- On May 25, 2011, the SEC adopted rules to implement the Dodd-Frank Act’s whistleblower program.
- Together, the Dodd-Frank Act and the rules requires the SEC to pay whistleblowers awards of between 10 - 30 percent of the aggregate monetary recoveries by the SEC, US Department of Justice, and certain other authorities where one or more whistleblowers voluntarily provide original information regarding a violation of the securities laws, and where the information leads to one or more SEC enforcement actions that result in monetary sanctions exceeding $1 million.
- Dodd-Frank also includes new anti-retaliation provisions that extend existing protections of whistleblowers.
- The whistleblower award program creates incentives for whistleblowers to bypass companies’ internal reporting programs in favor of reporting information directly to the SEC.
- In an attempt to counter balance those incentives, the rules create certain benefits to whistleblowers who report internally before reporting to the SEC.
- Companies should encourage employees to report their concerns about possible securities law violations through internal channels.
- Companies should have a comprehensive action plan “on the shelf” that will allow the company to respond immediately to whistleblower tips, and which will ensure an expeditious resolution of any ensuing investigations.
Introduction and Summary
Over the dissent of two of its five commissioners, the US Securities and Exchange Commission has adopted new whistleblower rules to implement the whistleblower program enacted by Congress in the Dodd-Frank Act.1 The program’s financial awards and anti-retaliation protections for whistleblowers — who under the rules may be anonymous — pose important new challenges for every US public company, foreign private issuer, and SEC-regulated entity. How to meet these challenges and minimize the attendant risks is the focus of this Commentary.
We highlight two main themes for companies grappling with these new rules.
First, companies need to redouble their efforts to encourage employees to report their concerns about possible securities law violations through internal channels. After all, there’s a world of difference between having an opportunity to investigate an alleged problem beforehand and being blindsided by a call from the SEC’s Division of Enforcement, especially as the Division’s view will then already have been colored by the whistleblower’s potentially erroneous perceptions.
Moreover, if serious violations have indeed occurred, a company that has had an opportunity to conduct a thorough investigation and self-report may be in a far better position to avoid or, at least, reduce sanctions against it than it would have been if the Division first learned of the matter from a whistleblower. Unfortunately, however, persuading employees to report internally will now be more difficult in practice, as the new rules provide incentives to whistleblowers to report directly to the SEC.
Second, when a company learns of a potential compliance problem, a speedy response will be more important than ever, as the risk of a whistleblower alerting the SEC before the company has been able to conclude its review will be ever present. That means companies will want to have prepared a detailed action plan that can be “taken off the shelf” and implemented with as little delay as possible whenever potential violations come to light.
In this Commentary, we discuss the much-debated effect of the whistleblower award program on internal compliance programs and describe the new SEC rules in some detail. We conclude by suggesting action items companies may wish to consider in response.
The Internal Reporting Controversy
The potentially adverse impact of the new rules on companies’ internal compliance programs was the greatest source of controversy during the rulemaking process. Many companies feared that, regardless of the strength of their commitment to ferreting out noncompliance, the new rules would push whistleblowers to bypass internal reporting mechanisms in favor of notifying the SEC in the first instance. The corporate community thus urged the Commission to require whistleblowers to report violations internally as a prerequisite for qualifying for an award. The SEC declined to adopt such an internal-reporting requirement. Instead, the SEC attempted to balance that omission by providing additional incentives not contained in the rules as initially proposed to help motivate whistleblowers to use their companies’ internal compliance and reporting systems when appropriate. The two dissenting commissioners believed the rules adopted by the majority failed to strike the right balance and would negatively affect internal compliance programs.2
Specifically, the rules provide that a whistleblower’s voluntary participation in internal compliance is a factor that the SEC, in its discretion, can use to increase the amount of an award, and a whistleblower’s interference with any internal response is a factor that the SEC can use to decrease the amount of an award. Also, whistleblowers may receive an award for reporting qualifying information to an entity’s internal compliance system even if the entity, and not the whistleblower, eventually reports the information to the Commission. In those circumstances, the SEC will attribute to the whistleblower all information provided by the entity to the Commission. Thus, the internally-reporting whistleblower will get credit — and quite possibly a greater award — for any additional information generated by the entity in its investigation.
Moreover, a whistleblower who firstreports internally will be treated as if he or she had reported to the Commission at that earlier internal reporting date, so long as the whistleblower later reports to the Commission within 120 days after the internal report. This means that even if, in the interim, another whistleblower makes a submission to the SEC that causes the staff to investigate the matter, the whistleblower who reported internally will be considered first in line for an award.
By crediting whistleblowers who first report internally with having provided all the information later reported by the company, the rules may motivate some whistleblowers to use internal reporting mechanisms. Companies seeking to encourage the use of internal reporting systems should consider highlighting these features of the new rules to their employees. Doing so could lead whistleblowers to report internally more often than they otherwise might, and could allow the company to dispose of meritless tips without involving the SEC. Of course, whistleblowers — particularly those advised by counsel — may also be concerned that by reporting first internally, and thereby permitting the company to conduct an investigation and self-report violations, they will increase the likelihood the company will get cooperation credit that reduces or avoids monetary sanctions — thereby reducing or eliminating the associated whistleblower award.
How the SEC Whistleblower Program Works
Effective July 21, 2010, the date of its enactment, the Dodd-Frank Act requires the SEC to pay whistleblowers awards of between 10 - 30 percent of the aggregate monetary recoveries by the SEC, US Department of Justice, US bank regulators, US self-regulatory organizations, and US state attorneys general in criminal cases, under the following circumstances:
- Where one or more whistleblowers voluntarily provide information regarding a violation of securities laws
- Where the information is original
- Where the information leads to an SEC enforcement action that results in monetary sanctions exceeding $1,000,0003
Tracking the SEC rules regarding the eligibility requirements, this section identifies the key factors on which the SEC will rely in assessing whether a whistleblower qualifies for an award.
A whistleblower is an individual who provides information to the SEC that relates to a possible violation of federal securities laws or rules that has already occurred, is ongoing, or is about to occur. The individual need not be an employee of the subject entity — in other words, the individual could be, for example, a competitor, an aggrieved spouse, or an unaffiliated academic. Only natural persons, not entities, can be whistleblowers under the rules.
That the information provided to the SEC needs only relate to a “possible” violation of the law could incentivize whistleblowers (who can remain anonymous, as discussed below) to report to the SEC on the basis of sketchy information, knowing that if their tip pans out, they stand to benefit financially.
The “Voluntary” Requirement
A submission of information is deemed not to have been made “voluntarily” if the whistleblower first provides information to the Commission (or another authority listed below) only after a request, inquiry or demand that relates to the subject matter of the submission is directed to the whistleblower or anyone (such as an attorney) representing the whistleblower: (i) by the Commission; (ii) in connection with an investigation, inspection, or examination by the Public Company Accounting Oversight Board or any self-regulatory organization or (iii) in connection with an investigation by Congress, any other authority of the federal government, or a state Attorney General or securities regulatory authority. Notably, a submission still qualifies even if it comes after the SEC or other relevant authority has contacted the company or anyone else other than the whistleblower (or his attorney or other representative). For example, a whistleblower could be triggered into making a submission of relevant company documents or other information by learning that an SEC investigation is underway, but still be eligible for an award.
In addition, submissions are not considered voluntary if the person is required to report the information to the Commission based on a pre-existing legal duty, a contractual duty owed to the Commission or one of the other authorities we listed above, or a duty arising out of a judicial or administrative order. This means, for example, that a would-be whistleblower who has previously entered into an agreement with the Department of Justice to cooperate with SEC and other government investigations as part of a settlement or a deferred or non-prosecution agreement will not be eligible for an award for such cooperation.
The rules and the Adopting Release seem to disqualify a whistleblower who has reported to an internal compliance program if the SEC subsequently contacts the whistleblower before the whistleblower contacts the SEC. In particular, the rules treat information as involuntary if it post-dates any SEC “request, inquiry, or demand” of the whistleblower, unless the whistleblower has previously “voluntarily provided the same information” to one of the listed governmental authorities. Notably absent from that list is the company’s own internal reporting program. This omission seems to put a whistleblower who first reports only internally at risk of losing out on a whistleblower award if the SEC contacts the whistleblower as part of an investigation — perhaps after self-reporting by the company — before the whistleblower contacts the SEC. It seems unlikely the SEC intended this result, as the whistleblower is entitled to count the date on which the whistleblower reports internally as the date on which a submission was made to the SEC for purposes of determining which of two competing whistleblowers is first in line for an award. Perhaps the SEC or its staff will issue an interpretation of the new rules that avoids this conclusion.4
The “Original Information” Requirement
“Original information” means information that is provided to the Commission for the first time after the enactment of Dodd-Frank, and which is: (i) derived from the “independent knowledge” or “independent analysis” of the whistleblower; (ii) not already known to the Commission from any other source, unless the whistleblower is the original source of the information; and (iii) not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation or from the news media, unless the whistleblower is a source of the information. Even if the SEC already knows some information about a matter, a whistleblower can still satisfy the “original information” requirement if she provides new information that “materially adds to the information that the Commission already possesses.”
The “Independent Knowledge” or “Independent Analysis” Requirements
“Independent knowledge” means any factual information in the whistleblower’s possession that is not derived from publicly available sources. Notably, in order to qualify as “independent,” the rules do not require knowledge to be direct or personal to the whistleblower — information picked up in a conversation at the water-cooler could suffice if it otherwise qualifies.
“Independent analysis” means the whistleblower’s own examination and evaluation of information that may be publicly available, but which reveals information that is not generally known or available to the public. The analysis may be done alone or in combination with others. For example, academic analysis of otherwise publicly available data has triggered major SEC investigations, such as in connection with stock option backdating. Similar analyses today could now provide the basis for whistleblower claims.
Exclusions to the Independent Knowledge or Analysis Requirement
The rules exclude certain categories of persons — regardless of whether they provide independent knowledge or analysis — whose knowledge does not, in the SEC’s view, constitute “independent knowledge or analysis of a whistleblower,” because the information or analysis was acquired: (1) on behalf of a third party operating in a sensitive legal, compliance, or governance role; (2) in the performance of an engagement required by the federal securities laws; or (3) by illegal means. Similarly, the rules exclude whistleblowers who obtained their information from a person who would not himself be eligible for providing the same information, unless the whistleblower is providing the SEC with information about possible violations involving the excluded person. This section describes these exclusions.
Legal Services Exclusions. Information does not satisfy the “independent knowledge” or “independent analysis” requirements if it is obtained by either an attorney or non-attorney through a communication that was subject to the attorney-client privilege, unless disclosure of the information would otherwise be permitted by an attorney pursuant to applicable state attorney conduct rules or the SEC’s own “reporting up” rules for attorneys.
Similarly, the rules exclude information obtained in connection with the legal representation of a client on whose behalf the whistleblower (or the whistleblower’s employer or firm) provides services, and the whistleblower seeks to use the information to make a whistleblower submission for his own benefit. Again, an exception to the exclusion applies where the attorney would otherwise be permitted to disclose the information.
The legal services exclusions are intended to promote policy interests embodied in the attorney-client privilege. Dissenting Commissioner Kathleen Casey has argued, however, that the “otherwise permitted” exception to the attorney-client privilege exclusion might often be available to lawyer whistleblowers, because in matters involving possible securities law violations an attorney may often be able to meet the relevant state law standards, for example (depending on the jurisdiction), by claiming a reasonable belief that disclosure was necessary to avoid substantial injury to the financial interests of third parties.5
Accounting Exclusion. The rules also exclude employees “or other person[s] associated with” public accounting firms, where the would-be whistleblower obtained information through the performance of an engagement required of an independent public accountant under the federal securities laws, and the information relates to a violation by the engagement client or the client’s directors, officers or other employees.
The rules, however, do permit accounting personnel to act as qualifying whistleblowers with respect to violations by their own organizations and to be eligible for awards based on monetary sanctions assessed against the audit client that grow out of the ensuing investigation of their own organization. As many potential violations by audit clients will necessarily raise the possibility of misconduct by the auditor for failing to prevent or report those violations, would-be whistleblowers at public accounting firms may find it relatively easy to avoid the force of this exclusion by carefully characterizing their submission as relating to the audit firm, while expecting any resulting investigation to ensnare the audit client as well.
Internal Compliance Exclusions. The rules generally exclude company officers, directors, trustees or partners who either are informed by another individual about allegations of misconduct by the company, or learn the information in connection with the entity’s processes for identifying, reporting and addressing possible violations of applicable law, from qualifying as a whistleblower with “independent knowledge.” For example, an officer who learns about a potential violation only when informed by a compliance officer would not have “independent knowledge” both because the officer learned the information from another person, and because the officer learned the information in connection with the entity’s internal compliance process.
Notably, where an officer, director, trustee, or partner learns of the information in any other manner — i.e., where the information was neither communicated to the individual by another individual, nor obtained from or through a company’s processes for identifying, reporting, and addressing possible violations of law — such individuals can serve as whistleblowers and be eligible for an award.
The rules also exclude (i) employees whose principal duties involve compliance or internal audit responsibilities; (ii) individuals employed by or otherwise associated with a firm retained to perform compliance or internal audit functions for an entity and (iii) individuals employed by or otherwise associated with a firm retained to investigate possible violations of law.
Illegal Means Exclusion. The rules exclude persons who are determined by a domestic court to have obtained the information in violation of federal or state criminal law.6 Note, however, that this exclusion generally will apply only where the individual has been convicted of obtaining the information illegally. A whistleblower who obtains information by illegal means — e.g., by recording a conversation illegally — thus would likely remain eligible for an award if prosecutors have chosen, for resource-allocation reasons or otherwise, not to bring charges related to the obtaining of the information.
Exceptions to the Exclusions. A whistleblower who otherwise falls into either the internal compliance or accounting exclusions described above may nonetheless be eligible for an award if:
- The whistleblower has a reasonable basis to believe that disclosing the information is necessary to prevent conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors
- The whistleblower has a reasonable basis to believe that the entity is engaging in conduct that will impede an investigation of the misconduct7
- At least 120 days have elapsed since the date that the whistleblower either (i) reported the information internally to his supervisor or to the entity’s chief audit, legal, or compliance officer or (ii) received the information, if the person received the information under circumstances indicating that his supervisor or the entity’s chief audit, legal, or compliance officer was already aware of the information.
The breadth of these exceptions will permit some otherwise-ineligible persons to qualify for whistleblower awards. For example, an otherwise-ineligible internal audit employee who questions an accounting decision might be able to claim “a reasonable basis to believe that disclosing the information is necessary to prevent an entity from engaging in conduct that is likely to cause substantial injury to the financial interest . . . of . . . investors.”
Successful Enforcement Action
A whistleblower will be eligible for an award only if his information leads to a successful enforcemenaction, which means that the information (i) “is sufficiently specific, credible, and timely” to commenan examination, open an investigation, reopen a closed investigation, or inquire into conduct as parof a current examination or investigation, and the Commission brought a successful action based inwhole or in part on conduct that was the subject of the whistleblower’s original information or (ii) contributes “significantly” to the success of an enforcement action regarding conduct that was alreathe subject of an investigation or examination. The enforcement action may be either judicial or administrative. Additionally, as discussed, a whistleblower will receive credit for any information thaotherwise eligible and that the whistleblower reported through an internal compliance program, andwhich the company then reported directly to the SEC.
A whistleblower is eligible for an award only if his or her tip leads to one or more SEC enforcement actions arising out of the same nucleus of operative facts that result in aggregate monetary sanctions exceeding $1 million. For purposes of the million-dollar threshold, monetary sanctions include all penalties, disgorgement and prejudgment or pre-settlement interest ordered to be paid, even if not actually paid.
A whistleblower who is convicted of a criminal violation related to the successful enforcement action is ineligible to receive an award. Moreover, in calculating the $1 million threshold, the SEC will exclude the value of any monetary sanctions that the whistleblower is personally ordered to pay. Similarly, the SEC will exclude monetary sanctions that a company is ordered to pay if the company’s liability is based substantially on conduct directed, planned, or initiated by the whistleblower.
Once a whistleblower establishes his eligibility for an award, the SEC has discretion to determine the amount of the payout within a range set by the statute of between 10% to 30% of “what has been collected of the monetary sanctions imposed.” By pegging the award amount to the sanctions actually collected, Dodd-Frank ensures that the SEC will pay whistleblower awards only where money has actually been recovered. For example, if total monetary sanctions equal $1.5 million, but only $750 thousand is recovered, an otherwise eligible whistleblower will qualify for an award because the sanctions exceed $1 million, but that award will be calculated based on the relevant percentage of only $750 thousand.
In determining the relevant figure off of which to base the 10 to 30 percent calculation, monetary sanctions that have “been collected” include sanctions collected not only in SEC enforcement actions, but also in certain related judicial or administrative actions brought by: (i) the Attorney General of the United States; (ii) an appropriate regulatory authority; (iii) a self-regulatory organization or (iv) a state attorney general in a criminal case. In order to qualify, the related action must be based on the same original information that the whistleblower voluntarily provided to the SEC, and that led the SEC to obtain monetary sanctions exceeding $1 million.
The rules identify several factors that the SEC, in its discretion, may use to determine award percentages within the statutory range.8 The following factors may increase a whistleblower’s award percentage:
- The significance of the information provided, including (i) how the information related to the successful enforcement action; and (ii) whether the reliability and completeness of the information provided to the Commission resulted in the conservation of Commission resources.
- The degree of the whistleblower’s assistance, including (i) whether the whistleblower provided ongoing, extensive, and timely cooperation; (ii) the timeliness of the whistleblower’s initial report to either the Commission or internal compliance or reporting system; (iii) the resources conserved as a result of the assistance; (iv) whether the whistleblower appropriately encouraged or authorized others to assist SEC staff; (v) any efforts by the whistleblower to remediate the harm caused by the violations, including assistance in the recovery of the fruits and instrumentalities of the violations and (vi) any unique hardships suffered by the whistleblower as a result of reporting the information or assisting in the enforcement action.
- The law enforcement interest in deterring violations of securities laws, including (i) the degree to which the award will enhance the SEC’s ability to enforce securities laws in the future; (ii) the extent to which the award encourages the submission of tips in the future, even where an entity’s self-report limited the sanctions recovered by the SEC; (iii) whether the subject matter is an SEC priority, whether the violations involved regulated entities or fiduciaries, whether the whistleblower exposed an industry-wide practice, and the nature of the violations themselves; and (iv) the dangers presented by the violations to investors or others, including the amount and type of harm caused or threatened, and the number of actual or potential victims. This means that whistleblowers have an added incentive to come forward with tips related to potential high-priority violations.
- The whistleblower’s participation in internal compliance systems, including (i) whether the whistleblower reported the information through internal reporting programs before or concurrently with the report to the Commission; and (ii) whether the whistleblower assisted any internal investigation into the reported violations. In practice, the success of this factor in incentivizing internal reporting could turn on the whistleblower’s calculation of any potential monetary benefits the company will reap for self-reporting a violation later. In other words, if a whistleblower determines that reporting internally could lead the company to later self-report and receive credits against the amount of sanctions, the incentive intended by this factor could become illusory.
The following factors may decrease a whistleblower’s award percentage:
- The whistleblower’s culpability, including (i) the whistleblower’s role in the violations; (ii) the whistleblower’s education, training, experience, and position of responsibility; (iii) whether the whistleblower acted with scienter; (iv) whether the whistleblower benefitted financially from the violations; (v) whether the whistleblower is a recidivist; (vi) the egregiousness of fraud by the whistleblower and (vii) any knowing interference with the SEC’s investigation of the violations.
- Any unreasonable reporting delay by the whistleblower, including (i) whether the whistleblower was aware of relevant facts but failed to act to prevent or report the violations; (ii) whether the whistleblower was aware of relevant facts but only reported them after learning about an investigation; and (iii) whether there was legitimate reason for any reporting delay. By tying the amount of the award in part to any reporting delay, the rules could push whistleblowers to rush to disclose information, and the SEC (and companies, to the extent that whistleblowers report internally first) could receive large numbers of low quality tips.
- The whistleblower’s interference with internal compliance systems, including (i) whether the whistleblower knowingly interfered with internal compliance systems to prevent or delay detection; (ii) whether the whistleblower made any material false, fictitious, or fraudulent statements or representations that hindered an entity’s efforts to detect, investigate, or remediate the reported securities violations and (iii) whether the whistleblower provided any false writing or document knowing it contained any false, fictitious or fraudulent statements or entries that hindered an entity’s efforts to detect, investigate or remediate the reported securities violations.
Mechanics of the Award Program
The Rules describe a relatively streamlined reporting process. One or more whistleblowers may report information to the SEC through an electronic submission system or through a form, which the SEC adopted along with the rules, for submitting a tip, complaint or referral (Form TCR). The rules expressly permit a joint submission of a single Form TCR by multiple whistleblowers.
Among other background questions, Form TCR asks the whistleblower whether he or she reported the violation to his or her supervisor, an internal compliance office, whistleblower hotline, ombudsman or other available internal reporting mechanism. Submissions must be accompanied by sworn certifications by the whistleblower and his or her counsel, if any, that each has a good faith belief that the information in the report is true, correct, and complete. Although these reporting requirements are styled as mandatory, the rules also permit the SEC to waive them upon a showing of extraordinary circumstances.
Anonymous Reports. Whistleblowers may submit information anonymously. Anonymous whistleblowers must be represented by counsel. Before ultimately collecting an award, however, all whistleblowers will have to reveal their identity to the SEC, and the SEC must verify the whistleblower’s identity.
Before submitting information anonymously, a whistleblower must provide the attorney with a completed Form TCR, which requires the whistleblower’s signature under penalty of perjury. The attorney must then certify that he or she (i) has verified the whistleblower’s identity; (ii) has reviewed the completed and signed Form TCR for completeness and accuracy; (iii) has obtained the whistleblower’s non-waivable consent to provide the SEC with the whistleblower’s original completed and signed Form TCR in the event the SEC requires it based on concerns that the whistleblower knowingly and willfully made false, fictitious, or fraudulent statements, or knowingly used a false writing or document and (iv) consents to be legally obligated to provide the signed Form TCR within seven calendar days of receiving a request from the SEC.
The SEC cannot disclose any information that could reasonably be expected to reveal a whistleblower’s identity, unless and until:
- The whistleblower’s identity is required to be disclosed to a defendant or respondent in connection with a federal court or administrative action that the SEC files or in another public action or proceeding that is filed by an authority to which the SEC provides the information
- The SEC determines that, because it is necessary to accomplish the purposes of the Exchange Act and to protect investors, it must provide identifying information to the DOJ, an appropriate regulatory authority, a self-regulatory organization, a state attorney general in connection with a criminal investigation, an appropriate state regulatory authority or foreign securities and law enforcement authorities
The SEC may also make disclosures in accordance with the Privacy Act of 1974. The whistleblower rules require the SEC to determine what assurances of confidentiality it deems necessary before disclosing information that could reasonably be expected to reveal a whistleblower’s identity to foreign securities or law enforcement authorities. Information that could reasonably reveal the identity of a whistleblower is also expressly exempted from the provisions of the Freedom of Information Act.
Applications for Awards. When an enforcement action satisfies the $1 million threshold, the SEC will electronically publish a Notice of Covered Action. From the date of the Notice of Covered Action, whistleblowers will have 90 days to file a claim for an award by completing the newly adopted Form WB-APP, Application for Award of Original Information Provided Pursuant to § 21F of the Securities Exchange Act of 1934. As noted, whistleblowers who report information anonymously must reveal their identity in order to qualify for an award. Form WB-APP requires the whistleblower to identify the information necessary for the SEC to determine the whistleblower’s eligibility to receive an award.
Enhanced Whistleblower Protections
Alongside the new award system, Dodd-Frank also significantly expands anti-retaliation employment protections and remedies for whistleblowers. Various laws, including the Sarbanes-Oxley Act and the employment laws of many states, prohibit retaliation against whistleblowers. Dodd-Frank adds substantially to those protections.
Dodd-Frank prohibits discharging, demoting, suspending, threatening, harassing or otherwise discriminating in any way against certain whistleblowers —including some whistleblowers who the SEC deems ineligible for an award — because of any lawful act done by the whistleblower in connection with their whistleblowing.
The individuals protected are those who possess a reasonable belief that the information he or she is providing relates to a possible securities law violation that has occurred, is ongoing, or is about to occur, and who provides the information in a manner described in Dodd-Frank (at paragraph (h)(1)(A) of Exchange Act Section 21), which includes:
- Providing information to the Commission’s whistleblower program
- Initiating, testifying in, or assisting in any Commission investigation or judicial or administrative action based on or related to whistleblower program information
- Making disclosures required or protected under the Sarbanes-Oxley Act of 2002 (“SOX”), Exchange Act Section 10A(m) (public company accounting and auditing requirements), or any other law, rule, or regulation subject to the jurisdiction of the Commission9
Anti-retaliation protection applies even if the whistleblower ultimately does not qualify for an award and whether or not the information provided turns out to relate to an actual violation of law.
In addition, the new anti-retaliation provisions:
- Extend the statute of limitations to bring retaliation claims from 90 days to six years
- Exempt whistleblower claims from pre-dispute arbitration agreements
- Allow whistleblowers to bypass the administrative process to bring claims directly in federal court
- Clarify that whistleblower claims, including under SOX, can be tried before a jury
- Provide not only for reinstatement and attorneys’ fees, but also double back-pay
More employees are covered by Dodd-Frank’s protections than are covered by SOX. Dodd-Frank overrules recent case law interpreting SOX by expressly extending whistleblower protections to employees of consolidated subsidiaries of publicly-traded companies (not just employees of the publicly traded parent company), and expands coverage to almost any employee working in the financial services industry, regardless of whether the company is publicly traded.10
Taken together, these changes are likely to result in more whistleblower activity, and more costly retaliation litigation against public company and financial sector employers.
Likely Effects of the Dodd-Frank Whistleblower Award Program
The SEC estimates that it will receive 30 thousand tips, complaints, and referrals annually, with 3 thousand of those submissions being on Forms TCR. The large volume of expected tips, complaints, and referrals may lead the SEC — in “appropriate cases” — to notify companies who were otherwise unaware of the information, and ask those companies to investigate the allegations.11
Despite the high estimated number of whistleblower submissions, the $1 million threshold suggests that there will not be a large number of awards. The SEC estimates there will be only 143 such cases each year, resulting in an anticipated 129 Forms WB-APP requesting an award.12 Of course, we will have to await actual experience with the program to know how frequent awards will be.
In many cases, however, any potential award could well be so sizeable as to be lifestyle-changing for the individual involved, so these new bounties will be enticing both to knowledgeable corporate employees and knowledgeable third parties. Notable awards may result from conduct outside the United States, because violations of the Foreign Corrupt Practices Act are subject to the new rules. Together, SEC and DOJ FCPA actions yielded more than $1.5 billion of judgments and settlements in 2010 alone, with the number of FCPA enforcement actions nearly doubling between 2009 and 2010. It is easy to imagine award-seeking individuals in countries with substantial public corruption issues blowing the whistle on US registrants that are directly or indirectly involved in payments to government officials.
Academics and other researchers may also be inspired by the new award regime to look for patterns of illegal activity involving securities and, if they find them, to report them to the SEC. For example, University of Iowa finance professor Erik Lie published stock options backdating research in 2005 that eventually led to numerous SEC enforcement actions and DOJ prosecutions. Had the SEC award program been in effect in 2005, Lie presumably would have had the option of going to the SEC in addition to publishing his results, thereby potentially setting himself up to reap what might have been tens of millions of dollars in awards.
In addition, a number of lawyers and law firms are running advertisements and otherwise promoting their services representing SEC whistleblowers, which may inspire more, and more effective, whistleblowing.13 Representatives of the Division of Enforcement have said that the quality of tips received has gone up since the passage of Dodd-Frank, and that tips now often include supporting documentation and are submitted by attorneys representing the whistleblower.
Potential Impacts on Public Companies
The SEC whistleblower program is just one element of a perceptible shift in the government’s focus from fostering internal corporate compliance programs to encouraging external whistleblowing. The awards program works in tandem with other recently-introduced programs that may undercut internal reporting programs. About six months before the passage of Dodd-Frank, the SEC unveiled new cooperation guidelines that encourage individual witnesses who may themselves have exposure to report directly to the SEC in order to help the government build cases against others.14 As a result, companies are now more likely to find themselves playing catch-up after hearing about potential wrongdoing from a regulator rather than through internal whistleblowing and reporting systems.
A decade ago, the government’s focus was different. DOJ’s 1999 policy memorandum titled “Federal Prosecution of Corporations” (also known as the “Holder Memo”), the SEC’s 2001 “Seaboard” Guidelines regarding cooperation in SEC investigations, and the 2002 SOX hotline and whistleblower protection provisions were designed to encourage companies to self-police by inviting and investigating employee reports of potential wrongdoing, and taking the initiative to remediate problems.15 Similarly, the Federal Sentencing Guidelines take into account both the extent to which companies maintain effective internal controls and the degree of the company’s cooperation with the government.16
Companies generally will be significantly disadvantaged whenever an employee reports suspected misconduct to the SEC without first availing himself or herself of the company’s internal reporting program. In that situation, the Enforcement Division’s initial perspective on the matter will be shaped by the whistleblower’s perceptions, which in many cases may be based on misunderstandings, incomplete information or distorted perspectives. An investigation sufficient to persuade the Division otherwise may be quite costly to the company. And, if there has been misconduct, the company may lose potential “credit” for self-reporting or cooperating with an investigation — meaning that sanctions may be more likely or more severe.
Companies may also lose the opportunity to fully investigate matters before having to report or answer to the SEC or may be forced to conduct investigations on a more compressed, and therefore more expensive, timetable. The 120-day grace period pressures companies to determine whether they have a reportable incident within a timeframe that may be sufficient in some situations but not in all. Complicating the decision matrix of when and whether to report to the SEC will be the specter of a whistleblower blowing the whistle before the 120-day period expires. And once that period expires, even compliance personnel can became award-seeking whistleblowers. Thus, even when potential misconduct is reported first internally, the company will often be forced to assume it may be in a race with unknown potential whistleblowers.
To counter the potentially negative consequences of the new incentives for employees to bypass internal corporate whistleblower processes and first contact the SEC directly, companies will need to think creatively about how best to persuade employees to surface their concerns internally. Companies will need to reassure employees that avoiding illegal business conduct is a priority for the company and that they will be protected, if not rewarded, if they raise legitimate compliance concerns in good faith. Companies should also consider highlighting for employees the benefits to whistleblowers of internal reporting. That effort could emphasize that internal reporting can have benefits even for whistleblowers who end up later reporting to the SEC.
Companies also will need to review and improve compliance and investigatory functions to ensure that whenever anyone raises a credible issue regarding possible non-compliance with the securities laws, including possible overseas FCPA violations, the company has processes, procedures and personnel — internal and external, as appropriate — to “fast track” its response so as to minimize the likelihood of receiving an unwanted call from the Division of Enforcement before the company has its proverbial arms around the issue.
The decision of whether and when to report an issue to the SEC will remain as fraught as ever, but now there will be additional pressure to fashion a rapid response. First, at any moment, an internal whistleblower may without warning or notice become an SEC whistleblower. As discussed above, whistleblowers who choose to report internally may delay a report to the SEC for up to 120 days and still retain eligibility for an award, with the SEC treating the whistleblower as having reported to the SEC on the date of the whistleblower’s original internal report.
Second, also as discussed above, delays in reporting to the SEC could expand the number of award-eligible whistleblowers. Personnel in compliance functions who, under the rules, would otherwise be ineligible for a whistleblower award can themselves report the issue to the Commission and qualify for an award if: (i) the whistleblower reasonably believes that disclosure of the information is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors; (ii) the company does not provide the information to the Commission within 120 days of the whistleblower’s internal report or the date the whistleblower learned of the information if circumstances indicate that certain management and compliance personnel already knew the information or (iii) the whistleblower reasonably believes that the entity is engaging in conduct that will impede an investigation of the misconduct.
To stay ahead and out of trouble, companies will want to consider how best to adapt their internal controls, whistleblower programs, and crisis response plans. Among the possible new action items are the following:
- Have a comprehensive action plan “on the shelf” that will allow the company to respond immediately to whistleblower tips, and which will ensure an expeditious resolution of any ensuing investigations.
- Review and update corporate compliance policies, including provisions for anonymous reporting, hotlines and whistleblower policies.
- Develop programs designed to persuade employees to report internally. Highlight the potential benefits to whistleblowers who report internally before going to the SEC under the rules implementing the whistleblower program.
- Offer periodic training on the internal reporting policy and procedures so that employees know the process and appreciate the roles of the people involved.
- Consider offering employees incentives for appropriate internal reporting of potential violations and cooperation in efforts to investigate potential violations.
- Consider a program of periodic employee certifications to encourage internal reporting of legitimate concerns about noncompliance.
- Evaluate employee confidentiality agreements and other corporate policies that limit employees’ dissemination of information outside the company, to ensure that no policy purports to prohibit protected whistleblowing.17
As was true before Dodd-Frank created the whistleblower award program, companies will want to continue to:
- Cultivate a corporate culture that emphasizes the importance of legal and regulatory compliance and ethical conduct.
- Ensure that the corporate compliance program has appropriate oversight at the board level.
- Conduct exit interviews of relevant employees leaving the company, asking them if they suspect or know of any compliance violations. Include both specific and generalized questions intended to elicit detailed answers.
- Ensure that all employees understand that retaliation for reporting legitimate concerns of potential misconduct through the appropriate channels is illegal and will not be tolerated.
- Consult with counsel experienced in investigations, compliance, and enforcement to develop appropriate contingency plans.
- Ensure that internal whistleblower allegations made anonymously are taken seriously.
- In consultation with counsel, carefully communicate with internal whistleblowers to give them confidence the company is committed to getting to the bottom of the issues they have raised.
- Appropriately document the company’s response to each complaint.
- Assure that appropriate corrective action is taken where wrongdoing is found.
The prospect of a whistleblower award will surely increase the number of whistleblower tips. The company’s goal should be to have its employees funnel as many of those tips as possible to internal reporting mechanisms. In order to do so, the company will have to convince employees that it takes all internal reports seriously, will appropriately investigate all tips, and will take appropriate steps in response to any violations of law. In addition to cultivating a culture where employees trust the internal compliance program, the company should also work with counsel to establish a comprehensive action plan for rapid response to whistleblower tips. The rules create a potential race with whistleblowers, and the company should strive to reach the finish line first.