When a company makes forward-looking statements about its business, federal law generally shields such prospective comments if they are coupled with meaningful cautionary language. As a result, “risk disclosures” have become ubiquitous, and companies rely on them to safely issue forward-looking remarks that investors find invaluable. Risk disclosures are, therefore, often viewed as a tool for avoiding legal liability, not a means of generating it.
However, risk disclosures can amount to statements actionable under federal securities laws if they portray risks to the company’s business as hypothetical when, in reality, those risks have already materialized. But when, exactly, are risk disclosures actionable? The federal circuit courts are deeply divided on this issue, and the Supreme Court—despite hinting just two years ago that it would provide an answer—has turned away from the question entirely. As it stands, nine of the circuit courts have weighed in on the topic, resulting in three meaningfully different interpretations of the law. Moreover, the Second and Ninth Circuits have issued recent rulings consistent with the existing precedent in those Circuits, confirming that fault lines are deepening.
In this memorandum, we review the safe harbor for forward-looking remarks and its application to risk disclosure statements under federal securities laws. We also survey the existing circuit split, as well as the recent Second and Ninth Circuit decisions post-dating the Supreme Court’s apparent disengagement with the issue.
BACKGROUND ON ELEMENTS OF SECURITIES FRAUD & PSLRA SAFE HARBOR
Under Section 10(b) of the Securities Exchange Act of 1934, it is unlawful to “use or employ, in connection with the purchase or sale of any security . . . any manipulative or deceptive device.”[1] Rule 10b-5 operationalizes this mandate, prohibiting securities issuers from making untrue statements of material fact, or omitting material facts in a manner that renders statements misleading.[2] From this, courts have upheld a private right of action enabling plaintiff securities purchasers to recover damages[3] by establishing the defendant company “(1) made misstatements or omissions of material fact, (2) with scienter, (3) in connection with the purchase or sale of securities, (4) upon which the plaintiff relied, and (5) that the plaintiff’s reliance was the proximate cause of its injury.”[4]
In time, private securities litigation under § 10(b) skyrocketed, and Congress—wary of nuisance filings and other perceived abuses of the § 10(b) private action—enacted the Private Securities Litigation Reform Act (“PSLRA”) in 1995.[5] Of the PSLRA’s many spotlight provisions, its safe harbor (“Safe Harbor”) for forward-looking statements shines particularly brightly. Under the text, forward-looking statements cannot give rise to § 10(b) liability when they are “accompanied by meaningful cautionary statements,” “immaterial,” or made without “actual knowledge . . . that the statement was false or misleading.”[6] Citing this Safe Harbor, for the first time, issuers that sought to release prospective statements about the business’s goals, outlook, or plans for the future—information investors often find particularly useful—could do so with comfort as to the risk of legal liability, provided their statements qualify for protection under the PSLRA.
To trigger the Safe Harbor, issuers often include in their periodic filings cautionary statements known as “risk disclosures” addressing hypothetical threats to business operations that could later render forward-looking statements incorrect. The spectrum of risk disclosures is vast: a clothing company might make cautionary statements about its inventory management, while a technology company might focus on data security, and a medical device company might address product distribution.[7] Despite the diversity, every risk disclosure shares the same core foundation—namely, that the issuer has identified a potential risk to the company’s bottom line, and investors should be mindful when assessing prospective remarks.
According to some federal courts, however, risk disclosures themselves are not necessarily immune from § 10(b) liability. When a company’s risk disclosures portray as hypothetical threats that have already materialized, courts have found actionable misstatements and omissions in the cautionary language itself.[8] But the guidance is inconsistent across circuits. While the First, Second, Third, Fourth, Fifth, Sixth, Ninth, Tenth, and D.C. Circuits have opined on the issue, their results can be categorized into three distinct buckets. The Supreme Court has thus far declined to resolve the split, and the Second and Ninth Circuits have issued recent opinions highlighting the extent to which the fracture remains.
GROWING CIRCUIT RIFT ON PSLRA ELIGIBILITY FOR RISK DISCLOSURE STATEMENTS & OSTENSIBLE SCOTUS INTERVENTION
We start where most of the circuits agree: risk disclosures may contain actionable misstatements and omissions if they depict a risk to the company’s business as hypothetical when, in actuality, the threat has already occurred.[9] But, is it enough for plaintiff securityholders to state a claim by alleging that the purportedly hypothetical risk already materialized, or must they include something more? The majority bloc—comprising the First, Second, Third, Fifth, Tenth, and D.C. Circuits—requires both risk materialization and near-certain harm to the company to state a claim. Only the Ninth Circuit holds that risk disclosure statements are always actionable if the underlying threat has come to fruition. Yet, a minority group made up of the Fourth and Sixth Circuits takes the opposite approach: statements in risk disclosures are never actionable.[10] While the Supreme Court appeared ready to definitively resolve the three-way split in 2024 by granting certiorari in Facebook, Inc. v. Amalgamated Bank, it ultimately dismissed the writ as improvidently granted without comment after holding oral argument.[11]
THE MAJORITY VIEW
The First, Second, Third, Fifth, Tenth, and D.C. Circuits agree that risk disclosure statements are actionable if they suggest a risk is hypothetical when it has already materialized, but only if it is virtually certain that the risk will cause real harm to the company. In Karth v. Keryx Biopharmaceuticals, Inc., for instance, the First Circuit found that plaintiff securityholders failed to state a claim on the basis of Keryx’s risk disclosure statements that it relied on a single supplier which, if interrupted, could underdeliver and harm the business.[12] Because plaintiffs did not allege “a supply interruption was happening or was even close to a ‘near certainty’” or indicate a “widely-accepted certainty of failure” at the time of Keryx’s statements, plaintiffs failed to establish Keryx knew the risk had or would transpire.[13]
The Third Circuit’s decision in Williams v. Globus Medical, Inc. showcases the second half of the majority view. There, plaintiffs asserted Globus’s risk disclosure statements—that its sales might be adversely affected “if [its] independent distributors were to cease to do business with [Globus]”—were misleading because Globus was aware when making its remarks that one such distributor’s contract had already expired.[14] Notwithstanding that the risk of losing a supplier had materialized, the Third Circuit found Globus’s risk disclosures nonactionable, because the risk did not harm Globus’s sales.[15] Accordingly, the Third Circuit distinguished Globus from out-of-circuit rulings “in which the adverse effects at issue had in fact been realized.”[16]
Lormand v. US Unwired, Inc. is one such case. There, the Fifth Circuit held that US Unwired’s risk disclosures—which generally warned that a “high rate of [] subscriber churn could harm our competitive position”—were actionable for failing to adequately convey the threat to US Unwired of its “no-deposit” program that “enlist[ed] low income and credit risky subscribers without deposits or credit checks.”[17] Because US Unwired was aware that “dangers [] had already begun to materialize” and knew the no-deposit program “threatened to severely harm the company financially by increasing churn,” the Fifth Circuit concluded its risk disclosures did not qualify for the Safe Harbor.[18] The D.C. Circuit reached the same conclusion in In re Harman, finding that Harman knew its business could be significantly injured if its product (portable navigation devices) became technologically obsolete and was further aware that a “threat of serious obsolescence was materializing” when it made generic risk disclosures to investors.[19] Accordingly, those risk disclosures were not protected by the Safe Harbor.[20]
THE NINTH CIRCUIT
The Ninth Circuit’s stance is a less-rigorous variant of the majority view—specifically, risk disclosure statements are always actionable if the threat the company portrayed as hypothetical had already transpired.[21] Unlike the majority of circuits, the Ninth Circuit “does not require harm to have materialized for a statement to be materially misleading.”[22] Accordingly, the Ninth Circuit decisions that established its broad understanding of the Safe Harbor—In re Alphabet and In re Facebook—both found actionable company risk disclosure statements that asserted a risk “could” or “may” occur when the company knew the threat had materialized, regardless of whether the company actually suffered harm.[23]
THE MINORITY POSITION
The Fourth and Sixth Circuits appear to take the opposite view: under these Circuits’ precedents, risk disclosures are never actionable under § 10(b), even if they portray already materialized risks as hypothetical. In Bondali v. Yum! Brands, Inc., the Sixth Circuit explained that risk disclosures “are inherently prospective in nature,” warning investors of “what harms may come” but not educating investors on “what harms are currently affecting the company.”[24] As a result, it found the risk disclosures at issue nonactionable under the plaintiff’s “materialization of risk” theory. The Fourth Circuit’s ruling in In re Marriott International, Inc. echoes this principle.[25] There, the court held Marriott’s cybersecurity risk disclosures were not actionable even if the company “certainly could have provided more information” about its vulnerability to cyberattacks.[26]
SCOTUS INTERVENTION
To the relief of companies and litigants, the Supreme Court suggested it might resolve the circuit split in 2024 when it granted the petition for certiorari in In re Facebook. The Court heard oral argument on the matter in early November 2024, but weeks later dismissed its writ of certiorari as “improvidently granted” without further comment.[27] Since then, the Court has yet to revisit the topic, and interested parties have been left to wonder whether the fracture will naturally heal itself.[28] Yet, as the circuits continue to decide securities cases according to three meaningfully different interpretations of the Safe Harbor, a natural cure appears unlikely.
THE NINTH CIRCUIT’S DECISION IN FUNKO & THE SECOND CIRCUIT’S DECISION IN GAP
Earlier this year, for the first time since the Supreme Court’s unwillingness to address the split, the Ninth and Second Circuits again confronted Safe Harbor eligibility for risk disclosure statements. Unsurprisingly, both Circuits held firm in their respective applications of the PSLRA.
In February of this year, the Ninth Circuit issued its decision in Construction Laborers Pension Trust of Greater St. Louis v. Funko Inc.[29] There, toymaker Funko issued multiple periodic filings from late 2021 through late 2022 including risk disclosure warnings that “[the company’s] success depends . . . on our ability to successfully manage our inventories” and “[f]ailure to successfully operate our information systems and implement new technology effectively could disrupt our business or reduce our sales or profitability.”[30] What Funko did not disclose was that, beginning in April 2022, inventory began arriving at its warehouses and Funko’s inexperience with its equipment and technology resulted in significant logjams, lost shipments, delayed order fulfillment, and cancelled orders.[31] In line with In re Facebook and In re Alphabet, the Ninth Circuit explained that “where a statement about the future is in the form of a warning about a risk that might hurt business in the future, the statement implicitly serves as a comment on the present state of affairs, because it suggests that the circumstance posing the risk has not yet occurred.”[32] Put differently, “[s]uch a statement does not fall under the [Safe Harbor] because its falsity lies not in the failure to predict the future, but in the implicit assertion about the present that the risk identified has not happened yet.”[33] Because Funko’s risk disclosure statements “implied that it was not presently experiencing” excess inventory buildup or ineffective technology implementation when those threats had actually materialized, the Ninth Circuit found those statements actionable.[34]
In May of this year, the Second Circuit responded. It addressed a securities class action by shareholders of clothing company Gap, who similarly alleged the company’s risk disclosures were misleading in and of themselves. In Gap’s periodic filings, it disclosed that its business could be harmed if Gap “misjudge[d] the market for our merchandise,” “[failed] to manage our inventory effectively,” or did not successfully implement “key strategic initiatives designed to optimize our inventory levels.”[35] As alleged, Gap subsequently commenced a plus-sized clothing initiative in 2021 which required stores to carry certain items in every size, and directed investors to review its periodic filings in 2021 and 2022.[36] However, the company declined to disclose that demand for plus-sized clothing was less than anticipated, and stores were forced to sell these items at clearance to make room for more profitable inventory.[37] The Second Circuit emphasized that whether a risk disclosure is actionable if it fails to disclose the risk actually materialized “depends on how a reasonable investor would understand the statements ‘taken together and in context.’”[38] Citing in-circuit precedent that echoed the First Circuit’s “near certainty” standard in Keryx Biopharmaceuticals, the Second Circuit rejected that “a risk disclosure is actionable whenever a company fails to disclose that the risk already materialized in some way.”[39] The court ultimately found “the challenged statements would not have misled a reasonable investor about the nature of the risks disclosed,” and held Gap’s risk disclosures nonactionable.[40]
IMPACT
The Ninth Circuit’s decision in Funko and the Second Circuit’s decision in Gap demonstrate the low likelihood that the prevailing circuit split regarding PSLRA Safe Harbor eligibility for risk disclosure statements will resolve on its own. Given the wildly variable liability risk companies now face across these jurisdictions, companies should proceed with caution with respect to risk disclosures. Until the Supreme Court indicates a willingness to resolve the existing split, companies should take care to confirm their risk disclosures do not suggest threats have not come to fruition when they have indeed.
ENDNOTES
[1] 15 U.S.C. § 78j(b).
[2] 17 C.F.R. § 240.10b–5(b).
[3] Blue Chip Stamps v. Manor Drug Stores, 421 U.S. 723, 731–32 (1975).
[4] Smith v. Gap, Inc., 177 F.4th 405, 408–09 (2d Cir. 2026).
[5] Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 320–21 (2007).
[6] 15 U.S.C. § 78u-5(c)(1).
[7] See generally Gap, Inc., 177 F.4th at 409; In re Facebook, Inc. Sec. Litig., 87 F.4th 934, 948 (9th Cir. 2023); Williams v. Globus Med., Inc., 869 F.3d 235, 238, 245 (3d Cir. 2017).
[8] See, e.g., Wilson v. Merrill Lynch & Co., 671 F.3d 120, 130 (2d Cir. 2011) (“[W]e have noted that ‘[c]autionary words about future risk cannot insulate from liability the failure to disclose that the risk has transpired.’”).
[9] See, e.g., id.; Globus Med., 869 F.3d at 242 (“[A] company may be liable under Section 10b for misleading investors when it describes as hypothetical a risk that has already come to fruition.”); In re Harman Int’l Indus., Inc. Sec. Litig., 791 F.3d 90, 102 (D.C. Cir. 2015) (“A warning that identifies a potential risk, but ‘impl[ies] that no such problems were on the horizon even if a precipice was in sight,’ would not meet the statutory standard for safe harbor protection.”); In re Alphabet, Inc. Sec. Litig., 1 F.4th 687, 703 (9th Cir. 2021) (“Risk disclosures that ‘speak[ ] entirely of as-yet-unrealized risks and contingencies’ and do not ‘alert[ ] the reader that some of these risks may already have come to fruition’ can mislead reasonable investors.”).
[10] See In re Marriott Int’l, Inc., 31 F.4th 898, 904–05 (4th Cir. 2022); Bondali v. Yum! Brands, Inc., 620 F. App’x 483, 491 (6th Cir. 2015).
[11] Facebook, Inc. v. Amalgamated Bank, 604 U.S. 4, 4 (2024).
[12] 6 F.4th 123, 129–30, 138 (1st Cir. 2021).
[13] Id. at 138.
[14] Globus Med., 869 F.3d at 238, 241.
[15] Id. at 242; see also Indiana Pub. Ret. Sys. v. Pluralsight, Inc., 45 F.4th 1236, 1256–57 (10th Cir. 2022) (finding non-actionable risk disclosure statements regarding Pluralsight’s sales capacity plan because the “problem could still be remedied at the time Pluralsight disclosed the risk to investors”).
[16] Globus Med., 869 F.3d at 243.
[17] 565 F.3d 228, 243, 246 (5th Cir. 2009).
[18] Id. at 246–47.
[19] 791 F.3d at 103–04.
[20] Id. at 104.
[21] See In re Alphabet, 1 F.4th at 703.
[22] In re Facebook, 87 F.4th at 949.
[23] In re Alphabet, 1 F.4th at 704; In re Facebook, 87 F.4th at 949–50.
[24] 620 F. App’x at 491 (emphasis in original).
[25] 31 F.4th at 904 n.2.
[26] Id. at 904–05.
[27] Facebook, Inc., 604 U.S. at 4.
[28] Of note, the Supreme Court now faces another opportunity to resolve the split. Earlier this year, the Ninth Circuit addressed risk disclosures in the related context of claims brought under Section 11 of the Securities Act of 1933. Consistent with its rulings in In re Alphabet and In re Facebook, the court held that securityholders of technology company ON24 adequately stated Section 11 claims by alleging the company “knew that the risk[s] of [customer erosion] had started to come to fruition . . . yet disclosed only that those risks may occur.” In re ON24, Inc. Sec. Litig., 2026 WL 45259, at *2 (9th Cir. Jan. 7, 2026) (emphasis in original). ON24 subsequently filed a petition for certiorari seeking to determine whether a company makes an actionably material omission by describing unmaterialized risks as hypothetical. The parties completed briefing on the petition in early October, and now await the Supreme Court’s decision.
[29] The Ninth Circuit amended its decision in early September of this year to address Funko’s petitions for rehearing. See Constr. Laborers Pension Tr. of Greater St. Louis v. Funko Inc., 2026 WL 2601128, at *2 (9th Cir. Sept. 2, 2026). The court’s September opinion is substantively identical to its original February opinion, adding just two sentences to further support its reasoning. Id. at *14. Given the near complete overlap, this memorandum refers and cites to the Ninth Circuit’s February decision as the original ruling setting forth the court’s rationale.
[30] 166 F.4th 805, 815–16 (9th Cir. 2026).
[31] See id. at 816–19.
[32] Id. at 825 (emphasis omitted).
[33] Id.
[34] Id. at 826–27.
[35] Gap, Inc., 177 F.4th at 409.
[36] Id. at 407, 409–10.
[37] Id. at 407–08.
[38] Id. at 410.
[39] Id. at 410–11; see also Set Cap. LLC v. Credit Suisse Grp. AG, 996 F.3d 64, 85–86 (2d Cir. 2021) (finding actionable risk disclosures where plaintiff securityholders alleged the company “knew with virtual certainty” that it would suffer harm).
[40] Gap, Inc., 177 F.4th at 411.
This post is based on a Cahill, Gordon & Reindel LLP memorandum, “Circuit Split on PSLRA Safe Harbor Eligibility for Risk Disclosure Statements Deepens,” dated October 23, 2026, and available here.