Arthur McDonnell became administrator of Vincent P. Koth's estate in May 1998. Discovering that Koth kept some securities in safe deposit boxes, so that they did not appear in any of his brokerage statements, McDonnell concealed them from the probate court, Koth's heirs, and the tax collector. He set up a corporation and asked his son-in-law Patrick O'Meara to transfer the securities to its ownership. O'Meara, an account executive of Bear, Stearns & Co., did just that. McDonnell withdrew the money for his own use. We must assume, given the posture of the case, that O'Meara was McDonnell's accomplice and deceived Bear Stearns about what he was doing and why — though this is no more than an allegation, and perhaps O'Meara did not realize what McDonnell was up to. Eventually McDonnell was caught, and a state court has ordered him to repay more than $3.4 million; whether the money can be recouped is doubtful. Kenneth Foss, who replaced McDonnell as executor in May 2002, filed this suit against both O'Meara and Bear Stearns under § 10(b) of the Securities Exchange Act of 1934, 15 U.S.C. § 78j(b), and the SEC's Rule 10b-5, 17 C.F.R. § 240.10b-5. Foss contends that O'Meara defrauded the Koth Estate and that Bear Stearns is vicariously liable for his misdeeds under § 20(a), 15 U.S.C. § 78t(a).

This statement of the claim reveals its weakness, for O'Meara did not deceive McDonnell (or for that matter the estate, which "knew" whatever McDonnell knew). There is no violation of § 10(b) without fraud and no fraud without deceit. See, e.g., Dirks v. SEC, 463 U.S. 646, 103 S. Ct. 3255, 77 L. Ed. 2d 911 (1983); Chiarella v. United States, 445 U.S. 222, 100 S. Ct. 1108, 63 L. Ed. 2d 348 (1980); Ernst & Ernst v. Hochfelder, 425 U.S. 185, 96 S. Ct. 1375, 47 L. Ed. 2d 668 (1976). The deceit was committed by McDonnell against the probate court and Koth's heirs. McDonnell doubtless violated § 10(b) and Rule 10b-5, even though his fraud does not concern the value of any security. See SEC v. Zandford, 535 U.S. 813, 122 S. Ct. 1899, 153 L. Ed. 2d 1 (2002); United States v. Naftalin, 441 U.S. 768, 99 S. Ct. 2077, 60 L. Ed. 2d 624 (1979); SEC v. Jakubowski, 150 F.3d 675 (7th Cir.1998). But McDonnell is not a defendant. Instead of deceiving McDonnell, O'Meara helped him bilk the court, heirs, and revenue officials. Yet aiding and abetting a fraud does not support damages in private actions, see Central Bank of Denver, N.A. v. First Interstate Bank of Denver, N.A., 511 U.S. 164, 114 S. Ct. 1439, 128 L. Ed. 2d 119 (1994), though it does allow relief in some actions by the Securities and Exchange Commission. See § 20(e), 15 U.S.C. § 78t(e). If O'Meara is not liable to the Koth Estate, Bear Stearns cannot be liable vicariously under § 20(a). So the district court dismissed the complaint for failure to state a claim on which relief may be granted. 2004 WL 1102326, 2004 U.S. Dist. LEXIS 8694 (N.D.Ill. May 14, 2004), 2004 WL 2008863, 2004 U.S. Dist. LEXIS 9304 (N.D.Ill. May 17, 2004).

O'Meara and Bear Stearns contend that we need not consider these subjects, because the claim comes too late. Until 2002, suit had to be filed by the earlier of one year from discovery of the wrongdoing or three years from the improper transactions. See Lampf, Pleva, Lipkind, Prupis & Petigrow v. Gilbertson, 501 U.S. 350, 111 S. Ct. 2773, 115 L. Ed. 2d 321 (1991). As part of the Sarbanes-Oxley Act, Congress changed the allowable time to the shorter of two years from discovery or five years from the improper transactions. See Section 804 of Pub.L. No. 107-204, 116 Stat. 745, 801 (2002), codified in part at 28 U.S.C. § 1658(b). Defendants contend that, by the time Sarbanes-Oxley took effect on July 30, 2002, three years had passed since McDonnell's corporation got record title to the Koth securities. Only if the law retroactively revives expired claims, defendants contend, is this suit viable.

Foss insists that we lack authority to consider this argument because the district judge did not pass on it. That's wrong; prevailing parties may defend their judgments on all grounds preserved below. See Massachusetts Mutual Life Insurance Co. v. Ludwig, 426 U.S. 479, 96 S. Ct. 2158, 48 L. Ed. 2d 784 (1976); Pease v. Production Workers Union, 386 F.3d 819, 821 (7th Cir.2004). Foss also says that, because the judge did not make a decision on this issue, the decision is not final and may not be appealed. That's odd, as Foss himself did appeal, from a classic final judgment: one dismissing his complaint with prejudice. A selection among reasons for the dismissal did not make it any the less final.

Having advanced ill-considered procedural responses to defendants' position, Foss then decided not to meet it on the merits. That was both daring and foolish. He could have asked us to emulate the district judge; after all, the period of limitations is an affirmative defense that a complaint need not address. Unless the complaint alleges facts that create an ironclad defense, a limitations argument must await factual development. See United States v. Northern Trust Co., 372 F.3d 886 (7th Cir.2004); Xechem, Inc. v. Bristol-Myers Squibb Co., 372 F.3d 899 (7th Cir.2004); Walker v. Thompson, 288 F.3d 1005 (7th Cir.2002). Perhaps Foss could show that some of the improper transactions occurred within three years of suit, or at least within three years before the Sarbanes-Oxley Act tacked on two more. But he has not advanced such an argument, so the complaint is doomed unless the new statute is retroactive. In re Enterprise Mortgage Acceptance Co. Securities Litigation, 391 F.3d 401 (2d Cir.2004), the first appellate decision on the subject, holds that it is not retroactive. We find it persuasive and have nothing to add to the second circuit's explanation.

For completeness we add that the district judge got this right on the merits. O'Meara was at worst McDonnell's henchman, and there is no securities-law liability in private litigation for aiding and abetting. If O'Meara is not liable to the estate, then Bears Stearns cannot be vicariously liable to it under § 20(a). Foss wants us to call the conduct "manipulation" rather than "fraud," but this is a distinction without a difference. In securities law, manipulation is a kind of fraud; deceit remains essential. See Schreiber v. Burlington Northern, Inc., 472 U.S. 1, 105 S. Ct. 2458, 86 L. Ed. 2d 1 (1985); Santa Fe Industries, Inc. v. Green, 430 U.S. 462, 476-77, 97 S. Ct. 1292, 51 L. Ed. 2d 480 (1977).

This drives Foss to contend that O'Meara deceived Bear Stearns about what he was doing and about his relations to McDonnell. Such deceit might make O'Meara liable to Bear Stearns, even though it did not affect the value of any security. See United States v. O'Hagan, 521 U.S. 642, 117 S. Ct. 2199, 138 L. Ed. 2d 724 (1997), in addition to Zandford, supra. But how could that help the estate? Bear Stearns is a defendant, not a plaintiff; if O'Meara is liable to Bear Stearns for deceiving it (and thus depriving it of the value of his honest services), then it rather than the estate would collect any damages.

What Foss would like to do is put O'Meara's (potential) liability to Bear Stearns together with control-person liability under § 20(a) in the estate's favor. We don't see how that could be possible; Foss does not cite any decision holding that it is. Section 20(a) creates vicarious liability for a person who actually or potentially controlled the primary violator's acts. See 17 C.F.R. § 240.12b-2; Harrison v. Dean Witter Reynolds, Inc., 974 F.2d 873, 880-81 (7th Cir.1992); Pommer v. Medtest Corp., 961 F.2d 620, 626-27 (7th Cir.1992). If the primary violation is O'Meara's deceit of Bear Stearns, then McDonnell would be the control person. It makes no sense to say that Bear Stearns is the control person and victim at the same time. And if by some legerdemain Bear Stearns could be thought to control O'Meara's fraud against itself, then as the victim of the primary violation it would hold the right to collect from itself, a useless circle.

Unless § 10(b) turns all transactions using the proceeds of crime into a species of "fraud," the estate lacks a claim under the federal securities laws. Yet, as the Supreme Court has held repeatedly, § 10(b) is not an all-purpose remedy for private misdeeds. Schreiber and Santa Fe make the point directly, and Zandford distinguishes, as outside the federal laws' reach, "a case in which a thief simply invested the proceeds of a routine conversion in the stock market." 535 U.S. at 820, 122 S. Ct. 1899. Fraud differs from hawking or fencing stolen goods (the best description of the activity in which O'Meara aided McDonnell). A teller who embezzles from the bank and invests the proceeds in stock does not violate the federal securities laws. McDonnell embezzled securities, so he did violate the federal securities laws; but that primary violation is McDonnell's alone. Given Central Bank of Denver, which knocks out private actions for aiding and abetting primary violations, there is no way that the people and firms who dealt with McDonnell and the proceeds of his crimes could themselves be liable under § 10(b) in this private suit.

AFFIRMED.