On May 25, 2011, the Securities and Exchange Commission (SEC or Commission), by a 3-2 vote, approved final rules for implementing the SEC whistleblower program required by the Dodd-Frank Wall Street Reform and Consumer Protection Act. The final rules, set forth under Regulation 21F of the Exchange Act of 1934, substantially track the proposed rules issued by the SEC in November of 2010,[1] but there are a number of notable changes. The final rules, which are effective 60 days after publication in the Federal Register and apply to violations of the securities laws by publicly-traded companies, broadly address the following topics:

  • In order to obtain an award, a whistleblower must voluntarily provide original information to the SEC regarding the alleged misconduct, and the sanctions levied against the culpable party must exceed $1 million in an enforcement proceeding brought by the SEC in either federal court or an administrative action.
  • The whistleblower can recover 10 to 30 percent of the aggregate award of the sanctions collected in that SEC action and in any “related action” brought by certain governmental authorities on the basis of that information.
  • Employers are prohibited from retaliating against employees who report violations, and victims of retaliation are granted an independent cause of action.
  • Although the whistleblower need not report through a company’s internal compliance procedures in order to obtain an award, the final rules are intended to increase incentives for the whistleblower to report internally.  

After an executive summary, this alert first outlines the principal provisions of the whistleblower rules and notes certain changes between the proposed and final rules, and then discusses how the rules affect companies’ best practices for internal compliance efforts. An appendix summarizing key provisions of the final rules follows the text of the alert.

Executive Summary

  • Whistleblower rules encourage persons with knowledge of securities law violations by publicly traded companies to report such violations.
  • In order to obtain an award, a whistleblower must voluntarily provide “original information” to the SEC regarding a company’s violation of securities laws, and the sanctions levied against the culpable party must exceed $1 million in an enforcement proceeding brought by the SEC.
    • See pages 3-4 for more information
  • Whistleblowers can receive 10-30% of the SEC-levied sanctions.
    • See pages 1, 3-5 for more information
  • Potential whistleblowers do not need to use the company’s internal compliance procedures or report misconduct to the company to receive an award.
  • Despite no mandate to report internally first, whistleblower rules offer financial incentives to whistleblowers to first report misconduct to the company.
    • See pages 3-4 for more information
  • Under certain circumstances, persons who learn of the misconduct through internal compliance efforts may qualify as whistleblowers.
  • Attorneys, accountants, and certain other individuals generally are ineligible to recover unless they qualify for an exception.
    • See pages 3-4 for more information
  • Individuals who participated in the misconduct can be whistleblowers unless convicted of a crime in connection with the wrongdoing, but their ultimate award may be reduced.
    • See page 4 for more information
  • For information regarding company Best Practices and our compliance recommendations, see pages 5-6.

Interaction with internal reporting mechanisms

One of the most hotly-debated issues regarding the whistleblower rules is the relationship between the whistleblower program and companies’ internal compliance efforts. The SEC expressed sensitivity to concerns that the whistleblower incentives could undercut corporate compliance efforts by making it more attractive for whistleblowers to report misconduct to outside authorities rather than to raise issues internally. The Commission attempted to strike a balance between supporting internal compliance efforts and encouraging external whistleblowing. However, the SEC rejected requests that it require whistleblowers to report misconduct internally in order to obtain a reward.

The SEC attempted to encourage participation in internal compliance programs before filing whistleblower complaints through three separate mechanisms:

  • First, the rules dictate that the extent to which a whistleblower reported the alleged violation internally and participated in any resulting inquiry is one factor that may increase the amount of a whistleblower award. Rule 21F-6(a)(4). Conversely, unreasonable delay in reporting and interference with internal compliance systems are identified as possible bases for decreasing the whistleblower’s reward (although mere failure to report is not identified as interference with the compliance system). Rule 21F-6(b)(3).
  • Second, the rules provide that, if a potential whistleblower does first submit a complaint to the company’s compliance department, the whistleblower still has a 120-day grace period to provide the same information to the SEC and still qualify as having submitted the information on the date it was initially submitted to compliance. Rule 21F-4(b)(7). Thus, a whistleblower does not need to worry that another source who reports the same violation to the commission in the interim will deprive the whistleblower of his or her status as the original source of the information and thus eligibility to receive an award. However, the SEC statements indicate that when there are multiple whistleblowers, the award may be split among them and do not explain how this will be done, thus leaving some ambiguity as to the risks from not being the first to actually contact the SEC. Initially, the SEC had proposed a 90 day grace period but, in response to public comment, the SEC expanded the period to 120 days, primarily to give the company more time to investigate the violations and to reduce the pressure on whistleblowers to report quickly to the SEC.
  • Third, the rules provide that if a whistleblower reports internally and the company subsequently self-reports, the whistleblower may recover based on that information. Theoretically, that could lead to an even greater award for the whistleblower because the company may become aware of and report more information about the violations than the whistleblower alone would have done. Rule 21F-4(c)(3)  

These provisions appear to remove many disincentives to reporting internally before filing a whistleblower complaint, and they provide some affirmative incentives to do so. However, the lack of an absolute requirement to report internally means that companies are still at risk that employees will circumvent compliance programs and take their complaints directly to the SEC.

Persons who learn of misconduct through compliance efforts

A similar issue faced by the SEC in drafting the final rules involved the disqualification of those who learned the relevant information directly through participation in a corporate compliance program. The SEC desired to prevent those most responsible for ensuring proper corporate conduct from taking advantage of their positions and becoming whistleblowers themselves. In doing so, however, it sought to ensure that it did not unreasonably deter those with the most valuable information from coming forward.

In an attempt to strike this balance, the rules exclude three groups of people with compliance responsibilities from recovering under the whistleblower provision. Rule 21F-4(b)(4)(iii). Those groups include:

  • Officers and directors of the company who learned the information from another individual familiar with the allegations of misconduct or through internal compliance functions,
  • Employees whose principal duties involve compliance or internal audits, and
  • Outside firms retained to perform compliance or certain accounting duties.  

However, the final rules include exceptions through which those individuals may nonetheless qualify as whistleblowers and recover a reward. Rule 21F-4(b) (4)(v). Those circumstances include those in which:

  • They have reason to believe that disclosure is necessary to prevent further injury to the company,
  • They have a reasonable basis to believe that actions are being taken to impede an investigation, or
  • 120 days have passed since the misconduct was reported internally.  

This provision affords some protection to companies who fear that an internal compliance review may itself trigger whistleblower complaints. At the same time, it gives companies a strong incentive to disclose potential misconduct to the SEC, even in otherwise marginal matters, as employees involved in compliance efforts may have a considerable incentive to report misconduct that they do not believe the company itself will report.

Original information

To receive an award, a whistleblower must submit “original information,” as defined by Regulation 21-F. A whistleblower’s failure to submit such information necessarily disqualifies her from receiving an award. A submission contains original information if it (a) is derived from the whistleblower’s own independent knowledge or analysis, (b) is unknown to the SEC at the time of submission (unless the whistleblower is also the source of the information the SEC already has), (c) does not come exclusively from a public allegation or from the news media and (d) has been submitted after July 21, 2010. Rule 21F-4(b)(1).

Notably, a whistleblower does not provide original information, and may not receive an award, if the information provided to the government is not based on the whistleblower’s “independent knowledge” or “independent analysis.” “Independent knowledge” is information that has not been obtained from publicly available sources, such as through communications and discussions with others. Thus, a whistleblower who provides non-public, second-hand information may still qualify for an award by meeting this definition. “Independent analysis” means information which is the product of the whistleblower’s own evaluation and analysis, even if it is derived from public sources. As a result, a whistleblower need not even have a relationship with the company if the whistleblower discovers misconduct by, for example, analyzing public securities filings.

Attorney conduct, attorney-client privilege and eligibility to recover

The rules provide specific eligibility requirements for persons possessing privileged information. Any person who learns of the possible violation through privileged attorney-client communications or who brings whistleblower claims for her own benefit based on information learned through representation of a client (unless the disclosure is permitted under SEC-created exceptions or state attorney conduct rules) cannot recover as a whistleblower because such information is not within the definition of “independent information” or “independent analysis.” Rule 21F-4(b)(4). This is a slight departure from the proposed rules, under which only attorneys were barred from recovering based on privileged information.

Other ineligible individuals

In addition to attorneys, the final rules identify other individuals who are ineligible to recover as whistleblowers due to their relationship (usually professional) with the source of the information. Those categories of individuals ineligible to recover include:

  • Officers, members and employees of the SEC, Department of Justice, appropriate regulatory agencies, self-regulatory agencies, the Public Company Accounting Oversight Board and any other law enforcement organizations
  • Officers, members and employees of foreign governments and financial authorities and their associated subdivisions
  • Individuals convicted of crimes in connection with the activity in question
  • Individuals who obtained the information through a corporate audit
  • Immediate family members and other household members of SEC employees
  • Individuals who learned the information from ineligible parties
  • Individuals who knowingly and willfully provided false information in a whistleblower submission with the intent to mislead the SEC or a related regulatory authority
  • Parties providing information pursuant to formal or informal government requests
  • Parties submitting information pursuant to a legal duty to report or a contractual duty to report to the SEC
  • Employees whose duties involve compliance or internal audit functions (excluding attorneys, whose obligations are discussed above)
  • Employees retained to conduct investigations into possible violations of law
  • Employees of public accounting firms under an engagement required under the federal securities laws
  • Individuals who learned the information by a manner that is determined by a United States federal or state court to be criminal

One category of individuals is notably absent from this list. Individuals who had a substantial role in the wrongdoing alleged are still eligible to recover as whistleblowers, unless convicted of a crime in connection with the wrongdoing. However, any sanctions imposed on the whistleblower or on the company based substantially on the whistleblower’s misconduct will not be counted when determining either whether the SEC recovery exceeds $1 million or calculating the amount upon which the award will be calculated. Moreover, any misconduct will be taken into consideration in the SEC’s determination of the appropriate amount of the award. The whistleblower is not required to be given amnesty from prosecution for his or her conduct, although the SEC may take the whistleblower’s cooperation into account in making any enforcement actions or decisions. Rules 21F-15, 21F-16.

Procedure for calculation and payment of awards

The whistleblower rules outline how the SEC will calculate sanctions recovered for purposes of determining a potential award:

  • In a change from the proposed rules, a whistleblower may recover if the sanctions imposed in multiple SEC proceedings (but not related actions brought by other regulatory authorities) based on the same facts exceed $1 million when aggregated. Rule 21F-4(d).
  • In that circumstance, an eligible whistleblower is entitled to an award of 10 to 30 percent of the total of all sanctions imposed in both the SEC action and in any “related action” (other than the CFTC under its whistleblower program), whether the claim was litigated to conclusion or settled. Rules 21F-3, 21F-4(c), 21F-4(d), 21F-4(e).
  • In the case of multiple whistleblowers, the SEC will award each whistleblower a fraction of the ten to thirty percent whistleblower award, apportioned based on the SEC’s analysis of the importance of each whistleblower’s assistance, among other factors. Rule 21F-5(c).

Moreover, as discussed above, the SEC, in a change from the proposed rules, offered financial incentives to whistleblowers for self-reporting both through an increase in the award allocation and through credit for additional information provided by the company.

Best Practices

Not only do the new whistleblower provisions portend an aggressive new SEC enforcement effort, the potential reach of that effort is very broad. In addition to those matters normally thought to be securities law violations, the whistleblower incentives may lead to complaints in areas that do not always come to mind as securities violations. For example, a company that is accused of knowingly selling a dangerous product to consumers may be charged with failing to disclose to investors that a known defect could give rise to significant liabilities. Perhaps of most concern to companies operating internationally is that the new provisions apply to violations by issuers of the books and records or bribery provisions of the Foreign Corrupt Practices Act, already a hot area for enforcement and a difficult area to self-police.

Companies that operate in the health care industry or have substantial government contracts are well acquainted with whistleblower incentives, having dealt with them for years under the False Claims Act, 31 U.S.C. § 3729 et seq. Many other companies, however, are looking at the new provisions and wondering what this means for them. In particular, they are examining what they should do to prepare for the significant new SEC enforcement effort that is coming.

The following best practices are intended to encourage employees to raise compliance issues internally so the company can properly investigate the facts, analyze the legal issues, and report the conduct in an accurate and effective manner where appropriate.

  • Establish an effective compliance program that treats whistleblower complaints seriously. Whistleblowers typically raise their concerns internally as an initial matter, going to the authorities only if they believe they have not been taken seriously. Companies must take complaints seriously and make sure the whistleblowers know they are being taken seriously.
  • Establish and adequately publicize policies banning retaliation. Companies should provide assurances through a strict, visible antiretaliation policy that the company does not retaliate against employees for raising concerns and make clear there is no double-standard for executives or officers.
  • Assess the effectiveness of the compliance program. In assessing the effectiveness of a compliance program, the Federal Sentencing Guidelines for Organizational Offenders remain – some 20 years after their adoption – the best starting point. The Sentencing Guidelines describe seven elements for an effective compliance program: (1) it must include standards and procedures to prevent and detect criminal conduct; (2) management must be aware of the program and exercise oversight over it; (3) it must include taking reasonable efforts to prevent those known to have engaged in illegal or ethically suspect conduct from gaining significant authority; (4) it must include regularly informing employees of compliance standards and procedures, including through training programs; (5) it must require the company to take reasonable steps to make sure the compliance program is followed and audited and that employees can report violations anonymously; (6) it must promote compliance both through incentives for compliance and discipline for a lack of compliance; and (7) it must provide that, after the discovery of criminal conduct, reasonable steps are taken to address it and ensure that it does not happen again.
  • Encourage and facilitate internal complaints, including anonymous reporting mechanisms. Companies should document the complaints and the resolutions, investigate any credible allegations of wrongdoing, promptly report the problem to authorities where appropriate, and if the investigation reveals a problem, fix it. This should include an easy, anonymous reporting system.
  • Build a culture of compliance. Building a culture of compliance is important to help ensure employees are invested in the company’s compliance system and working within it. Companies should create such a culture through the appropriate “tone at the top,” supplemented by newsletters, employee communications, and announcements concerning disciplinary actions where appropriate.
  • Review and update the company’s compliance materials. Companies should review their code of conduct and/or code of ethics to make sure they emphasize the importance of internal reporting. They might consider adding revised examples addressing some of the rules discussed above and what employees should do when they are faced with potential misconduct.
  • Consider whether to self-disclose and be prepared to do so promptly. Given that public companies should be taking these steps already, perhaps the biggest change under the new program is the impact on the analysis when a company considers whether and when to self-report violations. The SEC has sought to promote self-reporting and cooperation with its investigations through a cooperation initiative announced in 2010, which formalized and elaborated upon SEC policy first enunciated in the 2001 Seaboard Report.[2] However, in order to obtain credit for self-reporting, whether in the form of a reduced financial penalty or a disposition that is more favorable in other respects,[3] a company is better served if it reports the violation to the government before the whistleblower does. Given the heightened risk of whistleblower reporting to the SEC under the new rules, the balance may tip in more cases to self-reporting, especially as the 120-day mark from the initial internal report approaches. Prompt reporting – and belief by employees that the company will promptly report — reduces the incentives for insiders involved in compliance efforts to take advantage of the whistleblower program rather than focus on compliance obligations. However, companies will still need to consider the risks of prompt self-reporting, including the potential opening of a government investigation that might not otherwise occur and the danger of class action and derivative lawsuits if the matter becomes public.
  • Thoroughly investigate any allegations of misconduct with an eye toward selfdisclosure. Promptly initiating an inquiry when a tip is first received and quickly initiating a full internal investigation when appropriate will help provide companies necessary knowledge in time to make an informed decision about self-reporting.

Key Elements of the SEC’s Whistleblower Rules

What must a whistleblower establish to obtain an award?

  • Must provide information to the SEC voluntarily
  • Information must be original
  • Information must result in sanctions by the SEC in federal court or an administrative action
  • The sanctions against the culpable party must exceed $1 million in the aggregate

What is original information?

  • Information which is: (1) not derived from publicly available sources or (2) a result of the whistleblower’s own analysis of information, whether public or not
  • Cannot be known by the SEC at the time of submission
  • Cannot be exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation or from the news media
  • Must be provided after July 21, 2010

Who is eligible to recover an award?

  • Only individuals (not legal entities) can recover
  • Individuals need not have a connection (e.g. employee, consultant, director) to the culpable actor or company to recover an award
  • The individual cannot fall within any of the exceptions noted below  

Who is ineligible to recover an award?

  • Anyone convicted of a criminal violation related to the SEC action or related action • Anyone who reports information which is (1) subject to the attorney-client privilege or (2) obtained in connection with the legal representation of another entity, unless the information qualifies for certain exemptions under SEC or state attorney conduct rules
  • Parties providing information pursuant to formal or informal government requests or pursuant to a legal duty to report or a contractual duty to report to the SEC
  • Members, officers or employees of the SEC, DOJ, certain regulatory agencies, selfregulatory organizations, PCAOB, or any law enforcement organization
  • Members, officers or employees of foreign governments or any subdivisions thereof or any foreign financial regulatory authority
  • Anyone obtaining the information through an audit of a company’s financial statements if making the submission would violate Section 10A of the Exchange Act
  • Any spouse, parent, child or sibling of a member of the SEC, or a person who resides in the same household of a member of the SEC
  • Anyone who obtains the information with an intent to evade the rules or knowingly and willingly makes any false or fraudulent statement to the SEC or any other authority with respect to a related action
  • Anyone reporting information obtained from a person who cannot report such information, unless the information is not excluded from that person’s use or the information is about that person
  • Anyone falling within any of the following five categories, subject to the exceptions noted below: (1) Officers, directors, trustees or partners who are informed of the misconduct by another person or through internal compliance procedures, (2) employees performing compliance or internal audit functions, (3) employees retained to conduct an investigation into violations of law, (4) employees of auditing firms who obtained the information from an audit required by federal securities laws or (5) anyone who obtains information that is determined by a US court to violate applicable federal or state law; individuals in these five categories may recover if any of the following three exemptions apply:
    • There is a reasonable basis to believe that disclosure is appropriate to prevent conduct that is likely to cause substantial injury to the financial interest of the company or investors
    • There is a reasonable basis to believe that the company is engaging in misconduct that will impede the investigation
    • At least 120 days have elapsed since providing the information to the relevant persons or organizations internally and such persons or organizations were already aware of the information  

How much can the whistleblower recover?

  • Recovery is 10 to 30 percent of the amount of the sanctions imposed by the SEC
  • Whistleblower can also recover 10 to 30 percent of the amount in any other judicial or administrative action brought by certain government or non-government entities or actors on the basis of information provided to the SEC by the whistleblower
  • Whistleblowers do not have a private right of action
  • Size of the award is in the discretion of the SEC and whistleblowers may not appeal a judgment that is within the proscribed range
  • Factors that may increase the award include reporting internally first, the significance of information provided by the whistleblower, the assistance provided by the whistleblower and the law enforcement interest
  • Factors that may decrease the award include culpability of the whistleblower, unreasonable reporting delays and interference with internal compliance and reporting systems  

Can a culpable actor recover from their bad actions?

  • Yes, a person who engages in culpable conduct may receive an award, but the award may be reduced based on the conduct of such person and any sanctions attributable to the conduct of the whistleblower will not be included in the $1 million threshold or form the basis for the whistleblower’s recovery. However, if the culpable actor is convicted of a crime for such conduct, they are barred from recovering.

Is amnesty available for those who are responsible for culpable conduct and report?

  • No, but the SEC will consider the person’s cooperation in its decision regarding bringing any actions against that person  

What happens when multiple persons report misconduct?

  • Depending on the timing, quality of information, how the information was obtained and whether the whistleblower used internal processes, the SEC may split the awards (not to exceed 10 to 30 percent of the sanctions) or allocate all of the award to one person