Responding to a Congressional mandate in the Dodd- Frank Act, the SEC yesterday adopted final rules providing for cash awards to eligible whistleblowers who voluntarily provide the SEC with original information regarding violations of federal securities laws that leads to payment of money sanctions to the SEC of more than US$1 million.  

The final rules reflect several SEC policy decisions:

  • whistleblowers are not required to report through internal company procedures before contacting the SEC;
  • an employee who reports a potential violation to the company’s internal legal and compliance department before reporting to the SEC will receive the benefit of a 120-day "look-back period" from the date of the SEC report and may also be eligible for an award if the company later makes a report to the SEC that leads to an eligible enforcement action; and
  • the SEC has broad discretion in determining eligibility for, and the size of, any award.

The SEC acknowledged the conflict created by providing a monetary incentive for whistleblowers to report violations directly to the SEC when so many companies have expended a great deal of time and money to create effective internal compliance processes and educate their employees to use them. Nevertheless, rejecting the views of many prominent companies and business organizations that had commented on the issue, the SEC declined to require that a whistleblower exhaust a company’s internal reporting process in order to be eligible for an award. However, in a change from the proposed rules, the SEC will now be required to take into account a whistleblower’s participation in the internal reporting process when determining the size of an award.

On a separate track, a House bill has been introduced that would both require whistleblowers to report violations internally before contacting the SEC and also amend the payout range to 0 percent to 30 percent (rather than the SEC rule’s 10 percent to 30 percent) so that a whistleblower is not guaranteed an award. Although reactions to the bill are mixed, it indicates the possibility of further adjustment to whistleblower treatment in the near future. For Squire Sanders’ analysis of what the new rules mean for you, please jump to "What Should Companies Do?"

For a high-level summary of the final rules, please jump to "Takeaways from the New Rules."

What Should Companies Do?

The whistleblower rules do not impose additional requirements on issuers; however, the possibility of monetary awards provides a skewed incentive to an employee in favor of reporting directly to the SEC rather than through internal company channels. This challenge is best addressed by a combination of the following:

  • a strong and regularly and periodically publicized internal compliance system that identifies and remediates compliance issues in a timely manner;
  • adequately documented processes to support the effectiveness of the compliance program;
  • easy and well-publicized reporting protocols for employees who spot issues; and
  • strong confidentiality protection around the identity of the whistleblower and the content of reports of potential violations.

The first goal – a strong internal compliance program – is obvious: the better (and better known) your compliance efforts, the less likely that an employee will have something to report to the SEC. Periodic reminders to employees not only strengthen the program, but also help to keep it "top of the mind' with employees who might otherwise not be familiar with the SEC bounty program. The new rule also places a premium on a compliance culture that is responsive to employee reports. Particularly since the new rules provide for a 120-day "look-back period" from the date of the SEC report (as outlined below) a company can assume that if it has not adequately responded to an employee whistleblower claim within 120 days, the employee will likely report to the SEC to secure "look-back" status . A primary key to responsiveness is to ensure that any internal report quickly reaches the appropriate personnel to address the concern.

In addition to having effective and highly visible compliance programs and being responsive to employee charges, companies must also ensure that such policies are easily accessed in order to encourage internal reporting. Some companies include the procedures for reporting suspected wrongdoing within their employee handbooks or ethics policies. International companies should include contacts in multiple languages and countries, as appropriate, and in compliance with local privacy laws. These procedures are also often accompanied by a policy encouraging employees to report such suspicions internally and promising confidentiality.

Finally, reliable confidentiality for internal reporting should help encourage employees to raise issues within the company rather than taking the more extreme step of notifying the SEC. Most companies already have the basics of anonymous tip lines in place. Best practices may come to include more frequent use of ombudspersons within an organization. Such ombudspersons would be available to receive employee complaints relating to compliance on a confidential basis and help navigate company channels to resolve them. Such a system also encourages anonymous follow-up by the reporter; otherwise, the initial report may yield incomplete and/or unactionable information. The SEC’s comments on the new rules stress its preference that allegations of non-compliance be addressed and effectively remediated by companies themselves before the situation rises to the level of an enforcement action. While not much comfort, the SEC does provide some modest support for this preference in rules relating to the determination of the final award amounts. It is likely that a whistleblower who entirely skirts a robust internal reporting process will not receive as large an award as someone who makes a report that is ignored or not vigorously investigated.  

During the public comment period following the release of the proposed rules, many commenters raised concerns regarding the difficulty of separating "highquality" tips from frivolous or malicious reports in the face of what will certainly be increased whistleblower submissions. To date, the SEC says that it has not experienced a "flood" of new tips, but that those it has received have included more substantiated information. Only time will tell whether this will continue to be the case, particularly following the first awards under these new rules.

Takeaways from the New Rules

Who is an eligible whistleblower?

In order to be eligible to receive an award, a whistleblower must voluntarily provide the SEC with original information regarding a federal securities law violation leading to a successful SEC enforcement action resulting in monetary sanctions exceeding US$1 million.

Individuals who have responsibility for a company’s legal, compliance, audit, supervisory or governance responsibilities and who learn of a potential violation either through the performance of the review processes associated with these duties or from internal upward reporting are not eligible for whistleblower awards unless they believe that (i) immediate reporting is necessary to protect investors from serious harm, (ii) the company is impeding the internal investigation or (iii) at least 120 days have passed since the internal report. In addition, an employee who reports a potential violation to the company’s internal legal and compliance department before reporting to the SEC will receive the benefit of a 120-day "look-back period" from the date of the SEC report so that he or she may still be eligible for a cash award, even if someone else makes a whistleblower report regarding the same circumstances in the intervening period.

What is original information?

Original information is information derived from the whistleblower’s independent knowledge or analysis that is not already known to the SEC and is not exclusively derived from the news media or from an allegation already made in a governmental investigation or hearing. Certain information, however, will not constitute original information, including information obtained in violation of law, through attorney-client privilege, by an independent public accountant in performing its engagement, or certain information acquired in connection with a company’s internal compliance and investigation process.

When is information provided voluntarily?

Information is provided "voluntarily" if provided prior to any request directed to the whistleblower from a government agency. However, if the SEC has already begun an investigation, information may still be considered original, voluntary information if it is essential information that would not have otherwise been obtained in the normal course of the investigation.

How is the amount of the government’s recovery calculated?

In determining whether the US$1 million threshold has been met – and if it has been, the amount of monetary sanctions on which an award percentage would be based – the SEC will include all amounts recovered in any single captioned judicial or administrative action, or arising out of the same set of facts, regardless of the number of defendants or the number of underlying charges. Further, a whistleblower is entitled to payment only to the extent that the monetary sanction is actually received by the SEC.

How will the SEC determine the size of an award?

The SEC will pay 10 percent to 30 percent (in the aggregate, divided among claimants) of the total monetary sanctions collected in any action as whistleblower awards. In determining the amount of an award, the SEC will take into account (a) the significance of the provided information to the success of the action, (b) the degree of assistance provided by the whistleblower, (c) the deterrent value of the size of the award, (d) the whistleblower’s participation in internal compliance systems and (e) whether an award otherwise enhances the SEC’s ability to fulfill its mission and encourage the submission of high-quality information. In weighing these criteria, the SEC may consider any number of factors including hardships experienced by the whistleblower as a result of his or her assistance; the time and resources conserved by the whistleblower’s assistance; the severity of the underlying violations; and/or any involvement of the whistleblower in the underlying violations, as either attempts to remediate or culpability in the misconduct. The SEC may also reduce the size of an award based on the whistleblower’s own culpability, delays in reporting or interference in the internal compliance process. The SEC has broad discretion in the factors that it uses to determine the size of any award within the 10 percent to 30 percent range and the weight that it gives any of such factors.