On May 25, 2011, the SEC adopted final rules under the Exchange Act creating a new whistleblower program and implementing the whistleblower provisions of the Dodd-Frank Act. Under the new rules, the SEC will reward individuals who voluntarily provide the SEC with original information that leads to successful enforcement actions in which the SEC obtains monetary sanctions totaling more than $1 million. The new rules set forth the criteria for whistleblowers to receive awards and protection from retaliation, as well as the procedures for reporting possible violations and submitting claims for an award. While the SEC is not requiring whistleblowers to first report possible violations through a company's internal compliance system before reporting to the SEC, the final rules, in response to concerns raised in a number of comment letters on the proposed rules, do provide additional incentives for reporting internally.
The new rules define a whistleblower as an individual who provides the SEC with information relating to a possible violation of the federal securities laws that has occurred, is ongoing, or is about to occur. In order to be eligible for an award, whistleblowers must:
- voluntarily provide the SEC (i.e., not pursuant to a direct request from the SEC or other governmental authority or from the Public Company Accounting Oversight Board or any selfregulatory organization)
- with original information (i.e., derived from the whistleblower’s independent knowledge or independent analysis)
- that leads to the successful enforcement by the SEC of a federal court or administrative action
- in which the SEC obtains monetary sanctions totaling more than $1 million.
Certain persons are not eligible to receive whistleblower awards under the new rules, including, subject to certain exceptions, the following:
- persons under a pre-existing legal or contractual duty to report the securities violations to the SEC or to other designated authorities because the submission would not be considered “voluntary”;
- attorneys and others who obtained the information through a communication subject to attorney-client privilege;
- officers, directors, trustees or partners of a company who learn the information through another person or through the company's internal reporting system;
- public accountants working on SEC required engagements;
- certain compliance and internal audit personnel;
- people who obtain the information in violation of federal or state criminal law; and
- foreign government officials.
Retaliation by companies against persons qualifying as whistleblowers is generally prohibited. To be protected by the anti-retaliation provisions of the Exchange Act, a whistleblower must have a reasonable belief that the information provided to the SEC relates to a possible violation of the federal securities laws that has occurred, is ongoing, or is about to occur. Furthermore, such protections will apply whether or not the company is found to have committed a violation of law or the whistleblower ultimately qualifies for an award.
The new rules detail the procedures for submitting information on possible violations to the SEC as well as the procedures for making claims for awards. Awards will be between 10 and 30 percent of the collected monetary sanctions, with the actual percentage within this range being determined in the discretion of the SEC. Actions arising from the same operative facts will be aggregated for purposes of meeting the $1 million threshold and for determining the amount of an award. The new rules set forth certain criteria that the SEC may consider in determining the appropriate award percentage. Factors that may increase the size of an award include:
- the significance of the information provided by the whistleblower to the success of the SEC action;
- the extent of the assistance provided by the whistleblower;
- an assessment by the SEC of how making an award may further the SEC’s interest in deterring violations and may lead to successful enforcement of securities laws; and
- the extent the whistleblower participated in a company's internal compliance systems.
Factors that may decrease the size of an award include:
- the culpability or involvement of the whistleblower in the subject matter of the SEC action;
- any unreasonable reporting delay; and
- any interference with or undermining of a company’s internal compliance systems.
Incentives for Internal Compliance Programs
The rules do not require that whistleblowers report possible violations through a company's internal reporting and compliance program. Whistleblowers may instead report directly to the SEC and still be eligible for an award. Numerous comment letters on the proposed rules had raised the concern that allowing a whistleblower to report directly to the SEC without reporting first to the company would undermine the effectiveness of a company’s internal reporting program. The SEC has attempted to address this concern by providing several incentives in the new rules for whistleblowers to report internally, including:
- a whistleblower will still be eligible for an award if the possible violation is reported internally and the company informs the SEC about the violation;
- a whistleblower will still be deemed a “whistleblower” as long as he or she provides the same information to the SEC within 120 days of reporting the information internally; and
- as noted above, voluntary participation in a company’s internal compliance program is a factor that may increase the amount of an award and any hindrance of or interference with a company's internal compliance program may decrease the size of an award.
In light of the SEC's new and expansive whistleblower program, companies should re-evaluate their internal reporting and compliance programs to ensure they are effective. While the new rules do contain several incentives to utilize a company's internal reporting system, if a whistleblower perceives the company's internal reporting to be ineffective, the whistleblower may bypass internal reporting and report a possible violation directly to the SEC. Companies should ensure they have effective company processes for promptly identifying, investigating and addressing allegations of wrongful conduct. In addition, as the new rules may result in an increase in reporting, companies should be prepared to handle a potential uptick in internal investigations of possible violations.
The new rules will be effective 60 days following publication in the Federal Register. A complete copy of SEC Release No. 34-64545 can be found at www.sec.gov/rules/final/2011/34-64545.pdf.