On July 21, 2010, the Dodd-Frank Act was signed into law, dramatically expanding the SEC’s authority and responsibility with respect to whistleblower complaints.1 The Act provides for financial rewards of 10 to 30 percent of the recovery to be paid to whistleblowers whose provision of original information leads to recoveries of over $1 million in judicial or administrative actions under the securities or commodities laws, or in related actions. In order to take advantage of the provision, a whistleblower must voluntarily provide original information or analysis to the government regarding the alleged misconduct. The Act also contains provisions designed to prevent employers from retaliating against employees who have reported violations, including an independent cause of action for victims of retaliation.
Since the Act was passed, there has been a flurry of activity. Anticipating significant enforcement activity resulting from the new law, the SEC set aside $450 million for the whistleblower fund, significantly more than the $300 million called for by the Act. The impact of the whistleblower provision is already beginning to be seen, with the SEC reportedly averaging at least one tip every day during the first two months after the Act took effect.2 And two days after the Act was passed, the SEC announced that it had awarded $1 million to Karen Kaiser, a whistleblower, who provided the SEC with information implicating her ex-husband and his employer, Pequot Capital, in an insidertrading scheme using information he had taken from his former employer, Microsoft. The award was made pursuant to a prior, heretofore underutilized whistleblower provision outlined in Section 21A(e) of the Securities Exchange Act, which applies only to insider trading violations. Nonetheless, it provided evidence of a new SEC focus on whistleblowers – in the previous 20 years, a total of only $160,000 had been paid to whistleblowers under that provision.
On November 3, 2010, the SEC announced proposed rules for implementing the new whistleblower program. For the most part, the proposed rules — styled Regulation 21F — implement the program as outlined in the Act. However, Regulation 21F also elaborates on the statute in a number of respects. Comments on the proposed rules are due by December 17, 2010.
Interplay with internal reporting mechanisms
Some of the most significant issues addressed by Regulation 21F concern eligibility to recover as a whistleblower and the relationship between the whistleblower program and companies’ internal compliance efforts. The SEC has expressed sensitivity to concerns that the whistleblower incentives will undercut corporate compliance efforts by making it more attractive for whistleblowers to report misconduct to authorities than to raise issues internally, and it has attempted to strike a balance between supporting internal compliance efforts and encouraging external whistleblowing.
Regulation 21F does not require that a whistleblower first report the violation internally. However, it provides that if a potential whistleblower does first submit a complaint to the company’s compliance department, the whistleblower still has a 90-day grace period to provide the same information to the SEC and still qualify as having submitted the information on the date it was initially submitted internally. Rule 21F-4(b). This could be significant for the whistleblower if, in the interim, the SEC learns of the information through other channels such as corporate self-disclosure or a tip from another whistleblower. As long as the SEC did not know of the information prior to the internal report, a tip filed within 90 days of that internal report should still qualify as original information. At the same time, the whistleblower should not feel pressured to report misconduct to the SEC quickly if the whistleblower reports the matter through proper internal channels. Nonetheless, so long as the whistleblower is aware of the issue through means other than involvement in compliance efforts (see below), Regulation 21F does little to encourage the whistleblower to refrain from approaching the SEC immediately upon learning of the issue, although the commentary does include internal reporting as one of the many factors that may influence the amount of recovery.
Persons who learn of misconduct through compliance efforts
Under Regulation 21F, individuals who have learned information through their role in a corporate compliance program may not rely on that information to pursue a whistleblower claim unless the company failed to subsequently disclose the information to the SEC within a reasonable time or proceeded in bad faith. This principle applies equally to those who have learned information as officers charged with administering the compliance program and those who have learned the information through the compliance program in other ways, such as being interviewed by the compliance department. In determining whether a company’s response was in bad faith, the SEC will consider several factors, including whether an attempt was made to prevent the preservation of evidence or the performance of a proper investigation. Rule 21F-4(b).
This provision affords some protection to companies who fear that an internal compliance review may trigger whistleblower complaints. At the same time, it gives companies a strong incentive to disclose potential misconduct to the SEC, even in otherwise marginal matters, as employees involved in compliance efforts have a strong incentive to report misconduct that they do not believe the company itself will report.
Regulation 21F outlines a number of situations in which a whistleblower may not receive an award because the whistleblower has not submitted “original information.” A submission contains original information if it (a) is based on the whistleblower’s own knowledge or analysis, (b) is unknown to the SEC at the time of submission (unless the whistleblower is also the source of the information the SEC already has), (c) does not come exclusively from a public allegation and (d) has been submitted after the effective date of the Act. Rule 21F-4(b).
Notably, a whistleblower is not deemed to have provided original information, and may not receive an award, if the information provided to the government does not constitute “independent” knowledge or analysis. However, “independent knowledge” generally means only that the information has not been obtained from publicly available sources. A whistleblower providing nonpublic second-hand information may still qualify for an award. The information may even be derived from generally available information if it is the product of the whistleblower’s own evaluation and analysis.
Several specific categories of individuals are deemed not to possess independent knowledge and are therefore ineligible to recover as whistleblowers. Attorneys or their agents who have learned the information through privileged attorney-client communications are not eligible unless the privilege has been waived or is otherwise inapplicable. Nor may attorneys bring whistleblower claims on their own behalf based on information learned through representation of a client, privileged or not. Similarly, an independent accountant may not bring a whistleblower claim based on information learned through a task required by securities laws.
Other ineligible individuals
The Act identifies various other categories of individuals who may not recover under the whistleblower provision, and Regulation 21F expands upon that provision, excluding certain other categories of would-be whistleblowers. Those categories of individuals ineligible to recover under the whistleblower provision include:
- Employees of the Department of Justice, appropriate regulatory agencies, self-regulatory agencies, the Public Company Accounting Oversight Board and any other law enforcement organizations
- Parties submitting information pursuant to a government request, either formal or informal
- Parties submitting information pursuant to a legal duty to report
- Officers, members and employees of foreign governments and financial authorities and their associated agencies
- Individuals convicted of crimes in connection with the activity in question
- Individuals who obtained the information through a corporate audit
- Individuals who learned the information from ineligible parties
- Immediate family members and other members of the households of SEC employees
- Individuals who have knowingly and willfully provided false information to the SEC
- Individuals who learned the information through illegal means
One category of individuals is notably absent from this list. Individuals who had a substantial role in the wrongdoing alleged are still eligible to recover as whistleblowers unless convicted of a crime in connection with the wrongdoing. However, any sanctions imposed on the whistleblower or based on conduct in which the whistleblowers were substantially involved will not be factored into the calculation of the amount of the recovery for purposes of determining whether the recovery exceeds $1 million or how much the award will be. While a whistleblower may receive credit for cooperation, Regulation 21F does not require that a whistleblower be given amnesty for his or her role in the wrongdoing. Rules 21F-14, 21F-15.
Procedure for calculation and payment of whistleblower awards
Regulation 21F outlines how the SEC will calculate sanctions recovered for purposes of a potential award:
- A whistleblower may be entitled to an award if the total of all sanctions imposed in a single captioned judicial or administrative proceeding exceeds $1 million, regardless of whether the claim was brought by the SEC or another agency in a “related action” or whether the claim was litigated or settled. Rules 21F-3, 21F-4(c), 21F- 4(d), 21F-4(e).
- As explained in the commentary to Regulation 21F, a whistleblower may not recover if the sanctions imposed in multiple proceedings only exceed $1 million when aggregated.
- In the case of multiple whistleblowers, the SEC will award each whistleblower a fraction of the ten to thirty percent whistleblower award, apportioned based on the SEC’s analysis of the importance of each whistleblower’s assistance. Rule 21F-5.
- A whistleblower who is represented by counsel may remain anonymous, and the SEC will only disclose the identity of a whistleblower when required to do so by law or to other government agencies which are also subject to confidentiality restrictions. Rule 21F-7.
Finally, Regulation 21F sets forth many of the specific procedures that must be followed to make a tip or claim an award. After a whistleblower has applied for an award, the SEC must determine whether an award is merited based on the information and assistance provided, with greater scrutiny applied to cases in which additional information was provided regarding an ongoing investigation. Rule 21F-4(c). The SEC must then determine what award is appropriate, within the ten to thirty percent range required by the statute, basing its determination on the level of assistance provided and the significance of the information. Rules 21F- 5, 21F-6. A whistleblower who is dissatisfied with the SEC’s determination must file an appeal with the SEC within thirty days of the award to avoid waiving those claims. Rules 21F-10, 21F-11. A whistleblower who is still dissatisfied may appeal the allocation to the U.S. Court of Appeals for the D.C. Circuit or the Circuit court that has jurisdiction over the whistleblower, but only if the award was not within the statutory range of ten to thirty percent. Rule 21F-12.
Not only do the new whistleblower provisions portend an aggressive new SEC enforcement effort, the potential reach of that effort is very broad. The classic cases of accounting fraud are, of course, covered. But also covered may be many types of conduct not traditionally viewed as securities laws violations. For example, a company that is accused of knowingly selling a dangerous product to consumers may be charged with failing to disclose to investors that a known defect could give rise to significant liabilities. Perhaps of most concern to companies operating internationally is that the new provisions apply to certain violations of the Foreign Corrupt Practices Act, already a hot area for enforcement and a difficult area to self-police.
Companies that operate in the health care industry or have substantial government contracts are well acquainted with whistleblower incentives, having dealt with them for years under the False Claims Act. Many other companies, however, are looking at the new provisions and wondering what this means for them. In particular, they are examining what they should do to be prepared for the significant new SEC enforcement effort that is coming.
The short answer is that companies should follow the advice compliance experts have been providing for years. Whistleblowers typically raise their concerns internally as an initial matter, going to the authorities only if they believe they have not been taken seriously. A company that has an effective compliance program, and treats whistleblower complaints seriously, will minimize the risk that a whistleblower will take advantage of the new SEC incentives. The goal is not, of course, to conceal from authorities conduct that should be reported, but to encourage employees to raise compliance issues internally so the company can properly investigate the facts, analyze the legal issues, and report the conduct in an accurate and effective manner if there is a reporting obligation.
In assessing the effectiveness of a compliance program, the Federal Sentencing Guidelines for Organizational Offenders remain – some 20 years after their adoption — the best starting point. The Sentencing Guidelines describe seven elements for an effective compliance program: (1) it must include standards and procedures to prevent and detect criminal conduct; (2) management must be aware of the program and exercise oversight over it; (3) it must include taking reasonable efforts to prevent those known to have engaged in illegal or ethically suspect conduct from gaining significant authority; (4) it must include regularly informing employees of compliance standards and procedures, including through training programs; (5) it must require the company to take reasonable steps to make sure the compliance program is followed and audited and that employees can report violations anonymously; (6) it must promote compliance both through incentives for compliance and discipline for a lack of compliance; and (7) it must provide that, after the discovery of criminal conduct, reasonable steps are taken to address it and ensure that it does not happen again.
With respect to whistleblower complaints received internally, the prescription is not complex – encourage and facilitate internal complaints, including anonymous reporting mechanisms; take the complaints seriously and make sure the whistleblower knows they are being taken seriously; document the complaints and the resolutions; investigate any credible allegations of wrongdoing; promptly report the problem to authorities where appropriate; and if the investigation reveals a problem, fix it. Given that public companies should be taking these steps already, perhaps the biggest change under the new program is the incentive to promptly report to the SEC, for prompt reporting – and belief by employees that the company will promptly report — reduces the incentives for insiders involved in compliance efforts to take advantage of the whistleblower program rather than focus on compliance obligations. No compliance program can prevent whistleblowers from by-passing internal reporting mechanisms, but a solid compliance program can go a long way toward minimizing the risk that whistleblowers will do so and reducing any exposure that may arise.