Integrated throughout. Except in the research notes.

A $19 million penalty for the distance between the claim and the work

On 25 September 2023, the Securities and Exchange Commission instituted settled proceedings against DWS Investment Management Americas, Inc., known as DIMA, the US investment-adviser arm of the DWS asset-management group and an indirect, majority-owned subsidiary of Deutsche Bank, imposing a $19 million civil penalty. The charge was not that DIMA had made bad investments or lost client money. It was that DIMA had told clients, prospective clients, and fund investors that it integrated environmental, social, and governance factors throughout its investment process, and had failed to adopt and implement the policies and procedures needed to make that representation true or to keep it from being materially misleading. The SEC found that DIMA willfully violated Section 206(4) of the Advisers Act and Rules 206(4)-7 and 206(4)-8, the provisions that require an adviser to maintain adequate compliance procedures and forbid misleading pooled-fund investors.¹

The heart of the case is a single, measurable gap. DIMA marketed itself as a leader in ESG. It built its story around a proprietary tool it called the DWS ESG Engine, and a senior leader told an industry magazine that ESG was "top of mind throughout our organization," the centerpiece of its commitment, used by every investment team to make decisions. The firm maintained a formal ESG Integration Policy that required its research analysts to incorporate material ESG factors into their valuation models, investment recommendations, and research reports. Then DIMA's own internal quality checks, on research notes written between January and November 2020, found that only about 54% of active equity research notes and 21% of fixed income research notes even mentioned ESG criteria. The process the firm had told the market was woven throughout its investment work was, by its own measurement, absent from nearly half of its equity analysis and from four out of five fixed income notes.

This study treats the DWS matter as the definitive case on greenwashing understood correctly, not as a dispute about whether ESG is good or whether the firm's investments were green, but as a failure of the discipline that governs every claim a regulated firm makes about its own process. It walks the claims DIMA made, the operation that did not match them, and the controls that were never built to connect the two, and it lifts each failure into the discipline it violated: why a marketing claim about a process is a factual assertion the firm must be able to prove and keep proving; why a correction that never reaches the published artifact is not a correction; why the capacity to substantiate a claim must scale to the breadth of the claim; why a monitoring control must be defined for the case where the thing it looks for is absent; why every public claim needs an owner accountable for its continued truth; and why discovering that a claim is unsubstantiated obligates a firm to correct or withdraw it, not to fix forward while leaving it published. It closes on the proposition that a claim should always lag the capability it describes, and on why marketing that runs ahead of the operation is a liability the operation eventually pays for.

What integration was claimed to be

To understand the gap, you first have to see how specific and how operational DIMA's claims were, because they were not vague aspirations to care about sustainability; they were concrete assertions about how the firm's investment process worked. At the center sat the DWS ESG Engine, a proprietary tool the firm described as the centerpiece of its commitment to integrating ESG considerations into its investment process. In a 2019 marketing piece, a senior leader said that ESG was top of mind throughout the organization and that every DWS investment team used the Engine to make investment decisions for their portfolios. The firm paid for an article in an investment magazine titled "When ESG is in your DNA." The language was not atmospheric; it made claims about tools used and teams using them.¹

Beneath the marketing sat a formal apparatus that made the claims still more concrete and, crucially, measurable. DIMA maintained an ESG Integration Policy, first created in August 2018, that applied to its investment professionals and required its research analysts to include financially material and reputation-relevant ESG aspects in their valuation models, their investment recommendations, and their research reports, and to consider material ESG aspects as part of their investment decisions. The firm's research handbooks reinforced this: the March 2019 Equity Research Handbook required research notes to document an issuer's ESG and controversies, and the July 2020 Credit Research Handbook required integrated initiation reports to consist in part of ESG analysis. The claim, in other words, was not merely that DIMA valued ESG; it was that DIMA's analysts were required to and did document ESG factors in the specific work products, the research notes and valuation models, through which investment decisions were made.

This specificity is what made the claim falsifiable, and it is why the case is such a clean lesson. A firm that says only that it "cares about sustainability" has made a claim too vague to measure and too soft to prove false. DIMA said something precise: that its analysts incorporated ESG into their research notes and valuation models as a matter of required policy, and that every team used a named proprietary tool. Those are testable assertions about operations, and they created, by their own terms, the measuring stick against which the firm could be, and ultimately was, found wanting. The claim named the work product, the research note, where the integration was supposed to appear, which meant that counting how often ESG actually appeared in the research notes was a direct test of whether the claim was true. The firm had, in its own marketing and its own policy, told the world exactly where to look.

The gap between the claim and the notes

When DIMA finally looked, in a systematic way, at whether its analysts were doing what the policy required and the marketing claimed, the answer was stark, and it came from the firm's own quality checks rather than from a regulator. On a sample of research notes written between January and November 2020, only about 54% of active equity research notes and about 21% of fixed income research notes mentioned ESG criteria at all. The policy required ESG to be documented in research notes. The marketing said ESG was integrated throughout. Nearly half of the equity notes and nearly four-fifths of the fixed income notes did not even mention it.¹

The significance of these numbers is not that they are low in some absolute sense; it is that they contradict the specific representation the firm had made. If DIMA had marketed itself as a firm that considered ESG where relevant, a 54% mention rate might be consistent with a process that applied ESG selectively. But DIMA had not said that. It had said ESG was required in the research notes, that it was integrated throughout, that every team used the Engine, that it was in the firm's DNA. Against those claims, a finding that ESG was missing from 46% of equity notes and 79% of fixed income notes is not a partial success; it is a direct measurement of the claim being false for a large fraction of the work. The documentation was the evidence of the process, because the policy itself made the research note the place where integration was supposed to be recorded, and the documentation showed the process was not happening at anything like the claimed rate.

It is worth sitting with the fixed income figure in particular, because 21% is the number that most clearly exposes the distance between story and operation. For a firm that told the market ESG was woven throughout its investment process, to find that fewer than one in four fixed income research notes mentioned ESG is to find that, in an entire asset class, the represented process was absent from the overwhelming majority of the analysis. This was not a rollout that was 90% complete and had some stragglers; it was a process that, in fixed income, barely existed in the documented record while being marketed as comprehensive. The gap between 100% claimed and 21% documented is the whole case in two numbers, and it is a gap the firm could measure precisely because its own policy had defined where the integration was supposed to appear.

A claim about your process is a factual assertion you must be able to prove

The DWS gap crystallizes the foundational discipline of marketing compliance, one that firms violate constantly because marketing language and operational reality are produced by different people with different incentives: a public claim about how a firm's process works is not marketing color, it is a factual assertion about operations, and the firm must be able to substantiate it with evidence, not only at the moment it is made but for the entire time it remains published. DIMA claimed ESG was integrated throughout its process; the test of that claim was whether the process actually did what was claimed; and the firm's own evidence, its research notes, showed it did not.¹

The reason this discipline is so easy to breach is that the people who write marketing claims are usually not the people who operate the process, and the two can drift apart without anyone deciding they should. A marketing team, briefed on the firm's ESG ambitions and its proprietary tool, writes copy that describes the aspiration as a reality, "integrated throughout," "every team," "in our DNA," because that is how marketing describes capabilities, in the present tense and at their best. The operational reality, meanwhile, is messier: the policy exists but is unevenly followed, the tool is available but not always consulted, the documentation is required but frequently absent. Nobody lies, exactly; the marketing describes the intended state and the operation lives in the actual state, and the gap between them is the greenwashing. The compliance discipline exists precisely to close that gap, by insisting that before a claim about the process is published, someone confirm that the process actually works the way the claim says, with evidence, and that the evidence be refreshed for as long as the claim stands. A firm that publishes claims its operation cannot substantiate has not committed a marketing excess; it has made false statements about itself to the people relying on them.

Substantiate before you publish, and keep substantiating

The discipline is that every claim a firm makes about its own process, in marketing, on its website, in RFP responses, in client presentations, must be substantiated by operational evidence before it is published and must remain substantiated for as long as it is live, with a defined owner responsible for confirming both. This means a firm needs a bridge between its claims and its operations: a process that takes each material representation about how the firm works and asks, before publication, what is the evidence this is true, and after publication, is it still true. For a claim that ESG is documented in research notes, the substantiation is a measurement of how often it actually is, exactly the quality check DIMA eventually ran, and the discipline is to run that check before making the claim, not years after. The test a firm should apply to any process claim is whether it could, if a regulator asked tomorrow, produce current evidence that the claim is true, and a firm that is making claims it has never measured, or that it measured once and has not re-checked, is carrying unsubstantiated representations that will be true only by luck. DIMA's claims were measurable, the firm had the means to measure them, and the measurement, when finally taken, disproved the claim. The discipline is to take the measurement first.

"Every" became "most," and the fix never shipped

One episode in the case is almost a parable of how a controls failure and a claims failure combine, and it turns on a single word. In the 2019 marketing article, the draft asserted that every DWS investment team used the ESG Engine to make investment decisions for their portfolios. Before publication, DIMA's own Marketing Review Group caught the overstatement and revised the last sentence, changing "every" to "most." The review worked: a control had identified that "every" was too strong and corrected it to something defensible. But the revision did not appear in the final published version. The article went out saying "every." DIMA did not notice the misstatement after publication, and the article remained online, available to clients, prospective clients, and investors.¹

This single word carries a surprising amount of the case's meaning, because it shows that the problem was not that DIMA lacked any review of its claims. The Marketing Review Group existed, and it worked: it read "every," recognized that the firm could not stand behind so absolute a claim, and changed it to "most." The judgment was correct and the control functioned exactly as intended. What failed was everything after the judgment: the corrected language did not make it into the published article, and no control confirmed that the approved version was the version that actually went out. The review caught the error, the fix was decided, and then the fix was simply lost somewhere between the reviewer's markup and the published page, where it sat, uncorrected, for the firm's clients to read. The control that mattered, the one that would have confirmed that the published artifact matched the approved version, did not exist, so the work of the control that did exist was quietly discarded.

And then the second failure compounded the first: DIMA did not notice the misstatement after publication. The firm had no process that, after the article went live, checked the published version against the approved version, so the discrepancy between "most" (approved) and "every" (published) went undetected and uncorrected, and the article stayed online making a claim the firm's own reviewers had already rejected as too strong. The overstatement the firm had caught before publication was republished by its own failure to connect the approval to the artifact, and then preserved by its failure to check what it had actually published. One word, approved as "most," published as "every," left as "every," is the whole machinery of a claims-control failure in miniature.

A correction that never reaches the artifact is not a correction

The "every" that should have been "most" generalizes into a discipline that applies to every firm that reviews and approves public materials: approving a correction is not the same as making it, and a review process that ends at the approved markup rather than verifying the published artifact has not controlled anything, because the only version that matters is the one the public can actually see. DIMA's reviewers did their job and changed "every" to "most"; the control failed anyway, because the approved change never became the published reality and nothing checked that it had.¹

The reason this failure mode is so common and so dangerous is that it hides inside a control that appears to be working. A firm with a marketing review function can point to it as evidence that its claims are vetted, and the function can be genuinely competent, catching overstatements and approving corrections, while a gap at the very end, between the approved version and the published version, silently defeats all of it. The review produces an approved document; publication produces a live artifact; and if nothing verifies that the second matches the first, the firm can have a rigorous review process and still publish exactly the language its reviewers rejected. This is the version-control problem that any organization producing public content faces: the approved version and the published version are two different objects, maintained by two different steps, and they can diverge. A firm that treats approval as the end of the control has confused deciding to make a change with having made it, and the DWS article is the proof that the two are not the same, because the change was decided and never made, and the undecided original went out instead.

Verify the published artifact against the approved version, and monitor it after

The discipline is that a claims-review process must not end at approval; it must verify that the published artifact matches the approved version at the moment of publication and must monitor live materials thereafter to confirm they still say what was approved. This means closing the loop between approval and publication with a check, automated where possible, that compares what went live against what was signed off, so that an approved correction that fails to ship is caught immediately rather than years later by a regulator. It also means maintaining an inventory of live public claims and periodically reconciling the published versions against the approved record, because materials drift, pages are updated, and an approved correction can be lost not only at first publication but through any later edit. The test is whether, for every public claim the firm has live, the published wording matches the last approved version, and a firm that cannot confirm this, that reviews drafts but never audits what is actually online, is exposed to exactly the DWS failure: a correct editorial judgment, approved and then discarded, leaving the rejected claim in front of clients. A correction exists only when it reaches the artifact the audience sees; until then it is a decision, and a decision that does not ship protects no one.

One person in Frankfurt

The reason the firmwide ESG claim went unsubstantiated for so long comes into focus in a single detail about who was responsible for checking it. The ESG Integration Team, the group charged with reviewing whether analysts were actually integrating ESG as the policy required, was composed of one employee based in Frankfurt. That one person conducted occasional, ad hoc quality checks for ESG integration in research reports in 2018 and 2019, but the review process was not widespread, not formalized, and not documented. A single individual, doing occasional undocumented spot-checks, was the entire substantiation function behind a claim that ESG was integrated across every investment team in a global asset manager.¹

The mismatch between the breadth of the claim and the capacity to verify it is the structural root of the case. DIMA had made a claim of enormous scope, that ESG was integrated throughout its investment process, across asset classes, across teams, as a required element of every research note and valuation model. Verifying a claim of that scope requires reviewing a correspondingly large volume of work: enough research notes, across enough analysts and asset classes, consistently enough, to know whether the integration was actually happening at the claimed rate. One person in Frankfurt doing occasional ad hoc checks cannot generate that knowledge. The capacity was not merely insufficient; it was orders of magnitude below what the claim required, which meant that the firm had, in effect, made a claim it had no way of knowing was true. The occasional checks that one person did conduct were not nothing, but they were not formalized or documented, so they could not even reliably accumulate into a picture of whether the firmwide claim held. The firm asserted a global process and resourced its verification with a single part-time effort.

The detail that senior leaders knew about this is what elevates it from an oversight to a culpable one. The order records that senior leaders knew the ESG Integration Team had received pushback from analysts and supervisors, knew there were limitations on the time the team could devote to the task, and knew that monitoring for ESG integration in models and recommendations was therefore not being achieved consistently across the organization. The people responsible for the firm's claims knew that the function meant to verify those claims was under-resourced to the point of being unable to verify them, and the claims continued. A one-person verification team behind a firmwide claim is a capacity failure; a one-person verification team that senior leaders knew was inadequate, behind a claim that kept being made, is the firm choosing to assert what it knew it could not confirm.

Size the substantiation to the breadth of the claim

The one-person team generalizes into a discipline that connects marketing directly to operational resourcing: the capacity a firm devotes to substantiating and monitoring a claim must be proportional to the breadth of the claim, and a firm that makes a sweeping, firmwide representation while resourcing its verification with a single ad hoc effort has guaranteed that the claim will be unsubstantiated, regardless of whether it happens to be true. DIMA claimed ESG across every team and asset class and verified it with one person in Frankfurt doing undocumented spot-checks, and the proportion between the two is the measure of the failure.¹

The reason firms get this proportion wrong is that making a claim is cheap and verifying it is expensive, and the two decisions are usually made separately. Expanding a marketing claim from "we consider ESG where material" to "ESG is integrated throughout every team" costs nothing at the moment of writing; it is a few words, and it sounds better. But the two claims impose wildly different verification burdens: the first can be substantiated by showing ESG consideration where it was material, while the second requires demonstrating integration across essentially all work, which means reviewing essentially all work. When the marketing function expands the claim without the compliance and operational functions expanding the verification, the firm ends up with a broad claim and a narrow proof, and the gap between them is unsubstantiated representation. The discipline requires treating the breadth of a claim as a direct driver of the resources needed to stand behind it, so that a decision to make a broader claim is also a decision to fund broader verification, and a firm unwilling to fund the verification must narrow the claim to what it can prove.

Let the claim you can verify set the claim you make

The discipline is to scope every public claim to what the firm has the capacity to substantiate and monitor, so that the breadth of the representation is governed by the breadth of the verification rather than the ambition of the marketing, and to treat a mismatch between the two as a reason to either resource the verification or narrow the claim. Concretely, before a firm makes a claim about its process, it should ask what would be required to know, on an ongoing basis, that the claim is true, and confirm that it has that capacity; where it does not, the honest move is to make the narrower claim it can actually verify. This inverts the usual order, in which marketing sets the claim and compliance is asked to bless it, and instead lets the verifiable truth set the ceiling on what is said. The test is whether, for every claim the firm makes, it has a verification function sized to actually monitor that claim across its full scope, and a firm with a sweeping claim and a one-person checking function has failed that test on its face. DIMA's claim was global and its verification was a single occasional effort, and the lesson is that the claim should have been cut to the size of the verification, because a claim no one can check is a claim that will eventually be checked by a regulator, at the firm's expense.

The monitoring with no answer for absence

Even the monitoring the policy did require was defined in a way that could not catch the most important failure, and the flaw is subtle and instructive. Until October 2021, DIMA's ESG Integration Policy stated that supervisors should monitor investment professionals' compliance by monitoring ESG comments in research notes. But the policy contained no specificity about how this should be carried out, and in particular, as the order notes, no guidance about what to do if a research report contained no mention of ESG at all. The monitoring was defined as reviewing the ESG comments that were present, with no defined process for the case where there were none.¹

This is a deep and common design flaw, and it defeats the control precisely where it matters most. A monitoring process built to review the ESG comments in research notes implicitly assumes that research notes contain ESG comments; it is designed to assess the quality of integration that is present. But the firm's actual problem was not poor-quality ESG comments, it was absent ESG comments, nearly half of equity notes and nearly four-fifths of fixed income notes had no ESG content to review. A control that monitors the comments that exist has nothing to do when the comments do not exist; it looks at a note with no ESG mention and, having no defined process for that case, moves on, treating the absence as outside its scope rather than as the very failure it should be catching. The policy had built a control that could evaluate integration where it happened and was silent about integration where it did not, which meant the control was blind to the firm's actual failure mode, the wholesale absence of the thing it was supposed to ensure.

The absence case is almost always the one that matters, because the failures a firm most needs to catch are usually failures of omission, the thing that should have been done and was not, rather than failures of quality in the thing that was done. A control designed around the presence of the expected behavior, reviewing the ESG comments, inspecting the filed reports, checking the completed steps, systematically misses the cases where the expected behavior simply did not occur, because those cases produce nothing for the control to inspect. DIMA's supervisors, told to monitor ESG comments in research notes, had no instruction for the note that contained none, and so the notes that most clearly violated the policy, the ones with no ESG at all, were the ones the monitoring was least equipped to flag. The control was pointed at the wrong half of the problem.

Define the control for the negative case

The monitoring that could not see absence generalizes into a discipline that applies to every control designed to ensure a required behavior: the control must be explicitly defined for the case where the behavior is absent, because the absence is usually the failure the control exists to catch, and a control that only inspects the behavior when it is present is blind to the omission that matters most. DIMA monitored the ESG comments that were in the notes and had no process for the notes with no ESG comments, which is where the policy was actually being broken.¹

The reason controls are so often built this way is that it is natural to design a check around the thing you expect to see. If the policy requires analysts to document ESG in their notes, the intuitive control is to review the ESG documentation, assess whether it is adequate, whether it covers the material factors, whether it informed the recommendation. That control implicitly assumes the documentation exists; it is a quality control, not a completeness control. But completeness and quality are different properties requiring different controls: a quality control asks whether the thing that was done was done well, while a completeness control asks whether the thing was done at all, and only the latter catches omission. A firm that builds quality controls and neglects completeness controls will reliably miss the cases where the required step was skipped entirely, because those cases produce no artifact for the quality control to examine. The most dangerous failures, the research note with no ESG, the review that never happened, the report that was never filed, are invisible to any control that starts by looking at the output of the step, because for those failures there is no output.

Control for completeness, not just quality

The discipline is to design controls that explicitly test for completeness, whether the required behavior happened at all across the full population, rather than only quality, whether the behavior that did happen was adequate, and to treat the absence of the expected behavior as a defined, flagged exception rather than a silence the control passes over. Concretely, a monitoring process for a required step should start from the full population of cases where the step should have occurred and identify the ones where it did not, making absence a positive finding rather than an empty result. For DIMA, the right control would have begun with every research note and flagged those with no ESG content as policy exceptions, surfacing the 46% and 79% as the control's primary output, rather than reviewing only the notes that happened to contain ESG and never counting the ones that did not. The test is whether a firm's controls can detect the required step not being performed, across the whole population, and a firm whose controls only inspect completed instances has built a quality check that will miss every omission. The absence is the signal, and a control that cannot see absence cannot see the failure that produced the DWS penalty.

Whose claim was it

Underneath the specific control gaps ran a confusion about responsibility that meant no one was clearly accountable for making the firm's ESG claim true. The order found that DWS employees at all levels, including at DIMA, had different understandings of their individual roles and responsibilities under the ESG Integration Policy. The ESG Integration Team expected research analysts to demonstrate their integration by documenting ESG factors in the research notes. Some research supervisors, who the policy said should monitor ESG comments, claimed a lack of resources and thought the monitoring was really the ESG Integration Team's job. The analysts, the supervisors, and the one-person integration team each had a different picture of who was responsible for what, and in the gaps between those pictures, the claim went unsubstantiated.¹

The pattern echoes the ownership failures that recur across enforcement, but here it operates specifically on the substantiation of a public claim, which adds a dimension. A firm making a marketing claim about its process is really making a promise that some set of people will perform some set of behaviors, analysts will document ESG, supervisors will monitor that they do, the integration team will verify it across the firm. For the claim to be true, each of those responsibilities must be clearly assigned and actually discharged. At DIMA, the responsibilities were diffuse: the supervisors thought monitoring belonged to the integration team, the integration team expected the analysts to self-document, and no single party owned the end-to-end question of whether the firmwide claim was actually true. The claim belonged, in practice, to no one, which meant that no one was accountable when it drifted away from reality. A marketing claim with no operational owner is an assertion the firm has made about behaviors that no one is responsible for ensuring, and such a claim is true only by accident.

The senior-leadership email captures the dynamic perfectly. The order notes that senior leadership in the investment division tried to emphasize the policy's importance by sending supervisors an email encouraging them to be ambassadors of ESG integration, but that this step alone was insufficient and progress was gradual. Exhortation is what a firm reaches for when ownership is unclear: unable or unwilling to assign and enforce specific accountability, it sends an email asking everyone to care. But an email asking supervisors to be ambassadors does not establish who is accountable for the claim being true, and the gap between a rousing message and an owned responsibility is exactly where DIMA's claim lived, asserted to the market, encouraged internally, and owned, operationally, by no one in particular.

Every public claim needs an owner accountable for its continued truth

The diffuse responsibility at DIMA crystallizes a discipline specific to the governance of claims: every material claim a firm makes about itself must have a single named owner who is accountable not for making the claim but for its continued truth, because a claim whose truth is everyone's responsibility is no one's, and it will drift from reality in exactly the way DIMA's did. The firm had analysts, supervisors, an integration team, and senior leaders all touching the ESG claim, and none of them owned the question of whether it was actually true.¹

The reason claims need owners distinct from the people who make them is that making a claim and keeping it true are different jobs performed at different times. The marketing team makes the claim once, at the moment of publication. Keeping it true is a continuous obligation that lives in the operation, in the analysts documenting ESG, the supervisors monitoring them, the verification of the aggregate, and it must be owned by someone with visibility into and authority over that operation. When the claim's owner is effectively the marketing function that published it, no one with operational authority is accountable for the behaviors that make it true, and the claim becomes an orphan: published by people who do not control the operation, dependent on an operation controlled by people who did not make and may not even know the claim. The owner of a claim must be positioned to know whether it is true and to do something about it when it is not, which means the owner belongs in or over the operation, not in marketing, and must be explicitly accountable for the ongoing match between what the firm says and what it does.

Assign each claim an operational owner, and make them accountable for its truth over time

The discipline is to assign every material public claim a single operational owner, documented and known, who is accountable for substantiating the claim before it is published and for monitoring its continued truth for as long as it is live, with the authority to compel the operation to match the claim or to force the claim to be narrowed or withdrawn. This means a firm needs, for each claim it makes about its process, an answer to the question of who owns this being true, and that answer must be a specific person with operational reach, not a committee, not the marketing department, and not a general exhortation to everyone. The owner's job is the ongoing reconciliation between claim and operation: to know the current rate at which the claimed process actually happens, to escalate when it drifts, and to insist that either the operation be fixed or the claim be changed. The test is whether, for every claim the firm makes, it can name the person accountable for its truth and that person can state the current evidence, and a firm whose claims are owned by whoever wrote them and verified by no one has built the DWS failure. DIMA's ESG claim had many people near it and no one accountable for it, and an orphaned claim, however sincere, drifts until a regulator measures the drift.

They knew, and left it up

The most aggravating part of the case is not that DIMA discovered the gap, it is what the firm did, and did not do, after it knew. By late 2020, through its own more systematic reviews, DIMA identified the gaps between how analysts were supposed to integrate ESG and how they actually were, including the 54% and 21% figures. The firm had, at that point, measured its own claim and found it wanting. And yet, as the order records, DIMA did not have the ESG Integration Policy removed from its website, did not revise its responses to RFPs, and made no effort to remove the paid magazine article from the Internet. The claims the firm now knew to be unsubstantiated stayed published, in front of clients and investors, after the firm had the evidence that they were not true.¹

This is the moment that most clearly separates a control deficiency from a disclosure violation, and it is worth being precise about the sequence. Before late 2020, DIMA could characterize its situation as one of inadequate controls: it had made claims and failed to build the procedures to ensure they were true, which is a serious but essentially negligent failure. After late 2020, the situation changed, because the firm now had actual knowledge, from its own reviews, that its published claims did not match its operation. From that point, every day the policy stayed on the website, the article stayed online, and the RFP responses stayed unrevised was a day the firm maintained a representation it knew was unsubstantiated. The failure to act on the knowledge converted a controls problem into a continuing misrepresentation, because a claim a firm knows to be false, left published, is no longer a claim the firm failed to verify, it is a claim the firm is knowingly maintaining.

The specific inertia, leaving materials up, is a distinct and underappreciated failure. When a firm discovers that a published claim is wrong, there are two kinds of remediation: fixing the operation so the claim becomes true, and un-publishing or correcting the claim so it stops misleading in the meantime. DIMA, to its partial credit, began the first, making incremental improvements to its process through 2021. But it neglected the second entirely, leaving the unsubstantiated claims live while the operation slowly caught up. That is backwards. A firm that learns a public claim is false must, first and immediately, stop making the claim, by taking it down or correcting it, because the claim is misleading people right now, every day it stays up, regardless of how the slower work of fixing the operation proceeds. DIMA fixed forward and left the false claim in front of clients, and the order treats that leaving-it-up as part of the violation, not as mitigation.

Knowledge that a claim is unsubstantiated obligates correction or withdrawal, now

DIMA's decision to leave its claims up after it knew they were unsubstantiated crystallizes a discipline that is simple to state and routinely violated: the moment a firm learns that a published claim does not match reality, it has an immediate obligation to correct or withdraw the claim, separate from and prior to the slower obligation to fix the underlying operation, because the published claim is actively misleading the audience every day it remains live. DIMA fixed forward and left the claim up, and the leaving-it-up was itself part of what the SEC sanctioned.¹

The reason firms get the order of operations wrong is that fixing the operation feels like the real remediation and taking down the claim feels like an admission, so firms instinctively prioritize the former and defer the latter. The engineering mindset says: the problem is that the process does not do what we said, so let us fix the process, and once it does, the claim will be true. That is correct as far as it goes, but it ignores the interval. While the operation is being fixed, which took DIMA well over a year, the unsubstantiated claim continues to be published, and every client who reads it during that interval is being misled by a representation the firm knows to be false. The obligation to stop misleading people is immediate and does not wait for the operation to catch up; it is discharged by correcting or withdrawing the claim now, which a firm can do in a day, while the operational fix proceeds on its own longer timeline. Treating the slow operational fix as the whole of the remediation leaves the fast, urgent, and separately required step, stop publishing the false claim, undone, and that is the step whose omission the order specifically faulted.

On discovery, correct or pull the claim first, then fix the operation

The discipline is that discovering a published claim to be unsubstantiated triggers two obligations on two timelines, and the faster one comes first: immediately correct or withdraw the claim from every place it is published, then fix the underlying operation so a true version of the claim can eventually be made again. This means a firm that finds a gap between a claim and its operation should, as its first action, inventory everywhere the claim appears, the website, the RFP library, the published articles, the client decks, and correct or remove it, accepting the discomfort of a visible retraction as the price of not continuing to mislead. The operational fix follows on its own schedule, and when it is complete and verified, a substantiated version of the claim can be republished. The test is whether, upon discovering a false claim, the firm can show it stopped making the claim promptly, independent of how long the operational remediation took, and a firm that left the claim live while slowly fixing the process, exactly DIMA's choice, has failed that test and converted a discovered problem into a knowing one. The claim misleads in real time; the remedy for a real-time harm is a real-time withdrawal, not a deferred fix.

Marketing ran ahead of the build

Step back from the individual failures and the case resolves into a single sequencing error that sits beneath all of them: DIMA marketed a capability it was still building, letting the claim lead the operation rather than lag it. The ESG Integration Policy was created in August 2018. The marketing describing ESG as integrated throughout, the Engine as the centerpiece, ESG as in the firm's DNA, ran from 2019. The systematic verification that the policy was actually being followed did not come until late 2020, and the real fixes, the revised templates, the clarified supervisory responsibilities, came in 2021. The claim was made in 2019 about a state of integration the firm did not actually achieve, or even verify, until years later. Marketing described the destination while the firm was still traveling toward it.¹

This sequencing error is the deepest and most generalizable lesson of the case, because it is the common cause of greenwashing and of its analogues in every domain where firms are racing to claim a capability. A firm building a genuine new capability, ESG integration, an AI system, a data-security posture, faces constant pressure to market it as complete before it is, because competitors are claiming it, clients are asking for it, and the aspiration feels close enough to the reality to describe in the present tense. The temptation is to let the claim lead, to announce the destination as if it were arrived at, on the theory that the operation will catch up before anyone checks. DIMA let the claim lead by years, and the gap between the 2019 claim and the 2021 fix is the space in which the violation lived. The discipline is the opposite sequence: the claim must lag the capability, made only after the operation demonstrably does what the claim will say, so that the representation describes an achieved and verified reality rather than an intended one. A claim that leads the build is a claim that is false for the entire interval between the announcement and the arrival, and that interval is where regulators find their cases.

Websites and RFPs are representations, not copy

One reason DIMA's claims carried legal weight, rather than being dismissed as mere marketing puffery, is where they appeared and who relied on them. The ESG Integration Policy was published on DIMA's US public website, through which it marketed its advisory services. The claims appeared in responses to requests for proposals, the formal documents through which institutional clients evaluate and select asset managers. They appeared in a paid industry-magazine article that the marketing department then disseminated directly to clients, prospective clients, and fund investors. These were not throwaway taglines; they were representations made in the channels through which sophisticated parties make allocation decisions, and the law treats representations in those channels as material.¹

The RFP response is the clearest example of why the channel matters. When an institutional investor sends an RFP, it is asking a series of specific questions to decide where to place money, and the adviser's answers are representations the investor relies on to make that decision. An RFP answer stating that the firm integrates ESG throughout its process, consulted by an investor choosing between managers, is not marketing in any loose sense; it is a factual representation that induces a decision with real financial consequences, and if it is false, the investor has been misled in precisely the way securities law exists to prevent. The same is true of claims on the firm's website, which the order notes created the impression that employees were following the ESG Integration Policy, and of the article the marketing department pushed to investors. Each of these is a channel where the audience is making a decision based on the claim, which is what gives the claim its legal character. A firm that treats its RFP responses, website disclosures, and client-directed articles as marketing to be written loosely has misunderstood what they are: they are representations, relied upon, and subject to the full weight of the antifraud provisions.

The discipline this implies is that the standard of accuracy for a claim should be set by the reliance it invites, not by the informality of the format, and the channels where clients and investors make decisions, RFPs, websites, disclosures, client communications, demand the highest standard regardless of how much they look like marketing. A firm should treat every statement in those channels as a representation it may have to defend, substantiated and owned to the same standard as a formal disclosure, because the audience will rely on it as if it were one, and the regulator will hold the firm to it as if it were one. DIMA's claims were fatal not because they were enthusiastic but because they were made, and relied upon, in the channels where enthusiasm becomes representation, and the firm did not hold them to the standard those channels require.

The broader lesson: the claim must lag the capability

The enduring lesson of the DWS case reaches far beyond ESG, to any firm making claims about a capability it is building: a public claim about what a firm does must lag the operational reality it describes, substantiated by evidence before it is made and monitored for as long as it is live, because a claim that leads the capability is false for the entire interval between the announcement and the arrival, and that interval is where the liability accrues. DIMA claimed an integrated ESG process years before it verified or achieved one, and the $19 million is the price of the gap.¹

The disciplines this study has drawn out compose a complete program for governing claims. Substantiate every process claim with operational evidence before publishing and keep substantiating it, because a claim about how the firm works is a factual assertion, and DIMA's was disproved by its own research notes. Verify the published artifact against the approved version and monitor it after, because an approved correction that never ships, "every" that should have been "most," leaves the rejected claim live. Size the verification to the breadth of the claim, because one person in Frankfurt cannot substantiate a firmwide representation. Control for completeness, not just quality, because the failure that matters is the research note with no ESG at all, and a control that only reviews present ESG comments cannot see it. Give every claim an operational owner accountable for its continued truth, because a claim everyone touches and no one owns drifts until a regulator measures the drift. On discovering a claim is false, correct or withdraw it first and fix the operation second, because DIMA left the claim up and the leaving-it-up was the violation. And hold the channels where clients decide, RFPs, websites, disclosures, to the standard of representations, not copy. Together they keep the claim behind the capability, which is the only safe place for it.

The forward view: the next claim is about AI

The reason the case is urgent now, and not merely a lesson about a particular ESG cycle, is that the structural temptation it exemplifies is being repeated at scale with the next capability every firm is racing to claim. The pattern, build a new capability, feel competitive pressure to market it as complete before it is, let the claim lead the operation, and skip the verification that would reveal the gap, is exactly what is now playing out with artificial intelligence, data and privacy practices, cybersecurity posture, and the next wave of thematic investment labels. A firm today claiming that it uses AI throughout its process, or that its controls are state of the art, or that its products deliver some measurable outcome, is standing exactly where DIMA stood in 2019, making a specific, falsifiable, operational claim about a capability it may still be building, in channels where clients rely on it, with verification that may be a fraction of what the claim requires. The regulators have shown, with DWS, that they will measure the claim against the operation and price the gap, and they will do it for AI and data claims as readily as for ESG ones. The firms that avoid the next version of this case will be the ones that treat every capability claim the way this discipline requires, as a representation that must lag a verified reality, owned, substantiated, monitored, and withdrawn the moment it stops being true. The lesson of DWS is not about ESG. It is about the permanent gap between what a firm wants to say about itself and what it can prove, and the discipline of never letting the first outrun the second.

What this case is really about