The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) introduces new cash incentives for corporate employees to report suspected wrongdoing directly to the Securities and Exchange Commission (SEC) and significantly expands protection of whistleblowers from employment retaliation. The new whistleblower rights and rewards created by the Dodd-Frank Act, effective July 21, 2010, raise new risks for public companies and call for a fresh look at internal corporate compliance programs. This Client Alert discusses how these changes are likely to impact public companies and suggests ways to minimize new corporate risks.

The New Whistleblower Regime

The new whistleblower provisions, found deep within the sweeping provisions of the Dodd-Frank Act, reflect a fundamental shift in government policy from the whistleblower provisions in the Sarbanes Oxley Act of 2002 (SOX). SOX required companies to establish whistleblower hotlines to encourage employees and others to report suspected wrongdoing internally, subject to ultimate audit committee oversight. These SOX provisions were designed to enable companies to identify and redress problems internally as a matter of good corporate governance. In contrast, the Dodd-Frank Act encourages employees to report directly out to the SEC based on the prospect of obtaining substantial financial rewards for providing "original" information that leads to recovery of monetary sanctions against corporate employers in successful government enforcement actions.

Specifically, the Dodd-Frank Act requires the SEC to pay whistleblowers rewards of between 10 percent and 30 percent of monetary sanctions that aggregate to at least US $1 million as a result of government enforcement actions based on information provided by one or more whistleblowers.1 Monetary sanctions include fines, disgorged funds and interest imposed as a result of prosecution or settlement of civil or criminal enforcement actions by the SEC, Department of Justice or state attorneys general. The reward program includes recoveries in actions charging violation of the Foreign Corrupt Practices Act, which alone has yielded billions of dollars in corporate penalties and settlements in the past few years.2

In order to qualify for a cash reward, a whistleblower must provide the SEC with "original information," which is "derived from the independent knowledge or analysis of a whistleblower" that "is not known to the Commission from any other source, unless the whistleblower is the original source" and "is not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation, or from the news media, unless the whistleblower is a source of the information."3

The SEC has discretion in determining the amount of a whistleblower’s share of a recovery (between the low of 10 percent and the high of 30 percent) but must consider the significance of the whistleblower’s information to the success of the enforcement action, the degree of assistance provided by the whistleblower, the interests of the SEC in deterring violations by making whistleblower awards and other factors that the SEC may establish by rule or regulation.4

In principle, a whistleblower should be eligible to collect a reward even if she or he reports the information internally to the corporation, and the information later is conveyed to the SEC, as long as the whistleblower was the "original source" of the information.5 Nonetheless, the new reward system encourages whistleblowers to report directly to the SEC, since the amount of the reward can be affected by the degree of assistance the whistleblower provides. A whistleblower also may assume that the opportunity for a large reward is better before the company has had an opportunity to investigate, address and remediate the potential wrongdoing.

Alongside the new reward system, the Dodd-Frank Act significantly expands anti-retaliation employment protections and remedies for whistleblowers. The new provisions:

  • Extend the statute of limitations to bring retaliation claims from 90 days to six years
  • Exempt whistleblower claims from pre-dispute arbitration agreements
  • Allow whistleblowers to bypass the administrative process to bring claims directly in federal court
  • Clarify that whistleblower claims, including under SOX, can be tried before a jury
  • Provide not only for reinstatement and attorneys’ fees, but also double back-pay

In addition, more employees are covered by the Dodd-Frank Act’s whistleblower provisions than by SOX. The Dodd-Frank Act overrules recent case law by expressly extending whistleblower protections to employees of consolidated subsidiaries of publicly traded companies (not just employees of the publicly traded parent company), and expands coverage to almost any employee working in the financial services industry, regardless of whether the company is publicly traded.6

Taken together, these changes are likely to result in more whistleblower activity, and more costly retaliation litigation against public companies and financial sector employers.

Potential Impacts on Public Companies

The Dodd-Frank Act and recent policy changes by the SEC signal a shift in the government’s approach to enforcement of the securities laws from fostering internal corporate compliance programs to encouraging external whistleblowing. As a result, companies are more likely to find themselves playing catch-up after hearing about potential wrongdoing from a regulator rather than through internal whistleblowing and reporting systems.

The 2002 SOX whistleblower provisions and the SEC’s 2001 Seaboard Guidelines regarding cooperation in SEC investigations were designed to encourage companies to self-police by inviting and investigating employee reports of potential wrongdoing, and taking the initiative to remediate problems. But earlier this year, the SEC unveiled new cooperation guidelines that encourage individual witnesses to report directly to the SEC in order to help the government build cases against others.7 As noted, the Dodd-Frank Act reinforces this policy shift by providing cash incentives for employees to report directly to the SEC.

There are real downsides for companies who find themselves in the SEC’s crosshairs after an employee has reported suspected misconduct to the SEC. For example, the company may lose potential "credit" for self-reporting or cooperating with an investigation — meaning that sanctions may be more likely or more severe. The company may lose the opportunity to fully investigate the matter before having to answer to the SEC — while, meanwhile, the SEC is more likely to hear allegations of misconduct from individuals who lack a complete or accurate understanding of the facts. In some instances, a whistleblower’s direct communication with the SEC may impair the company’s ability to protect the corporate attorney-client privilege.

Staying Ahead

To counter the potentially negative consequences of the new incentives for employees to bypass internal whistleblower processes and call the SEC directly, it is important for companies to reinforce and improve corporate compliance systems and messages to employees.

Companies should review the structure and efficacy of their compliance and ethics functions to ensure that compliance is a mainstay of day-to-day business operations. It is more important than ever to assure that internal whistleblowers are protected from employment retaliation in light of the expanded anti-retaliation provisions. It is even more critical, however, to think creatively about the most effective ways to communicate to employees the importance of surfacing their concerns internally in order to assure that the first time the company learns of potential misconduct is not a telephone call or subpoena from SEC Enforcement.

To further these goals, companies should take the initiative to:

  • Review and update corporate compliance policies, including provisions for anonymous reporting, hotlines, and whistleblower policies.
  • Cultivate a corporate culture that emphasizes the importance of legal and regulatory compliance and ethical conduct.
  • Ensure that the corporate compliance program has appropriate oversight at the board level.
  • Consider offering employee incentives for internal reporting of potential violations.
  • Offer training on the whistleblower policy and procedures so that employees know the process and appreciate the roles of the people involved.
  • Ensure that all employees understand that retaliation for reporting legitimate concerns of potential misconduct will not be tolerated.
  • Ensure that whistleblower allegations made anonymously are taken as seriously.
  • Investigate and evaluate whistleblower complaints expeditiously.
  • To the extent appropriate, inform internal whistleblowers of the fact of the investigation and the company’s commitment to seeing the investigation to its end.
  • Document the company’s response to each complaint.
  • Assure that appropriate corrective action is taken where wrongdoing is found.
  • Consult with counsel experienced in investigations, compliance and enforcement.

The landscape of corporate compliance and SEC enforcement is changing. To stay ahead and out of trouble, companies should consider how best to adapt their internal controls, whistleblower programs, and crisis response plans.