On November 3, 2010, the U.S. Securities and Exchange Commission ("SEC" or "Commission") proposed rules for the new whistleblower program ("Proposed Rules") that it will administer pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank").1The comment period for the Proposed Rules concluded on December 17, and several business groups and organizations submitted commentary, including the U.S. Chamber of Commerce.2The Proposed Rules raise a number of concerns about how the program will impact corporate compliance programs and the internal reporting systems upon which compliance efforts depend. The SEC is to be commended for recognizing the importance and value of robust corporate compliance programs in its commentary to the Proposed Rules.3Unfortunately, the Proposed Rules simply do not do enough to translate its indicated support into meaningful program policy. Outlined below are steps available to the Commission in modifying the Proposed Rules that can completely maintain its objectives for the whistleblower program without doing significant harm to the corporate compliance programs upon which companies depend to maintain corporate integrity.
At the open meeting announcing the Proposed Rules, Commissioner Walter stated that as rules implementing the new program are adopted, it is "critical" to investors that "existing and effective company compliance and other internal processes for responding to violations of federal securities lawsremain robust."4Although the Proposed Rules recognize the need to mitigate the potentially adverse consequences of the new whistleblower rewards on corporate compliance programs, they do not do enough to offset the imbalance of incentives the program creates. A number of critical issues that would undermine the vitality of internal reporting systems and compliance programs deserve further attention by the Commission in writing the rules to implement the reward program.
The Need To Mandate Use Of Internal Reporting Systems
Because companies can only investigate and take remedial actions for those internal issues of which they become aware, internal reporting systems are essential to identifying, investigating and addressing instances of internal misconduct. The Proposed Rules, however, state only that the SEC will consider an individual's use of an internal reporting system, along with ten other factors, when determining the amount of an award.5When the SEC adopts the rules implementing its new whistleblower program ("Final Rules"), the agency should require the use of an available internal reporting system in order to be eligible for an award. Without such a requirement, the overpowering financial incentives of the bounty program invariably will cause whistleblowers to choose reporting to the SEC over the available reporting mechanisms of an internal corporate system. Companies would, in turn, be deprived of information they need to protect shareholder value. Indeed, if the program provides information to the SEC that is unknown to the company, the whistleblower program would be doing a disservice to the investors that the nation's securities laws are designed to protect.
The Proposed Rules establish a 90-day reporting window for whistleblowers to provide information to the SEC after reporting internally in an effort to mitigate the incentive created by Dodd-Frank that encourages individuals to bypass internal systems. Under the Proposed Rules, if an individual first reports information internally, and within 90 days, that information is provided to the SEC, the Commission will consider the initial date of internal disclosure as the effective date for purposes of determining award eligibility.6This grace period provides assurance that utilizing internal systems before providing information to the SEC will not preclude eligibility for an award, but should be coupled with the requirement that an available internal system must be used as a condition of eligibility for an award.7
In addition, the 90-day grace period would often be inadequate to support the decisions that corporations make when voluntarily disclosing information to the SEC. The steps necessary to conduct an internal investigation, including interviews of relevant individuals, collecting relevant documents, and analyzing the legal implications of the collected facts, are often time-consuming and resource intensive. Credible allegations of misconduct, such as those that may lead to securities laws violations, deserve and require the time necessary to engage in the types of investigative efforts and techniques that produce reliable results. Under the Proposed Rules, a corporation would have, at most, 90 days to investigate a complaint and reach an informed conclusion on the merits of an allegation. This timeframe will likely result in poorly informed decisions, often based on rushed or incomplete investigations and legal analysis, and the SEC is likely to receive underdeveloped allegations from both whistleblowers and corporations. It would also impose a burden on the SEC to perform investigations that, with a longer grace period, the agency may not have to undertake.
Final Rules Should Require Internal Reporting, Install A Policy Of Information Sharing For The Commission, And Extend The Grace Period To 180 Days
In the Final Rules, the SEC should ensure that internal reporting systems continue to receive information about potential misconduct by (1) conditioning award eligibility on the use of an available internal reporting system and (2) adopting an agency policy under which the SEC will share information with the entity that is the subject of a complaint. With the support of both information sources, corporate compliance programs would be made aware of allegations of misconduct from both internal and external whistleblowers. So long as corporations continue to be informed of allegations of misconduct, whether through internal reporting or from the SEC, compliance programs can effectively investigate and address most allegations of misconduct. Furthermore, effective compliance programs will not only continue to protect shareholder value (by addressing misconduct and minimizing the impact of any misconduct that does occur), but also provide support to the enforcement efforts of the SEC (as a screening mechanism for many of the low-quality tips that may otherwise go directly to the agency).8
The Final Rules should also ensure that corporate decisions to disclose information remain "voluntary" by permitting adequate time for full investigations and analysis that will allow corporations to make informed disclosure decisions. Extending the grace period would not prevent an otherwise award-eligible individual from retaining eligibility, and it would allow corporate internal processes to more fully assess the allegations in a complaint before the information is provided to the SEC. A 180-day grace period would permit more informed corporate decisions on whether voluntary disclosure is appropriate in any particular case and reduce the burden on the SEC by permitting corporate programs to weed out frivolous and non-securities-related complaints. Finally, the Final Rules could make clear that whistleblowers may go to the SEC before the grace period has expired to ensure that an extension of the grace period does not impact the Commission's access to information as set forth under the Proposed Rules.
Operations Of Compliance, Audit, And Legal Systems
Under the Proposed Rules, some employees face a conflict between their own financial self-interest and their duties to report misconduct to the corporation. Subject to a number of other restrictions, the Proposed Rules properly exclude from award eligibility an individual who has "legal, compliance, audit, supervisory, or governance responsibilities,"9as well as individuals who seek awards based on information obtained "from or through an entity's legal, compliance, audit or similar functions."10However, if an entity does "not disclose the information to the Commission within a reasonable time or proceeds in bad faith" after receipt of the information, an individual otherwise excluded by these provisions may be eligible for an award.11
The SEC's commentary explains that these exclusions are intended to avoid "creating incentives for company personnel to seek a personal financial benefit by 'front-running' internal investigations."12The goal of these exclusions is sound, but the bad-faith and reasonable time exceptions allow those individuals with operational responsibility for compliance programs to become eligible for an award if the compliance programs are deemed by the whistleblower to be inadequate.
Final Rules Should Require Legal And Compliance Personnel To Report "Up-Before-Out" In Order To Be Eligible For An Award
A better solution to the allegedly inadequate compliance response to a whistleblower's complaint would be to require the whistleblower to go "up-before-out" with an allegation to be eligible for an award. That is, compliance personnel, as well as other individuals who obtain information from an internal compliance program, should remain ineligible in the face of an inadequate response, unless they take steps to notify the chief legal officer, the chief executive officer or independent board members of the allegation and the inadequate response of the compliance program. The current formulation in the Proposed Rules provides too much incentive for compliance personnel to develop divided loyalties between their duties to the corporation and their own personal financial gain through an award. An individual ought not be permitted to bypass up-the-chain reporting requirements in place at a corporation and still be eligible for an award. Moreover, an "up-before-out" requirement would provide guidance to individuals who may otherwise be excluded from award eligibility, but feel that allegations are not adequately reviewed.
Employment Actions And Protections Against Retaliation
The whistleblower program under the Proposed Rules would also complicate the task for employers seeking to enforce internal codes of conduct or take action against employees for legitimate reasons unrelated to an individual's status as a whistleblower. The issue is created by the Proposed Rules' broad definition of "whistleblower" and the lack of any guidance in the rules regarding the anti-retaliation provisions in Dodd-Frank. Even if the Commission has a limited direct role in litigation under the anti-retaliation cause of action created by Dodd-Frank, its overall role in defining criteria for award eligibility ought to earn it substantial deference from the courts where it provides the needed guidance on what constitutes retaliation.
The Proposed Rules define "whistleblower" as an individual who "alone or jointlyprovide[s] the Commission with information relating to a potential violation of the securities laws."13The SEC stated that it has adopted a broad definition of "whistleblower" to ensure that any individual who provides information about a potential securities law violation receives the protection afforded to "whistleblowers" by Dodd-Frank.14 However, the low bar established by the Proposed Rules creates problems for employers that seek to take action against an employee for reasons unrelated to the individuals' status as a whistleblower. As a matter of law, Dodd-Frank prohibits employers from taking certain actions against an employee "because of" lawful acts that establish an individual's status as a "whistleblower."15But as a practical matter, the ease with which an individual may qualify for protection significantly increases the likelihood that efforts to enforce internal codes of conduct or valid employment actions will be met with claims of retaliation from the whistleblower and hamstring corporations' legitimate efforts to take remedial measures against underperformance or other employee misconduct.
Final Rules Should Ensure Employers Can Enforce Internal Codes Of Conduct And Take Other Legitimate Employment Actions
The Final Rules should clarify that Dodd-Frank prohibits employment action only because of an individual's whistleblower status. Employers retain the authority to take employment actions for any other legitimate reason, including for participation in the wrongdoing that is the subject of a whistleblower's complaint or violating internal codes of conduct, and the Final Rules should make this clear. Many corporate codes of conduct require that if an employee is aware of potential misconduct, that employee is under a duty to report that information internally and truthfully cooperate with any related investigation. Business entities rely on such duties to obtain information about potential misconduct in an organization. Ensuring that corporations can enforce such provisions of codes of conduct, whether or not an individual qualifies as a "whistleblower" under the Rules, is important to the effectiveness of compliance programs, as recognized by existing SEC policy.16
Conclusion
Dodd-Frank requires that the SEC adopt regulations for the whistleblower program by April 21, 2011, and the SEC anticipates that it will adopt Final Rules for the new program ahead of the deadline.17While specifics of the new program will not be established until the Final Rules are adopted, the new whistleblower program will almost certainly increase enforcement activity, and the SEC has already seen an increase in tips as a result of Dodd-Frank.18In anticipation of the new program, business entities would be smart to evaluate the strength and effectiveness of internal reporting systems and compliance programs that are currently in place. The SEC should adopt Final Rules that address the serious problems that exist under the Proposed Rules, but proactive steps by corporations will put business entities in the best possible position to address the impact of the new whistleblower program, regardless of the form taken by the Final Rules.
1Proposed Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, Release No. 34-63237 (Nov. 3, 2010) available at http://www.sec.gov/rules/proposed/2010/34-63237.pdf ("Proposed Rules"); see Press Release, U.S. Sec. & Exch. Comm'n, SEC Proposes New Whistleblower Program Under Dodd-Frank Act, (Nov. 3, 2010) available at http://www.sec.gov/news/press/2010/2010-213.htm.
2The author collaborated with the U.S. Chamber of Commerce and a number of companies to provide comments to the Commission on the Proposed Rules.
3 See, e.g. , Proposed Rules, supra note 1, at 24 ("Compliance with the federal securities laws is promoted when companies implement effective legal, audit, compliance and similar functions.").
4Elisse B. Walter, Commissioner, U.S. Sec. & Exch. Comm'n, Implementation of 21F of the Exchange Act, "Whistleblower Incentives and Protection" (proposed rules and forms) (Nov. 3, 2010) available at http://www.sec.gov/news/speech/2010/spch110310ebw-whistleblowers.htm.
5 See Proposed Rules, supra note 1, at 51.
6 See id . at 131.
7For example, if there is no penalty for failing to report internally, a potential whistleblower who perceives even a slight risk that an internal report could be mischaracterized by his employer, which would later be required to certify the date and content of the report, may decide, so as not to jeopardize his eligibility for an award, that he should not report internally.
8"Finally, we have attempted to maximize the submission of high-quality tips and to enhance the utility of the information reported to the Commission." Proposed Rules, supra note 1, at 5.
9 Id. at 129.
10 Id .
11 See id . at 130-131.
12 Id . at 26.
13 Id . at 124.
14 See id . at 7.
15Securities Exchange Act of 1934, § 21F(h)(1)(A) amended by Dodd-Frank, Pub. L. No. 111-203, § 922(a) (2010).
16For example, the SEC's Seaboard Report lists thirteen different criteria that the agency will consider when determining whether, and how much, to credit a corporation for its cooperation efforts. Among other criteria, the agency will consider: "What steps did the company take upon learning of the misconduct? Did the company immediately stop the misconduct? Are persons responsible for the misconduct still with the company? If so, are they still in the same positions?" U.S. Sec. & Exch. Comm'n, Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement, Exchange Act Release No. 44969 (Oct. 23, 2001).
17U.S. Sec. & Exch. Comm'n, Dodd-Frank Act Rulemaking: Whistleblower Information, http://www.sec.gov/spotlight/dodd-frank/whistleblower.shtml (last visited December 15, 2010).
18 See Mary L. Schapiro, Chairman, U.S. Sec. & Exch. Comm'n, Testimony on Implementation of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Sept. 30, 2010) available at http://www.sec.gov/news/testimony/2010/ts093010mls.htm ("Already, since the passage of the Act, we have seen a slight uptick in the number of tips and complaints received and, more importantly, an uptick in the quality of complaints.").
Published January 3, 2011.
