The belated adoption on May 25, 2011 of the U.S. Securities and Exchange Commission’s (“SEC”) long anticipated final whistleblower rules (“Final Rules”) pursuant to Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”)1 has done little to temper the sharply divergent reactions that the initial Proposed Rules evoked.2 As the Commissioners’ divided 3-2 vote in favor of the Rules and public commentary since make clear, opinions remain deeply divided on the propriety, the wisdom, and the legality of the SEC’s approach.

On the single most contentious issue—whether the “bounty” program providing financial incentives for would-be whistleblowers should include an internal reporting requirement—the Final Rules ignore the urging of many parties and does not require individuals to report a suspected securities law violation within a company first in order to benefit from the potential financial rewards. SEC Chairman Mary L. Schapiro expressed the view that the Rules “strike[] the correct balance . . . between encouraging whistleblowers to pursue the route of internal compliance when appropriate . . . [and] providing them the option of heading directly to the SEC.”3  

The U.S. Chamber of Commerce, for one, is not persuaded.4 A leading critic of both the Proposed Rules and the Final Rules, the Chamber criticized the approach of “not requiring simultaneous reporting to both the company and the SEC” (which it claims “prevents quick action to investigate and solve problems if they exist”), and colorfully analogized the idea of “[n]ot informing the company of a potential fraud and waiting for the SEC to act” to “not calling the firefighters down the street to put out a raging fire and . . . calling the lawyers from the next town to sue over the fire instead.”5  

It is hardly a foregone conclusion that the Rules will take effect in their current form, as the legality of SEC rulemaking pursuant to Dodd-Frank has already elicited significant legal challenges on a number of fronts, including challenges in which our firm has participated.6 In the event the Rules do take effect substantially in their current form, however, wbelow a preliminary assessment of their key provisioand implications, so that corporations may be prepawhether it is ultimately “firefighters” or lawyers who come calling.

Section 922 of Dodd-Frank and the new Section 21F of the Exchange Act

The centerpiece of the Dodd-Frank whistleblower provisions, enacted on July 21, 2010, is the enticing financial incentive for would-be whistleblowers to report potential securities violations to the SEC (as well as the Commodities Futures Trading Commission (“CFTC”)).7 This was thought to fill a gap in the 2002 Sarbanes-Oxley Act (“Sarbanes-Oxley”), which afforded whistleblowers the shield of anti-retaliation provisions, but without any financial incentive.  

A whistleblower is entitled to a bounty, under Dodd-Frank, if the whistleblower “voluntarily provide[s] original information to the Commission that [leads] to the successful enforcement”8 of “any judicial or administrative action brought by the Commission under the securities laws” and which “results in monetary sanctions exceeding $1,000,000,”9 or a “related action,”10 which includes actions by the U.S. Department of Justice (“DOJ”), “an appropriate regulatory authority,” “a self-regulatory organization,” and “a State attorney general in connection with any criminal investigation.”11 In that event, the whistleblower will be entitled to between ten and thirty percent of monetary sanctions collected12 (including penalties, disgorgement, and interest13), with the precise amount determined at the SEC’s discretion.14 At a minimum, therefore, a successful whistleblower will receive an award of $100,000.15  

Criticism of the Proposed Rules

The SEC’s Proposed Rules, which were published for public comment on November 3, 2010, prompted various criticisms. Corporations and interested organizations critical of the Proposed Rules sought modifications addressing the following concerns:  

  • as noted above, conditioning awards on a whistleblower’s prior use of internal reporting and compliance procedures, which companies had painstakingly implemented in the wake of Sarbanes-Oxley;16
  • cabining the eligibility of potential whistleblowers, by excluding those who contributed to the problem being reported, those who perform corporate compliance functions, or those whose financial interest is contrary to the company’s, such as short-sellers;17  
  • sharing information the SEC receives from whistleblowers with companies, allowing them to conduct internal investigations and receive credit for cooperating with the SEC;18  
  • extending the grace period for whistleblowers to report to the SEC following their internal reporting (e.g., from 90 days to 120 or 180 days);19  
  • requiring whistleblowers to comply with corporate policy in obtaining evidence of wrongdoing;20
  • clarifying anti-retaliation provisions to allow companies to take disciplinary action if based on factors other than whistleblowing status.21

One pervasive theme among the comments received was that the SEC, the DOJ, and the U.S. Sentencing Commission have long encouraged voluntary cooperation by companies in law enforcement.22 If the SEC were to reward “external” whistleblowers without encouraging them to report internally as well, these cooperation initiatives could be undermined.23

The Final Rules

Key provisions of the Final Rules, and their implications for businesses, are reviewed below.

No Mandatory Internal Reporting Before or Simultaneous with External Reporting

The SEC ultimately rejected the modification that corporate interests had advocated most strongly: requiring whistleblowers to make use of internal company reporting mechanisms before or simultaneously with an external report to the SEC. The SEC explained that one concern that led to its rejection of this approach was “that, while many employers have compliance processes that are well-documented, thorough, and robust . . . others do not.”24 The SEC also worried that there are a significant number of whistleblowers who would be deterred by an internal reporting requirement for “fear of retaliation and other forms of harassment,” despite the strengthened anti-retaliation provisions in the new Rules.25 Ultimately, the agency concluded that “whistleblowers are in the best position to assess whether reporting potential securities violations through their companies’ internal compliance and reporting systems would be effective.”26  

No Requirement that the SEC Share with Companies Information Obtained From Whistleblowers

The SEC also declined to adopt a provision that would require the agency to “notify any affected company of a whistleblower’s allegations” and to give the company “full credit under applicable SEC policies” if it took remedial action.27 Corporations had sought access to such information so that their own efforts to address allegations of wrongful conduct (as required by Sarbanes-Oxley) would not be undermined. Instead, the SEC left to the discretion of the SEC staff whether to contact companies upon receiving whistleblower complaints and to credit firms for their corrective actions, if the SEC determines that this is “consistent with the public interest.”28  

Retaliation Protection Available for Reports of Merely “Possible” Violations Must Be Based Upon “Reasonable Belief”

Dodd-Frank protects whistleblowers from retaliatory employment actions if they report externally to the SEC.29 The threshold requirement for retaliation protection—that the whistleblower’s report be based upon merely a “possible” violation—would seem easily satisfied, but this is moderated by the requirement that the whistleblower’s report be based upon a “reasonable belief” that an actual violation has occurred.30 As the Final Rule Release explains, “[t]he ‘reasonable belief’ standard requires that the employee hold a subjectively genuine belief that the information demonstrates a possible violation, and that this belief is one that a similarly situated employee might reasonably possess.”31  

Limited Anti-Retaliation Protection for Internal Reporting at Non-Public Companies

As for internal reporting within a company, the new Rules extends the anti-retaliation protections for external whistleblowers to employees who report to “a person with supervisory authority over the employee.”32 However, this only applies to employees of public companies and a few other limited entities.33 This leaves employees of non-public companies without similar protection for internal reporting. Without eqguarantees of protection for reporting internally, there is a strong incentive for whistleblowers in these other companies to head directly to the SEC to report suspected violations.34

Notably, the SEC also denied the numerous requests from commenters to “categorically provide that employees who make whistleblower reports to [the SEC] may be disciplined for reasons independent of their whistleblowing activities,” as “unnecessary” because the statute by its terms is limited to adverse actions taken “because of” lawful whistleblowing.35 The absence of specific language protecting lawful disciplinary actions by an employer may result in more burdensome and costly lawsuits, as well as the use of whistleblowing as a shield for employees otherwise facing disciplinary action.

Incentives for Whistleblowers to Report Internally

Notwithstanding the foregoing discussion, there are also competing incentives for would-be whistleblowers to report internally. First, new Rule 21F-4(c)(3) allows whistleblowers who report through internal channels to reap awards from their company’s subsequent disclosures to the SEC.36 If a whistleblower reports information through the proper internal channels, the employer provides this information to the SEC, and the employer’s disclosures in turn lead to a successful enforcement action, “the whistleblower will receive full credit for the information provided by the employer as if the whistleblower had provided the information to” the SEC.37 In other words, Rule 21F-4(c)(3) puts a whistleblower who uses only internal procedures on equal footing with one who goes directly to the SEC.38

Second, internally reporting may entitle whistleblowers to monetary awards as well. In addition to the basic formula for an award—i.e., that the whistleblower receives “between 10 percent and no more than 30 percent of the monetary sanctions that the Commission and other authorities are able to collect” as a result of the disclosure,39 the Final Rules now include a new factor that can increase a whistleblower’s award percentage: namely, “the extent to which the whistleblower . . . participated in internal compliance systems.”40 The SEC explained that it added this “incentive” to dissuade employees from reporting solely to the SEC, and to express its genuine recognition of “the important investor protection role that corporate compliance programs can serve.”41  

Broader Exclusions from Eligibility as a Whistleblower

Beyond providing some incentives for internal reporting, the Final Rule also benefits corporations by much more narrowly defining the eligibility of potential whistleblowers. Consequently, a larger category of persons involved in companies’ internal compliance activities are now precluded whistleblower eligibility.

First, in-house counsel are not eligible for whistleblowing awards.42 Second, public accounting firms and their employees are similarly ineligible.43 As the SEC explained, this measure was taken “based on [a] concern about creating incentives for independent public accountants to seek a personal financial benefit by ‘front running’ the firm’s proper handling of information obtained through engagements required under the federal securities laws.”44

Third, and perhaps most importantly, officers, directors, trustees, and partners of an entity who obtain information from another person, informing them of a securities violation, are not eligible for whistleblowing awards.45 In the Proposed Rule, this class of persons had been excluded from going to the SEC only when information was communicated to them “with the reasonable expectation that [they] would take steps” to respond to the violation.46 Now, the Rule applies regardless of the expectations of the person who made the report. There are, however, exceptions to the ineligibility rules. For example, if an officer discovers evidence of other senior management engaged in securities law violations, the officer may be an eligible whistleblower.47 The new Rules also provide three general exceptions permitting otherwise excluded individuals to become eligible for whistleblowing awards.48

Extension of “Lookback Period” from 90 to 120 Days

Corporations will also benefit from an extension of the “lookback period” from 90 to 120 days.49 The “lookback period” refers to the window of time between when an employee submits an initial report of a securities violation to personnel within a company, and when the employee makes a disclosure to the SEC. Under the Proposed Rule, this period had been set at 90 days that the employee making an external report to the SEC within 90 days of reporting internally would still be eligible for an award.50 Corporations complained that this period did not give them enough time to self-correct, and asked for up to 180 days so that compliance personnel could thoroughly conduct an internal investigation.51 Ultimately, the SEC settled on a 120-day period. This means that companies gain another month to respond to the problem—and take corrective actions if needed—before the SEC necessarily launches an investigation. Based on initial reactions to the Final Rules, however, companies may still find the 120-day period insufficient to correct problems and avoid external whistleblowing.52

Where We Go from Here

Potential Legal Challenges

As noted above, the SEC’s adoption of the Rules does not shield it from a potential legal challenge.53 For example, despite the fact that great deference is afforded the promulgating agency, a party might claim that the Rule are an “arbitrary and capricious” exercise of the SEC’s authority under the Administrative Procedure Act (APA)54 on various grounds, including perhaps the SEC’s failure to adequately consider the costs and benefits of the adopted Rules. For example, as Commissioner Kathleen L. Casey noted, “to the extent that the rule will tend to convert internal complaints into SEC investigations, the defense costs of companies will increase materially as they are forced to hire outside counsel to represent them before the Division of Enforcement.”55 However, Casey pointed out, the “release makes no effort to quantify with specificity the impact of that likely cost increase, and this has prevented the Commission from fully considering the true impact of the rule.”56  

Similarly, SEC rules are deemed “arbitrary and capricious” when the SEC fails to consider their effects on “efficiency, competition, and capital formation.”57 Here, a party could argue that the SEC did not fully consider the effects of its Rules on the agency’s own efficiency (and its capabilities for processing complaints),58 nor on business competition and capital formation.

In fact, commenting corporations maintained that an over-zealous whistleblowing regime—particularly one lacking an internal reporting requirement—would undermine corporate compliance systems and marketplace confidence.59 The SEC indirectly dismissed these allegations in its Final Rule Release,60 but a party might argue that the SEC’s explanations were insufficient. Furthermore, it is arguably contrary to the spirit, if not the letter, of Sarbanes-Oxley for the SEC to incentivize employees to circumvent internal corporate reporting structures and thereby, effectively, to undermine the effective functioning of the corporate compliance programs created pursuant to Sarbanes-Oxley.

A party could also argue that the SEC failed to consider regulatory alternatives that are consistent with the underlying statutory purpose and are potentially more cost-effective.61 This argument has particular merit when the SEC does not properly consider alternatives proposed during the comment period.62 For example, corporate commenters argued that the SEC could (and should) have adopted a whistleblowing program capable of differentiating between companies with strong internal compliance programs and those without them. The idea was to require employees of the former firms to report internally before or in parallel with an external report, while employees in companies without strong compliance programs could report externally alone. This approach was embraced by dissenting Commissioner Troy Paredes,63 as well as the Chamber.64

Here, a compelling argument can be made that the SEC’s putative reasons for declining this approach—that a mandatory internal reporting rule could have a “chilling effect” for employees fearful of retaliation,65 that mandatory reporting could hamper law enforcement efforts in companies where corporate compliance is mismanaged,66 and that the current approach (of optional internal reporting) will actually encourage firms to strengthen internal compliance the most67—are unpersuasive. None of these reasons explain why the SEC could not have established a mandatory reporting rule only for companies whose internal reporting mechanisms are well-developed, and where retaliation, mismanagement, and the need for improvement are consequently less compelling. Thus, it is unclear why the SEC did not adopt the proposal made by General Electric and others for a rule requiring internal reporting for companies that have effective compliance programs.68 Such a requirement, General Electric pointed out, could be implemented by permitting companies to annually certify that they maintain compliance and internal reporting programs that meet the standards established by the SEC and Chapter Eight of the U.S. Sentencing Guidelines.69

What This Means for Companies

Even at this early stage after the Rules’ adoption, it is possible to anticipate several implications for companies:

  • Speculative whistleblowing is likely to significantly increase in response to the financial incentives, supported by an active plaintiffs’ bar. The Chamber has reportedly “already seen trial lawyers running advertisements and training seminars on how to profit from bounty programs adopted under these rules.”70  
  • In parallel with the uptick in employee whistleblowing, “defensive whistleblowing” from employees who reasonably fear independent disciplinary actions is also likely to increase. Dodd-Frank also creates a private cause of action for whistleblowers to sue companies taking adverse employment action against individuals for lawfully providing information or other assistance to the SEC.71
  • SEC inquiries are also likely to increase in response to the rise in whistleblowing. If the SEC is in fact overwhelmed by a deluge of tips, as its own anecdotal evidence suggests, delays in pending and future investigations can be anticipated as the SEC analyzes the newly available evidence.  
  • Companies may face additional criminal exposure if they are denied the benefit of voluntary disclosure in criminal investigations because of information spill-over from information provided to the SEC by whistleblowers.  
  • Multinational and foreign corporations are not immune from the potential effects of the Final Rule. Any company that is the defendant in a “successful enforcement of the covered judicial or administrative action, or related action,” as these terms are defined by Dodd-Frank,72 will have employees who potentially may benefit from whistleblower status. Similarly, Dodd-Frank makes clear that “[w]ithout the loss of its status as confidential in the hands of the” SEC, the SEC can, in its sole discretion, share information obtained from whistleblowers with “a foreign securities authority” or “a foreign law enforcement authority.”73  

As a result, companies should:  

  • Reevaluate compliance and internal reporting programs in order to minimize opportunities for wrongdoing, thereby reducing whistleblower risks to begin with.  
  • Train employees on avenues for internal reporting which can greatly aid a company’s internal investigation without removing an employee’s potential eligibility for an award, pursuant to new Rule 21F-4(c)(3). This will minimize the concern that the new Rules “will lead to trial lawyers urging whistleblowers to keep the company in the dark as long as possible so as to maximize any available bounty.”74  
  • Carefully consider the ramifications and timing of adverse action against employees that could later be deemed retaliatory. Similarly, companies should train managers and supervisors to avoid potential retaliation pitfalls.75