The SEC's 54-Year No-Deny Rule Is Gone. Here's What Your Enforcement Response Playbook Needs Now.

TL;DR

• The SEC rescinded Rule 202.5(e) effective May 21, 2026. The rule had required settling parties not to publicly deny the agency’s allegations since 1972.
• Companies can now settle SEC enforcement actions and publicly contest the allegations. The SEC will not enforce existing no-deny clauses in prior settlements either.
• Denials carry real litigation, regulatory, and reputational risk from parties the SEC doesn’t control — civil plaintiffs, state AGs, DOJ, and FINRA.
• Most enforcement response playbooks were written around a no-denial default. They need to address the new option.

In 1972, when the SEC decided it wanted defendants to stop publicly contesting the facts in enforcement settlements, it wrote a rule and called it Rule 202.5(e). For more than five decades, settling parties had to agree, as a condition of any deal, that they would not publicly deny the agency’s allegations. If you settled, you stayed quiet.

On May 21, 2026, that rule ceased to exist.

SEC Chairman Paul Atkins announced the rescission with a brief statement: “Speech critical of the government is an important part of the American tradition.” The SEC press release confirmed that the Commission would also stop enforcing existing no-deny clauses already written into prior settlement orders — making the change retroactive from day one.

That’s a significant structural shift in how SEC enforcement settlements work. Understanding what changed, what didn’t, and what it means for your enforcement response protocol is now a real agenda item.

What Rule 202.5(e) Actually Said

The rule set a policy: the SEC would not settle an action imposing a sanction unless the defendant agreed not to publicly deny the allegations. In practice, that meant standard consent language. As the Commission’s own rescission release quotes it, a defendant agreed it “will not take any action or make or permit to be made any public statement denying, directly or indirectly, any allegations in the complaint or creating the impression that the complaint is without factual basis.”

This wasn’t ceremonial. It was baked into every settlement document. Companies couldn’t issue a press release disputing the characterization. They couldn’t have their CEO contest the findings on an earnings call. They couldn’t tell investors publicly that they thought the allegations were overstated. The settlement was the settlement, and the only public version of events was the SEC’s version.

The only remedy for a violation was to ask a court to vacate the settlement (or, in an administrative case, to reopen the proceeding). The SEC says it knows of no instance in which it sought to reopen a case over a breach. The no-deny clause was enforceable in theory. In practice, it was theatrical.

Why the SEC Killed It

The First Amendment is the backdrop. Courts upheld the policy, but defendants and media outlets kept challenging it, and Commissioner Hester Peirce had called it “unnecessary, undermines regulatory integrity, and raises First Amendment concerns” in a 2024 dissent. Chairman Atkins framed the announcement around speech. But the Commission’s release concludes that post-settlement denials do little harm to the public interest, then gives four additional reasons.

The remedy was never used. The SEC says it isn’t aware of ever asking a court to vacate a settlement, or reopening an administrative proceeding, over a breach. A rule whose only remedy goes unused for five decades is hard to justify on the merits.

Social media made policing impractical. What counts as a “public” denial — a tweet, a comment to an analyst, a statement in an earnings call, a response to a journalist? Defining the line had become genuinely ambiguous in the social media era.

No comparable rule elsewhere. Most federal agencies, including DOJ, operate without a no-deny requirement. The CFTC, which had its own no-deny policy, followed the SEC and rescinded it in June 2026.

Flexibility. The rule blocked settlements with defendants unwilling to sign a no-deny provision; rescission conserves resources and may speed returns to injured investors.

On process, the Commission’s release states the rescission is a general statement of policy and rule of agency procedure exempt from notice and comment, and found good cause to make it effective on publication.

Retroactivity: What Happens to Existing Settlements

Here’s where the rule change gets complicated in practice.

The SEC announced it will not enforce the no-deny provisions embedded in prior settlement orders. That non-enforcement position is explicit, immediate, and retroactive from May 21, 2026 forward. A company that settled an SEC enforcement action in 2019 can now issue a public statement contesting the underlying allegations. The SEC will not seek to reopen that settlement.

What this doesn’t change:

• The settlement contract itself still exists. The no-deny clause is still written into it. The SEC has unilaterally announced it won’t enforce it — but that’s not the same as deleting it.
• The penalties, disgorgement, and injunctions in the original order remain in force.
• The factual record the settlement created is still the factual record. A company that publicly disputes it is disputing findings it consented to without admitting or denying them.

The O’Melveny analysis is useful here: the retroactive non-enforcement is real, but it does nothing about the third parties who were affected by the original settlement and who might now use a public denial against the settling company.

If you have a prior settlement and you’re considering issuing a public denial now that the rule is gone, that conversation needs to happen with outside counsel, not communications.

What Changes in Enforcement Negotiations

The no-deny clause was, in practice, a secondary negotiating point. Companies spent most of their energy on the factual record — the specific allegations, the characterization of intent, the scope of conduct described in the order. The no-deny clause was a near-inevitable condition, barely negotiated.

Practitioners expect several dynamics to shift. The DLA Piper analysis flags that dropping the no-deny barrier may draw reluctant parties to settle and turns post-settlement communications into a new risk area. One more is our own read:

The factual record matters differently. If companies can now publicly contest allegations after settling, SEC enforcement staff may front-load more specific, documented facts in complaints and orders. The Commission anticipates being disputed; it will want a detailed record to respond to that dispute. This could make the factual record in SEC orders more granular, not less.

Settlement friction decreases. Some companies have historically been reluctant to settle because the no-deny clause felt like an admission in all but name. You couldn’t contest the narrative even if you technically didn’t admit the facts. That friction largely disappears. Some cases that were heading toward litigation may now settle.

Post-settlement communications become a strategic decision. Before the rescission, the calculus was simple: say nothing, move on. Now it’s a more complex question. Do we deny? Do we dispute some allegations and not others? Do we stay quiet because the risks outweigh the narrative benefit? Your public relations, legal, and compliance teams all have views on this. Without a framework, you’ll make the decision on the fly in a high-stakes moment.

The Risks That Don’t Go Away

The SEC changed its rule. The rest of the enforcement ecosystem did not. This is the part that gets missed.

Civil securities plaintiffs. Shareholder class action lawyers will monitor post-settlement public statements closely. A denial of the SEC’s allegations can be introduced in related securities litigation under Fed. R. Evid. 801(d)(2) as a party admission. If the denial is later shown to be false or inconsistent with the factual record, it creates additional exposure. If the denial is ambiguous, it creates discovery. Counsel at Vinson & Elkins put the framing well in their “Silence No More, But Speak With Care” analysis — this is the exact tension.

DOJ parallel proceedings. If the underlying conduct triggered a parallel criminal investigation, any public denial of the civil allegations is fair game for prosecutors. A public statement that contradicts facts admitted under a DPA, NPA, or guilty plea creates its own exposure with prosecutors. The SEC explicitly preserved its own discretion to seek admissions in cases with parallel criminal proceedings — which signals that the most serious conduct cases are likely to remain in admission territory regardless of the rescission.

State attorneys general. State AGs are not bound by the SEC’s rescission. A public denial of federal securities allegations does not shield a company from state securities enforcement under Blue Sky laws. Some states may treat a public denial as an affirmative representation subject to state fraud or consumer protection statutes.

FINRA. FINRA AWCs still contain their own no-deny clause: the respondent “may not take any action or make or permit to be made any public statement, including in regulatory filings or otherwise, denying, directly or indirectly, any finding in this AWC” (for example, the Revere Securities AWC from October 2026). Broker-dealers that settled with both the SEC and FINRA over the same conduct are still bound on the FINRA side.

Your next SEC examination. A company that publicly contests findings from a prior settlement may find future examination interactions more adversarial. In practice, exam staff have institutional memory. A candor and cooperation track record matters in exam cycles, and a high-profile denial of prior SEC findings doesn’t build it. This is informal, but it’s real.

The intersection of the SEC enforcement landscape and CCO personal liability adds another layer here. As covered in the CCO liability analysis from earlier this year, enforcement exposure for individual compliance officers is a real consideration in how companies respond to SEC matters — and post-settlement public statements that backfire can implicate compliance leadership.

What Your Enforcement Response Playbook Needs Now

Most corporate enforcement response protocols were written around a binary: settle, issue a brief factual statement about the resolution, move on. The no-deny clause made that binary stable. Now there’s a genuine option your playbook probably doesn’t address.

1. Add a post-settlement communications decision framework. Who makes the decision about public statements? The CEO? The board? Outside securities counsel only? What are the criteria — regulatory risk, civil litigation exposure, investor communications obligations, reputational considerations? What does the approval chain look like before anything goes public? Write this down before it becomes a live question.

2. Require outside counsel review of any post-settlement denial. Your communications team and your legal team have different instincts. One will want to tell your story. The other will want to manage exposure. The protocol should specify that no post-settlement denial goes out without outside securities counsel review — not just communications review, and not just in-house review.

3. Build in a parallel proceedings assessment. Before issuing any public denial, the protocol should require an affirmative answer to: Does this matter have DOJ exposure? State AG exposure? Active civil litigation? If the answer to any of those is yes or uncertain, the denial question becomes materially more complicated. This isn’t optional analysis — it’s a threshold requirement.

4. Update board-level notification procedures. If management is considering issuing a public denial after settling an SEC matter, does that require board notification? Does it affect disclosure obligations? The intersection with Item 1.05 cybersecurity reporting is one example — as covered last week, material events already carry their own disclosure clocks. Your board needs to know when management is making post-settlement public statements that could intersect with disclosure obligations.

5. Monitor the SEC enforcement pipeline for the new normal. The SEC’s enforcement back-to-basics approach from earlier this year signaled that the Commission is focused on substantive fraud, not procedural compliance. But the rescission of Rule 202.5(e) may change how enforcement staff drafts orders, how they present factual records, and how they approach settlement negotiations — watching early post-rescission orders will tell you a lot about how the dynamic is evolving in practice.

So What?

The SEC rescinding the no-deny rule is a real change. It removes a speech restriction that had been in place since 1972, and it gives companies a genuine option they didn’t previously have.

But the most dangerous misread of this development is treating it as a green light to publicly challenge SEC findings after settling. The rest of the enforcement ecosystem — civil plaintiffs, state AGs, DOJ, FINRA — didn’t change their rules. For most companies in most situations, the calculus will still favor staying quiet. The risk of speaking publicly is that you give your adversaries — the ones not bound by the SEC’s rescission — something new to work with.

What changed is that you now have a choice. And your enforcement response protocol needs to address that choice explicitly, with a framework, before the next investigation lands on your desk and someone has to decide under pressure.

Resources used to build this post:

• SEC Press Release: Commission Rescinds Policy Regarding Denials in Settlements of Enforcement Actions
• Sullivan & Cromwell: SEC Rescinds No-Deny Settlement Requirement
• DLA Piper: SEC Rescinds Decades-Old No-Deny Settlement Policy — Practical Implications
• Vinson & Elkins: Silence No More, But Speak With Care
• Gibson Dunn: Undeniably Deniable — SEC Rescinds Policy on Denials of Enforcement Settlements

Related reading on this site:

• SEC Enforcement 2026: Back to Basics, Fraud Focus, and Off-Channel Communications
• CCO Personal Liability: What the SEC and FINRA Are Actually Saying in 2026
• SEC Item 1.05 Cybersecurity Disclosure: The Materiality Clock and What Your Incident Response Plan Needs to Track

The enforcement response protocol itself is yours to write, with counsel. If an SEC exam or investigation has also exposed gaps in the documentation around it, the Compliance Essentials Bundle covers incident response and breach notification, business continuity, data privacy and SOC 2 readiness. It does not include enforcement response or settlement communications templates.