On May 25, 2011, the Securities and Exchange Commission (the "SEC"), by a three to two vote, adopted final rules implementing the whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the "Dodd-Frank Act"). The final whistleblower rules have been highly anticipated by various constituencies, from plaintiffs' attorneys to corporate counsel, as they have the potential to greatly increase reporting of possible corporate misconduct to the SEC. While the SEC made various changes to the proposed rules in response to comments it received, it did not include a requirement that whistleblowers first report violations through internal compliance programs as a pre-requisite for award eligibility as many commenters had requested. The SEC settled on an approach relying more on incentives for whistleblowers to make reports through a company's internal channels than on any strict internal reporting requirement. This alert provides a summary of the final whistleblower rules and explain some of the significant changes that the SEC made to the rules as initially proposed in November of 2010.
Section 922 of the Dodd-Frank Act requires the SEC to pay awards to whistleblowers who voluntarily provide original information to the SEC that leads to the successful enforcement of a violation of the federal securities laws resulting in monetary sanctions exceeding $1,000,000. By statute, the awards must range from at least 10 percent to a maximum of 30 percent of the monetary sanctions collected in the case. Section 922 of the Dodd-Frank Act also prohibits retaliation by employers against individuals who provide the SEC with information about possible securities law violations.
SUMMARY OF THE FINAL WHISTLEBLOWER RULES AND SIGNIFICANT CHANGES FROM THE PROPOSED RULES
The final rules define a whistleblower as an individual (entities do not qualify) who, alone or with others, provides information voluntarily to the SEC, pursuant to the procedures specified by the SEC, relating to a "possible violation of the federal securities laws (including rules and regulations thereunder) that has occurred, is ongoing or is about to occur." This definition embodies several changes from the proposed rules.
First, the proposed rules referred to "potential" violation of the securities laws, and commenters had encouraged the SEC to change it to "likely" or "probable" violation in order to exclude frivolous submissions from eligibility for awards. In the release adopting the final rules, the SEC states that the term "possible violation" requires that the information "should indicate a facially plausible relationship to some securities law violation -- frivolous submissions would not qualify for whistleblower status."
Second, the final rules make it clear that the whistleblower program applies only to violations of the federal securities laws -- information about violations of state securities laws and any foreign laws would not qualify for awards. The SEC explicitly rejected suggestions by commenters that possible securities law violations must be "material." The SEC believes that the enforcement staff's judgment in declining to pursue immaterial violations will protect against abuses in this area.
Section 922(h)(1) of the Dodd-Frank Act provides that no employer may discharge, demote, suspend, threaten, harass or in any other manner discriminate against a whistleblower in terms of employment. An employee who proves a retaliation claim is entitled to reinstatement and two times back pay, with interest. The final rules clarify that, to have anti-retaliation protection, an individual must have a reasonable belief that the information being provided to the SEC relates to a possible securities law violation. While the SEC may decline to pursue leads reflecting immaterial violations, the employee who provides information to the SEC about immaterial possible violations will nonetheless be entitled to anti-retaliation protection.
Unlike the Sarbanes-Oxley anti-retaliation provisions, the Dodd-Frank provisions do not require an employee to first file a complaint with the Department of Labor and instead permit retaliation claims to be initiated in federal court. Further, jury trials are explicitly permitted for retaliation claims. Finally, the SEC rules make it clear that the SEC has enforcement authority over violations of the anti-retaliation provisions.
The final rules require, as contemplated by Dodd-Frank, that a whistleblower's submission of information to the SEC must be "voluntary" -- it cannot be made following a request for information to the whistleblower pursuant to a formal or informal investigation or inquiry by the SEC or another enforcement agency. The final rules represent a significant change from the rules as proposed. In its November 2010 rule proposals, the SEC indicated that a subpoena or request to a company was also deemed to be a request to the company's employees who possess the information called for by the subpoena or request. The final rules reverse that result -- a submission is still voluntary even if it is made after the whistleblower's employer receives an information request from the SEC staff so long as the request was not made directly to the employee or his or her counsel.
To qualify for an award, information provided by a whistleblower must be "original." That means it must be based on the whistleblower's independent knowledge or independent analysis, not already known to the SEC, and not derived exclusively from certain public sources. If the whistleblower provides the same information to another authority, including pursuant to an internal compliance program, the whistleblower has a 120-day grace period (extended from 90 days in the proposed rules) during which he or she can submit information to the SEC and still be considered to have provided the original information as of the date the information was submitted to another authority (including a compliance program).
If all of the conditions of the rules are met, the SEC must pay an award of at least 10 percent and not more than 30 percent of the monetary sanctions collected in the case. The SEC can also pay an award to a whistleblower based on monetary sanctions that are collected from "related actions," which may include an enforcement action commenced by the U.S. Department of Justice or another governmental agency.
Criteria for Award Amounts
Under the November 2010 proposed rules, the SEC set forth a list of factors that the SEC would be required to consider in determining the amount of an award, as well as a list of factors that the SEC could, but was not required to, consider. Reporting through an internal compliance program was only in the list of optional factors. The final rules have restructured the award criteria and contain a list of factors that the SEC will consider in determining whether to increase or decrease an award percentage or in allocating awards among multiple whistleblowers. The SEC must consider the following criteria which may increase a whistleblower's percentage award: (1) the significance of the information provided; (2) the assistance provided by the whistleblower; (3) law enforcement interest in making a whistleblower award; and (4) participation by the whistleblower in internal compliance systems. The following required criteria may decrease a whistleblower's award: (1) culpability of the whistleblower; (2) unreasonable reporting delay by the whistleblower; and (3) interference with internal compliance and reporting systems by the whistleblower. It is interesting to note that while the SEC contends that the whistleblower rules are intended to encourage the use of internal compliance and reporting systems, the rules do not bar a person who has materially interfered with one of those systems from receiving an award.
Information Must Lead to Successful Enforcement
Under the Dodd-Frank Act, whistleblowers are entitled to an award only if the information "led to" a successful enforcement action. For behavior not being investigated by the SEC, the November 2010 rule proposals provided that the information must have either caused the staff to commence an investigation or examination, to reopen a closed investigation, or to inquire into new and different conduct as part of an existing investigation, and the information must have "significantly contributed" to the success of an SEC enforcement action. For pending investigations, the standard in the proposed rules was higher -- information would have been considered to have led to a successful enforcement action if the information would not have otherwise been obtained by the SEC and was essential to the success of the action. In response to comments, the SEC's final rules have lowered the standard for determining information that qualifies for an award. First, the "significantly contributed" standard has been eliminated as a factor for investigations that are not currently open. Under the final rules, information will be considered to have led to successful enforcement when (i) the information is sufficiently specific, credible and timely to cause the staff to commence an investigation, reopen a closed investigation, or inquire concerning different conduct as part of a current examination or investigation, and (ii) the SEC brings a successful judicial or administrative action based in whole or in part on the conduct identified in the information.
Second, with respect to information concerning conduct already under investigation, the final rules have abandoned the concept that the information would not otherwise have been obtained and was essential to the success of the action, in favor of a standard that will consider whether the information "significantly contributed" to the success of the SEC action. The adopting release notes that, practically speaking, in assessing whether information led to a successful enforcement action, the SEC will examine the relationship between the information submitted by the purported whistleblower and the allegations in an SEC complaint.
Incentive to Report Through Internal Compliance Programs
Many commenters expressed concern that the SEC's rule proposals did not go far enough to encourage whistleblowers to report possible violations through internal compliance programs either before, or at the same time as, they are reported to the SEC. In response to this concern, the final rules provide that if a whistleblower reports original information through his or her employer's internal compliance procedures before or at the same time as they are reported to the SEC, and if the employer provides the SEC with the whisteblower's information or with the results of an investigation initiated in response to the whistleblower's information and the information provided by the employer leads to a successful enforcement action, then the whistleblower will receive full credit for the information provided by the employer as if it had been provided by the individual to the SEC. In other words, even if an employee internally reports information that would not have "led to" a successful SEC enforcement action, but prompts an internal investigation that yields information that leads to a successful enforcement action, the whistleblower will be considered as having provided all the information provided by the company. This provision may be the only true incentive in the final rules for whistleblowers to think about reporting internally before or at the same time as they report to the SEC.
Exclusions From Award Eligibility
The final rules identify several categories of individuals or information that will not be eligible for an award. The principal categories include certain company employees or representatives, including officers, directors and compliance personnel, who obtain information in connection with the company's processes for identifying, reporting and addressing possible violations of the law, or whose principal duties involve compliance or internal audit. Information obtained by employees of a firm retained to perform compliance or internal audit functions or conduct an inquiry or investigation into possible violations of law are also excluded. Finally, information obtained by an employee who is associated with a public accounting firm is excluded if the information was obtained through the performance of an engagement required under the federal securities laws. These exclusions from award eligibility do not apply if (i) the whistleblower has reason to believe that disclosure to the SEC is necessary to prevent the entity from engaging in conduct that is likely to cause substantial injury to the financial interests or property of the entity or its investors; (ii) the whistleblower has a reasonable basis to believe that the relevant entity is engaging in conduct that will impede an investigation of the misconduct; or (iii) 120 days have elapsed since the whistleblower provided the information to the company's audit committee, chief legal officer, chief compliance officer or supervisor. The final rules also exclude from award eligibility information that was obtained through a privileged attorney-client communication or if the would-be whistleblower obtained the information in a manner that is determined by a domestic court to violate applicable federal or state criminal law.
Staff Communications With Whistleblowers
The November 2010 proposed rules stated explicitly that the staff of the SEC is authorized to communicate directly with whistleblowers who are directors, officers, members, agents or employees of an entity that has counsel without notifying the company or its counsel. This proposed rule was adopted as originally proposed. Although a number of commenters expressed concern that the rule will undermine the attorney-client privilege, the adopting release states that "nothing about this rule authorizes the staff to depart from the Commission's existing procedures when dealing with potential attorney-client privileged information."
The final rules, consistent with the November rule proposals, do not exclude from possible awards whistleblowers who are culpable in the unlawful conduct at issue unless they are convicted of a crime related to the action for which they would otherwise receive an award. However, monetary sanctions that the whistleblower is ordered to pay, or that an entity is ordered to pay if the entity's liability is based substantially on the whistleblower's conduct, will not be included in determining whether the $1,000,000 threshold for an award has been satisfied. In addition, those amounts will not be included in the total monetary sanctions collected for purposes of calculating the amount of an award to a whistleblower.
WHAT COMPANIES SHOULD DO NOW
Debate will continue as to whether the SEC's final rules strike the appropriate balance between encouraging the submission of high quality tips to the SEC about securities law violations, on the one hand, and supporting effective internal compliance programs, on the other. Regardless of that debate, companies should expect an increase in whistleblower activity, and should recognize that the large potential awards, the dynamics of the SEC's rules, and the large number of law firms publicly recruiting whistleblowers, significantly increase the risk that employees will bypass internal reporting mechanisms and go straight to the SEC. Even if employees do report internally first, the rules will put companies under increased pressure to investigate quickly and determine whether self-reporting to the SEC is appropriate.
Companies should take this opportunity to reexamine their internal compliance programs and how they are communicated to employees. These programs should be reviewed to confirm that they are easy to understand and use. As part of any communication about the compliance program, companies should consider reemphasizing that the company has a robust process by which employees can and are encouraged to report violations through the company's whistleblower hotline, and that anonymity will be protected if the employee so desires. Employees should be reminded that periodic certification and sub-certification requirements require them to advise the company of suspected wrongdoing, and that internal reporting benefits the company by enabling it to sort through facts privately before deciding whether something is so serious as to require self-reporting to the SEC. Companies should consider including in their training programs a reminder that some information employees encounter is subject to the company's attorney-client privilege, which is not subject to waiver by employees. In addition, companies should reinforce their policies against retaliating against whistleblowers and train their human resource executives and other business leaders on the anti-retaliation provisions of Dodd-Frank and Sarbanes-Oxley.
It is not too early to work with counsel experienced in SEC enforcement actions to establish procedures for the handling of whistleblower complaints, including communication protocols that will assure an employee that the company is taking the matter seriously. The adoption of the new whistleblower rules is a good reason for companies to revisit their internal planning for dealing with SEC investigations and with internal complaints about securities violations. The handling of any whistleblower complaint will also require the assistance of employment counsel who can help navigate the anti-retaliation provisions once a whistleblower has been identified. Companies should connect now with counsel experienced in SEC investigations so that not even a few days are wasted selecting qualified counsel once an issue arises.