Stepping-Stone Claims: The Next Wave of Director Liability in Australia

What is Stepping-Stone Liability?

The concept is deceptively straightforward. Where a company has been found to have breached the law, whether by regulatory enforcement, a penalty proceeding, or an agreed settlement, a shareholder may subsequently bring a derivative action against the company’s directors, alleging that those directors breached their duty of care and diligence under s 180(1) of the Corporations Act 2001 (Cth) by causing or permitting the company to commit the underlying contravention. The company’s own breach becomes the “stepping stone” to a finding of personal liability against the directors.

The shareholder then seeks an order that the directors personally compensate the company for its loss, typically measured by reference to the fine imposed on the company, though the claim may extend to consequential losses that exceed the penalty itself.

The theoretical foundations of this approach were laid in ASIC v Maxwell [2006] NSWSC 1052, where Brereton J observed that “[r]elevant jeopardy to the interests of the company may be found in the actual or potential exposure of the company to civil penalties or other liability under the Act.”[1]  However, the doctrine received its fullest articulation in the Storm Financial litigation, ASIC v Cassimatis (No 8) [2016] FCA 1023; (2016) 336 ALR 209.[2] In that case, Edelman J (as his Honour then was) found that ASIC had relied upon an actual breach by Storm Financial as a “stepping stone” for a finding that Mr and Mrs Cassimatis contravened s 180(1).[3]

ASIC’s case in Cassimatis proceeded in two steps. First, ASIC proved that Storm Financial had actually contravened the Corporations Act by providing inappropriate financial advice in breach of s 945A(1)(b) and (c). Second, ASIC demonstrated that the directors had breached s 180(1) by exercising their powers in a manner which caused or permitted (by omission to prevent) that inappropriate advice, thereby exposing Storm to a foreseeable risk of harm, including the loss of its Australian Financial Services Licence. Critically, Edelman J noted that s 180(1) does not impose a general obligation on directors to ensure corporate compliance with the law; the duty is not one of strict liability. Nevertheless, his Honour held that there will be cases where it constitutes a contravention of s 180(1) for directors to authorise or permit the company to commit contraventions, particularly where relevant jeopardy to the interests of the company exists.

The Full Federal Court upheld ASIC’s case on appeal in Cassimatis v ASIC [2020] FCAFC 52.[4] Greenwood J emphasised that the duty under s 180(1) was a norm of conduct of a public character, and that while the company’s contraventions were a necessary element of the harm, they were not sufficient by themselves to result in a contravention of s 180 by the directors, the foundation of liability resided entirely in the directors’ own conduct. Thawley J agreed, holding that s 180(1) applies according to its terms and that a company’s contravention might be a material fact relevant to whether a director failed to meet the requisite standard, but it is not an essential ingredient of liability in the way it is under accessorial liability.  Rares J dissented, viewing ASIC’s approach as an arcane and backdoor use of s 180(1).

The High Court subsequently refused special leave to appeal, leaving the Full Court’s decision as settled law.

The stepping-stone doctrine has since been applied and confirmed in subsequent decisions. In ASIC v GetSwift Ltd, Lee J confirmed that liability under s 180(1) is triggered where a director’s failure to exercise reasonable care and diligence has caused, or allowed, the company to contravene the Corporations Act, at least where it was reasonably foreseeable that such contravention might harm the company’s interests.[5]

For more than a decade, ASIC has relied upon the stepping-stone theory as a tool of regulatory enforcement.  However, a new and arguably more significant development is now emerging: the deployment of stepping-stone reasoning by private litigants, specifically, shareholders backed by litigation funders, to pursue derivative claims against directors for the company’s benefit.

Under ss 236 and 237 of the Corporations Act, a member may bring proceedings on behalf of a company with leave of the Court.[6] Where a director is found to have contravened s 180(1), the Court may order compensation to the corporation under s 1317H for damage resulting from the contravention.[7]  The combination of these provisions creates a pathway by which shareholders can effectively require directors to reimburse the company for fines and penalties that resulted from the directors’ alleged failure to prevent corporate wrongdoing.

The role of litigation funders in this emerging landscape cannot be understated.  Australian litigation funders commonly finance complex proceedings in return for a share of any recovery.  This economic model enables claims to be pursued that might otherwise never be brought, because the individual shareholder need not bear the financial risk of the proceedings.  For funders, stepping-stone claims represent an attractive proposition: the quantum of a potential recovery is often large (being measured by reference to a regulatory penalty already imposed) and the factual substratum of the claim, the company’s own contravention, has frequently already been established by a regulator or admitted by the company.

The first stepping-stone derivative action filed in Australia was brought against former directors and officers of SkyCity Adelaide Pty Ltd, following the imposition of a $67 million penalty on SkyCity for breaches of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).  That claim, sought to recover the company’s losses from its former directors. The SkyCity derivative action ultimately failed.

A second matter now looms.  ASX Limited settled ASIC proceedings in connection with misleading statements made to the market about the progress of its CHESS replacement project, agreeing to pay a $20.5 million penalty and contribute $3 million towards ASIC’s costs.  ASX has now disclosed that shareholder Rosherville Pty Ltd intends to seek leave to commence derivative proceedings against certain former officers and directors of ASX in connection with the failed project.  ASX itself is not accused of wrongdoing in the proposed action.

To the authors’ knowledge, if the anticipated ASX matter is filed, it will be only the second stepping-stone derivative action brought in Australia.

What is the Risk to Directors?

The emergence of stepping-stone derivative actions introduces a qualitatively different risk for Australian directors and officers. Whereas the regulatory enforcement model involves ASIC pursuing directors for breaches of their duties, with the attendant constraints of prosecutorial discretion, public interest considerations, and limited regulatory resources, the private derivative model is subject to no such limitations. Where an economic incentive exists for a litigation funder to back a claim, directors may face proceedings regardless of whether the regulator considered director-level enforcement appropriate.

The most immediate risk is personal financial liability for the full amount of any fine imposed on the company, or potentially greater damages encompassing consequential losses. In the ASX matter, the penalty and costs contribution total approximately $23.5 million. In the SkyCity matter, the AUSTRAC penalty was $67 million. These are not insignificant sums, and they represent the floor rather than the ceiling of potential exposure in a successful derivative claim.

The economics of litigation funding make stepping-stone claims particularly attractive to funders and therefore particularly dangerous for directors.  The essential elements of the claim, the company’s own contravention and the quantum of loss, are often already established by the time the derivative action is filed.  The company may have admitted the contravention, paid the penalty, or had liability determined against it in separate proceedings. The derivative claimant’s remaining task is to establish the causal nexus between the directors’ conduct and the company’s breach. For well-resourced funders assessing the merits of potential investments, this significantly de-risks the claim.

A further dimension of risk lies in the individual nature of liability under s 180(1). The standard of care is objective but applied by reference to the corporation’s circumstances and the office and responsibilities within the corporation that the officer held.  This means that exposure may differ markedly between co-directors, depending on their specific roles, committee memberships, and degree of involvement in the impugned decisions.  A director with portfolio responsibility for a failed project may face materially greater exposure than a non-executive colleague.  This divergence of interests has practical consequences for the conduct of any defence.

Beyond the immediate financial exposure, directors face a constellation of ancillary risks.  A finding of contravention of s 180(1) may support an application for a disqualification order, preventing the individual from managing corporations for a period.  The reputational damage attendant upon being named as a defendant in high-profile derivative proceedings, particularly where the underlying corporate failure has already attracted public attention, may be severe and enduring.  The distraction of defending such proceedings diverts management attention at precisely the moment when the company may be seeking to recover from the underlying compliance failure.

What Do Directors Need to Do to Protect Themselves?

The emergence of stepping-stone derivative actions demands that directors take proactive steps to manage their exposure. While the doctrinal landscape continues to develop, three areas of practical preparation warrant immediate attention.

1. First, directors must ensure they maintain adequate coverage under directors’ and officers’ liability insurance, and specifically review whether their existing policies contemplate stepping-stone claims. Many D&O policies were drafted in an era where director liability principally arose from regulatory enforcement or shareholder class actions alleging misleading disclosure. Derivative actions brought on behalf of the company against its own directors represent a different species of claim, and it cannot be assumed that all existing policies will respond. Directors should work with their brokers and insurers to confirm that their coverage extends to derivative proceedings, including those brought by shareholders with the backing of litigation funders. Particular attention should be paid to policy exclusions, sub-limits applicable to regulatory proceedings, and the treatment of penalties and fines.
2. Second, directors should obtain proper legal advice before making any decision that may financially impact the company and its shareholders. The business judgment rule under s 180(2) of the Corporations Act provides a safe harbour for directors who make informed, good-faith decisions. Directors who can demonstrate that they sought and considered appropriate legal and compliance advice before taking material decisions will be better placed to resist allegations that they failed to exercise reasonable care and diligence. The maintenance of contemporaneous records, board papers, risk assessments, legal opinions, and minutes recording the deliberative process, is essential to establishing this defence.
3. Third, in the event that a director is named in a stepping-stone claim, it is critical that the director obtains independent legal representation. Because the standard of care under s 180(1) is assessed by reference to each director’s individual office and responsibilities, the interests of co-directors named in the same proceedings may diverge significantly.  A director who served on the relevant committee, who had direct oversight of the impugned activity, or who received specific warnings about the risk in question may face materially different exposure from a colleague who did not. The individual nature of the enquiry means that what was reasonable for one director may not be the measure of what was reasonable for another. Joint representation in such circumstances carries obvious risks of conflict, and directors should ensure from the outset that their legal advisers are acting solely in their individual interests.

There is a legitimate debate about where responsibility for corporate failures should end. Large organisations make decisions through complex governance structures involving boards, executives, management committees, advisers, and regulators.  The prospect of shareholders retrospectively seeking to recover major corporate losses from individual directors may lead some to question whether the balance has shifted too far from entrepreneurial risk-taking towards defensive governance.

The resolution of that policy tension will be shaped, in significant part, by the outcome of the matters now before the courts.

[1]ASIC v Maxwell [2006] NSWSC 1052 per Brereton J at [104].

[2]ASIC v Cassimatis (No 8) [2016] FCA 1023; (2016) 336 ALR 209.

[3]The expression “stepping stone” was borrowed from Keane CJ in ASIC v Fortescue Metals Group Ltd [2011] FCAFC 19.

[4]Cassimatis v ASIC [2020] FCAFC 52.

[5]ASIC v GetSwift Ltd (Liability Hearing) [2021] FCA 1384.

[6]Corporations Act 2001 (Cth), ss 236–237.

[7]Ibid, s 1317H.