"Why aren't we holding the individuals responsible for the financial crisis accountable?" It is a question that has been repeated so many times over the last five years that no one seems to expect an answer. But the question was raised again recently by Benjamin Lawsky, head of the New York State Department of Financial Services, with a public promise to name names and hold individuals accountable in enforcement actions going forward.

In public remarks before the Exchequer Club in Washington, Lawsky stated that in order to deter misconduct and incentivize ethical behavior on Wall Street, regulators must not only hold corporations accountable, but also the individuals who engaged in the misconduct on behalf of the corporation.

First, he stated that regulators "should publicly expose—in great detail—the actual, specific misconduct that individual employees engage in." Second, he stated that "where appropriate—individuals should face real, serious penalties and sanctions when they break the rules." To this end, in addition to imprisonment for criminal violations, Lawsky proposed "suspensions, firings, bonus claw-backs, and other types of penalties in the regulatory context."

What is clear from these statements is that there will be a real, concrete attempt by DFS – and we expect other regulators as well – to name names and hold individuals accountable in enforcement actions. While it would be hard for anyone to disagree with the basic proposition that individual bad actors should be held accountable for their conduct, a concerted effort to go after individuals raises two significant questions. First, what precautions should regulators take to ensure that innocent individuals are not swept up in an aggressive enforcement effort? And second, outside of the criminal context, what regulatory sanctions are appropriate for individual actors?

A primary concern when it comes to pursuing individuals is the risk of irreparable reputational and other damage they may incur when facing allegations that may not ultimately result in any finding of misconduct. To his credit, Lawsky recognized that "when you're talking about an employee's reputation, career, or even personal liberty, you have to have a very high degree of confidence that the action you're taking is just and fair. And you need strong evidence regarding an individual's misconduct before you proceed."

To put these considerations into practice, we would propose that DFS, and any enforcement authority that actively seeks to hold individual actors accountable, implement reasonable procedural protections for individuals who are the subjects of investigations.

First, we would propose that any individual who is the target of an investigation receive a confidential notice of investigation that details the allegations against them and provides an opportunity to respond. There is ample guidance on implementing such procedures from the Securities and Exchange Commission's Wells process, which enforcement authorities could look to in developing their own standards for the issuance of a notice, and the process for consideration of an individual's response. It is critical that the process remains confidential so individuals are not subjected to reputational harm from allegations that may not ultimately warrant an enforcement action.

Next, after receipt of the individual's response, if the enforcement authority determines an enforcement action is warranted, the individual should be provided an opportunity to appeal to an ombudsman before an action is filed or the investigation is otherwise made public. An ombudsman process will provide a layer of protection against potentially overzealous enforcement personnel, ensure that there is a heightened level of objectivity in the enforcement decision and add credibility to the agency's decision.

DFS, and other regulatory agencies considering similar action, also should publish the standards it will use in deciding when to bring actions against individuals and allow for public comment before finalizing these standards. Published standards would serve as a deterrent to bad behavior by sending a clear signal to financial services employees regarding what constitutes conduct for which they may incur personal liability. Such standards also would serve as a guide for regulatory personnel regarding when pursuit of individuals is appropriate and when it is not.

Getting these standards right will be necessary to have a deterrent effect and to promote fairness. For instance, while a corporation may have vicarious liability for the actions of even low-level employees, holding an executive personally liable for hard-to-detect misdeeds by a junior employee would be unfair and undermine public support. On the other hand, reckless disregard for basic financial prudence in creating products or setting corporate underwriting criteria might appropriately be laid at the feet of the executives who made such decisions.

Of course, if an employee has been involved in criminal activity, then law enforcement will seek appropriate punishment. What will be the harder case is where individual conduct by a decision maker reflects risk taking or bad judgment that is not criminal, but has damaged an institution or its customers. In such instances, DFS might seek disgorgement of large bonuses the employee received that turned out to be unjustified because of the long-term damage the employee's actions inflicted on the company.   

It appears inevitable that DFS and other financial enforcement authorities will be naming names in future enforcement actions. While few would argue with attempts to deter individual misconduct and incentivize ethical behavior, it will be important for agencies to proceed cautiously when pursuing individuals, following defined procedures that take into consideration their unique and more vulnerable position.

Jeremiah S. Buckley and Ann D Wiles are attorneys at BuckleySandlerLLP.