Offit Kurman Blogs
Commercial Litigation
When the Middleman Disappears: Synapse and the Litigation Risk Hiding in Banking-as-a-Service
In May 2024, a Maryland teacher told a federal bankruptcy court in California that he could not reach his own savings. “I have nearly $38,000 tied up,” he wrote. “This money took years to save up.” His money sat with a crypto app called Juno. Juno ran on technology from Synapse Financial Technologies, a middleware company most customers had never heard of, which had filed for bankruptcy weeks earlier.1 He was not alone. His problem was the predictable failure mode of Banking-as-a-Service, or BaaS. In a typical BaaS program, the customer opens an account in an app that may carry a bank’s name and logo. A fintech company designs the app and runs much of it. The bank holds the deposits and provides the regulated services. A middleware company like Synapse sits between them, connecting systems, processing transactions, and keeping the ledger that says who owns what. For a community or regional bank without the budget to build its own digital platform, the model is attractive. It is also a structure in which no single company sees the whole picture. When the middle layer fails, the bank must ask the question it should have asked from the start. If the provider disappeared tomorrow, could it still determine what it owes each customer? Synapse’s Collapse Synapse occupied that middle layer. Its technology connected nonbank fintech platforms to partner banks, including Evolve Bank & Trust, and supported account infrastructure, payments, and ledger management. By one industry estimate, as many as 100 fintechs and 10 million end users relied on Synapse.1 The decline was quick. Synapse laid off staff in 2023 and filed for Chapter 11 in April 2024, planning to sell its assets to another fintech. The buyer walked away within weeks.2 Then customers lost access to their money. Synapse’s records could not be reconciled with those of its partner banks. The Consumer Financial Protection Bureau (CFPB) later alleged that Synapse failed to keep adequate records of where consumer funds were and failed to make sure its records matched the banks’. By the CFPB’s account, the banks found that they held between $60 million and $90 million less than the balances in Synapse’s records. Synapse, through its bankruptcy trustee, resolved the CFPB matter by stipulated judgment, without any adjudication of fact or law.3 The Lawsuits That Followed For banks, the more instructive story is the litigation. In November 2024, customers of Yotta, a savings app that offered high-yield accounts through Synapse’s banking partners, and Juno filed a putative class action in Colorado against the four partner banks (Evolve, AMG National Trust Bank, Lineage Bank, and American Bank). They alleged that the banks failed to safeguard customer funds and keep accurate records, and that the banks relied on Synapse to open accounts, process transactions, and manage ledgers. A second putative class action, filed in Tennessee against Evolve and Lineage, accused the banks of negligent monitoring and mismanagement of consumer deposits. That case was transferred to Colorado and consolidated with the first. The banks dispute the allegations.4 Yotta itself sued Evolve in federal court in California, accusing the bank of fraud. The court dismissed Yotta’s complaint because Synapse was a required party, and because Synapse was in bankruptcy, it could not be joined. The court did not decide whether Evolve was liable, and it held that Yotta could refile in state court. Yotta has appealed. The obstacle was federal joinder, not the merits. But the ruling shows how central Synapse was to the dispute — so central that a federal court could not resolve the bank’s liability without it.5 What Banks Will Have to Answer Synapse is an extreme case. The legal questions it raises are not. They arise whenever a bank-branded product depends on companies the bank does not control. Start with duty. A program agreement can divide responsibilities among the bank, the fintech, and the middleware company. It cannot bind customers who never signed it, and it does not stop regulators or plaintiffs from going straight at the bank. That argument gets stronger when the app the customer used carried the bank’s own name and logo. These cases will be won or lost based on records. If a bank relied on Synapse’s ledger and that ledger cannot be reconciled with its own, the customer sees one balance in the app, and the bank sees another. Plaintiffs will say the gap proves the bank failed to keep accurate records, failed to oversee its vendor, or failed to account for customer funds. And the bank must defend those claims without the one document it needs most: a reliable record of what each customer was owed. Contracting out a function does not contract out the regulatory obligation. The 2023 interagency guidance from the Federal Reserve, FDIC, and OCC states that a bank’s use of third parties does not diminish or remove its responsibility to operate safely and soundly and to comply with applicable law. That guidance covers the relationship from planning and due diligence through contract negotiation, ongoing monitoring, and termination. In September 2026, those agencies and the NCUA proposed to rescind it and replace it with a shorter, principles-based document. The proposal states that it establishes no enforceable standards, and that the agencies do not expect banks to eliminate third-party risk. It is not final, and the 2023 guidance remains the operative standard until it is. Nor does the proposal change the underlying statutes, including the Bank Service Company Act, under which services a third party performs for a bank are examined as if the bank performed them itself.6 Expect plaintiffs’ counsel to build discovery requests from the FFIEC’s Bank Secrecy Act/Anti-Money Laundering Examination Manual and the agencies’ third-party risk management guidance. They will ask what the bank knew about its vendor, what controls it required, whether anyone independently tested the account records, and whether the bank had a workable plan for the day the vendor failed. The Synapse plaintiffs are already doing a version of this. Their Colorado complaint points to a June 2024 Federal Reserve enforcement action against Evolve, based on 2023 examinations that found Evolve lacked an effective risk-management framework for its fintech partnerships, to argue that Evolve knew of its problems well before the bankruptcy. The Fed said its action was independent of the Synapse bankruptcy. Regulatory findings do not establish civil liability, but they will shape the claims, defenses, and discovery.7 Reducing the Litigation Risk No contract eliminates BaaS risk. A bank can, however, decide now what kind of record it will have when the dispute arrives. Diligence should scale with what the bank is handing over. A bank that lets a vendor keep its core records or process its transactions needs to know how those records are created, where they live, and how the bank can check them independently. Draft the contract for the worst day of the relationship. It should address, in plain terms, recordkeeping and reconciliation; data access and audit rights; indemnification and insurance; and transition assistance. Most important, it should give the bank usable access to the records before a crisis, not merely a right to demand them after one. A right to data means little against a vendor that has stopped operating. Then test whether the bank could function without the vendor. That means backups, independent reconciliation, data-export procedures that have actually been run, and an exit plan built for abrupt failure rather than an orderly wind-down. The right controls depend on what is outsourced, but the test is always the same. If the provider disappeared tomorrow, could the bank still determine what it owes each customer? The bank does not need to write the software. It does need to know which system is authoritative, how balances are calculated, where transaction records reside, and whether those records can be preserved and produced in litigation. If only the vendor can answer those questions, the dependency is itself the risk. What Comes Next Synapse did not end Banking-as-a-Service. It exposed the questions every bank in a fintech partnership should already be able to answer. Who performs each function? Who controls the records? What is left when one company disappears? Those questions get harder as fintechs build artificial intelligence into account monitoring, fraud detection, and customer service, exposing banks to errors by autonomous AI agents and AI-enabled fraud. Much of the Synapse litigation remains unresolved, and the law governing these relationships is still forming. Banks should not wait for it. They should structure every fintech partnership on the assumption that, when something goes wrong, the bank will have to explain not only what its vendor did, but why it trusted the vendor to do it. 1 Hugh Son, Fintech Nightmare: “I Have Nearly $38,000 Tied Up” After Synapse Bankruptcy, CNBC (May 22, 2024), https://www.cnbc.com/2024/05/22/synapse-bankruptcy-customer-funds.html; Mary Ann Azevedo, Synapse, Backed by a16z, Has Collapsed, and 10M Consumers Could Be Hurt, TechCrunch (May 25, 2024), https://techcrunch.com/2024/05/25/with-a16z-backed-synapses-collapse-baas-fintech-is-a-mess-and-10-million-consumers-could-be-hurt/. 2 Mary Ann Azevedo, Synapse’s Collapse Has Frozen Nearly $160M from Fintech Users—Here’s How It Happened, TechCrunch (Aug. 22, 2024), https://techcrunch.com/2024/08/22/synapses-collapse-has-frozen-nearly-160m-from-fintech-users-heres-how-it-happened/; In re Synapse Financial Technologies, Inc., No. 1:24-bk-10646-MB (Bankr. C.D. Cal. filed Apr. 22, 2024). 3 Consumer Financial Protection Bureau, Synapse Financial Technologies, Inc. (Aug. 21, 2025), https://www.consumerfinance.gov/enforcement/actions/synapse-financial-technologies-inc/; Stipulated Final Judgment and Order, Consumer Financial Protection Bureau v. Synapse Financial Technologies, Inc., Adv. No. 1:25-ap-01052-MB (Bankr. C.D. Cal. Sept. 12, 2025). 4 Class Action Complaint, Margul v. Evolve Bank & Trust, No. 1:24-cv-03259 (D. Colo. Nov. 22, 2024); Consolidated Class Action Complaint, Justus v. Evolve Bank & Trust, No. 2:25-cv-02385 (W.D. Tenn. Apr. 4, 2025), transferred and consolidated with Margul, No. 1:24-cv-03259 (D. Colo. Sept. 17, 2025). Dispositive motions remained pending in the consolidated action as of early 2026. 5 Order Granting Motion to Dismiss First Amended Complaint, Yotta Technologies Inc. v. Evolve Bank & Trust, No. 3:24-cv-06456-TLT (N.D. Cal. Feb. 18, 2026) (holding that the action could not proceed in federal court without Synapse as a required party and could be refiled in state court), appeal docketed, No. 26-1535 (9th Cir. Mar. 13, 2026). The court previously dismissed Yotta’s original complaint in May 2025. 6 Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation & Office of the Comptroller of the Currency, Interagency Guidance on Third-Party Relationships: Risk Management, 88 Fed. Reg. 37,920 (June 9, 2023); see also FDIC, FIL-29-2023 (June 6, 2023), https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html; Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation & National Credit Union Administration, Proposed Third-Party Risk Management Guidance, 91 Fed. Reg. 58,536 (Sept. 15, 2026); 12 U.S.C. § 1867(c); see also Crowell & Moring LLP, From Process to Principles: Federal Regulators Propose a New Third-Party Risk Management Framework (Sept. 30, 2026), https://www.crowell.com/en/insights/client-alerts/from-process-to-principles-federal-regulators-propose-a-new-third-party-risk-management-framework. 7 Board of Governors of the Federal Reserve System, Federal Reserve Board Issues an Enforcement Action Against Evolve Bank & Trust for Deficiencies in the Bank’s Anti-Money Laundering, Risk Management, and Consumer Compliance Programs (June 14, 2024), https://www.federalreserve.gov/newsevents/pressreleases/enforcement20240614a.htm. The Federal Reserve stated that the enforcement action was independent of the Synapse bankruptcy. See also Synapse Partner Banks Hit with Lawsuit over Fund Mismanagement, Banking Dive (Nov. 2024), https://www.bankingdive.com/news/synapse-partner-banks-evolve-amg-lineage-american-bank-hit-with-lawsuit-over-fund-mismanagement/734219 (reporting that the Margul complaint relied on the Federal Reserve order to allege Evolve knew of its compliance issues before the Synapse bankruptcy).
October 14, 2026
Commercial Litigation
When the Mammoth Gets Out: Is a Genetically Engineered Animal a Product, or Is It Livestock?
It is a little before dawn when the fence gives way. The animal that steps through it is not supposed to exist. It stands nearly 11 feet at the shoulder, wrapped in a coat of coarse, rust-colored hair, its breath rising in the cold. It weighs five tons. A quarter mile off, a rancher hears a low rumble he feels in the floorboards before he hears it in the air. By the time he reaches the window, the thing is already in his neighbor’s wheat field, then his neighbor’s fence, then his neighbor’s parked truck. This is less far-fetched than it used to be. Colossal Biosciences, a company based in Dallas, has spent several years and a great deal of money on what it calls de-extinction, using gene editing to bring back species the earth has not seen in thousands of years. i The woolly mammoth is its most famous target. Whether or not a mammoth ever walks out of a lab, the company has already done something quieter that ought to interest lawyers. It has made us ask what body of law would govern the animal if one ever did. Because when that mammoth flattens the fence and crosses the wheat field, the first hard question is not biological. It is legal. Who pays for the wheat, the fence, and the truck? To answer that, a court will have to decide something no court has decided before. Is a woolly mammoth livestock, or is it a product? The Law Already Knows What to Do with Animals The law has been sorting out liability for wayward animals for a very long time, longer than it has handled almost anything else. Cattle have wandered into neighbor’s crops since there were neighbors and crops, and the common law worked out rules for the aftermath. The modern American version lives in the Restatement (Third) of Torts, which sorts the animal kingdom into a few practical categories. An owner of livestock that strays onto a neighbor’s land and does damage is generally strictly liable for the intrusion. There is no need to prove the rancher was careless, only that the cattle got out and the corn got eaten. An owner of a wild animal, meaning a species that has not been domesticated and tends to hurt people unless restrained, is strictly liable for the harm it causes. Everyone understands that keeping a tiger is a different proposition from keeping a cow. And an owner of an ordinary domestic animal becomes strictly liable once he knows, or has reason to know, that his particular animal has dangerous tendencies abnormal for its kind. That is the rule behind the old idea that every dog gets one free bite.ii Underneath all of this runs a deeper legal principle. In 1868, the House of Lords decided Rylands v. Fletcher, a case that had nothing to do with animals. A mill owner built a reservoir on his land. It burst through some abandoned mine shafts and flooded his neighbor’s coal mine. The court held him liable even though he had not been negligent, and it announced a rule that has echoed through the common law ever since. A person who brings onto his land something likely to do mischief if it escapes keeps it there at his peril, and answers for the damage if it gets loose.iii The Rylands principle appears to fit this scenario. A wooly mammoth in a wheat field is surely something extraordinary and something likely to do mischief if it escapes. Neither Quite Animal nor Quite Product So the law has categories, and at least one seems to fit. If the mammoth is just an exotic, dangerous beast, the wild-animal rule imposes strict liability, and the inquiry ends there. If it is closer to livestock, the trespassing-animal rule imposes strict liability for the crops and the fence. Either way the neighboring rancher recovers. Where is the difficulty? The difficulty is that every one of these doctrines quietly assumes something that is not true of a mammoth. Each assumes the species already exists and that people have built up some working knowledge of how it behaves. Cattle stray and trample. Tigers maul. A dog that has bitten once may bite again. The categories work because generations of experience have filled them. No one has that experience with a mammoth. No rancher has raised one. No veterinarian has treated a herd of them. No actuary has a drawer full of mammoth claims. The last person with any practical knowledge of the species died before the pyramids were built. The dangerous-propensities rule asks what is normal for the animal’s kind, and for this animal nobody alive can answer. There is a second problem. A cow is born. A tiger is born. The mammoth was designed. Somewhere a research team chose its traits, selecting for cold tolerance, for size, for coat, editing a genome the way an engineer sets a tolerance on a drawing. The animal in the wheat field did not simply get loose. It is the output of a manufacturing process. It’s a product. The Law Also Knows What to Do with Products Products liability exists to hold manufacturers responsible for the things they design and sell into the stream of commerce. The logic is intuitive. The company that decides how a product will be built, and profits from selling it, is the party best placed to make it safe and to pay when it is not. The doctrine asks a familiar set of questions. Was there a design defect, meaning the thing was unreasonably dangerous as intended? Was there a manufacturing defect, meaning this particular unit came out different from its design? Was there a failure to warn, meaning the maker did not tell foreseeable users and bystanders what they needed to know to stay safe?iv Now ask those same questions about the mammoth. If the animal is aggressive because a team selected for size and dominance, is that a design defect? If a genetic edit expressed differently in this individual than the company intended, and produced a beast more unpredictable than the blueprint promised, is that a manufacturing defect? If the company handed the animal to a preserve without warning that its containment needs went beyond anything in ordinary ranching, is that a failure to warn? None of these questions is absurd. Every one of them sounds like a products case. This is the collision at the heart of the problem. Livestock law assumes an animal that is born and merely owned. Products law assumes an object that is designed and sold. A genetically engineered mammoth is both at once. It is born and built, owned and manufactured, alive and, in the coldly commercial sense, a product. It does not fit either box, because it was never meant to exist in a world that has only two boxes. Who Pays for the Damage? Line up the possible defendants. First, there is the owner, the preserve or facility that held the animal and let it escape. This is the classic livestock posture. You owned the beast, you failed to contain it, you answer for the damage. Straightforward, and probably right as far as it goes. However, there is also the creator, the company that designed the animal, chose its traits, “manufactured” it, and put it into the stream of commerce. If the injury flowed from a characteristic the company deliberately engineered, the rancher’s lawyer will not be content to sue only the party that owned the fence. He will follow the deeper pocket back to the drawing board and argue that a company cannot design a five-ton animal, sell it, and then walk away from the predictable results of its own design choices. Likely, courts will end up borrowing from both traditions at once. The owner answers under animal-law principles for failing to contain the creature. The creator answers under products principles for the traits it built into it. That is not a tidy rule. But tidy rules tend to be the ones the law inherits for problems it has already seen. This is a problem the law has not seen, and the first courts to face it will be improvising with borrowed tools. The Quiet Gatekeeper: Insurance There is one more player in this drama, and it may matter more than any court. Long before a judge rules on whether a mammoth is a product or livestock, an underwriter has to decide whether it can be insured at all, and at what price. Insurers price risk from data, and here there is none. There is no loss history and no mortality table for an animal that has been extinct for millennia. Faced with that kind of uncertainty, an insurance market does one of two things. It refuses the risk, or it prices the risk so high that the underlying activity stops making economic sense. The mammoth may never be stopped by a statute. It may simply turn out to be uninsurable. Living Products are Coming Either Way It would be easy to file all of this under science fiction and move on. That would be a mistake. The mammoth is the most theatrical example of a category that is already arriving in quieter forms, and it is not only about giants. Colossal’s own roster runs well past the mammoth, to the Tasmanian tiger, the dodo, the moa, the South African bluebuck, and the dire wolf, whose pups the company says it has already produced.v Add the gene-edited cattle and hogs, the engineered salmon, and the disease-resistant crops already moving toward market, and the pattern is hard to miss. A growing catalogue of organisms are, unmistakably, designed. Each raises a gentler version of the question the mammoth asks so loudly. When a living thing is engineered by a company and sold into the world, is it an animal, a product, or some third thing the law has not yet named? For centuries tort law has kept two sets of rules on two separate shelves. Animals are born, and the law of animals governs them. Products are made, and the law of products governs them. The whole structure rests on the assumption that living things and manufactured things are different kinds of things. Synthetic biology quietly dissolves that assumption. It produces organisms that are grown rather than assembled, that reproduce rather than roll off a line, and that were still designed as deliberately as any machine. So when the mammoth finally puts its shoulder into that fence, or, more likely, when some engineered animal with a far less exciting name does something a court has to sort out, the judge will reach for the tools on hand. She will find two bodies of law built for two kinds of things and a defendant that is somehow both. The mammoth is a good way to notice the problem. It is not, in the end, what the problem is about. The problem is that biology is becoming an engineering discipline, and the liability rules were written for a world in which it was not. i Colossal Biosciences, The De-Extinction Company, https://colossal.com (last visited Sept. 12, 2026). ii Restatement (Third) of Torts: Liab. for Physical & Emotional Harm § 21 (Am. L. Inst. 2010) (intrusion by livestock or other animals); id. § 22 (wild animals); id. § 23 (abnormally dangerous domestic animals with known dangerous tendencies). iii Rylands v. Fletcher (1868) LR 3 HL 330 (appeal taken from Eng.), aff’g Fletcher v. Rylands (1866) LR 1 Ex 265 (Blackburn, J.). iv Restatement (Third) of Torts: Prods. Liab. § 2 (Am. L. Inst. 1998) (distinguishing manufacturing defects, design defects, and defects based on inadequate warnings). v Colossal Biosciences, Our Species, https://colossal.com/species/ (last visited Sept. 12, 2026) (listing the woolly mammoth, thylacine, dodo, moa, bluebuck, and dire wolf); see also Colossal Biosciences, Dire Wolf, https://colossal.com/direwolf/ (last visited Sept. 12, 2026) (announcing the birth of dire wolf pups).
September 23, 2026
Commercial Litigation
DExit: How Texas is Building a Corporate Alternative to Delaware
Through business court reform, corporate governance legislation, and the creation of a national stock exchange, Texas is making a deliberate bid to compete with Delaware as America's preferred corporate domicile. Texas is a lot of things, but subtle is rarely one of them. And there is certainly nothing subtle about Texas's recent efforts to attract businesses and capital to the Lone Star State. The latest evidence can be found in a term that has increasingly entered corporate nomenclature: DExit. Short for "Delaware Exit," DExit refers to the growing trend of companies reconsidering Delaware as their state of incorporation. Much of the public discussion surrounding DExit has focused on a handful of high-profile corporate relocations and reincorporations. That focus, however, risks missing the larger story. For more than a century, Delaware has occupied a singular place in corporate America. That dominance is remarkable when one considers Delaware's size. The entire State of Delaware could fit within the greater Houston metropolitan area and still leave room for a few Buc-ee's locations. Yet this geographically tiny state became the legal home of many of America's largest corporations by offering something few jurisdictions could match: a sophisticated body of corporate law and a specialized judiciary capable of resolving corporate disputes with predictability. Texas has spent the last several years studying that playbook. Recent amendments to the Texas Business Organizations Code, the creation of the Texas Business Court and Fifteenth Court of Appeals, and the launch of the Texas Stock Exchange suggest that Texas is no longer content merely to attract a company's regional office or even its corporate headquarters. Texas now wants the company's legal domicile as well. Whether Texas ultimately succeeds remains to be seen. Delaware's advantages remain substantial. But for the first time in decades, a serious challenger appears to be emerging. Rewriting the Corporate Rulebook The clearest evidence of Texas's ambitions appear in Senate Bill 29 and the legislature's recent amendments to the Texas Business Organizations Code (TBOC). The legislature was not particularly coy about what it hoped to accomplish. State Senator Bryan Hughes described Delaware as a jurisdiction in which many companies had become "shackled by a burdensome Delaware legal establishment dominated by activist judges and special interest groups" and stated that the legislation would help bring American enterprise and jobs to Texas.1 The bill's legislative history described Texas's goal as becoming the "corporate law capital of America."2 Amended TBOC § 21.218 narrows shareholder inspection rights by requiring a shareholder to hold shares for at least six months or own at least 5% of the corporation's outstanding shares before demanding access to books and records. The statute also limits inspections to requests related to a shareholder's economic interest in the corporation and generally restricts access to certain categories of electronic communications. That restriction on electronic communications is particularly significant. Emails, text messages, and other electronic communications are among the most voluminous and expensive categories of information for a company to collect, review, and produce upon a books and records request. The legislature also codified the business judgment rule through TBOC § 21.419, establishing a statutory presumption that directors and officers acted in good faith, on an informed basis, and in the best interests of the corporation. Senator Hughes stated that the change would allow Texas businesses to "confidently deploy capital" by providing greater certainty to corporate decision-makers.3 Finally, new TBOC § 21.373 permits qualifying corporations to adopt heightened requirements for shareholder proposals, including minimum ownership thresholds, holding periods, and proxy solicitation requirements. Reasonable minds may disagree on the wisdom of these changes, but their purpose is clear. Texas is actively reshaping its corporate-governance framework to make itself more attractive to corporate managers and directors considering where to incorporate. Building a Texas Version of the Court of Chancery Corporate lawyers have never chosen Delaware solely because of its statutes. Delaware's true advantage has long been its Court of Chancery and the extensive body of precedent developed through decades of specialized corporate litigation. Texas’s response is the Texas Business Court. Operational since September 2024, the court has jurisdiction over certain complex business disputes, including corporate-governance matters and significant commercial transactions. For many claims, Business Court jurisdiction generally requires an amount in controversy exceeding $5 million. Appeals proceed directly to the newly established Fifteenth Court of Appeals, creating a centralized path for the development of Texas business law.4 Early results suggest the court is attracting substantial use. During its first year, the Texas Business Court received 185 filings, including 145 corporate-governance cases. Judges issued more than 680 orders, conducted more than 270 hearings and conferences, and produced 42 written opinions.5 Those numbers matter. Delaware's dominance did not emerge overnight. It developed because companies, lawyers, and judges repeatedly chose a singular and specialized forum for business disputes, which resulted in a predictable body of case law. Texas appears to be attempting a similar process. Ringing the Opening Bell The most ambitious piece of Texas's strategy may be the Texas Stock Exchange (TXSE). A state can attract incorporations through favorable laws. It can improve predictability through specialized courts. But creating a genuine alternative corporate ecosystem requires access to capital markets. The Texas Stock Exchange received SEC approval in September 2025 and completed its rollout into full production trading in July 2026. It is Texas’s first fully integrated national securities exchange.6 Its launch was more than symbolic. TXSE began trading with more than 50 member-firms and described its opening as the broadest day-one participation of any exchange launch in half a century. TXSE leadership has stated that the exchange was designed to provide “real competition for primary listings for the first time in decades."7 In August 2026, Reuters reported that TXSE secured its first primary listings, an early milestone in that effort, and noted that the venture is backed by prominent financial institutions and investors, including BlackRock, Citadel Securities, and Charles Schwab.8 TXSE plans to begin facilitating initial public offerings in 2027, which would mark its next major step toward becoming a full-service competitor to the established New York exchanges.9 No one should expect TXSE to depose the New York Stock Exchange or Nasdaq anytime soon. That is not the point. The significance of TXSE lies in what it represents. Texas is no longer content to attract headquarters. It is building the infrastructure that supports public companies after they arrive. The message seems to be that if a company is willing to move its charter to Texas and litigate its disputes in a Texas business court, Texas would also like it to ring the opening bell here. Viewed alongside the TBOC amendments and Business Court reforms, the exchange is another step in Texas's broader effort to become the legal home of major American businesses. Texas Makes Its Move Delaware remains the dominant corporate domicile in America. Its position rests on more than a century of corporate law precedent and the predictability that comes with it. No state can replicate that overnight. Texas, however, enters this competition from a position of strength. In 2026, Texas surpassed California as the state with the largest number of Fortune 500 headquarters. The state is now home to 57 Fortune 500 companies with a combined $2.8 trillion in annual revenue.10 For decades, Texas competed on cost, taxes, and population growth. Today, it is competing on corporate governance and capital as well. Whether DExit ultimately becomes a wave or merely a footnote in corporate history remains to be seen. What is already clear is that Texas has made a deliberate decision to challenge Delaware's dominance. The coming years will determine whether businesses embrace that challenge. Texas, however, is no longer content to be where companies do business. It wants to be where they choose to call home. 1 Press Release, Office of Senator Bryan Hughes, Senator Bryan Hughes Files Groundbreaking Bill to Transform Texas Corporate Law (Feb. 27, 2025). 2 S.B. 29, 89th Leg., Reg. Sess. (Tex. 2025), legislative history and bill analyses; Tex. Bus. Orgs. Code §§ 21.218, 21.373, 21.419. 3 Note 1, supra. 4 H.B. 19, 88th Leg., Reg. Sess. (Tex. 2023), legislative history; S.B. 1045, 88th Leg., Reg. Sess. (Tex. 2023), legislative history; Tex. Gov't Code ch. 25A and § 22.2151. 5 Office of Court Administration, The Business Court of Texas, Annual Report FY 2025. 6 Office of the Governor, Governor Abbott Marks Successful Trading Launch of Texas Stock Exchange (July 31, 2026). 7 Texas Stock Exchange, Texas Stock Exchange Celebrates Successful Launch of Trading (July 31, 2026). 8 Reuters, Texas Stock Exchange Lands First Primary Listings in Bid to Carve Out Market Turf (Aug. 18, 2026; updated Aug. 19, 2026). 9 Eric Revell, Texas Stock Exchange Officially Goes Live to Rival NYSE and Nasdaq, Fox Business (July 31, 2026). 10 Fortune Media, Amazon Claims No. 1 Spot on the Fortune 500 (June 3, 2026); Office of the Governor, Texas Leads With Most Fortune 500 Headquarters (June 3, 2026).
August 31, 2026
Commercial Litigation
AI, Data Breaches, and an Old Lesson from the Law of Bailment
OpenAI recently disclosed that, during testing of one of its frontier artificial intelligence models, AI agents working to solve assigned tasks found ways to access the internet and ultimately infiltrate the systems of another AI company, Hugging Face. They did so through pathways OpenAI's developers never intended them to reach. The incident quickly dominated technology and cybersecurity headlines. It also prompted OpenAI to send two of its security engineers to Black Hat USA 2026, one of the cybersecurity industry's premier conferences, to discuss what occurred.1 Although the Black Hat presentation included highly technical explanations of the exploits, there were two noteworthy statements that stood out from a legal perspective. First, one OpenAI engineer explained that agents who became stuck on their assigned tasks "thought to try to get internet access in ways we didn't intend." Second, the presenters repeatedly emphasized that the incident was not the result of malicious human actors. It was an unintended consequence of testing frontier AI systems whose behavior ultimately extended beyond what their developers anticipated.2 Some observers view the incident as another example of the broader concerns surrounding AI autonomy and alignment. Others see it as evidence that cutting-edge AI systems require greater oversight, testing safeguards, and deployment controls. Regardless of where one falls in that debate, the incident highlights a challenge general counsel cannot afford to ignore. Organizations increasingly face risks not only from malicious actors, but also from highly capable systems pursuing legitimate objectives through unexpected means. The legal implications of that reality, however, may be far less revolutionary than many assume. The Technology Has Changed. The Legal Question Has Not. In Krupa v. TIC International Corp., a federal court recently summarized the relationship between businesses and customer data in simple terms: "Consumers entrust their data to firms with the expectation that those firms take reasonable care against data breaches."3 Long before courts dealt with ransomware, credential theft, or AI-enabled cyberattacks, they addressed a more basic question. What duty does someone owe when entrusted with another person's property? The law answered that question through the doctrine of bailment. A custodian was not an insurer against every loss. But the custodian was expected to exercise reasonable care over property entrusted to it. More than a century ago, in Claflin v. Meyer, a New York court explained that a warehouse owner was not automatically liable simply because thieves successfully stole property entrusted to his care. Liability turned on whether the warehouse failed to exercise the degree of care that a prudent person would use to protect his own property under similar circumstances.4 That same principle continues to echo through modern data-breach litigation. Courts may label the theory differently depending on the jurisdiction. One court may analyze negligence. Another may discuss bailment. A third may focus on some other duty. Yet the practical question remains remarkably consistent throughout. Did the company take reasonable steps to protect information entrusted to its care? Today's businesses may not store their customers’ data in warehouses, but they are the keepers of a vast array of valuable digital data. Banks maintain clients’ financial information. Law firms possess confidential communications. Healthcare providers store patient records. Virtually every organization now serves as a custodian of information entrusted to it by someone else. In the nineteenth century, courts looked at locks, guards, and warehouse security. Today they examine the overall cybersecurity posture of an organization. The specific safeguards may be different, but the inquiry is very similar. The tools have changed. The standard has not. Why the OpenAI Incident Matters The significance of the OpenAI-Hugging Face incident is not that it suddenly created a new legal duty. It may, however, influence what decision-makers come to expect from organizations entrusted with sensitive information. During the Black Hat presentation, OpenAI's engineers acknowledged a concern increasingly shared across the cybersecurity industry. Offensive AI capabilities may be advancing faster than defensive ones. For general counsel, that does not mean every company must immediately deploy cutting-edge AI security tools or spend unlimited resources on cybersecurity. Courts have never required perfection, and they are unlikely to start now. But reasonable care is not a static concept. As threats evolve, expectations evolve. A security posture that appeared reasonable five years ago may not appear reasonable five years from now. What General Counsel Should Be Asking The lesson from the OpenAI incident is not that every company needs to keep up with all the goings-on of every cutting-edge AI company. The lesson is that cybersecurity can no longer be treated as an issue that belongs exclusively to IT. General counsel do not need to know how to configure firewalls or administer cloud environments. They should, however, be able to explain why the organization chose the safeguards it did and why those safeguards were reasonable under the circumstances. In advising a client after reviewing the OpenAI incident, it would be important to determine whether management could confidently answer a handful of basic questions: What sensitive information does the company hold? Where is that information stored, and who has access to it? What cybersecurity standards or frameworks guide the company's program? How often does the company assess new risks or known vulnerabilities? Which vendors store or process sensitive information for the company? How does the company monitor emerging AI-related cybersecurity threats? When did the company last conduct a tabletop exercise or incident-response drill? If a breach occurred tomorrow, what evidence would show that the company acted reasonably? The goal is not merely to have answers. The goal is to document the process. If a breach ultimately occurs, a company is far better positioned when it can point to documented, pre-breach evaluations of its cybersecurity risks and safeguards. That evidence tells a compelling story. It shows that management recognized the risks, discussed potential safeguards, consulted the appropriate professionals, and made informed decisions before anything went wrong. A judge or jury is generally more likely to view that conduct as reasonable than a company attempting to reconstruct and justify its decisions only after a breach has occurred. The Legal Standard Has Not Changed The emergence of increasingly capable AI systems has generated plenty of headlines and speculation. Some of that concern may prove justified. Some may prove overstated. From a legal perspective, however, the underlying principle remains remarkably familiar. No company is expected to create an impenetrable system. No company is expected to anticipate every threat. What courts have historically required is reasonable care. AI may have altered the speed, scale, and sophistication of cyberattacks. Yet the fundamental question that follows a breach remains much the same as it was when courts evaluated warehouse burglaries more than a century ago. Did the company act reasonably to protect what was entrusted to its care? The warehouses have changed. They are now digital. The duty of reasonable care, however, remains the same. 1 Michael Dalton & Eric Wallace, The "Breaking" News: The OpenAI-Hugging Face Incident: A Technical Reconstruction and Its Implications for AI, Black Hat USA 2026, YouTube (Aug. 2026), https://www.youtube.com/watch?v=87DyyMV0kCY. 2 Id. 3 Krupa v. TIC Int'l Corp., No. 1:22-cv-01951-JRS-MG, 2023 WL 143140, at *2 (S.D. Ind. Jan. 10, 2023). 4 Claflin v. Meyer, 75 N.Y. 260, 264-65 (1878). See also In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1175-77 (D. Minn. 2014) (allowing data-breach claims to proceed past the pleading stage).
August 17, 2026
