Ten months after Congress created a new whistleblower program for the U.S. Securities and Exchange Commission ("SEC") as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank"),1the SEC adopted rules to implement the program. By a 3 to 2 vote on May 25, 2011, the SEC adopted rules ("Final Rules")2that clarify eligibility for awards, the procedures for submitting tips to the SEC, the criteria the SEC will consider in determining the appropriate amount of an award, and the availability of protection for whistleblowers under the anti-retaliation provisions of Dodd-Frank.
Notably omitted from the Final Rules are requirements that were suggested and designed to preserve the effectiveness of corporate internal reporting systems. The Final Rules provide what the SEC posits are a number of incentives to encourage potential whistleblowers to utilize existing internal reporting systems. However, an individual with access to a well-structured, staffed, and responsive internal reporting system can nonetheless forego reporting internally, provide information directly to the SEC, and remain eligible for an award.
The SEC has downplayed the likelihood that individuals seeking awards will bypass internal systems, but the program's first-to-report requirement, enormous potential financial awards, and lack of an internal reporting requirement represent a significant challenge to maintaining effective compliance programs. Companies have implemented these very compliance programs, often at great expense, at the behest of federal authorities and the dictates of Sarbanes-Oxley requirements to effectively monitor corporate operations for compliance with law.
Companies now need to assess the effect of the whistleblower reward provision of Dodd-Frank and the SEC's implementing rules on their compliance programs and consider such programmatic adjustments and changes as that assessment may suggest.
Impact Of Whistleblower Program On Corporate Compliance Efforts
The potential impact of the whistleblower program on corporate compliance efforts and, in particular, internal reporting systems, has concerned the business and compliance communities since the enactment of Dodd-Frank. As Commissioner Paredes stated: "singular attention has centered on the extent to which the whistleblower program, depending on how it is structured, could unduly erode the value of internal compliance programs in rooting out and preventing wrongdoing."3Despite the advocacy for an internal reporting requirement as a condition of award eligibility, the SEC declined to incorporate such a requirement in the Final Rules. The SEC did "not believe that a general requirement on whistleblowers to report possible violations through internal compliance procedures would be consistent with the language of, or legislative intent underlying, Section 21F."4The Final Rules do contain several incentives that the SEC identifies as an effort to encourage individuals to use internal reporting systems and preserve corporate compliance programs that rely on such systems to identify misconduct.
The SEC's release accompanying its Final Rules identifies three incentives in the Final Rules to encourage individuals to report potential misconduct to internal systems, or at least minimize the incentive for individuals to bypass internal reporting systems in the hope of qualifying for an award.5First, a whistleblower's voluntary participation or interference with a corporate compliance program may increase or decrease the award for that whistleblower. Second, if an individual reports information internally that prompts an internal investigation by the company and ultimately results in a disclosure of information that leads to a successful enforcement action, the SEC will give the whistleblower "full credit" for information disclosed by the corporation for purposes of determining the individual's eligibility for and amount of an award. Third, if a whistleblower reports information internally and within 120 days, reports that same information to the SEC, the SEC will consider the initial date of internal disclosure as the effective date for purposes of determining the whistleblower's eligibility for an award.
These incentives, however, fall short of the rule-making options available to the SEC that would ensure internal reporting systems continue to help companies identify misconduct and provide opportunities to investigate and take appropriate remedial actions. It seems apparent that the SEC made a policy choice that places greater importance on its enforcement interests than on maximizing the continued effectiveness of internal reporting systems and the compliance programs they support. For its part, the SEC "expect[s] that in appropriate cases, consistent with the public interest and [its] obligation to preserve the confidentiality of a whistleblower, [it] will, upon receiving a whistleblower complaint, contact a company, describe the nature of the allegations, and give the company an opportunity to investigate the matter and report back."6While one can hope this positive policy statement will describe a normative practice excepted only in outlier cases where the business or entity in question bears hallmarks of a criminal enterprise, the SEC's actual practice under its whistleblower rules merits continued attention, including through congressional oversight.
Considerations For Reevaluating Corporate Compliance Programs
The new whistleblower program provides good cause for corporations to evaluate their compliance efforts and take steps to encourage employees to use internal reporting systems and ensure that companies are made aware of compliance issues as soon as possible.
The objectives of such reevaluation should include (a) maximizing the effectiveness of internal reporting systems; (b) ensuring that internal reports are thoroughly evaluated by a person or group with sufficiently comprehensive knowledge to recognize potential compliance issues in reports that are misdirected or incomplete; and (c) re-examining policies and practices concerning the dissemination of information regarding potential compliance issues within a corporation.
When considering the effectiveness of existing internal programs, a systematic examination of how the program works and how those most closely associated with it view its effectiveness is a good starting point. All practices and past experiences can be evaluated against a standard of effectiveness designed to make the company aware of and to allow the company to act on internal reports of misconduct as soon as possible.
As part of a compliance program reevaluation, the means and methods by which internal reports are analyzed should be examined. In addition, the decision-making process and criteria governing whether a report merits further inquiry should be considered. Previous incidents show that many internal reports are imprecise or misdirected with regard to the compliance issues they may raise. Thus, the evaluation criteria and the person or group applying it needs to be in a position to recognize potential compliance issues that may arise even when such issues are poorly articulated or imprecise.
As explained in the more detailed recitation of the SEC rules that follows, an eligible whistleblower may include someone who is contacted during an internal investigation. While compliance personnel themselves are generally excluded, those with whom they interact in performing a compliance function are not.7 Individuals contacted during internal investigations may qualify for awards, so long as the source of the information on which the award is based is not an excluded individual.8This raises potentially difficult issues concerning interactions with employees during even preliminary internal inquiry procedures. For example, is the recipient of a document preservation notice that provides information concerning an underlying compliance issue an eligible whistleblower or rendered ineligible if the relevant information came from excluded compliance personnel? Does it make a difference if the whistleblower is aware of the source of the information? These and similar issues suggest that companies should reevaluate their policies and practices regarding the dissemination of information about compliance issues, both in general and in the context of internal actions taken in response to possible compliance matters.
Corporations may also want to consider renewed efforts to inform or remind employees about the existence and use of internal reporting systems and provide additional training concerning such use. Employees must believe that reporting internally will not negatively impact their job status. Where appropriate, examples of successful internal reporting offer the best evidence to employees that internal reporting is in the best interest of both the employees and the corporation.
Corporations should also evaluate, assess, and update compliance programs to ensure that internal complaints are handled swiftly and, where appropriate, lead to investigations, remediation and disciplinary measures. Such efforts are, of course, necessary to protect shareholder value and mitigate liability if misconduct does occur, as the SEC will continue to consider cooperation efforts by companies in accordance with the Seaboard Report and SEC policies that reward such efforts.9
What follows is a summary of the relevant provisions of Dodd-Frank and the SEC rules implementing the whistleblower reward program.
Dodd-Frank And An Overview Of The Whistleblower Program
Section 922(a) of Dodd-Frank amends the Securities Exchange Act of 1934 by creating Section 21F, entitled "Securities Whistleblower Incentives and Protection."10This new section instructs the SEC to pay awards to qualifying whistleblowers valued between 10-30 percent of monetary sanctions imposed if the information leads to a successful enforcement action by the SEC in which sanctions exceed $1 million.11Along with the increased financial incentives for individuals to provide information to the SEC, Dodd-Frank also creates new protections against retaliation for whistleblowers and affords individuals a cause of action in federal district court to enforce the new provisions. Employees that experience retaliation from their employers for lawful acts done in providing information to the SEC, assisting in SEC enforcement actions, or making disclosures required by applicable laws, rules, and regulations12can recover up to twice the amount of back pay owed by the employer, reinstatement with the same seniority status, and litigation costs.13Dodd-Frank also authorizes the SEC to "issue such rules and regulations as may be necessary and appropriate to implement" the new whistleblower program.14
Eligibility For An Award Under The Final Rules
In order to qualify for an award, an individual must (i) voluntarily provide the SEC (ii) original information (iii) that leads to a successful enforcement by the SEC resulting in at least $1 million in sanctions. The Final Rules clarify some of these key terms from Dodd-Frank that determine when an individual may be eligible for an award.
Voluntary Submission Of Information
In general, an individual "voluntarily" provides information to the SEC so long as the information is submitted to the SEC before "a request, inquiry, or demand that relates to the subject matter of [the] submission" from the SEC or another authority of the federal government is directed at the whistleblower.15Importantly, an inquiry directed at an employer does not necessarily preclude an employee from "voluntarily" submitting information on the same subject matter to the SEC, nor does a contact during an internal investigation preclude an employee from "voluntarily" providing information to the SEC.16
Original Information
The whistleblower must provide "original information" to the SEC in order to be eligible for an award. "Original information" is derived from a whistleblower's "independent knowledge" or "independent analysis" and is unknown to the SEC at the time it is reported.17The Final Rules define both "independent knowledge"18and "independent analysis,"19but also explain that the SEC will not consider certain types of information to be derived from an individual's independent knowledge or analysis. These exclusions (and related exceptions to the exclusions) impact the potential award eligibility for attorneys, certain senior-level corporate personnel, and employees whose "principal duties" relate to a corporation's compliance functions.
Excluded Individuals
Under the Final Rules, attorney-client privileged information and information obtained "in connection with the legal representation of a client" may not qualify an individual for an award unless disclosure of that information is otherwise permitted by applicable rules regarding attorney conduct.20An individual is excluded from award eligibility if he was "[a]n officer, director, trustee, or partner of an entity" and he learned the information from another individual or through an entity's compliance processes.21"An employee whose principal duties involve compliance or audit responsibilities" is also generally precluded from obtaining an award.22The Final Rules also impose a derivative exclusion such that an individual that obtains information from another individual who would be ineligible for an award may not qualify as a whistleblower.23
Senior level officials and individuals generally excluded because of compliance-related duties may, however, qualify for an award if they submit information with a "reasonable belief" that (i) disclosure is necessary to avoid "substantial injury to the financial interest or property of the entity or investors,"24or (ii) that the "relevant entity is engaging in conduct that will impede an investigation of the misconduct."25Finally, if an otherwise excluded individual submits information internally, that individual may be eligible after 120 days have elapsed since reporting internally.26
Anti-Retaliation
The protections against retaliation are available to employees who provide information to the SEC in the manner described in the Final Rules and with "a reasonable belief that the information [being] provid[ed] relates to a possible securities law violationthat has occurred, is ongoing, or is about to occur."27As noted above, Dodd-Frank affords individuals a cause of action in federal district court to enforce the new provisions.28But the Final Rules state the anti-retaliation provisions "shall be enforceable in an action or proceeding brought by the Commission."291Pub. L. No. 111-203, § 922(a), 124 Stat. 1841 (2010) (to be codified at 15 U.S.C. § 78u-6 et seq .) (hereinafter "Dodd-Frank").
2Implementation of Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, Release No. 34-64545 (May 25, 2011) available at http://www.sec.gov/rules/final/2011/34-64545.pdf (hereinafter "Adopting Release").All "Final Rule" references are to the Text of Amendments to 17 C.F.R. Part 240, located at pages 241 - 248 of the Adopting Release.
3Troy A. Paredes, Commissioner, U.S. Sec. & Exch. Comm'n, Statement at Open Meeting to Adopt Final Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 (May 25, 2011) available at http://www.sec.gov/news/speech/2011/spch052511tap-item2.htm.
4Adopting Release, supra note 2, at 104-105.
5 Id . at 5-6.
6 Id . at 92.
7 See id . at 33 ("[W]e reject the suggestion of some commenters that a whistleblower should not be permitted to make a 'voluntary' submission after being contacted for information in the course of an internal investigation.").
8 See Final Rule § 240.21F-4(b)(4)(iii), (vi).
9Adopting Release, supra note 2, at 92.
10Securities Exchange Act of 1934, § 21F as amended by Dodd-Frank, supra note 1, § 922(a) (to be codified at 15 U.S.C. § 78u-6 et seq .).
1115 U.S.C.A. § 78u-6(a)(1), (b)(1) (West 2011).
1215 U.S.C.A. § 78u-6(h)(1)(A).
1315 U.S.C.A. § 78u-6(h)(1)(C).
1415 U.S.C.A. § 78u-6(j).
15Final Rule § 240.21F-4(a).
16Adopting Release, supra note 2, at 31-33.
17Final Rule § 240.21F-2(b)(1).
18Final Rule § 240.21F-4(b)(2).
19Final Rule § 240.21F-4(b)(3).
20Final Rule §§ 240.21F-4(b)(4)(i), (ii).
21Final Rule § 240.21F-4(b)(4)(iii)(A).
22Final Rule § 240.21F-4(b)(4)(iii)(B).
23Final Rule § 240.21F-4(b)(4)(vi).
24Final Rule § 240.21F-4(b)(4)(v)(A).
25Final Rule § 240.21F-4(b)(4)(v)(B).
26Final Rule § 240.21F-4(b)(4)(v)(C).If an individual receives information under circumstances that indicate certain relevant committees or individuals within the entity are aware of the information, that individual may also become eligible for an award after 120 days since he received the information. Id .
27Final Rule § 240.21F-2(b)(1).
28 15 U.S.C.A. § 78u-6(h)(1)(B).
29Final Rule § 240.21F-2(b)(2).
Published July 1, 2011.
