
179 Cal.App.4th 1494 (2009)
THE PEOPLE ex rel. PRESTON DUFAUCHARD, as Corporations Commissioner, etc., Plaintiff and Respondent,
v.
ANTHONY O'NEAL, Defendant and Appellant.
No B209612.
Court of Appeals of California, Second District, Division Three.
December 9, 2009.
As modified December 29, 2009.
CERTIFIED FOR PARTIAL PUBLICATION[*]
*1496 Collins & Bellenghi, Michael J. Collins and Julian B. Bellenghi for Defendant and Appellant.
Preston DuFauchard, Alan S. Weinger and Uche L. Enenwali for Plaintiff and Respondent.
Edmund G. Brown, Jr., Attorney General, J. Matthew Rodriguez, Chief Assistant Attorney General, Mark J. Breckler, Assistant Attorney General, and Jon M. Ichinaga, Deputy Attorney General, as Amici Curiae on behalf of Plaintiff and Respondent.

OPINION
CROSKEY, Acting P. J.
Those who violate the Corporate Securities Law of 1968 (Corp. Code, § 25000 et seq.) may be exposed to criminal sanctions, civil suits, and administrative enforcement actions brought by the Commissioner of Corporations (Commissioner). In this case, the Commissioner brought an administrative action against defendant Anthony O'Neal for (1) the offer and sale of unqualified, nonexempt securities; and (2) fraud in the offer and sale of securities. Defendant and Otha Cole[1] had created a business in which they convinced several individuals to invest by means of poorly drafted principal investment agreements (PIA's), which were signed by the individuals and Cole, but not defendant. Defendant and Cole misused investors' funds and the business failed.
*1497 After a bench trial, the trial court concluded defendant had violated both pleaded provisions of the securities law, enjoined defendant from further violations, and ordered him to pay restitution and civil penalties. In the published portion of this opinion, we consider, and reject, defendant's argument that he cannot be held liable in an administrative enforcement action and required to pay restitution to his victims unless he was in contractual privity with thema requirement imposed in civil actions for the identical securities law violations. In the unpublished portion of the opinion, we address defendant's other, factually dependent, contentions. We affirm in part and remand for further findings.

FACTUAL AND PROCEDURAL BACKGROUND

1. The LadyCare Device and Business

LadyCare is an alternative medical device, designed to reduce menstrual cramps and discomfort. Less charitably described, it is a magnet intended to be worn inside the underwear.
LadyCare is also the name of a business operated by Cole and defendant, which had the stated goal of distributing the LadyCare magnetic device in the United States and Canada. LadyCare, as a business, never existed as a legal entity. Instead, Cole and defendant conducted the LadyCare business, in part, through two corporations: Innerplanetary Enterprise, Inc. (Innerplanetary), and ICJ Health, Inc. (ICJ Health).
It is undisputed that Cole first introduced the LadyCare product and the idea of the LadyCare business to defendant. Defendant asserted, at trial, that he was merely an investor in LadyCare, who lost money just as the other investors did. The trial court concluded, however, that defendant was deeply involved in the business and the sales of securities to investors. As we discuss at length in the unpublished portion of the opinion, substantial evidence supports the conclusions of the trial court.
2.-17.[*]

18. The Complaint

On October 23, 2008, the Commissioner brought an action against defendant, Cole, and "USA LadyCare Lifetime," under Corporations Code section *1498 25530, which permits the Commissioner to bring an action to enjoin acts or practices in violation of securities law. The Commissioner may also seek restitution and civil penalties in such an action. (Corp. Code, § 25530, subd. (b), 25535.) As the Commissioner did not know the precise nature of the LadyCare entity, the Commissioner named USA LadyCare Lifetime as a corporation, a limited liability company, a partnership, a fictitious business name of defendant and/or Cole, and as the alter ego of defendant and Cole.[27]
Two causes of action were alleged against defendant: (1) the offer and sale of unqualified and nonexempt securities, specifically, the LadyCare PIA's; and (2) misrepresentations or omissions of material fact in the offer and sale of securities, including misrepresentations that the LadyCare investments would give a 100 percent return within six months. The Commissioner sought an injunction, restitution, and civil penalties of $25,000 per statutory violation.

19. The Trial

Defendant filed an answer and the case proceeded to a bench trial. Testimony was heard from the nine LadyCare investors discussed in the unpublished portion of the opinion, as well as an examiner from the Department of Corporations. Defendant testified in his own behalf, as did Cole (by deposition). Defendant testified that he had no control over the LadyCare operations; Cole had made all of the decisions. Cole agreed. As set forth at length in the unpublished portion of the opinion, the documentary evidence and investor testimony was to the contrary.

20. Statement of Decision, Judgment and Appeal

On April 10, 2008, the trial court issued its proposed statement of decision. The court concluded that "USA LadyCare is not a recognized legal entity and is only a name used by . . . Cole and [defendant]." The trial court did not make specific factual findings regarding any individual investor. Instead, the trial court made numerous factual findings pertaining to the investors generally. For example, the trial court found that defendant was present at meetings with investors; investors were told that defendant was vice-president of LadyCare; defendant was involved in "securing and pushing" the investments; and investors made their checks out to defendant. Additionally, the trial court found numerous facts pertaining to defendant's involvement in the LadyCare business, including: defendant took business trips on behalf of LadyCare; defendant executed contracts for LadyCare; defendant was the CFO (chief financial officer) of Innerplanetary; and defendant was a signatory *1499 on the ICJ Health bank account and wrote checks. On the basis of these facts, the trial court found that defendant "was fully involved in the operation of LadyCare and was instrumental in convincing parties to invest in LadyCare." Finally, the trial court found that the PIA's were unqualified nonexempt securities, and that defendant and Cole made numerous misrepresentations and omissions in the offer and sale of those securities.
Based on its findings, the trial court concluded that defendant had violated Corporations Code sections 25110 (offer or sale of unqualified, nonexempt securities) and 25401 (fraud in the offer or sale of securities). As such, defendant was enjoined from further violations, directed to pay restitution in the amount of $202,000, and suffered nine $25,000 civil penalties, in the total amount of $225,000.
On April 22, 2008, defendant objected to the proposed statement of decision, arguing that the trial court failed to address four arguments he had raised at trial: (1) he was not in privity with the investors; (2) each investment was exempt from the qualification requirement as each investor had a preexisting personal or business relationship with defendant or Cole; (3) he did not know the statements made to investors were false; and (4) he could not be liable for substantially assisting Cole in Cole's violations of the securities law. The trial court responded by stating that it had specifically found that defendant was a seller of the securities, fraudulently offered them for sale, and sold themthereby rendering any legal arguments against substantial assistance liability moot. The court also stated that it had found defendant's exemption argument to be inapplicable. The trial court adopted its proposed statement of decision as its statement of decision.
Judgment was entered in accordance with the statement of decision on June 19, 2008. Defendant filed a timely notice of appeal.

ISSUES ON APPEAL
On appeal, defendant makes the following arguments: (1) as a matter of law, he can only be held liable for the alleged securities law violations if he was in privity with the investors, and the undisputed evidence is that he was not; (2) the PIA's were exempt from the qualification requirement because undisputed evidence establishes that a preexisting business or personal relationship existed between defendant or Cole and each investor; (3) he cannot be liable as a "principal" in LadyCare because LadyCare did not exist, and, to the extent that it did, he was not a control person in LadyCare; (4) there can be no civil liability on a theory of substantial assistance; (5) the undisputed evidence establishes that defendant himself made no fraudulent representations or material omissions to investors, nor was he aware of the falsity of *1500 any of his representations; and (6) restitution and the civil penalties were improperly calculated. We reject defendant's first two contentions; this conclusion mandates affirmance of the trial court's judgment in most respects. However, we conclude that defendant is not directly responsible with respect to one of the investors, requiring remand for the trial court to determine whether he is indirectly liable. We also conclude that restitution was improperly calculated.

DISCUSSION

1. Overview of Relevant Provisions of Securities Law

Before addressing defendant's contentions, a brief overview of the relevant provisions of the Corporations Code is helpful. First, we consider the substantive provisions which defendant violated; then, we discuss the ways in which these provisions may be enforced.
We are concerned with the Corporate Securities Law of 1968. (Corp. Code, § 25000.) Defendant was found to have violated Corporations Code section 25110. That section provides that "[i]t is unlawful for any person to offer or sell in this state any security in an issuer transaction . . . unless such sale has been qualified under Section 25111, 25112 or 25113 . . . unless such security or transaction is exempted or not subject to qualification . . . ." It is conceded that the PIA's sold in this case are securities; it is also undisputed that the PIA's were sold in issuer transactions.[28] It is also conceded that the sales at issue were not qualified.[29]
Corporations Code section 25102 identifies securities which are exempt from Corporations Code section 25110. The sole exemption at issue in this case is found in Corporations Code section 25102, subdivision (f). It exempts from the qualification requirement, any offer or sale of any security, "in a transaction . . . that meets each of the following criteria: [¶] (1) Sales of the security are not made to more than 35 persons, including persons not in this state. [¶] (2) All purchasers either have a preexisting personal or business relationship with the offeror or any of its partners, officers, directors or controlling persons, or managers . . ., or by reason of their business or financial experience or the business or financial experience of their professional advisers who are unaffiliated with and who are not compensated by the *1501 issuer . . . could be reasonably assumed to have the capacity to protect their own interests in connection with the transaction. [¶] (3) Each purchaser represents that the purchaser is purchasing for the purchaser's own account. . . and not with a view to or for sale in connection with any distribution of the security. [¶] (4) The offer and sale of the security is not accomplished by the publication of any advertisement." This is known as the "private" security exemption. (People v. Graham (1985) 163 Cal.App.3d 1159, 1164 [210 Cal.Rptr. 318].)
The second provision defendant was found to have violated is Corporations Code section 25401. That section provides, "It is unlawful for any person to offer or sell a security in this state or buy or offer to buy a security in this state by means of any written or oral communication which includes an untrue statement of a material fact or omits to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading."
(1) There are three enforcement mechanisms provided for in the Corporate Securities Law of 1968: (1) criminal prosecution, (2) civil action, or (3) administrative action brought by the Commissioner. (People v. Simon (1995) 9 Cal.4th 493, 514-515 [37 Cal.Rptr.2d 278, 886 P.2d 1271].)[30]A willful violation of the Corporate Securities Law of 1968 is a crime for which, upon conviction, the violator may be fined up to $1 million or imprisoned. (Corp. Code, § 25540.)
There are specific provisions dealing with civil actions for the violation of the two sections at issue in this case. A person who violates Corporations Code section 25110 "shall be liable to any person acquiring from him the security sold in violation of such section, who may sue to recover the consideration he paid for such security with interest thereon at the legal rate, less the amount of any income received therefrom, upon the tender of such security, or for damages, if he no longer owns the security, or if the consideration given for the security is not capable of being returned." (Corp. Code, § 25503, italics added.) Similarly, a person who violates Corporations Code section 25401 "shall be liable to the person who purchases a security from him . . . who may sue either for rescission or for damages." (Corp. Code, § 25501, italics added.)
*1502 We are concerned here with neither a criminal prosecution nor a civil action brought by the people who purchased securities from defendant. Corporations Code section 25530 provides for administrative actions brought by the Commissioner. Subdivision (a) of that section provides, "Whenever it appears to the commissioner that any person has engaged or is about to engage in any act or practice constituting a violation of any provision of this division . . ., the commissioner may in the commissioner's discretion bring an action in the name of the people of the State of California in the superior court to enjoin the acts or practices . . . ." Subdivision (b) of that section provides, "If the commissioner determines it is in the public interest, the commissioner may include in any action authorized by subdivision (a) a claim for ancillary relief, including but not limited to, a claim for restitution or disgorgement or damages on behalf of the persons injured by the act or practice constituting the subject matter of the action, and the court shall have jurisdiction to award additional relief." In addition, "Any person who violates any provision of this law . . . shall be liable for a civil penalty not to exceed twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the commissioner in any court of competent jurisdiction." (Corp. Code, § 25535, subd. (a).)
(2) "The civil, criminal, and administrative remedies available to the commissioner pursuant to this division are not exclusive, and may be sought and employed in any combination deemed advisable by the commissioner to enforce the provisions of this division." (Corp. Code, § 25255.) There are, however, different requirements which apply to each type of enforcement. For example, as noted above, a criminal prosecution requires a willful violation. A defendant civilly sued for misleading statements in the sale of securities may rely on the affirmative defense that the plaintiff knew the true facts or that the defendant exercised reasonable care and did not know of the untruth. (Corp. Code, § 25501.) This defense does not apply, however, in an administrative enforcement action brought by the Commissioner seeking to enjoin further sales based on false or misleading statements. (People v. Simon, supra, 9 Cal.4th at pp. 515-516.) Thus, care must be taken not to import requirements for a criminal prosecution or civil suit into this administrative enforcement action.

2. Privity Is Not Required for an Administrative Enforcement Action

(3) Relying on Apollo Capital Fund LLC v. Roth Capital Partners, LLC (2007) 158 Cal.App.4th 226 [70 Cal.Rptr.3d 199], defendant argues that he cannot be held liable in an administrative enforcement action for violating the Corporate Securities Law of 1968 unless he was in privity with the investors. That case involved investors who sued a broker-dealer who placed worthless *1503 bridge notes with them. The investors brought suit under Corporations Code section 25501, which provides that a civil action may be brought against anyone who violates Corporations Code section 25401 (offering or selling a security by means of untrue or misleading statements). (Apollo Capital Fund LLC v. Roth Capital Partners, LLC, supra, 158 Cal.App.4th at pp. 232-233, 252-253.) Yet the plain language of Corporations Code 25501 provides that any person who violates Corporations Code section 25401 "shall be liable to the person who purchases a security from him." The statute, by its terms, limits recovery to plaintiffs who purchased the security from the defendant. It does not provide for civil liability of a broker-dealer who acted as a placement agent for the seller, but did not actually sell the security to the plaintiffs.[31] As such, the appellate court concluded that the broker-dealer could not be liable under Corporations Code section 25501 to the investors. (Apollo Capital Fund LLC v. Roth Capital Partners, LLC, supra, 158 Cal.App.4th at p. 253.)
(4) That privity is expressly required for a civil suit under Corporations Code section 25501 has no bearing on this case, which is an administrative action brought under Corporations Code section 25530. The privity requirement is found in the civil enforcement provision, not the administrative enforcement provision or the substantive provisions violated. The administrative enforcement provision has no such privity requirement. The Commissioner may bring an administrative action seeking injunctive relief "[w]henever it appears to the commissioner that any person has engaged or is about to engage in any act or practice constituting a violation" of the Corporate Securities Law of 1968. (Corp. Code, § 25530, subd. (a).) Moreover, there is no privity requirement when the Commissioner seeks restitution. The Commissioner may seek restitution "on behalf of the persons injured by the act or practice constituting the subject matter of the action." (Corp. Code, § 25530, subd. (b).) There is no limitation that the Commissioner may seek restitution only on behalf of those who were in privity with the violator; the Commissioner may seek restitution on behalf of any "person[] injured" by the violation.[32]
*1504 3.-6.[*]

DISPOSITION
The restitution order is modified to require restitution in the amount of $126,000. The imposition of civil penalties is modified to impose eight $25,000 civil penalties, in the total amount of $200,000. As modified, the judgment is affirmed. The matter is remanded to the trial court for further findings of fact with respect to the Wards" investment; and any additional restitution award and/or civil penalty based on those findings. The parties shall bear their own costs on appeal.
Kitching, J., and Aldrich, J., concurred.
NOTES
[*]  Pursuant to California Rules of Court, rules 8.1100 and 8.1110, this opinion is certified for publication with the exception of parts 2 through 17 of the Factal and Procedural Background, and parts 3 through 6 of the Discussion.
[1]  Cole died prior to trial; his deposition was admitted into evidence at defendant's trial.
[*]  See footnote, ante, page 1494.
[27]  Cole and defendant were also alleged to be corporate officers of, partners in, control persons of, and individuals doing business as, USA LadyCare Lifetime.
[28]  An issuer is any person who issues or proposes to issue any security. (Corp. Code, § 25010.) An issuer transaction is one in which "any portion of the purchase price of any securities involved in the transaction will be received indirectly by the issuer." (Corp. Code, § 25011.)
[29]  Corporations Code section 25111 describes qualification in coordination with federal registration; Corporations Code section 25112 describes qualification by application to the Commissioner; Corporations Code section 25113 describes qualification by permit.
[30]  There is also a fourth enforcement mechanism: the Commissioner may issue a desist and refrain order, which may be challenged pursuant to the Administrative Procedure Act (Gov. Code, § 11400 et seq.). (Corp. Code, § 25532.) This mechanism is not at issue in this case. Instead, when we refer to an "administrative action" or "administrative enforcement action," we mean, as discussed below, an action brought by the Commissioner under Corporations Code section 25530. In this regard, we are using the terminology established by the Supreme Court in People v. Simon, supra, 9 Cal.4th at pp. 514-515.
[31]  Additionally, the statute does not provide for civil liability to a person who was offered a security based on a false representation, but chose not to purchase it.
[32]  Defendant suggests that the Commissioner should not be allowed to obtain relief beyond that which could be obtained by a private plaintiff, but can point to no authority requiring such a limitation. Indeed, Corporations Code section 25530, subdivision (b) allows the Commissioner to obtain disgorgement on behalf of the parties injured, while none of the civil action provisions provide for that remedy. Similarly, $25,000 civil penalties can only be recovered in enforcement actions brought by the Commissioner. (Corp. Code, § 25535.)
[*]  See footnote, ante, page 1494.
