Criminal Penalties & Civil Liability

Overview

When a person violates the Uniform Securities Act (USA), the result can be either a criminal violation or a civil violation.

Criminal violations can lead to court-imposed fines and possible jail time.
Civil violations can lead to liabilities (typically restitution owed to an investor) and penalties imposed by the state administrator.

The key difference comes down to one question: Was the violation willful?

	Criminal violation	Civil violation
Willful?	Must be willful	May result from a non-willful violation
Imposed by	The U.S. court system (not the administrator); administrator typically works with the state attorney general	Liabilities owed to the investor (restitution); civil penalties imposed by the state administrator
Result	Court-imposed fines and possible jail time	Restitution / liabilities and administrator-imposed penalties
Statute of limitations	5 years (federal and state)	3 years, but no later than 2 years after discovery

🔑 Numbers & deadlines

This chapter is pure numbers. These are commonly swapped on the exam.

Item	Number	Notes
Criminal statute of limitations — state	5 years	A violation that occurred more than 5 years ago can’t result in criminal legal consequences
Criminal statute of limitations — federal	5 years	Same 5-year period at both levels
Criminal maximum fine — state law violations	$5,000	Per violation
Criminal maximum jail sentence — state law violations	3 years	Per violation
Criminal maximum fine — federal law violations	$10,000	Per violation
Criminal maximum jail sentence — federal law violations	5 years	Per violation
Per-violation stacking example	3 violations → $15,000 max fine and up to 9 years imprisonment	Penalties are levied on a per-violation basis
Civil liability statute of limitations (1956 USA — tested)	3 years, but no later than 2 years after discovery of the violation	NASAA continues to test the 1956 version
Civil liability statute of limitations (2002 USA — not tested)	Earlier of 2 years from discovery or 5 years from the violation	Most states still operate under statutes based on the 1956 Act
Rescission letter — client response window	30 days	No response within 30 days = same result as rejecting it
NASAA 2025 report — enforcement actions initiated by state administrators	1,183	Of which 145 were criminal enforcement actions

🔑 Memory shortcuts (statute of limitations – maximum fine – maximum jail)

Level	Shortcut	Expands to
Federal	“5-10-5 rule”	5-year statute of limitations, $10,000 maximum fine, 5-year maximum jail
State	“5-5-3 rule”	5-year statute of limitations, $5,000 maximum fine, 3-year maximum jail

These refer to: statute of limitations - maximum fine - maximum jail.

Criminal penalties

A willful violation means the person knew what they were doing before taking the action. When a violation is proven willful, criminal penalties may apply.

Criminal consequences aren’t imposed by the administrator. They’re handled through the U.S. court system.
The administrator stays in close contact with the legal system and petitions the court when seeking legal action. The state administrator typically works with the state attorney general to bring criminal charges.
There isn’t a specific list of USA provisions that must be violated to trigger criminal penalties. Instead, any willful violation can make a person subject to criminal charges and prosecution. In practice, the most serious violations are more likely to be pursued in court.
According to the North American Securities Administrators Association’s (NASAA’s) 2025 report, state administrators initiated 1,183 enforcement actions, of which 145 were criminal enforcement actions.

If the conduct is prosecuted criminally, a person could face:

Violation of	Maximum fine*	Maximum jail sentence*
State laws	$5,000	3 years
Federal laws	$10,000	5 years

*⚠️ These penalties are levied on a per-violation basis. For example, a person found guilty of three violations could face a maximum fine of $15,000 and up to 9 years of imprisonment.

Criminal prosecutions have a 5-year statute of limitations at both the federal and state level. That means a violation that occurred more than 5 years ago can’t result in criminal legal consequences.

If you want to see criminal enforcement actions your state administrator has participated in, start with NASAA’s ‘contact your regulator’ page to find your administrator. On the administrator’s website, look for an enforcement section. It typically includes actions involving registration, plus criminal and civil actions. For example, a historical summary of all enforcement actions taken by Colorado’s state administrator.

Civil liabilities

Even if a USA violation isn’t willful, it can still create civil liability. Civil liability usually comes up when an investor is owed restitution.

Example from the text: suppose an investment adviser representative (IAR) recommends that a client buy a security, but the security is a non-exempt, unregistered security. The only way to sell a non-exempt unregistered security is through an exempt transaction. If no exempt transaction applies, the security shouldn’t have been recommended or sold. In that case, the IAR (and, by extension, the investment adviser) could be liable for restitution.

The USA identifies three primary restitution categories tied to civil liability: securities sales, securities purchases, and investment advice. These apply when the transaction or advice is connected to a USA violation.

🔑 What an injured investor may recover (word-for-word)

Category	What is recovered (exact text)
Restitution for securities purchases (client buys)	“Original cost of the security” / “Less any income received from security” / “Plus the legal rate of interest” / “Plus any legal fees”
Restitution for securities sales (client sells)	“Client may recover (buy back) the security” / “Less any income paid by the security” / “Less any legal fees”
Restitution for investment advice	“Cost of the investment advice” / “Plus actual damages due to investment advice” / “Less any income received from security” / “Plus the legal rate of interest” / “Plus any legal fees”

Restitution for securities purchases (client buys)

Original cost of the security*
Less any income received from security
Plus the legal rate of interest**
Plus any legal fees

*⚠️ A common exam “trick” is whether the investor should be repaid the original cost or the current market value. It’s always the original cost. If an investor was sold a security illegally and its value later dropped, repaying only the current value wouldn’t make the investor whole.

**The legal rate of interest is set by each state administrator. It’s meant to compensate the investor for the time their money was tied up in an investment they shouldn’t have been sold.

Restitution for securities sales (client sells)

Client may recover (buy back) the security
Less any income paid by the security
Less any legal fees

Restitution for investment advice

Cost of the investment advice
Plus actual damages due to investment advice
Less any income received from security
Plus the legal rate of interest
Plus any legal fees

You don’t need to over-focus on the small differences among these formulas. The general idea is consistent: the investor should be made whole, and legal fees are typically recoverable.

One detail to keep straight: the legal rate of interest generally applies when the investor’s money was tied up (for example, after an improper purchase). It does not apply in the securities sale scenario (assuming a violation occurred). In that case, the investor’s remedy is to get the security back, along with any income the security paid while it wasn’t in the investor’s possession.

Two ways a civil liability can be settled

Method	Description
Right of rescission	The registered person proactively contacts the client in writing and offers restitution
Legal actions	The client pursues arbitration or a lawsuit

Right of rescission

If a registered person discovers they violated the USA during a securities transaction and/or while providing investment advice, they can try to fix the problem proactively. The USA provides a right of rescission, which allows the registered person to contact the client and offer restitution. The offer must be in writing and is commonly called a rescission letter.

The rescission letter offers the same restitution described above, depending on the situation. Example from the text: assume an agent mistakenly sells a non-exempt unregistered security to a client and no exempt transaction applies. To reduce future legal risk, the agent sends a written rescission letter offering to buy back the security at its original cost, minus income received from the security, plus the legal rate of interest and legal fees (if any).

🔑 After receiving the letter, the client has a few options:

Client’s response	Result
Accepts the offer	Client returns the security and receives restitution
Rejects the offer	The agent is released from future liability related to that transaction
Doesn’t respond within 30 days	Same result as rejecting it — the agent is released from future liability

Legal actions

If the registered person doesn’t offer a rescission letter, the client can pursue legal action. In most cases, this means arbitration or a lawsuit, depending on the client’s agreement with the firm.

Most financial firms require clients and customers to sign arbitration agreements, which prevents the client from suing in court. In that case, the dispute goes to arbitration.
If no arbitration agreement exists, the client may file a lawsuit.
Whether the case goes to arbitration or court, the client is generally seeking the same restitution described above. Legal fees are often highest in these situations because of the cost of pursuing arbitration or litigation.

🔑 Civil statute of limitations & survival

Civil liabilities have a 3-year statute of limitations, but no later than 2 years after discovery of the violation.
Civil liabilities also survive the death of all parties. If a client dies before pursuing arbitration or a lawsuit, the client’s estate may proceed on the client’s behalf.
⚠️ While the 2002 version of the Uniform Securities Act uses a different limitations period — the earlier of 2 years from discovery or 5 years from the violation — NASAA continues to test the 1956 version because most states still operate under statutes based on the 1956 Act.

What if a registered person makes an unethical or fraudulent securities-related offer, but no transaction occurs? For example, an agent offers a customer an unregistered, non-exempt security, but the customer rejects the offer.

In that situation, the customer or client can’t bring a civil action (such as filing a lawsuit). Civil restitution is tied to losses or costs from a transaction or from accepting investment advice. If the customer rejects the offer or recommendation, there’s no transaction-based loss to rescind.
⚠️ Even so, the state administrator may still take action against a person for unethical or fraudulent offers, even if no transaction occurs and no advice-related charges are assessed.

Civil penalties

Separate from civil liabilities owed to clients, the administrator may impose a civil penalty for (non-willful) USA violations. These are essentially fines assessed against registered persons and are often used for repeat offenders. Each state sets its own penalty structure.

Term	Definition	Example
Civil liability	Restitution owed to an investor arising from a (possibly non-willful) USA violation	IAR sells a non-exempt unregistered security; client is owed original cost less income, plus legal interest and legal fees
Civil penalty	A fine assessed by the state administrator for a (non-willful) USA violation	Often used for repeat offenders; each state sets its own penalty structure
Willful violation	The person knew what they were doing before taking the action	Triggers criminal penalties through the court system
Legal rate of interest	Rate set by each state administrator to compensate the investor for the time their money was tied up	Added to restitution after an improper purchase
Right of rescission	A written offer (rescission letter) from the registered person to the client offering restitution	Agent offers to buy back the security at original cost, less income, plus legal interest and legal fees

Key points

Criminal penalties

Must involve a willful violation of the law
5-year statute of limitations
Potential penalties:
- $5,000 maximum fine
- 3-year maximum jail sentence

Civil liabilities

May result from a non-willful violation of the law
Can involve a lawsuit or arbitration
Can be avoided through the right of rescission