Karimi v. Deutsche Bank Aktiengesellschaft

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

ALI KARIMI, Individually and On Behalf of All Others Similarly Situated, 22-cv-2854 (JSR)

Plaintiff, OPINION AND ORDER

-v-

DEUTSCHE BANK

AKTIENGESELLSCHAFT, JOHN

CRYAN, CHRISTIAN SEWING,

MARCUS SCHENCK, and JAMES VON MOLTKE,

Defendants.

JED S. RAKOFF, U.S.D.J.: Defendant Deutsche Bank (“DB” or “the Bank”), like all banks, is required to maintain anti-money laundering (“AML”) and know-your- customer (“KYC”) systems to prevent their facilities from being used to launder money. Failure to maintain these systems may make a bank liable for regulatory or criminal penalties. DB, like all banks, also relies on these systems to prevent its disparate businesses from taking on high-risk client relationships that might later harm the institution’s reputation. But, according to the instant complaint, DB has materially failed to implement effective AML & KYC controls. These repeated compliance failures have allegedly been particularly acute in DB’s wealth management business, which caters to the very rich. The instant suit is a putative securities fraud class action alleging that DB and its recent chief executive officers (“CEOs”) and chief financial officers (“CFOs”) materially misrepresented the Bank’s AML & KYC processes during the proposed class period of March 14, 2017 through May 12, 2020. The operative second amended complaint, ECF 37 (“Complaint” or “SAC”), concerns the Bank’s disclosures in various securities filings and on its website describing specific AML & KYC processes and procedures that allegedly were systematically undermined by the Bank’s executives. The Complaint alleges that eleven confidential witnesses (“CWs”) who worked in DB’s compliance functions have informed counsel that DB’s AML & KYC procedures did not work as described. They further allege that the Bank’s executives and

management board routinely overruled compliance staff so that the Bank’s wealth management business could commence or continue relationships with high-risk, ultra-rich clients, such as Russian oligarchs, the convicted sex trafficker Jeffrey Epstein, founders of terrorist organizations, people associated with Mexican drug cartels, and people suspected of financing terrorist organizations. When these relationships were revealed, DB’s stock allegedly lost value, harming investors. Now before the Court is defendants’ motion to dismiss the Complaint. ECF 52. This motion was fully briefed in the U.S. District Court for the District of New Jersey before Judge Esther Salas granted

defendants’ motion to transfer this action to the Southern District of New York. ECF 64. The Court, having now carefully considered the motion papers and the oral arguments from counsel, grants in part and denies in part the motion to dismiss. Specifically, the motion to dismiss is granted with respect to the CFO defendants, Marcus Schenck and James von Moltke, and is denied in all other respects. I. Factual Background A. The Individual Defendants The Complaint brings securities fraud claims under 15 U.S.C. § 78j(b) and Rule 10b-5 against the Bank and four of its recent executives, as well as control-person claims under section 20(a) against the CEOs and CFOs. Defendant John Cryan was chairman of the DB management board and the Bank’s global CEO from July 2015 to April 8, 2018. SAC ¶ 15. In

this role, Cryan was responsible for, inter alia, DB’s Group Audit and the Bank’s business in the Americas. Id. Cryan’s successor is defendant Christian Sewing, who has been DB’s CEO since April 8, 2018, a member of the Bank’s management board since 2015, and DB’s president since 2017. Id. ¶ 16. Sewing has also held other roles relevant to the Complaint’s allegations, including as Head of Private, Wealth & Commercial Clients (since 2016) and Co- Head of Private & Commercial Bank (since 2017). As a member of the Management Board, he was responsible for the responsibilities known as Legal, Incident Management Group and Group Audit. Before assuming his role on the Management Board, Sewing was Global Head of Group Audit (from June 2013 until February 2015) and held several positions

before that in Risk, including Deputy Chief Risk Officer (from 2012 to 2013) and Chief Credit Officer (from 2010 to 2012). Id. Defendant Marcus Schenck joined DB in January 2015 and was appointed to the Management Board in May 2015. Id. ¶ 17. Schenck served as DB’s CFO until June 30, 2017. Id. Upon Schenck’s departure, defendant James von Moltke assumed the role of CFO, which he continues to hold, and has served on the Management Board. Id. ¶ 18. B. Challenged Statements The Complaint alleges that the following statements from DB’s annual reports, Form 20-F submissions, and website (“Challenged Statements”) were materially misleading: • “We are exiting client relationships where we consider ... risks to be too high while also strengthening our client on-boarding and know-your client (KYC) procedures.” SAC ¶¶ 136, 151, 166 (Annual Report 2016 at 41; Annual report 2017 at 5; Annual report 2018 at 5) • “Major achievements in 2016 included ... substantial investment in our control functions, including the ongoing implementation of a more comprehensive Know-Your-Client (KYC) process and an off-boarding process for higher risk clients.” SAC ¶ 139 (2016 Form 20-F at 49). • “Compliance: Conformity with the law and adherence to regulations and standards. How we assess and accept clients: We have developed effective procedures for assessing clients (Know Your Customer or KYC) and a process for accepting new clients in order to facilitate comprehensive compliance. Furthermore they help us to minimize risks relating to money laundering, financing of terrorism and other economic crime. Our KYC procedures start with intensive checks before accepting a client and continue in the form of regular reviews. Our procedures apply not only to individuals and corporations that are or may become our direct business partners, but also to people and entities that stand behind them or are indirectly linked to them.” SAC ¶¶ 141, 156, 171. (2017, 2018, 2019 statement on DB’s website) • “DB has developed and implemented a comprehensive set of measures to identify, manage and control its AML risk. These measures are: A robust and strict KYC program.... 6.3. KYC Program DB has implemented a strict group-wide KYC program to ensure all kinds of customers (natural or legal persons or legal structures, correspondent banks) are subject to adequate identification, risk rating and monitoring measures. This program has been implemented globally and throughout all business divisions. KYC includes not only knowing the clients and entities the Bank deals with (either as a single transaction or ongoing relationship), or renders services to, but also the Ultimate Beneficial Owners (UBOs), Legal Representatives and Authorised Signatories as appropriate. The program includes strict identification requirements, name screening procedures and the ongoing monitoring and regular review of all existing business relationships. Special safeguards are implemented for business relationships with politically exposed persons (PEPs) and clients from countries or industries deemed high risk.” SAC ¶¶ 143, 158, 173 (2017, 2018, 2019 statement on DB’s website) • “KYC is an ongoing process throughout the life cycle of a client relationship ... As part of our regular client due diligence, we screen our relationships against internal and external criteria, e.g. relating to Politically Exposed Persons (PEPs), terrorism, or sanctions.” SAC ¶¶ 162, 175 (2018 Non-Financial Report, supplement to 2018 Annual Report) • “[T]hat the Bank’s newly-implemented KYC program “pay[s] special attention to high-risk clients (such as politically exposed persons [PEP]) ... Clients are assessed as part of due diligence and are regularly screened against internal and external criteria. In 2017, we continued to roll out an extended screening program, which serves as the basis for further enhancement with regards to screening effectiveness and efficiency.” SAC ¶ 145 (2017 Non-Financial Report, supplement to 2017 Annual Report) The Complaint further alleges that during the class period, when investigative reporting revealed deficiencies in DB’s AML practices, DB allegedly issued public denials touting the strength of its KYC processes.1

1 See, e.g., SAC ¶ 73 (“In a written public response to Reuters, Deutsche Bank flatly denied that its KYC processes were not effective and doubled-down on its continued misrepresentations that ‘Our procedures to identify potential anti-money laundering and KYC risks are very effective,’ saying of its group-wide controls.”). C. Alleged AML & KYC Deficiencies The Complaint relies on three main sources of information to describe AML & KYC process failures and to give examples of specific bank clients who appear to have been using the Bank’s facilities to further criminal or corrupt activities. First, the complaint relies on eleven CWs. Second, the complaint relies on reports by U.S. and European regulators into the Bank’s AML & KYC deficiencies. Third, the complaint relies on newspaper articles discussing the Bank’s relationships with people linked to criminal or terrorist activity and politically exposed persons (“PEPs”).

In sum, the complaint alleges that DB’s AML & KYC processes were materially ineffective during the proposed class period (March 14, 2017 to May 12, 2020). SAC ¶ 1. According to the CWs, executives at the Bank’s U.S. operations and at the global group level routinely overruled AML & KYC staff, who had recommended not doing business with various high-risk clients and PEPs, particularly if they came in through the Bank’s wealth management business, which services the globe’s very wealthy persons and the entities those people control. In particular, the CWs allege that the decision to on-board high-risk clients, notwithstanding identified AML & KYC risks, was routinely made at the highest levels of the bank: According to CW1, in the case of really notorious Russian oligarchs and the like – the onboarding and retainer of such clients only happened with the approval of the highest-level authorities: the CEO, the COO, and Deutsche Bank’s Board. Epstein, in particular, was discussed at Deutsche Bank’s Board level. SAC ¶ 49. The CWs also recount specific instances in which high-level executives overruled decisions by risk management staff, as well as deficient KYC practices for Jeffrey Epstein,2 Russian Oligarchs and others, including inadequate investigation and decisions to ignore obvious red flags. In some instances, defendants Cryan and Sewing are specifically alleged to have been involved, either in their capacity as individual executives or as members of the DB management board. See, e.g., SAC ¶¶ 57 (Cryan),3 58 (Sewing & Cryan), 59 (Cryan), 49 (Board). The Complaint, based on information from CWs, also alleges that the Bank widely employed practices such as “wire stripping” to

facilitate U.S. dollar-denominated transactions on behalf of entities subject to U.S. sanctions. See, e.g., SAC ¶ 60.

2 See, e.g., SAC ¶ 101. (“According to CW8, Deutsche Bank had a KYC ‘special deal’ for Epstein and other high-net-worth individuals. CW8 explained that such individuals were not required to submit to the normally required KYC documentation. Deutsche Bank gave them special exceptions because of the amount of business they generated. 102. CW8 explained that after Epstein was onboarded, decisions about whether to continue keeping him as a client were repeatedly escalated, including to Deutsche Bank’s Reputational Risk Committee. ‘He would go up, get approved, go up, get approved,’ CW8 said. CW8 noted that the people who sat on Deutsche Bank’s Reputational Risk Committee were ‘primarily business-sided people,’ meaning they were interested solely in making money for the Bank.”). 3 Defense counsel correctly pointed out at oral argument that SAC ¶ 57 alleges Cryan’s involvement in a problematic April 2018 real estate finance transaction, supposedly on the basis of information from CW1, who is described as having been “a Compliance Officer at Deutsche Bank from around mid-2007 to around mid-2015.” ¶ 23. It is therefore unclear how CW1 would have personal knowledge of the 2018 transaction, assuming that CW1 left the Bank after 2015. But the Court need not untangle this knot, since its ultimate decision on this motion does not depend on the allegation in SAC ¶ 57. Second, the Complaint describes the findings of various internal audits regarding AML & KYC deficiencies, as well as findings of government reports from U.S. and European regulators. These reports allegedly identified systematic deficiencies with DB’s AML & KYC practices. Defendants Cryan and Sewing are specifically alleged to have been aware of pertinent audits, which revealed deficiencies inconsistent with the Challenged Statements, by virtue of their roles on the management board and as executives. Sewing is also specifically alleged to have been made aware of certain reports describing systematic weaknesses in AML & KYC processes that conflict with the

representations made in the Challenged Statements. For instance, Sewing was allegedly made aware of a June 2018 audit report that assigned DB a zero percent pass rate for KYC processes on client files in several countries, including Russia. SAC ¶ 71. CW1 alleges that DB’s Global Head of Group Audit, Max Ng, was aware of audit findings regarding business with sanctioned entities, systematic due diligence failures during on-boarding of wealth management clients, and approvals to do business by the DB Board that overruled risk management staff. SAC ¶ 64. Further, CW1 alleges that Ng would have reported these audit results to DB’s CEO and to Defendant Sewing. Id. Other CWs describe other reporting chains through which they allege that other

pertinent audit findings would have been relayed to defendants. See, e.g., SAC ¶¶ 67 (Sewing), 71 (Sewing). Plaintiffs also argue in opposition to the motion to dismiss that Cryan and Sewing would have been aware of significant AML & KYC findings in critical reports by the Bank’s regulators by virtue of their position as CEOs, see, e.g., SAC ¶¶ 74-76, and that the Bank’s executives met with regulators in response to certain findings of AML & deficiencies, see SAC ¶ 72. Finally, the Complaint alleges that in practice, DB did not turn down high net worth clients from its wealth management division for AML or KYC deficiencies: CW11 said the AFC unit regularly approved new clients, despite their cases being escalated because of red flags linked to adverse news findings, location, industry and other information that came up during the KYC/due diligence process. “They would approve them anyway even though we brought it to their attention,” CW11 stated, referring to red flags discovered during the due diligence process. “I’ve never seen them not approve [a client] -- never.” SAC ¶ 134. Other CWs stated that for some high-risk wealth management clients (such as Epstein), “no KYC investigations were ever undertaken.” SAC ¶ 85. II. Procedural History This action was filed in the District of New Jersey on July 15, 2020. ECF 1. On December 28, 2020, Judge Salas appointed lead counsel, ECF 31, who then filed the SAC on March 1, 2021, ECF 37. DB moved for a venue transfer and, in the alternative, to dismiss the complaint on April 23, 2021. ECF 52. Judge Salas granted the venue motion on March 31, 2022. ECF 63. The case was then transferred to this District. ECF 65. Discovery was automatically stayed pursuant to the Private Securities Litigation Reform Act. See 15 U.S.C. § 78u-4(b)(3)(B); ECF 53. Following transfer, the Court heard oral argument from counsel on the fully-briefed motion to dismiss. III. Discussion The Complaint brings two securities fraud claims: Count I alleges a violation of Rule 10b-5 against the Bank and the individual defendants, and Count II alleges a § 20(a) violation against the individual defendants as control persons. “To avoid dismissal under Section 10(b) and Rule 10b-5, a complaint must plausibly allege: (1) a material misrepresentation (or omission); (2) scienter, i.e., a wrongful state of mind; (3) a connection with the purchase or sale of a security; (4) reliance; (5) economic loss; and (6) loss causation.” Singh v. Cigna Corp., 918 F.3d

57, 62 (2d Cir. 2019).4 Securities fraud complaints must also satisfy the pleading standards of Fed. R. Civ. P. Rule 9(b), so they must: “(1) specify the statements that the plaintiff contends were fraudulent, (2) identify the speaker, (3) state where and when the statements were made, and (4) explain why the statements were fraudulent.” ATSI Commc’ns, Inc. v. Shaar Fund, Ltd., 493 F.3d 87, 99 (2d Cir. 2007). The Complaint must also satisfy the pleading standards of the Private Securities Litigation Reform Act (“PSLRA”). See 15 U.S.C. § 78u-4. The defendants make two principal arguments in support of their motion to dismiss the Complaint: (i) that the Complaint identifies no

actionable misstatement or omission by any defendant, and (ii) that

4 Unless otherwise specified, all internal quotation marks, citations, omissions, emphases, and alterations are omitted from all sources cited herein. the Complaint does not adequately allege scienter by the individual defendants. Defendants do not challenge loss causation, reliance, or the nexus to securities. Defendants also suggest that two cases in this District that dismissed private securities fraud claims against Deutsche Bank for alleged problems with internal controls weigh in favor of dismissing the instant Complaint.5 Indeed, defendants’ motion for venue transfer was predicated on the contention that other plaintiffs had already tried and failed to litigate these same issues in the Southern District of New York, and so the plaintiffs here filed in New Jersey to avoid

unhelpful precedent. Perhaps the dismissal of these earlier complaints did motivate plaintiffs’ initial choice of venue. But the Court concludes that neither case is here dispositive, because they concern different issues at DB and the Challenged Statements are distinguishable from the alleged misrepresentations in the earlier complaints. First, in June 2017, Judge Torres dismissed a putative securities class action complaint against DB that alleged that disclosures made between 2013 and 2016 in various reports, filings, earnings calls, and press conferences about the Bank’s AML programs were materially misleading in light of DB’s role in facilitating the so-called Russian

5 See Green v. Deutsche Bank Aktiengesellschaft, 2019 WL 4805804, at *2 (S.D.N.Y. Sept. 30, 2019) (Nathan, J.); In re Deutsche Bank Aktiengesellschaft Sec. Litig., 2017 WL 4049253 (S.D.N.Y. June 28, 2017) (Torres, J.), aff’d sub nom. Sfiraiala v. Deutsche Bank Aktiengesellschaft, 729 F. App’x 55 (2d Cir. 2018) (“In re: DB”). “mirror trades” money laundering scheme. Judge Torres held that all of the alleged misstatements were “insufficient because they fall into one of three categories: first, statements about which the complaint fails to show why they were false when made; second, statements that are aspirational; or third, statements that suggest mere corporate mismanagement.” In re DB, 2017 WL 4049253 at *6. With respect to the first category, the complaint did not allege how it was false that the Bank sought to strengthen or review its AML programs, notwithstanding that the perpetrators of the mirror trades scheme used DB’s systems. With respect to the second category, the complaint alleged as

misleading various statements concerning the Bank’s values, beliefs, and efforts to comply with relevant laws, which Judge Torres found to be mere puffery. Third, and most relevant to the instant case, Judge Torres held that various statements about the effectiveness of the Bank’s internal controls were not actionable because the complaint “allege[d] neither facts showing that the descriptions of the processes were false or misleading at the time they were included in the public statements, nor facts showing that the processes were not followed.” Id. at *7. The Second Circuit later affirmed Judge Torres’s decision. See Sfiraiala, 729 F. App’x 55 (2d Cir. 2018). Then, in September 2019, Judge Alison J. Nathan dismissed a

putative securities class action against DB concerning a representation that “[b]ased on the assessment performed, management has determined that our internal control over financial reporting as of December 31, 2016 was effective based on the COSO framework.” Green, 2019 WL 4805804, at *2. The Green complaint cited a Wall Street Journal article reporting that DB had been designated in “troubled condition” by the Federal Reserve, in part because of the Bank’s exposure to repo financing and its inability to calculate its exposures to other institutions via repo agreements. Id. at *1. Judge Nathan held that the complaint had failed to adequately allege falsity, in that the complaint did not allege whether or how the Bank’s management had failed to determine that its internal controls were effective under the COSO framework or how the repo issues relied upon were

germane to “internal control over financial reporting” as opposed to risk management. Id. at *2-*3. As detailed below, Green, like In re DB, is readily distinguishable from the instant complaint. With this in mind, the Court now addresses in turn each of the issues raised by defendants’ motion. A. Whether the Challenged Statements Contain Actionable Misrepresentations or Omissions Defendants argue that the Challenged Statements are not actionable for three reasons. First, they argue that the statements

6 See Green, 2019 WL 4805804, at *1 (“Deutsche Bank, like many financial institutions, measures the quality of its internal controls under a framework established by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the COSO Framework, internal controls principally focus on three aspects of a financial institution: 1. the effectiveness and efficiency of operations; 2. the reliability of financial reporting; and 3. its compliance with applicable laws and regulations.”) were aspirational or “puffery” rather than actionable statements of fact. Second, defendants argue that any inaccuracies in the Challenged Statements were immaterial because the Bank’s AML & KYC failures were already known to the market. And third, defendants argue that the complaint does not adequately allege falsity. The Court addresses each argument in turn, though none suffices for dismissal. a. Whether the Challenge Statements Are Merely Aspirational Defendants first contend that the Challenged Statements are just aspirational statements of corporate optimism, not actionable statements of falsifiable fact. Defendants specifically identify

statements such as “Deutsche Bank has ‘developed effective procedures for assessing clients ... in order to facilitate comprehensive compliance,’ that its ‘KYC procedures start with intensive checks,’ and that its ‘robust and strict’ KYC program ‘includes strict identification requirements.’” Mot. 26 (quoting challenged statements in SAC ¶ 4). However, for the reasons explained below, the Court concludes that the Challenged Statements are neither mere puffery nor aspirational statements of intention or corporate optimism. “Whether a representation is ‘mere puffery’ depends, in part, on the context in which it is made.” In re Petrobras Sec. Litig., 116 F. Supp. 3d 368, 381 (S.D.N.Y. 2015). Therefore, even if some statements, “viewed in isolation, may be mere puffery, nonetheless, when ... the

statements were made repeatedly in an effort to reassure the investing public about the Company's integrity, a reasonable investor could rely on them as reflective of the true state of affairs at the Company.” Id. Further, even where a statement may be considered vague or comparative when viewed in isolation, and so could be considered aspirational on its own, it may still be a material misrepresentation when what “was actually going on” at the company are wholly at odds with any reasonable interpretation of the terms. Arkansas Tchr. Ret. Sys. v. Bankrate, Inc., 18 F. Supp. 3d 482, 485 (S.D.N.Y. 2014).7 The Court finds that the Challenged Statements quoted in the Complaint are not inactionable puffery. Indeed, even the specific examples cited in defendants’ brief and quoted above are actionable, because they provide descriptions of the processes by which DB claims

to vet its clients and thereby comply with its legal AML & KYC obligations and protect its reputation. For example, the statements that DB’s “KYC procedures start with intensive checks” or that its KYC program “includes strict identification requirements” assert that DB takes specific actions before on-boarding clients, steps that the CWs and government reports suggest are honored only in the breach, at least for the ultra-rich clientele of the Wealth Management business. Other statements not identified by defendants’ brief are even less susceptible to the objection that they are aspirational. For instance, the Bank claimed to implement “special safeguards” for PEPs with “intensive checks” and “strict identification requirements, name

7 See Arkansas Tchr. Ret. Sys., 18 F. Supp. 3d at 485 (“[W]hile a term like ‘high quality’ might be mere puffery or insufficiently specific to support liability in some contexts, it is clearly a material misrepresentation when applied to assets that are entirely worthless, as were large percentages of [defendant’s] leads.”) screening procedures and the ongoing monitoring and regular review” of all the existing client relationships, that it had “effective procedure for assessing clients [via its KYC processes]” and “comprehensive compliance” that “minimize[d] risks relating to money laundering, financing of terrorism and other economic crimes.” SAC ¶¶ 141, 143. The statements also assert that DB was “exiting client relationships where [it] consider[ed] risks to be too high,” SAC ¶ 136, a statement that could be proven false if, as alleged, the Bank’s executives routinely overruled decisions by risk management staff to close high risk accounts. These statements all describe specific

processes that the Complaint alleges were routinely ignored or, in practice, did not even exist when it came to ultra-rich and PEP wealth management clients. The Second Circuit has previously held that securities fraud liability may lie for published descriptions of processes that a company takes to comply with regulatory requirements, even if “technically true,” where they omit information that inaccurately “gave comfort to investors that reasonably effective steps were being taken to comply with applicable ... regulations.” Meyer v. Jinkosolar Holdings Co., 761 F.3d 245, 251 (2d Cir. 2014). As Jinksolar explained, it is not enough for disclosures to avoid guaranteeing compliance:

To be sure, these descriptions did not guarantee 100% compliance 100% of the time. Such compliance may often be unobtainable, and reasonable investors may be deemed to know that. However, investors would be misled by a statement [that describes specific processes] if in fact the [processes] were then failing to prevent substantial violations of the ... regulations. Id. In this case, the Complaint alleges that certain high-net-worth and politically connected wealth management clients were systematically exempted from the AML & KYC processes described in the Challenged Statements, or the processes were applied in a manner that was routinely “failing to prevent substantial violations of the [applicable] regulations.” Id. According to the Complaint, these AML & KYC processes might as well not have existed for this subset of clients. And this is no random subset of clients. The Bank’s failure to apply its policies to the ultra-rich and PEPs seeking its “wealth management” services is material because, when it comes to AML & KYC

compliance, these are a highly likely source of problems. Nor are any of the statements highlighted by defendants “too general to cause a reasonable investor to rely upon them” because they discuss abstract notions of ethics, responsibility or integrity. ECA, Loc. 134 IBEW Joint Pension Tr. of Chicago v. JP Morgan Chase Co., 553 F.3d 187, 206 (2d Cir. 2009) (holding that statements about risk management processes were puffery where they, e.g., “set the standard for integrity” and are “highly disciplined and designed to preserve the integrity of the risk management process”). While the Challenged Statements include assertions that may be unverifiable, such as that systems “minimize risks relating to money laundering,” or that the

group-wide KYC program is “strict,” SAC ¶ 141, 143 (emphasis added), even “indefinite and unverifiable” or “conclusory term[s] [used] in a commercial context are reasonably understood to rest on a factual basis that justifies them as accurate, the absence of which renders them misleading.” Virginia Bankshares, Inc. v. Sandberg, 501 U.S. 1083, 1093 (1991). And none of the Challenged Statements is “explicitly aspirational, with qualifiers such as ‘aims to,’ ‘wants to,’ and ‘should.’” City of Pontiac Policemen’s & Firemen’s Ret. Sys. v. UBS AG, 752 F.3d 173, 183 (2d Cir. 2014). And unlike in In re: DB, the statements do not simply assert that the Bank “compl[ied] with all laws and regulations.” 2017 WL 4049253 at *6 n. 4. The Court therefore rejects defendants’ suggestion that the Challenged Statements are only inactionable puffery or merely aspirational statements of intent. b. Whether the Statements Were Immaterial Because DB’s Failures were Already Known Defendants argue that the Challenged Statements are immaterial as a matter of law, and therefore cannot be the basis for Rule 10b-5 liability, because investors already knew that DB’s AML & KYC systems were inadequate. Since investors supposedly already knew DB’s AML & KYC processes had failed to stop criminals from laundering money,

defendants contend that there is no “substantial likelihood that the disclosure of the omitted fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” Basic Inc. v. Levinson, 485 U.S. 224, 231–32 (1988). In support of this so-called “truth-on-the-market” defense, the motion points out that the Complaint relies on various news articles and government reports that reveal the alleged deficiencies, and defendants insist that DB spokespeople and executives occasionally acknowledged that the Bank had experienced “weaknesses” over the years. See, e.g., Reply 9. Further, DB points to high-level statements, also appearing in the corporate disclosures containing some of the Challenged Statements, that acknowledged that the Bank had “identified the need to strengthen [its] internal control environment” and that “the infrastructure that underlies it fall short in a number of areas of our standards for completeness and comprehensiveness and are not well integrated across the Bank.” See Mot. 29-30 (quoting 2017 Form 20-F). However, defendants’ “truth-on-the-market” defense cannot justify

dismissal for two reasons, the first more procedural and the second more substantive. First, as plaintiffs correctly argue, a “truth-on-the-market defense” is generally an inappropriate basis for dismissal on the pleadings. “[T]he so-called “truth on the market” corollary to “fraud on the market” [holds that] ... a misrepresentation is immaterial if the information is already known to the market because the misrepresentation cannot then defraud the market.” Ganino v. Citizens Utilities Co., 228 F.3d 154, 167 (2d Cir. 2000). To prevail, “the corrective information must be conveyed to the public with a degree of intensity and credibility sufficient to counter-balance effectively

any misleading information created by the alleged misstatements.” Id. Accordingly, the Second Circuit has held that “[t]he truth-on-the- market defense is intensely fact-specific and is rarely an appropriate basis for dismissing a § 10(b) complaint for failure to plead materiality.” Id. Defendants’ briefing and argument fails to contend with this case law or explain why their defense is not fact-specific and so an inappropriate basis to grant a motion to dismiss. Second, the Court rejects defendants’ suggestion that general disclaimers can substantively mitigate the effect of specific, alleged misrepresentations. For instance, the Challenged Statements specifically identified processes and procedures that the Bank allegedly did not apply to the high-risk wealth management clients that should be a financial institution’s greatest AML concern. Defendants have not remotely demonstrated how, if the specific

descriptions of compliant AML & KYC processes were inaccurate, as alleged, they may be cured by highly general disclosures that some of the Bank’s unspecified internal control systems may be inadequate. The Bank’s repeated insistence throughout this period that it had implemented specific AML & KYC process improvements cannot be ameliorated by the Bank’s general acknowledgement of weaknesses in unspecified internal controls and statements generally admitting a need to improve performance, even if a press statement specifically mentions AML compliance. The Court therefore concludes that defendants’ “truth-on-the- market” defense is inadequate to obtain dismissal. c. Whether Falsity was Adequately Alleged

In an evident parallel to In re: DB, defendants argue that the Complaint does not adequately allege the Challenged Statements’ falsity because it does not allege that the Bank did not review or attempt to improve its processes. This argument is not without force. There are some statements that literally speak only about the Bank’s efforts, and not about the existence of processes or procedures. For instance: • Major achievements in 2016 included ... substantial investment in our control functions, including the ongoing implementation of a more comprehensive Know-Your-Client (KYC) process and an off-boarding process for higher risk clients. SAC ¶ 139 • We are exiting client relationships where we consider ... risks to be too high while also strengthening our client on-boarding and know-your client (KYC) procedures. Id. But the Court concludes that even these statements may be misleading if, as the CWs allege, DB’s purported efforts to screen new clients and exit problematic relationships were systematically undermined by executives seeking to on-board and retain ultra-rich and PEP clients whose accounts raised clear red flags. Defendants also suggest that statements about the existence of processes are not rendered misleading because the implementation of those processes was spotty and because executives failed to address weaknesses in policies and procedures. Defendants thus assert that the complaint alleges mismanagement, not misstatements, and they quote case law for the proposition that allegations of mismanagement are not actionable under the securities laws. See Mot. 32. Defendants also emphasize caveats published in some of the same filings quoted by plaintiffs, in which the Bank warns that it “may be unable to complete [listed] initiatives as quickly as we intend or as our regulators demand, and our efforts may be insufficient to prevent all future deficiencies.” Reply 11. See also id. (quoting disclosure that the Bank “may not always have the personnel with the appropriate experience, seniority and skill levels to compensate for shortcomings in [its] processes and infrastructure, or to identify, manage or control risks”). But the statements at issue here describe specific processes that the Bank and its executives allegedly knew were being systematically undermined by an unwritten but pervasive practice of exempting ultra- rich and politically connected wealth management clients from the due diligence processes supposedly required by Bank policy. This is unlike

the situation in In re DB. There, the statements at issue claimed only that the Bank had reviewed or strengthened its AML and compliance programs, but the plaintiffs did not adequately allege that the programs were not “reviewed” or “strengthened.” 2017 WL 4049253 at *6. But defendants mistakenly construe Judge Torres’s holding as categorically exempting certain types of inaccuracies; in fact, Judge Torres only pointed out specific gaps in the pleadings before her. In re DB does not conflict with the principle that “[t]he federal securities laws prohibit misrepresentation of material facts, even when those material facts relate to corporate mismanagement.” City of Sterling Heights Police & Fire Ret. Sys. v. Abbey Nat., PLC, 423 F.

Supp. 2d 348, 355 (S.D.N.Y. 2006) (Chin, J.). The Court therefore concludes that the Complaint adequately alleges that the Challenged Statements were false, because they allegedly misrepresented the Bank’s AML & KYC practices, not just that the Bank’s managers failed to successfully implement in all cases policies that were generally adequate and appropriately described. Relatedly, the fact that some statements appeared in publications that also contained hedges about the risk of inadequate implementation of Bank policy does not justify dismissal on the ground of a “cautionary disclosure.” See Mot. 31. First, as plaintiffs correctly argue, the “cautionary disclosure” safe harbor does not apply because the Challenged Statements purport to describe current practices, and so are not forward-looking statements. See 15 U.S.C. § 78u-5(c)(1). In any event, on the substance, cautionary disclosures must be

“extensive and specific,” and a “vague or blanket (boilerplate) disclaimer which merely warns the reader that the investment has risks will ordinarily be inadequate to prevent misinformation.” Slayton v. Am. Exp. Co., 604 F.3d 758, 772 (2d Cir. 2010). Here, the vague disclaimers that the Bank might fail to implement its policies cannot sufficiently cure the misinformation conveyed by descriptions of policies and procedures that the bank routinely fails to apply to its highest-risk clients. Since plaintiffs have established that the Challenged Statements are actionable and that their falsity is adequately alleged, none of these arguments suffices for dismissal. B. Whether the Complaint Adequately Alleges Scienter of the CEO and CFO Defendants To survive, under Rule 9(b) and the PSLRA, the Complaint must adequately allege the scienter for each defendant, with specificity. Defendants contend that the Complaint fails to adequately allege scienter with respect to either the CEOs (Cryan and Sewing) or the CFOs (Schenck and von Moltke). After carefully reviewing the Complaint and considering the arguments of counsel, the Court concludes that the Complaint adequately alleges scienter against the CEOs but not against the CFOs. a. Legal Standard The PSLRA imposes specific pleading standards for the scienter element in a securities fraud case seeking money damages: where scienter is required, “the complaint shall, with respect to each act

or omission alleged to violate this chapter, state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.”3 15 U.S.C. § 78u–4(b)(2). “The plaintiff may satisfy this requirement by alleging facts (1) showing that the defendants had both motive and opportunity to commit the fraud or (2) constituting strong circumstantial evidence of conscious misbehavior or recklessness. Moreover, ‘in determining whether the pleaded facts give rise to a strong inference of scienter, the court must take into account plausible opposing inferences.’ For an inference of scienter to be strong, ‘a reasonable person [must] deem [it] cogent and at least as compelling as any opposing inference one could draw from the facts alleged.’” ATSI Commc’ns, 493 F.3d at 99 (quoting Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 U.S. 308 (2007)). The Court also

“must consider the complaint in its entirety, as well as other sources” cognizable on a Rule 12(b)(6) motion to determine “whether all of the facts alleged, taken collectively, give rise to a strong inference of scienter.” Tellabs, 551 U.S. at 322. And “[t]he inference that the defendant acted with scienter need not be irrefutable, i.e., of the ‘smoking-gun’ genre.” Id. at 324. Plaintiffs argue that the Complaint adequately alleges scienter under either the direct and circumstantial evidence prong or under the motive and opportunity prong of the PSLRA standard. b. Direct and Circumstantial Evidence of Scienter Defendants argue that there is no direct or circumstantial evidence in the Complaint that any of the individual defendants acted

with scienter. They contend that none of the individual defendants is alleged with adequate specificity to have been aware of information that allegedly falsifies the Challenged Statements. Mot. 36. They also argue that “Deutsche Bank’s open acknowledgment of its internal control challenges and its disclosures of its effort to resolve them supports the more plausible, benign inference that Deutsche Bank was earnestly attempting to resolve ongoing issues.” Id. “Circumstantial evidence can support an inference of scienter in a variety of ways, including where defendants “(1) benefitted in a concrete and personal way from the purported fraud; (2) engaged in deliberately illegal behavior; (3) knew facts or had access to information suggesting that their public statements were not accurate;

or (4) failed to check information they had a duty to monitor.” Employees' Ret. Sys. of Gov't of the Virgin Islands v. Blanford, 794 F.3d 297, 306 (2d Cir. 2015). Plaintiffs principally rely on the third option -- that the CEOs and CFOs knew information suggesting that the Challenged Statements were not accurate -- and the Court agrees that these allegations are sufficient with respect to the CEOs. The complaint identifies several reports of government investigations and settlements with regulators that provided red flags of the Bank’s deficient KYC and AML practices as applied to high-risk customers. See, e.g., ¶ 75 (discussing January 30, 2017 settlement agreement with U.K. Financial Conduct Authority).8 Relevant warnings from and settlements with regulators are widely recognized to be evidence of scienter. See, e.g., In re Bear Stearns Companies, Inc.

Sec., Derivative, & ERISA Litig., 763 F. Supp. 2d 423 (S.D.N.Y. 2011) (discussing “warnings from the SEC and other indicators” as evidence that executives had reason to know the false and/or misleading nature of their statements). The CEOs are alleged to have been aware of these regulatory proceedings by virtue of their position as executives and as members of the management board, inferences that are sufficiently plausible at this stage. Sewing is also specifically alleged to have been aware of these audit findings. SAC ¶ 71. The Complaint also alleges that during the class period, Reuters reported on the findings of two germane, internal audits from July 2018 that showed significant

8 Defendants stress the tension in the argument that these reports constituted red flags but are insufficient to have alerted the market to the relevant facts. See Reply 14. But there is no “contradiction” at the motion to dismiss stage, since, as explained, a “truth-on-the- market” defense is generally an inadequate basis for dismissal on the pleadings. KYC deficiencies. SAC ¶¶ 70-72. Allegedly, DB responded by publicly denying that its systems were deficient. SAC ¶ 73. Public denials such as this are also recognized to support an inference of scienter. See, e.g., Institutional Invs. Grp. v. Avaya, Inc., 564 F.3d 242, 269 (3d Cir. 2009). Allegations based on statements of the CWs also support the necessary inferences of the CEOs’ scienter. For instance, “CW3, the Vice President/AFC Principal Auditor of Sanctions and Embargoes, part of Deutsche Bank’s Group Audit, explained that three internal critical audit findings during the Class Period -- which were concealed from

investors -- showed that (i) the Bank was ‘not going through the right protocols to onboard’ clients, specifically high-net-worth, Wealth Management clients, who were not vetted; (ii) the Bank was onboarding and servicing companies and clients that were sanctioned in the United States through the ‘back-door;’ (iii) and the Bank was conducting ‘wire stripping.’” Opp. 35 (quoting ¶¶ 61-63). CW3 also explained why s/he believed these findings would have been relayed to Sewing. Id. Several other CWs also described escalating these issues toward the executive level of DB. Opp. 35-36. Defendants argue that these alleged links are speculative, but allegations of scienter need not be supported by documentation, particularly at the pleadings stage.

Finally, plaintiffs allege, based on the CWs’ statements and on other information, that DB’s top executives were personally involved in on-boarding and retention decisions around high-risk wealth management clients and PEPs, specifically including notorious Russian oligarchs and Epstein. The Complaint specifically alleges links between these decisions and CEO Cryan, and several CWs describe the systematic practice of DB’s CEOs getting personally involved in overruling KYC/AML staff decisions to secure relationships with very rich but high-risk wealth management clients. Opp. 38. Considering all the sufficiently specific allegations, and drawing all plausible inferences therefrom in plaintiffs’ favor, the Court concludes that the Complaint adequately alleges that the CEOs (Cryan and Sewing) were personally aware of the deficiencies in the Bank’s KYC and AML practices that rendered false or misleading the

statements in filings they signed. However, the Complaint does not specifically allege any connections between the CFOs and the AML & KYC deficiencies at issue here, nor any means by which the CFOs were made aware of these deficiencies, other than by virtue of their membership on the management board.9 This deficiency with respect to the CFOs means that plaintiffs have failed to state a claim against Schenck and von Moltke. The Court need not consider the adequacy of the motive and opportunity allegations concerning the CEOs, since the direct and circumstantial evidence allegations suffice. And with respect to the CFOs, there are no motive and opportunity allegations from which

scienter may be plausibly inferred.

9 Even this link was only discernible with the help of the collage assembled during oral argument by plaintiffs’ counsel, who was himself duly assisted by a team of attorneys scouring the Complaint. C. Section 20(a) Control Person Claims The defendants move to dismiss the section 20(a) claims against the individual defendants as control persons with respect to DB’s alleged securities law violations. “To state such a claim, plaintiffs must allege (1) a primary violation by the controlled person, (2) control of the primary violator by the defendant, and (3) that the defendant was, in a meaningful sense, a culpable participant in the controlled person’s fraud.” Arkansas Tchr. Ret. Sys., 18 F. Supp. 3d at 486. The Court has already concluded that the Complaint states a claim against DB itself for a primary violation of the securities

laws, and there is no meaningful dispute that the CEOs and CFOs are control persons under the second prong. However, as to the third prong of this test, and for the reasons discussed in the scienter analysis above, the Court holds that while the Complaint alleges with particularity why the CEOs were “culpable participant[s]” in the alleged securities fraud, there are no such allegations connecting the CFOs to the alleged securities fraud. Accordingly, the section 20(a) claim is dismissed only as against the CFOs. IV. Conclusion For the reasons set forth above, the Court concludes that the Complaint fails to state either a primary securities fraud claim or a

control-person claim against the CFO defendants. The Court therefore grants in part defendants’ motion to dismiss the Complaint’s two claims, but only as against defendants Schenck and von Moltke. Defendants’ motion is otherwise denied. The Court has already lifted the automatic stay of discovery and entered a case management plan in this long-delayed case. See ECF 81, 85. The litigation shall now proceed toward class certification, summary judgment, and trial with all deliberate speed. SO ORDERED. hy New York, NY i LA June [3, 2022 JHY S. RAKE, U.S.D.d.