[1110]*1110ORDER RE MOTION TO DISMISS CONSOLIDATED COMPLAINT
William Alsup, United States District Judge
INTRODUCTION
In this securities action, defendants move to dismiss in three separate motions. For the reasons stated below, the motions are Granted in part and Denied in part.
STATEMENT
At all relevant times, defendant Len-dingClub Corporation operated an online peer-to-peer marketplace to match borrowers and investors for a variety of loans. Defendant Renaud Laplanche founded the company and served as its chief executive officer and chairman of the board until May 4, 2016.
LendingClub did not itself originate loans. Once a borrower and a lender matched in the marketplace, LendingClub would contact a partner bank, which would originate the loan, disburse funds to the borrower, and immediately sell that loan to LendingClub. LendingClub purchased the loans with funds it received from the matched lenders. It then serviced the loans on behalf of its lenders. It generated its revenue from origination fees and servicing fees (Consolidated Compl. ¶¶ 12, 29-30).
Below is a diagram illustrating this process between a- borrower, B and a lender, L, as follows: (1) B and L match from the pools of borrowers and lenders in Len-dingClub’s marketplace, (2a) LendingClub directs a partner bank to (2b) initiate a loan to B, which loan the partner bank immediately sells (2c) to LendingClub, paid for with funds (2d) paid to Len-dingClub by L.
[1111]*1111[[Image here]]
On December 11, 2014, LendingClub completed an initial public offering of its common stock. Defendants Morgan Stanley & Co., LLC; Goldman, Sachs & Co.; Citigroup Global Markets Inc.; Allen & Company LLC; Stiefel, Nicolaus & Company, Inc.; BMO Capital Markets Corp.; William Blair & Company LLC; and Wells Fargo Securities, LLC, all served as underwriters of the IPO (collectively, the “underwriter defendants”). As part of the IPO, LendingClub issued a registration statement, which incorporated excerpts from LendingClub’s prospectus, prior quarterly reports, and a letter from CEO Laplanche. It filed that registration with the Securities and Exchange Commission.
The registration statement and documents incorporated therein included certain representations about LendingClub’s internal control procedures for financial reporting, which procedures would have prevented seíf-dealing, processing of improper loan applications, misleading investors, and irresponsible lending practices. Specifically, the registration statement stated LendingClub had evaluated the effectiveness of its disclosure controls and procedures, and concluded they “were effective at a reasonable assurance level” (id. ¶ 57).
The registration statement stated that LendingClub was “continuing to earn investor confidence every day by providing equal access and with [sie ] a level playing field with the same tools, data and access for all investors, small and large, within a fair and efficient marketplace” (id. ¶ 39). It further stated that LendingClub employed “Sophisticated Risk Assessment” with “proprietary algorithms,” and that its procedures used “behavioral data, transactional data and employment information to supplement traditional risk assessment tools, such as FICO scores to assess the borrower’s risk profile” (id. ¶45). Len-dingClub stated that it verified borrowers’ statements from numerous data sources. Based on its stated mission of transparency, LendingClub provided the full credit profile of a borrower to potential investors and indicated which data was verified (id. ¶¶ 45-47).
The registration statement described LendingClub’s data-seeurity protocols, as follows (id. ¶ 51):
We maintain an effective information security program based on well-estab[1112]*1112lished security standards and best practices, such as IS02700x and NIST 800 series. The program establishes policies and procedures to safeguard the confidentiality, integrity and availability of borrower and inventor information. The program also addresses risk assessment, training, access control, encryption, service provider oversight, an incident response program and continuous monitoring and review.
On February 11, 2016, LendingClub reported more than eight billion dollars in loan originations, revenues of more than four hundred million dollars, and net income of 4.6 million dollars (Bafus Decl., Exh. B at 4). Its prior years had operated with similar profit margins (see id, Exh. A at 11-13).
In a Form 8-K filing on May 9, 2016, less than eighteen months after the IPO, LendingClub reported that its board had accepted the resignation of CEO La-planche, the founder, chief executive officer, and chairman of LendingClub, which resignation “followed an internal review of sales of $22 million in near-prime loans to a single investor, in contravention of the investor’s express instructions as to a noncredit and non-pricing element” in the pri- or two months. LendingClub also reported that it had discovered Laplanche’s financial stake in a participant in the market, later revealed to be Cirrix (Bafus Deck, Exh. D at 2-3; Consolidated Compl. ¶¶ 105-06).
One week later, LendingClub’s quarterly report revealed that it had “identified material weakness,” including a “[l]ack of transparent communication and appropriate oversight” in dealing with investors. These weaknesses resulted from “the aggregation of control deficiencies related to the Company’s ‘tone at the top,’ ” which deficiencies “also existed at the end of 2015” (id ¶ 111).
LendingClub had previously determined that early in December 2009, CEO La-planche had artificially inflated loan origination volume by taking thirty-two loans for himself and several family members, in order to “increase reported platform loan volume” and that LendingClub had reported inflated asset values for its subsidiaries from 2011 through 2016 (id ¶ 60).
LendingClub stated that it needed to correct “material weaknesses in internal control over financial reporting identified in the first quarter of 2016,” which included the termination or resignation of three senior managers (id ¶¶ 115-17). These deficiencies included an inability to assure compliance with the company’s code of conduct and ethics policy, proper disclosure of related-party transactions, adherence to investors’ purchase specifications, and communication by management with risk and financial accounting departments (id ¶ 58).
That quarterly statement (dated May 16, 2016) also noted that on April 1, 2016, LendingClub invested ten million dollars in Cirrix Capital, L.P., a company formed in 2012 for the sole purpose of purchasing loans from LendingClub. It also disclosed that “from inception, LendingClub ... provided Cirrix with a credit-support agreement under which LendingClub assumed millions of dollars of risk for the loans it sold to Cirrix” (id ¶ 43). It also revealed that Laplanche (who had already resigned as CEO) and an outside board member, together with LendingClub held limited partnership interests and an aggregate of 31% ownership in Cirrix as of April 1, 2016 (Bafus Deck, Exh. E at 55-56).
On May 17, 2016, LendingClub acknowledged in a Form 8-K filing that it had discovered changes to the application dates on more than three hundred loans sold to one investor, after a review of a sub-committee of its board of directors found “a [1113]*1113gap in preventative controls related to data management.” It stated it corrected the problem less than forty-eight hours later (though there is no indication of how long it took before detection). LendingClub indicated it would be implementing certain “enhancements” to better monitor internal changes to key data and to subject such changes to review by an internal audit team (id., Exh. F; Consolidated Compl. ¶¶ 52-56).
LendingClub’s loan-approval process contained “large numbers of discrepancies and inconsistencies” (id. ¶ 48(a)). Some borrowers were allowed to apply for multiple loans; others’ lending history and income appeared implausible in light of their other circumstances; delinquent borrowers received new loans (to pay off their defaulted loans) at the same rates as they had before delinquency; borrowers were allowed to split larger loan requests in part, when they failed to qualify for the larger loan; and just before the IPO Len-dingClub reduced its loan-approval time from five-to-seven days to same-day approval (id. ¶¶ 48-50).
As many of these revelations came to light, LendingClub’s share price tumbled, and various securities rating agencies downgraded LendingClub.
In August 2016, the chief financial officer of LendingClub, defendant Carrie Do-lan, resigned from her position, after she had been asked to stay on to manage the crisis following CEO Laplanche’s departure. It was later revealed, however, that CFO Dolan had sold 135,000 shares of LendingClub stock (five percent of her holdings throughout the class period) in November and December 2015, still six months before the central issues here came to light (id. ¶ 123). Her stock holdings increased throughout the class period, however, because more than eight hundred thousand options vested (Bafus Deck, Exh. K).
[[Image here]]
Three now-consolidated actions were filed in federal court here in San Francisco in May and June of 2016. The actions were related to the undersigned judge in July 2016 (Dkt. No. 71). An order consolidated the actions and appointed the Water and Power Employees’ Retirement, Disability and Death Plan of the City of Los Angeles (“WPERP”) as lead plaintiff in August 2016 (Dkt. No. 90). In October 2016, an order approved lead plaintiffs selection of lead counsel (Dkt. No. 113).
WPERP filed the consolidated complaint in December 2016, alleging four claims and adding seventeen new defendants, namely, the outside directors of LendingClub at the time of the IPO and the underwriters. The four claims now alleged are: (i) violation of Section 11 of the Securities Act of 1933 against all defendants; (ii) violation of Section 15 of the Securities Act against CEO Laplanche, CFO Dolan, and the director defendants; (iii) violation of Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5 promulgated thereunder against LendingClub, CEO Laplanche, and CFO Dolan; and (iv) violation of Section 20(a) of the Exchange Act against LendingClub, Laplanche, and Dolan.
Defendants now move to dismiss with three motions. LendingClub, the director defendants, and CFO Dolan all move to dismiss in one motion (Dkt. No. 139). CEO Laplanche moves separately but joins in the LendingClub defendants’ motions (Dkt. No. 142). Underwriter defendants also move separately but join in the other two motions as well (Dkt. No. 149). This order follows full briefing and oral argument.
ANALYSIS
1. Section 11.
The consolidated complaint alleges that all defendants violated Section 11 of the [1114]*1114Securities Act of 1988. To recover under Section 11, a plaintiff who bought stock traceable to the registration statement must show that “any part of the registration statement, when such part became effective, contained an untrue statement of a material fact or omitted to state a material fact required to be stated therein or necessary to make the statements therein not misleading.” 15 U.S.C. 77k(a).
The registration statement represented that LendingClub’s CEO and CFO “concluded that [its] disclosure controls and procedures were effective at a reasonable assurance level” (Consolidated Compl. ¶ 57). Less than' eighteen months later, LendingClub admitted its internal controls suffered from various “material weaknesses” (id. ¶ 58). Lead plaintiff contends the statement in the registration statement was untrue or omitted facts regarding (i) the weaknesses in LendingClub’s internal controls,' (ii) LendingClub’s relationship with Cirrix, (iii) the adequacy of its loan-approval process, and (iv) the adequacy of its data integrity and security protocols.
. This order first addresses the applicable pleading standard.
A. Applicable Pleading Standard.
Defendants argue that our lead plaintiffs clahn under Section 11 must satisfy the heightened pleading standard of Rule 9(b), which requires a plaintiff “[i]n alleging fraud [to] state with particularity the circumstances constituting fraud.” Generally, a plaintiff pursuing a claim under Section 11 “need not prove ... that the defendant acted with any intent to deceive or defraud.” Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 575 U.S. ——, 135 S.Ct. 1318, 1333, 191 L.Ed.2d 253 (2015). A claim under Section 11 that is “grounded in fraud” must nevertheless be pled with particularity. In re Rigel Pharma., Inc., Sec. Litig., 697 F.3d 869, 885 (9th Cir. 2012).
A claim is grounded in fraud if it is premised on a “unified course of fraudulent conduct” and relies “entirely on that course of conduct as the basis of a claim.” Rubke v. Capitol Bancorp Ltd., 551 F.3d 1156, 1161 (9th Cir. 2009). Where a complaint “employs' the exact same factual allegations to allege violations of section 11 as it uses to allege fraudulent conduct under section 10(b) of the Exchange Act, we can assume that it sounds in fraud.” Ibid, (citing In re Daou Systems, Inc., Sec. Litig., 411 F.3d 1006, 1028 (9th Cir. 2005)).
Our lead plaintiff responds that the claims herein are not grounded in fraud. Indeed, the consolidated complaint expressly states, regarding the Section 11 claim, “[t]his claim is not based on and does not sound in fraud” (Consolidated Compl. ¶ 137). But merely disclaiming “any allegation of fraud in contention with the section 11” claim, is insufficient because “a plaintiffs nominal efforts to disclaim allegations of fraud with respect to its section 11 claims are unconvincing where the gravamen of the complaint is fraud and no effort is made to show any other basis for the claims.” Rigel, 697 F.3d at 885.
Our lead plaintiff ignores Rigel and Rubke entirely, offering no rebuttal to their concern about reliance on the very same allegations for both Section 11 and Section 10(b) claims. Instead, it cites Daou, 411 F.3d at 1028, as follows:
The only consequence of a holding that Rule 9(b) is violated with respect to a § 11 claim would be that any allegations of fraud would be stripped from the claim. The allegations of innocent or negligent misrepresentation, which are at the heart of a § 11 claim, would survive.
But lead plaintiff ignores the later discussion in Daou (also relied upon in Rub-ke ), noting that where the statement of a [1115]*1115Section 11 claim is simply a “ ‘wholesale adoption’ of the securities fraud allegations for purposes of the Securities Act claims,” the district court need not “sift through allegations of fraud in search of some ‘lesser included’ claim of strict liability.” Daou, 411 F.3d at 1028 (quoting Lone Star Ladies Inv. Club v. Schlotzsky’s Inc., 238 F.3d 363, 368 (5th Cir. 2001)).
Our lead plaintiff makes no effort to distinguish the factual bases for its Section 11 claim and its Rule 10b-5 claim. Rather, it engages in wholesale adoption of the facts for the former as the basis for the latter. In other words, our lead plaintiffs Section 11 claim relies on the very same allegations of false or misleading statements that purport to support its Rule 10b-5 claim. “Plaintiff must meet the heightened pleading requirements with respect to pleading a false or misleading statement.” Rigel, 697 F.3d at 886.
Accordingly, this order will not sift through each claim to attempt to find a lesser included theory of liability. The heightened standard of Rule 9(b) applies to lead plaintiffs entire complaint. Nevertheless, this order finds lead plaintiff has met that heightened standard with respect to three of its Section 11 claims, as now discussed.
B. Internal Controls over Financial Reporting.
Lead plaintiff alleges that defendants misrepresented the adequacy of LendingClub’s internal controls over its financial reporting. The registration statement represented that LendingClub’s CEO and CFO “concluded that [its] disclosure controls and procedures were effective at a reasonable assurance level” (Consolidated Compl. ¶ 57). Less than eighteen months later, however, LendingClub admitted its internal controls suffered from various “material weaknesses” (id. ¶ 58).
Defendants respond that lead plaintiff fails to plead facts showing that Len-dingClub’s statements about its internal controls in the registration were either false or omitted facts that were material at the time of the IPO in December 2011. Defendants’ argument rests on two points. First, they contend the consolidated complaint does not adequately allege that Len-dingClub employed the same control systems at the time trouble arose as it did at the time of the IPO. Second, even if the same control systems did exist, defendants argue the consolidated complaint lacks allegations showing those systems were inadequate at the time of the IPO. Both arguments fail.
LendingClub’s quarterly report in May 2016 (in which the problems were first described) admitted that the material weaknesses identified therein “also existed at the end of 2015 and therefore that [Len-dingClub’s] disclosure controls and procedures were ineffective and not operating at the reasonable assurance level as of December 31, 2015” (Consolidated Compl. ¶ 111). Defendants argue that lead plaintiff has failed to connect the dots between December 2015 and the IPO in December 2014.
The consolidated complaint expressly alleges that “the same material weaknesses existed at the time of the IPO” (id. ¶ 59). Though LendingClub never directly admitted that the same internal controls existed at the time of the IPO or that those controls suffered from material weaknesses at that time, the specific facts alleged in the complaint corroborate the express allegation to that effect. First, prior to LendingClub’s admission that its internal controls became inadequate, it issued consecutive quarterly reports averring that there had been no material change to the Company’s “internal control over financial reporting” from the start of 2015 through September of that year, and it did not [1116]*1116report a material change between September 2015 and December 2015 {ibid.).
LendingClub admitted that “[t]he identified material weakness is the result of the aggregation of control deficiencies related to the Company’s ‘tone at the top’ ” (Consolidated Compl. ¶ 111). LendingClub disclosed no changes to its senior leadership between the IPO and the time these material weaknesses emerged, so it appears the cause of the problem existed at the time of the IPO.
Moreover, two snafus indicate that Len-dingClub’s internal controls allowed inaccurate financial reporting years before the IPO. First, in 2009, CEO Laplanche took out thirty-two loans for himself and several family members, which loans constituted nearly ten percent of LendingClub’s market activity for the month. He did this for the purpose of “increasing reported platform loan volume” (Consolidated Compl. ¶ 60). Second, LendingClub admitted that between March 2011 and May 2016, it reported exaggerated values for loans brokered in LendingClub’s marketplace held as assets for several of its subsidiaries, resulting in underpayments to limited partners, indicating that LendingClub’s internal controls failed to prevent inaccurate financial reporting years before the IPO (Consolidated Compl. ¶ 61).
Our defendants contend this is not enough, citing In re Worlds of Wonder Securities Litigation, 35 F.3d 1407, 1419 (9th Cir. 1994). There, the plaintiff alleged the defendant failed to warn of an impending collapse of its sales after it began publicly offering so-called “junk bonds.” At summary judgment and with the benefit of discovery, the evidence failed to show any basis for inferring the company could have known of the problem at the time.
That is not our case. Most notably, we remain at the pleading stage. Under Rule 9(b), the consolidated complaint includes sufficient particular factual allegations beyond a bare assertion to support the express allegation that the control systems in place from December 2015 through March 2016 also existed in December 2014 at the time of the IPO, and that their inadequacies could have been discovered. As stated, several alleged inappropriate transactions had already slipped through the internal control systems. That is sufficient for now.
Defendants further contend that even if the internal control systems remained consistent from the IPO to May 2016, the consolidated complaint fails to show that the systems were inadequate at the time of the IPO. Rather, defendants speculate, the procedures in place may only have become deficient once LendingClub’s platform hit a certain scale, after the IPO. Notably, the May 2016 quarterly report only concluded those weaknesses extended back to December 31, 2015. But the complaint alleges that material problems with the control systems already existed at the time of the IPO, and the surrounding allegations support that conclusion.
First, contrary to defendants, the particular weaknesses in question appear agnostic to the scale of LendingClub. Specifically, LendingClub identified the “tone at the top,” compliance with ethics policies, disclosure of related-party transactions, and adherence to investors’ specifications for loans as some of its internal control problems. Corrupt practices from the get-go remain corrupt regardless of scale thereafter (Consolidated Compl. ¶ 58).
Second, even if these problems would have been benign at a small fledgling start-up but malignant once the company had exploded in popularity, the consolidated complaint shows that LendingClub had already hit its flash point by the time of its IPO. It reported that the quarter before its IPO included $1.4 billion in new loans {id. ¶ 55).
[1117]*1117Lead plaintiff has alleged with particularity the statements at issue herein regarding LendingClub’s internal controls— those in the registration statement — and the circumstances that allegedly proved those statements false — LendingClub’s own admissions that its internal controls were inadequate as of December 2015, and it has further alleged specific facts warranting the inference that the same circumstances existed as of the IPO.
Defendants also argue that lead plaintiff failed to adequately allege that these weaknesses in LendingClub’s internal controls were material. Here, the mere fact that CEO Laplanche had engaged in the improper transactions discussed above made the adequacy of LendingClub’s internal controls material. Reasonable investors would have found it important to know of CEO Laplanche’s prior efforts to drive his company’s performance with artificially initiated loans, and even more importantly, that LendingClub’s internal controls could not effectively curb the artifice. See In re Sipex Corp. Securities Litig., No. 05-00392, 2005 WL 3096178, at *2 (N.D. Cal. Nov. 17, 2005). The materiality of the omission of those material weaknesses (and the affirmative statement that the internal controls operated effectively) was adequately alleged.
Nor was it mere puffery. To the extent these material weaknesses in fact existed at the time of the IPO, a statement that the controls performed effectively and adequately would likely mislead an investor.
At this stage, the allegations relating to internal controls are adequate to state a claim under Section 11.
C. Cirrix.
Lead plaintiff contends Cirrix — a company formed in 2012 for the sole purpose of purchasing loans from Len-dingClub — and LendingClub were “related parties” at the time of LendingClub’s IPO in December 2014, yet the registration statement made no mention of Cirrix. The revelations in May 2016 showed that by the end of December 2015 CEO Laplanche and another board member held owned an aggregate of 12% of Cirrix; that by April 2016, LendingClub held a 15% interest, and that in the first quarter of 2016, Cir-rix’s loan purchases amounted to two-thirds of LendingClub’s loan-origination growth. Furthermore, from the inception of Cirrix in 2012, LendingClub agreed to provide millions of dollars in credit support for the loans in which Cirrix invested— effectively shifting the risk of loss back to LendingClub.
Defendants contend that lead plaintiff failed to show with particularity that Len-dingClub and Cirrix were “related parties” or that, through that relationship, Len-dingClub had taken on significant credit risk in its own market at the time of the IPO.
Both sides agree that Section 229.404 of Title 17 of the Code of Federal Regulations requires disclosure of transactions with “related parties” which are defined by the applicable accounting standards as follows (Consolidated Compl. ¶ 43 n.l):
Other parties that can significantly influence the management or operating policies of the transacting parties or that have an ownership interest in one of the transacting parties and can significantly influence the other to an extent that one or more of the transacting parties might be prevented from fully pursuing its own separate interests.
The parties disagree as to whether the consolidated complaint adequately alleges that Cirrix constituted a “related party” at the time of the IPO. Defendants also contend the consolidated complaint fails to adequately allege that LendingClub’s omission from the registration statement of any mention of its interest in Cirrix, or [1118]*1118that of CEO Laplanche or another director, was misleading.
LendingClub’s express admissions in its SEC filings only detailed its ownership interest as of April 2016 (and that of CEO Laplanche and another board member as of December 2015). Lead plaintiff contends the consolidated complaint offers additional allegations on point.
First, the complaint alleges that “at least one news report indicate[d]” that CEO Laplanche and his fellow board member’s relationship with Cirrix “predated the IPO,” (without identifying the source of that report). The complaint further alleges that Cirrix’s founding purpose as of 2012 was purchasing loans via Len-dingClub with the benefit of a credit-support agreement (Consolidated Compl. ¶ 43). Second, the complaint specifically alleges that Cirrix’s loan purchases “represent[ed] [twenty percent] of LendingClub’s ... loan-origination growth and nearly [five percent] of LendingClub’s total sales of whole loans in the last quarter before the IPO,” underscoring Cirrix’s interest in LendingClub (id. ¶ 38) (five percent of whole loan sales in that quarter constituted approximately eighteen million dollars total). Third, as lead plaintiff later learned, CEO Laplanche had already shown his willingness to engage in self-dealing to inflate LendingClub’s loan-origination volume.
Taken together, these allegations warrant the inference that either LendingClub or Cirrix could “influence the management or operating procedure” of or “significantly influence” each other at the time of the IPO. The allegations also warrant the inference that either party might have been “prevented from fully pursuing its own separate interests” as a result of that relationship. After all, LendingClub took on a significant credit risk on Cirrix’s behalf in the form of a credit-support agreement. This indicated that some of LendingClub’s sales arose inorganically and that Len-dingClub, not Cirrix, carried the risk of loss.
This contradicted statements in the registration statement that LendingClub did “not assume credit risk or use [its] own capital to invest in loans facilitated by [its] marketplace, except in limited circumstances and in amounts that [were] not material,” as well as Laplanche’s subsequent public statements to similar .effect (Consolidated Compl. ¶¶ 32, 44).
Defendants contend that the credit risk assumed by the credit-support agreement with Cirrix fell into the “amounts that . [were] not material” category identified in the registration statement. But, as stated, the credit risk assumed by the agreement with Cirrix covered twenty percent of Len-dingClub’s loan-origination growth and-nearly five percent of LendingClub’s total sales of whole loans in the quarter before the IPO. Given the thin margins on which LendingClub operated, the millions of dollars it assumed in credit risk could have wiped out its entire margin for a year. At this stage, lead plaintiff has adequately pled that LendingClub’s failure to disclose its relationship with Cirrix (and that of its senior leadership), and that such failure was material at the time of the IPO.
Moreover, setting aside the relatedness of Cirrix and LendingClub, investors would also have been interested to know that millions of dollars of loans were not the result of organic matches in the marketplace reflecting participants’ trust in LendingClub’s purportedly neutral platform, but were inflated artificially through self-dealing disguised as real transactions.
Lead plaintiffs claims relating to Cirrix survive.
D. Data Integrity and Security.
The registration statement represented that LendingClub employed “best prac[1119]*1119tices” to conduct “risk assessment, training, access control, encryption, service provider oversight, an incident response program and continuous monitoring and review” to maintain the integrity of its data and to detect and prevent internal manipulation of that data, the program was based on “well-established security standards and best practices such as” two specific standards (Consolidated Compl. ¶ 51).
Its Form 8-K report filed on May 9, 2016, disclosed that CEO Laplanche had resigned amid the revelation that Len-dingClub had sold twenty-two million dollars in loans that did not comply with investors’ specifications. That discovery occurred during a review of a separate discrepancy that affected three million dollars in loans (Bafus Decl. Exh. D). Len-dingClub’s Form 8-K report filed on May 17, 2016, provided the details of the three-million-dollar discrepancy {id., Exh. F).
Specifically, in its May 17 filing, Len-dingClub reported that “a gap in preventative controls related to data management alongside other internal controls issues” allowed someone at the company to improperly change the application dates for 361 loans to a single investor, totaling three million dollars in loans, had been improperly changed, and that despite its data integrity and security protocols, those changes went unnoticed for some unspecified length of time. LendingClub corrected that discrepancy quickly after discovering it. LendingClub’s subsequent audit of its loans for the prior two years revealed no further improper alterations of data, but LendingClub identified several “enhancements” it would need to implement to bridge the gap in its data integrity and security protocols that it identified (Bafus Deck, Exh. F). (The specific details of the gap were not disclosed.)
The consolidated complaint alleges that LendingClub’s description of its data integrity and security protocols was false inasmuch as the “enhancements” implemented after LendingClub discovered a “gap in preventative controls related to data management” should have ■ already been in place pursuant to the standards it touted in its registration statement (Consolidated Compl. ¶¶ 51-56).
Defendants first argue that lead plaintiff failed to plead that any deficiency in Len-dingClub’s data-integrity and security protocols existed at the time of the IPO. This order rejects that argument. To accept defendants’ position, we would need to presume that LendingClub initially implemented compliant protocols and then subsequently substituted deficient protocols. That implausible scenario does not warrant consideration at this stage. Here, the alleged basis for the misstatement is pled with particularity: LendingClub touted compliance certain specific standards in its registration statement and it allegedly failed to implement those standards. That particular allegation is based on inferences warranted by the surrounding allegations.
Defendants also contend lead plaintiff failed to plead that these deficiencies were material at the time of the IPO. Not so. As discussed above, CEO Laplanche had already played fast and loose with disclosure requirements and data- manipulation. A reasonable investor would have wanted to know that the company’s data-integrity and security measures were not as effective at preventing and detecting such manipulation. . Those concerns would have been vindicated upon the revelation that some loan data had been improperly altered and that CEO Laplanche resigned amid allegations that an investor had been sold loans that did not comply with that investor’s specifications.
This claim is adequately pled.
[1120]*1120E. Loan-Approval Process.
Lead plaintiff next contends defendants misrepresented the details of its loan-approval process. CEO Laplanche, in a letter incorporated into the registration statement, touted LendingClub’s “maximum transparency” regarding the terms and performance of the loans available to investors and a “sophisticated risk-assessment” protocol that included “proprietary algorithms” and thorough “verification processes,” all of the foregoing subject to LendingClub’s internal control systems and data integrity protocols, discussed above (Consolidated Compl. ¶¶ 45-47). The consolidated complaint alleges, based on an unspecified source, that in advance of the IPO, LendingClub shrank its review time for loans from five-to-seven days to same-day approval. It further alleges that at an unspecified time and LendingClub began approving loan applications with “large numbers of discrepancies and inconsistencies,” and it began employing tactics, such as loan-splitting and underwriting, that purportedly hid the true risk of certain loans. These practices, the consolidated complaint alleges, resulted in “lower returns to [LendingClub’s] lenders due to increased delinquencies, defaults, and write-offs,” as allegedly indicated by Cir-rix’s decreasing returns in the quarters following the IPO (Consolidated Compl. ¶¶ 48-50).
Apart from the allegation that Len-dingClub shrank its approval time in advance of the IPO, however, the allegations that purport to support this claim include no information about when the purported practices arose (much less when they materially affected LendingClub’s business, if ever), and the emergence of these practices at some unspecified time does not warrant the inference that the practices existed at the time of the IPO. Accordingly, those allegations are not pled with particularity and cannot support this claim.
As to the shortened loan-approval time, lead plaintiff alleges that “[w]ith so little time, LendingClub could not possibly verify income information for all of its applicants,” rendering LendingClub’s assertions of “transparency” and “sophistication” false at the time of the IPO (Consolidated Compl. ¶ 48(e)). Defendants do not dispute the assertion that they could not timely verify income information for every applicant in the time allotted. Instead, they contend the consolidated complaint does not plead with particularity how failing to verify income information contradicted assertions of “transparency” and “sophistication,” or how such omissions were material beyond the bare assertion that it led to “increased delinquencies, defaults and write-offs” (see Consolidated Compl. ¶ 49). This order agrees.
Lead plaintiff has failed to alleged particularized facts supporting its claim that LendingClub made materially false representations at the time of its IPO regarding the transparency and sophistication of its loan-approval process. Nevertheless, lead plaintiff may seek leave to amend this claim to allege the purportedly obfuscated and unsophisticated practices with greater specificity or to allege further statements that may have been false in light of the implementation of any particularly pled practices.
2. Section 10(b) & Rule 10b-5.
Section 10(b) of the Securities Exchange Act of 1934 makes it unlawful for any person to:
use or employ, in connection with the purchase or sale of any security registered on a national securities exchange ... any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the [SEC] may prescribe as necessary or appropriate in [1121]*1121the public interest or for the protection of investors.
15 U.S.C. 78j(b). One such rule promulgated by the SEC is Rule 10b-5, which prohibits making “any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in light of the circumstances under which they were made, not misleading.” 17 C.F.R. 240.10b-5(b).
To sufficiently plead a primary violation of Rule 10b-5 based on misstatements, a plaintiff must adequately allege the following: 1) a material misrepresentation or omission by the defendant; 2) scien-ter; 3) a connection between the misrepresentation or omission and the purchase or sale of a security; 4) reliance upon the misrepresentation or omission; 5) economic loss; and 6) loss causation.
In re Rigel Pharma., Inc., Sec. Litig., 697 F.3d 869, 876 (9th Cir. 2012).
A plaintiff alleging securities fraud under Section 10(b) of the Securities Exchange Act of 1934 must “state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.” 15 U.S.C. 78u-4(b)(2). That is, plaintiff must allege particularized facts supporting a strong inference that defendants made false or misleading statements “intentionally or with deliberate recklessness.” Reese v. Malone, 747 F.3d 557, 569 (9th Cir. 2014). A strong inference is one that is “cogent and at least as compelling as any opposing inference one could draw from the facts alleged.” Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308, 324, 127 S.Ct. 2499, 168 L.Ed.2d 179 (2007). In evaluating scienter, the proper inquiry is not whether “any individual allegation, scrutinized in isolation, meets that standard,” but rather “whether all of the facts alleged, taken collectively” satisfy the scienter burden. Id. at 323, 127 S.Ct. 2499.
“The scienter of the senior controlling officers of a corporation may be attributed to the corporation itself to establish liability as a primary violator of [Section 10(b) and Rule 10b-5] when those senior officials were acting within the scope of their apparent authority.” In re ChinaCast Educ. Corp. Sec. Litig., 809 F.3d 471, 475-76 (9th Cir. 2015).
Our lead plaintiff asserts claims under Section 10(b) via violations of Rule 10b-5 against LendingClub, CEO Laplanche, and CFO Dolan. This order need not address lead plaintiffs theory relating to the loan-approval process, which theory is inadequately pled for the same reasons addressed above. Lead plaintiff makes no effort to defend its fraud claim relating to data integrity and security, and there is no basis for a strong inference of scienter, so that claim is Dismissed. Lead plaintiff offers two theories under Section 10(b), however, that warrant separate consideration of the issue of scienter.
A. Internal Controls over Financial Reporting.
As discussed above, the complaint adequately and particularly alleges that material weaknesses in internal controls over financial reporting existed at the time of the IPO and throughout the class period. Beyond attacking this theory under Section 10(b) for the same reasons addressed above, our defendants only contend that the consolidated complaint lacks allegations supporting a strong inference of scienter about the misstatements about its internal controls.
Here, it is difficult for CEO La-planche to avoid a strong inference of scienter for any of the claims against him. He had engaged in self-dealing to inflate loan-origination numbers and he had inflated the assets of subsidiaries of Len-dingClub before the IPO — both issues involving financial reporting. No competing [1122]*1122inference is more reasonable than concluding that CEO Laplanche knew that some material weaknesses in internal controls over financial reporting persisted. This conclusion is further supported by the fact that CEO Laplanche later resigned amid allegations that he exploited the flaws in LendingClub’s internal procedures regarding loan approval, loan data, and financial reporting. The inference that Laplanche abandoned his previous shady practices for a brief period around the IPO and represented the adequacy of the procedures in place to prevent against the shady practices he had already engaged in is simply not the most reasonable inference.
Nor can CFO Dolan escape allegations of scienter on this claim. Internal controls over financial reporting fell squarely within her oversight. And LendingClub’s admission that material weaknesses and an improper tone at the top existed and CEO Laplanche’s earlier pattern of alleged abuses at the top suggests it would be “absurd” for CFO Dolan to have been blind to these weaknesses and improprieties when the company assured investors its controls performed adequately and effectively. S. Ferry LP, No. 2 v. Killinger, 542 F.3d 776, 786 (9th Cir. 2008).
Defendants note that our court of appeals has held that where a defendant accused of fraud sold no stock during the period between allegedly fraudulent statements and the subsequent disclosure of the truth does not support an inference of scienter, and “[i]n fact, it supports the opposite inference.” Rigel, 697 F.3d at 884-85. Defendants note that both CEO Laplanche and CFO Dolan increased their holdings in LendingClub during the class period, which, under Rigel, supports an inference that they lacked scienter. True, but this order holds that fact is insufficient to overcome the countervailing allegations supporting a strong inference of scienter.
B. Cirrix Post-IPO.
At this stage, the consolidated complaint adequately alleges under Section 10(b) and Rule 10b-5, the post>-IPO investments by CEO Laplanche, another director, and eventually by LendingClub itself adequately support the conclusion that LendingClub became capable of controlling Cirrix, and possibly vice versa, such that the failure to disclose that relationship was misleading. Certainly, as discussed above, the consolidated complaint also adequately alleges that the failure to disclose the credit-support agreement was misleading. And the materiality of either omission is also the same as discussed above regarding Cirrix.
Nor can CEO Laplanche plausibly deny that, on these allegations, he knew about his relationship with Cirrix and his company’s relationship and the misleading nature of failing to disclose that relationship. Moreover, he had been accused of self-dealing before (in 2009).
Unlike the issues regarding internal controls, however, nothing in the consolidated complaint warrants the strong inference of scienter as to Dolan with regard to Cirrix. The fact of CEO Laplanche’s (and another board member’s) ownership interest in Cirrix was only revealed upon an internal investigation, and there are no particularized allegations that CFO Dolan knew or should have known of that relationship.
The motion to dismiss this claim is Denied as to LendingClub and CEO La-planche and Granted as to CFO Dolan.
3. Control Person Liability.
Defendants only oppose lead plaintiffs “control person” claims by relying on purported deficiencies in the allegations supporting the foregoing claims. These motions are Granted in part and Denied in [1123]*1123part to the same extent as the balance of defendants’ motions.
4. Discovery Stay.
Under the Private Securities Litigation Reform Act, “[i]n any private action arising under this title, all discovery and other proceedings shall be stayed during the pendency of any motion to dismiss” subject to certain exceptions not applicable here. 15 U.S.C. 78u-4(b)(3)(B). Thus, ■ the PSLRA imposes a discovery stay during the “pendency of any motion to dismiss,” but it does not require the stay to continue where, as here, some portion of a complaint has been allowed to proceed, while others remain unsettled.
Nevertheless, in the discretion of the undersigned judge, and in pursuit of the PSLRA’s goal of ensuring that complaints brought thereunder “stand or fall based on the actual knowledge of the plaintiffs rather than information produced by the defendants after the action has been filed,” Medhekar v. United States Dist. Ct., 99 F.3d 325, 328 (9th Cir. 1996), this order finds a discovery stay for all claims remains appropriate (though not mandatory) until the present pleadings are fixed.
Unless otherwise ordered, the discovery stay will remain in place until either: (1) lead plaintiff files an amended complaint omitting all claims dismissed in this order, or (2) lead plaintiff files an amended complaint pursuant to an order on a motion seeking leave to amend pursuant to the procedure discussed below.
Defendants sought judicial notice of several public disclosures that were referenced in the complaint, all appended as exhibits to the declaration of Attorney Marie Bafus. Lead plaintiff does not oppose these requests. This order takes judicial notice of the documents referred to above. To the extent judicial notice is requested for documents not discussed above, such documents were not necessary to this order, and so the requests for judicial notice are Denied as moot.
CONCLUSION
For the reasons stated above, the motions to dismiss are Granted in part and Denied in part. By June 15, lead plaintiff may seek leave to amend its claims based on the loan-approval process and CFO Do-lan’s scienter regarding Cirrix by filing a formal motion noticed on the normal 35-day calendar. The motion should include a proposed amended consolidated complaint (and a redlined copy) and affirmatively demonstrate how the proposed amendments cure the problems identified herein and any others identified in defendants’ motions even if not addressed herein. Lead plaintiff must plead its best case. Defendants should raise any Rule 12 arguments in response to the motion seeking leave to amend, rather than filing a separate motion to dismiss.
A case management conference is hereby Set for July 20 at 11:00 a.m. to set dates to proceed with this case on an amended pleading that either removes all claims dismissed herein or an amended pleading allowed pursuant to a motion seeking leave to amend to correct the deficiencies identified herein.
IT IS SO ORDERED.