand by alleging particularized facts that created reason to doubt whether the directors had acted in good faith in exercising their oversight responsibilities.

The judgment of the Court of Chancery is affirmed.