Daniel Silver and Benjamin A Berringer, Clifford Chance

This is an extract from the third edition of GIR's The Practitioner’s Guide to Global Investigations. The whole publication is available here

20.1 Overview of US whistleblower statutes

The US legal system contains a multitude of state and federal laws that protect individuals who report potential misconduct (whistleblowers) from retaliation for making the report. Some of these laws protect specific classes of individuals, such as truck drivers, nuclear engineers, pilots and miners. Others relate to specific conduct such as motor vehicle safety issues, violations of the Clean Air Act, violations of the Clean Water Act or violations of the Affordable Care Act. Each of these laws is structured differently. As a result, the precise steps that a whistleblower must take to file a report, whether the whistleblower has a private right of action and the scope of protection may vary depending on the statutory basis for the whistleblower claim.

20.1.1 The SEC whistleblower regimes

US securities laws protect whistleblowers who report potential misconduct by entities and individuals subject to regulation by the US Securities and Exchange Commission (SEC). This protection was originally created by the Sarbanes-Oxley Act (SOX) in 2002. It was then strengthened and expanded by the Dodd-Frank Act (DFA) in 2009, which created the Whistleblower Protection Program (the Program), pursuant to which, individuals who voluntarily report ‘original information’ about potential violations of federal securities laws are protected from retaliation and entitled to a financial award if the information leads to a successful judicial or administrative enforcement action in which the SEC obtains monetary sanctions over US$1 million. The Program has been a significant success for the SEC. Since August 2011, the Program has received over 22,000 whistleblower reports from individuals in all 50 states and 114 foreign countries. In fiscal year 2017 alone, the SEC received over 4,400 whistleblower reports, including 550 (approximately 12 per cent) from foreign whistleblowers. As a result of these reports, the SEC has instituted enforcement actions that have resulted in penalties of more than US$1.7 billion and awarded over US$326 million to 59 different whistleblowers.

The Program rewards individuals for making reports pursuant to both SOX and the DFA whistleblower provisions. Under both statutes, individuals qualify as whistleblowers if they report alleged misconduct and have ‘a reasonable belief that the information [they are] providing relates to a possible securities law violation . . . that has occurred, is ongoing, or is about to occur’. A belief is reasonable if it is both subjectively and objectively reasonable; that is, the employee must have both ‘a subjectively genuine belief that the information demonstrates a possible violation, and that this belief is one that a similarly situated employee might reasonably possess.’

To satisfy the subjective component of this standard, the employee must have ‘actually believed the conduct complained of constituted a violation of pertinent law’. For the objective component, ‘[the] employee need not show that an actual violation occurred so long as “the employee reasonably believes that the violation is likely to happen.”’ ‘A belief is objectively reasonable when a reasonable person with the same training and experience as the employee would believe that the conduct implicated in the employee’s communication could rise to the level of a violation of’ the securities laws.

While the standard for whistleblower status is similar under both statutes, there are also some material differences. First, there are differences in who is protected. SOX protects employees, contractors and subcontractors of publicly traded companies and rating agencies from retaliation for reporting certain criminal offences (mail or wire fraud) or the potential violation of ‘any rule or regulation of the Securities and Exchange Commission, or any provision of federal law relating to fraud against shareholders’ either internally or to certain government entities. The DFA, on the other hand, prohibits any employer from taking adverse employment actions against employees who report potential violations of the securities laws to the SEC.

Second, there are differences in what misconduct can be reported. DFA protections only apply to whistleblowers who report potential violations of the securities laws, while SOX prohibits retaliation against whistleblowers who report potential violations of a wider range of laws.

Third, there are differences in the definition of retaliation. The DFA prohibits a broader range of retaliatory conduct. Pursuant to the statute, no employer ‘may discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment because of any lawful act done by the whistleblower’. The SOX prohibition is substantially similar, but does not specifically prohibit indirect action against employees.

Fourth, there are procedural differences in how whistleblowers must report the conduct. SOX specifically states that whistleblowers are protected against retaliation if they report misconduct internally to ‘a person with supervisory authority over the employee (or such other person working for the employer who has the authority to investigate, discover, or terminate misconduct)’ or externally to a federal regulatory or law enforcement agency, or the US Congress. The DFA, on the other hand, statutorily defines a whistleblower as ‘any individual who provides . . . information relating to a violation of the securities laws’ to the SEC. Recognising that SOX whistleblowers – who can report internally – are also protected under DFA, the SEC attempted to extend DFA protection to whistleblowers who report internally pursuant to SOX. This interpretation, however, was unanimously rejected by the Supreme Court, which held that the DFA only protects employees who report misconduct to the SEC.

Finally, there are significant differences in how a whistleblower can bring a claim for retaliation. SOX is enforced by the Occupational Safety and Health Administration (OSHA), which is responsible for investigating claims. Once a whistleblower makes a claim, OSHA will conduct an initial investigation to determine if the whistleblower has made a prima facie showing that their whistleblower report was a contributing factor to an unfavourable employment decision. If OSHA comes to this determination, the employer can then rebut the claim with clear and convincing evidence. Once OSHA makes a final finding, either party may appeal to the Department of Labor’s Office of Administrative Law Judges (ALJ). The regulations then allow for limited discovery, after which the ALJ will conduct a hearing and render a decision. The ALJ’s decision can be appealed by the unsuccessful party to the Department of Labor’s Administrative Review Board, with further appeal to the United States Circuit Court of Appeals for the circuit in which the employee resided or the violation allegedly occurred. Additionally, a SOX whistleblower may bring a retaliation claim in federal court if the Secretary of Labor ‘has not issued a final decision within 180 days of the filing of [a] complaint and there is no showing that such delay is due to the bad faith of the claimant’.

Individuals claiming DFA protections, on the other hand, may immediately bring a claim in federal court. There, courts will employ a burden-shifting standard. The employee must initially meet the ‘rather light burden of showing by a preponderance of evidence that [the whistleblower report] tended to affect [the adverse action] in at least some way.’ Once the employee has made this prima facie showing of retaliation, the burden shifts to the employer to prove that there was a legitimate non-retaliatory reason for the decision. Only if the employer is able to provide a non-retaliatory reason does the burden shift back to the employee to show that the proffered legitimate reason is a pretext.

20.2 The corporate perspective: preparation and response

20.2.1 Preparing for a whistleblower report

There is no legal requirement to create whistleblower policies, but companies that are potentially subject to SOX or DFA whistleblower requirements should ensure that they are prepared by creating policies and procedures that address how they will respond to and protect whistleblowers. These policies and procedures must be appropriately tailored to take into account factors such as the size of the company, the statutory whistleblower provisions that apply, and the nature of its business. At a minimum, whistleblower policies should include the following three types of guidance.

First, the whistleblower policy needs to make clear how an employee or external party can report information about potential misconduct. There are a number of methods that firms can use to facilitate whistleblower reports, including designating an employee from legal or compliance who will receive those reports, creating a web-based interface for making reports, or creating a telephone hotline. Ultimately, the company should adopt one or more methods that will best facilitate reports. Regardless of the method chosen, whistleblowers must also be able to escalate the report to a designated senior employee or board member in the event that the conduct implicates legal, compliance or senior executive management.

Second, the policy should explain how the company will investigate a whistleblower claim. This aspect of the policy should not mandate that specific steps will be followed in each case, as the actual nature and scope of any investigation will depend heavily on the nature and circumstances of the claim. Among the aspects that may be included are (1) who is responsible for initially investigating a whistleblower claim, (2) who is responsible for making an initial determination on the merit of the claim, (3) the circumstances under which the company will conduct a more extensive investigation and (4) who is responsible for ultimately evaluating the whistleblower report and implementing remedial improvements if necessary.

Finally, the policy should ensure that when the identity of a whistleblower is known and the whistleblower is an employee, steps are taken to protect that person from retaliation. This protection could include designating an employee from legal or compliance to monitor the status of the whistleblower to ensure that they are not subject to adverse actions. Additionally, the policy should make clear that any personnel who retaliate against a whistleblower will be subject to discipline.

20.2.2 Responding to a whistleblower report

Once a company learns that a whistleblower report has been made, it should adhere to its whistleblower policy. First, the company should assess the whistleblower’s claim to determine what responsive action is appropriate. As discussed above, the nature of the inquiry will depend on the claim, but could range from an informal assessment by the compliance team to a formal investigation conducted by external counsel. Ultimately, the determination of how to investigate the claim will depend on the severity of the alleged conduct and the credibility of the claim. In conducting the inquiry, it is critical that the company make clear to any employees who are interviewed that even though the substance of the interview may be protected by the company’s attorney–client privilege, the employee retains the right to disclose the facts discussed during the interview to the appropriate authorities.

Second, in the case of a whistleblower report by an employee whose identity is known, in addition to the steps outlined in the whistleblower policy to protect the employee, the company should also ensure that it has documented any previous warnings or disciplinary actions taken against the employee, as well as adhere to consistent disciplinary procedures. Such documentation and adherence will, if necessary, support the company’s position that a whistleblower employee was disciplined or terminated for conduct unrelated to a whistleblower report.

20.2.3 Defending anti-retaliation suits

If a whistleblower brings a retaliation action it will be difficult, if not impossible, to defeat the action at an early stage in the litigation. This difficultly exists because the standard for what constitutes an adverse employment action is purposely vague to allow for ‘a factual determination on a case-by-case basis’, which has been interpreted by courts to reflect a ‘congressional intent to prohibit a very broad spectrum of adverse action against . . . whistleblowers.’ As a result, courts have refused to create a bright-line standard for what constitutes an adverse employment action and instead ‘pore over each case to determine whether the challenged employment action’ constitutes an adverse action. While any action can be construed by an employee as retaliatory, in practice, whistleblower claims are generally predicated on conduct, such as dismissals, demotions or decreased compensation.

Despite these difficulties, there are certain defences that may be successfully asserted in a retaliation lawsuit. First, an employer can argue that there was no causal connection between the protected activity and the adverse employment decision. Two factors that can sever the causal connection are the passage of time or a legitimate intervening event. The passage of time between a whistleblower’s report and their termination can demonstrate that the adverse action was not retaliatory. The Second Circuit has declined to establish a bright-line rule, but in the absence of additional evidence of a defendant’s retaliatory motive, the passage of two months may be sufficient to sever the causal connection. However, to the extent that there is evidence of other retaliatory actions against the whistleblower, courts will allow for a longer gap between the protected activity and termination. Similarly, a legitimate intervening event that occurs after the whistleblower’s disclosure to the SEC will sever the causal connection and create a non-retaliatory justification for the termination. For example, one court granted summary judgment for an employer because, after making his disclosure to the SEC, the whistleblower told investors that the external directors were ‘worthless’, which provided a non-retaliatory justification for the whistleblower’s dismissal. However, because causation is generally a question of fact, a court is unlikely to decide as a matter of law that either the passage of time or an intervening event has severed the causal chain.

An employer could argue that the whistleblower did not have a reasonable belief that the alleged conduct constituted a violation or potential violation of the securities law. In particular, whistleblower complaints need to provide more than ‘self-serving averments’ or ‘bald statement[s]’ in support of the claim that the plaintiff had a reasonable belief that the conduct was illegal.

There are certain defences that may be more applicable to either DFA or SOX whistleblower claims. First, DFA whistleblower claims may be amenable to arbitration. As a general principle, US federal courts ‘strongly [favour] arbitration as an alternative dispute resolution process’, and statutory claims may be submitted to arbitration unless the statute explicitly prohibits arbitration. As a result, some courts have held that DFA retaliation claims are amenable to arbitration, although a prohibition on arbitration was added to other whistleblower retaliation statutes by the DFA. The Third Circuit, the only circuit court to examine this issue so far, has concluded that ‘although Congress conferred on whistleblowers the right to resist the arbitration of certain types of retaliation claims, that right does not extend to Dodd-Frank claims arising under [the Dodd-Frank whistleblower provision].’ SOX claims, on the other hand, are not arbitrable as a result of an amendment to SOX that was passed as part of the DFA.

Finally, in some instances, an employer can argue that an anti-retaliation claim is barred because it is extraterritorial. In Liu Meng-Lin v. Siemens AG, for example, the Second Circuit held that DFA whistleblower protection does not generally apply extraterritorially and that the plaintiff, a resident of Taiwan who was employed by the Chinese subsidiary of a German company, did not have a valid anti-retaliation complaint because neither his report to superiors in China and Germany regarding allegedly corrupt activities that took place outside the United States, nor the decision by Siemens in Germany or China to terminate him, had a sufficient connection to the United States to treat it as a domestic application of the statute. The Second Circuit, however, declined to ‘define the precise boundary between extraterritorial and domestic applications’ of the anti-retaliation provision because the case was ‘extraterritorial by any reasonable definition.’ Nonetheless, this suggests that many foreign whistleblowers may not be protected by the DFA.

20.2.4 Anti-retaliation suits by the SEC

In addition to potential suits by a whistleblower, the SEC has asserted an independent right to bring whistleblower retaliation claims. In June 2014, the SEC brought its first enforcement action against a registered investment adviser for retaliation. Subsequent actions show that this remains an enforcement priority for the SEC. In particular, the SEC may enforce the DFA anti-retaliation provision for ‘conduct occurring outside the United States that has a foreseeable substantial effect within the United States.’ Therefore, even if a company can successfully avoid a retaliation suit by a whistleblower on extraterritorial grounds, the SEC could still bring a suit for the same conduct.

20.3 The whistleblower’s perspective: representing whistleblowers

In determining whether to advise a client to make a whistleblower report, there are several key preliminary considerations. First, if the client is implicated in the wrongdoing this will impact whether they receive a whistleblower award and the amount of any award. The SEC in the DFA Implementation Release noted that ‘culpable whistleblowers can enhance the Commission’s ability to detect violations of the federal securities laws, increase the effectiveness and efficiency of the Commission’s investigations and provide important evidence for the Commission’s enforcement actions.’ As such, pursuant to SEC regulations, the SEC ‘will assess the culpability or involvement of the whistleblower in matters associated with the Commission’s action or related actions’ in determining the amount of a whistleblower award. In at least one case, it appears that the SEC gave an award to a culpable whistleblower. In an April 2016 order, the SEC stated that a whistleblower was subject to a parallel proceeding and that the award was ‘subject to an offset for any monetary obligations’, including disgorgement, prejudgment interest, and penalty amounts that the whistleblower had yet to pay towards a judgment. In ordering this relief, the SEC noted that the whistleblower had previously been advised of the potential offset and did not object.

Second, counsel should consider whether the putative whistleblower is subject to any professional confidentiality obligations that would be implicated. In particular, SEC regulations generally exclude attorneys from recovering under the Program. Information obtained through communications that are subject to the attorney–client privilege or information obtained ‘in connection with the legal representation of a client’ is generally not considered ‘original information’. These exclusions are clearly directed at attorneys to ‘send a clear, important signal to attorneys, clients, and others that there will be no prospect of financial benefit for submitting information in violation of an attorney’s ethical obligations.’ Similarly, certain fiduciaries and professionals engaged by the company who obtained the information through those roles are generally not deemed to have ‘original information’ about misconduct. However, there is no general bar on the use of information that is otherwise deemed confidential by a company.

Disclosing to the SEC

Neither DFA nor SOX whistleblower provisions mandate that a whistleblower make their initial disclosure to the SEC. Therefore, a whistleblower can choose to disclose initially to the SEC or first make an internal report to the employer.

From a rewards perspective, there is no benefit to disclosing first to the SEC. Pursuant to SEC regulations, the date of a whistleblower’s initial internal report will be treated as the date of disclosure to the SEC, so long as the whistleblower makes a report to the SEC within 120 days of the internal report or a report to another federal agency. Therefore, delaying SEC disclosure to make an internal report first will not affect whether the whistleblower is the first person to provide original information and thereby qualifies for an award.

Moreover, reporting directly to the SEC could, in theory, reduce an award as one of the factors that the SEC considers in determining the amount of an award is whether the whistleblower reported the potential misconduct through internal company compliance systems and whether the whistleblower co-operated with any internal investigations. Therefore, reporting directly to the SEC could reduce an award if the whistleblower is perceived to have circumvented the company’s internal reporting system.

However, there is one major potential benefit to first disclosing to the SEC – guaranteed protection as a whistleblower under DFA. In particular, the Supreme Court has held that individuals must report to the SEC in order to be protected as whistleblowers under the DFA. Therefore, if an employee only makes an internal report the employee will lose the anti-retaliation protection provided by the DFA. Moreover, because the SEC treats all whistleblower complaints as confidential and the Program provides additional confidentiality protections to ensure that a whistleblower’s identity is protected, whistleblowers receive an added protection through SEC disclosure.

Once a whistleblower decides to make a report to the SEC, the process itself is fairly simple. Whistleblowers may submit a complaint either through the online Tips, Complaints, and Referrals (TCR) Portal on the SEC’s whistleblower website or by mailing or faxing a TCR Form to the SEC Office of the Whistleblower. Once the form is received, it will be reviewed by Division of Enforcement staff, who will then determine who is best placed to investigate the allegations. In some instances, the TCR will be sent to another federal or state enforcement agency, in which case information that could identify the whistleblower is generally withheld.

20.4 Filing a qui tam action under the False Claims Act

Individuals who report fraud against the United States government have another option for disclosing information – the False Claims Act. This Act was initially created in 1863 to combat price-gouging during the Civil War, but the modern incarnation of the statute is a result of congressional concern regarding defence procurement fraud. Since the statute was enhanced in 1986, there has been a significant growth in False Claims Act suits, from 30 in 1987 to 674 in 2017. As a result of these suits, the US Department of Justice (DOJ) collected US$56 billion between 1986 and 2017, including US$3.4 billion in the 2017 fiscal year alone.

The False Claims Act can be used to prosecute claims for false monetary claims against the government, false statements in aid of false claims, conspiracies to defraud the government into paying a false claim, or false statements intended to reduce an obligation to the government. Moreover, pursuant to the False Claims Act, private individuals – referred to as relators – may bring qui tam claims on behalf of the government alleging that a defendant has committed fraud against the US government. If the prosecution of the qui tam claim is successful, the relator may receive between 15 per cent and 30 per cent of the recovery. This can result in substantial compensation for a whistleblower, as False Claims Act defendants may be liable for penalties of US$5,000 to US$10,000 per violation and for treble damages.

20.4.1 How a qui tam action operates

To bring a qui tam action, the relator must file their complaint in federal court under seal. The initial complaint is only served on the DOJ, which has 60 days to examine the merits of the claim. During this 60-day period (which is often subject to extensions), the DOJ will determine whether to terminate or settle the claim, intervene and take ‘primary responsibility’ for the claim, or decline to intervene and allow the relator to proceed alone. After this period expires, the complaint is unsealed and the defendant will receive notice of the claim.

At this stage, the government’s ‘ultimate election among the options has a direct effect on the relator’s right to share in a recovery.’ If the government decides to intervene in the action, the relator is entitled to 15 per cent to 25 per cent of any recovery, while the government receives the remaining recovery. The precise amount will ‘depend upon the extent to which the person substantially contributed to the prosecution of the action.’ If, on the other hand, the government decides not to pursue the case, the relator will be entitled to 25 per cent to 30 per cent of the recovery, with the government again receiving the remainder of the recovery. The relator is also entitled to ‘an amount for reasonable expenses which the court finds to have been necessarily incurred, plus reasonable attorneys’ fees and costs.’ However, one study has revealed that the majority of plaintiffs voluntarily dismiss the qui tam action if the DOJ declines to intervene, despite the potential for a larger award.

In addition to this basic framework, there are also limitations on awards, which may reduce or eliminate a possible award. First, a relator’s award will be reduced if they ‘planned and initiated’ the False Claims Act violation. Second, if the court determines that the information is ‘based primarily on disclosures of specific information’ relating to governmental investigations or news accounts, the award will be reduced to no more ‘than 10 percent of the proceeds, taking into account the significance of the information and the role of the person bringing the action in advancing the case to litigation.’ Finally, a relator is entitled to no award if they are ‘convicted of criminal conduct arising from his or her role in the violation’. Additionally, there are provisions that preclude filing additional suits based on substantially similar qui tam or government enforcement proceedings. These provisions are intended to achieve ‘the golden mean between adequate incentives for whistle-blowing insiders . . . and discouragement of opportunistic plaintiffs who have no significant information to contribute of their own’.

In addition to determining the quantum of a qui tam award, the DOJ’s decision may also have a substantial impact on the outcome of the lawsuit. Statistics published by the DOJ show that cases where the DOJ intervenes are substantially more likely to generate recoveries than declined cases. DOJ declination may also signal a lack of merit to the court.

Recently enacted DOJ policy also encourages DOJ attorneys to ‘consider whether the government’s interests are served’ by seeking dismissal of the qui tam action.Pursuant to this policy, DOJ attorneys are encouraged to seek dismissal in order to (1) curb meritless qui tam actions, (2) prevent ‘parasitic or opportunistic’ actions that duplicate a pre-existing investigation, (3) prevent interference with government programmes, (4) preserve the DOJ’s litigation prerogatives; (5) safeguard national security, (6) preserve government resources or (7) address ‘egregious procedural errors’ that would frustrate a proper investigation.

However, even if the DOJ decides not to intervene a case, it still has an oversight role in the litigation. First, the DOJ retains the continuing right to dismiss or settle an action being prosecuted by a relator, although at least some courts have suggested that this is not an absolute right. Second, the DOJ retains the right to veto private dismissals or settlements because any judgment will have preclusive effect on a future lawsuit by the US government based on the same facts. That said, a minority of courts have held that the DOJ can only object by showing ‘good cause’ in a case where it has not intervened.

20.4.2 Effects of filing a qui tam action

A qui tam action can have a substantial impact on both the relator and the defendant. First, the relator faces both reputational and financial risk. By filing a qui tam action the relator has agreed to be publicly identified because the unsealed complaint will identify them as the complainant. Relators have tried to avoid this consequence by moving to dismiss and seal cases if the DOJ declines to intervene, but have met with, at best, limited success. For relators who are still employed by the defendant, this risk is mitigated by the anti-retaliation provisions in the False Claims Act, which provide for reinstatement and double damages in the event of retaliation. Nonetheless, depending on the situation, relators may have legitimate concerns about the impact on their professional reputations.

Relators often face additional financial risks if the government declines to intervene. In particular, relators may be responsible for the defendant’s reasonable legal fees if the defendant prevails and ‘the court finds that the claim of the person bringing the action was clearly frivolous, clearly vexatious, or brought primarily for purposes of harassment.’

A qui tam action also creates financial and reputational risks for a defendant. A successful qui tam action could cost a corporation millions, if not billions, of dollars. Moreover, defendants also risk debarment from additional federal contracts. From a reputational perspective, the corporation faces negative publicity associated with public accusations of committing fraud against the government, although at least one court has suggested that this impact is minimised when the DOJ declines to intervene.

Subscribe here for related content, breaking news and market analysis from Global Investigations Review.

Global Investigations Review provides exclusive news and analysis and other thought-provoking content for those who specialise in investigating and resolving suspected corporate wrongdoing.