On May 25, 2011, the Securities and Exchange Commission (the “SEC” or the “Commission”) adopted final rules (the “Final Rules”) to implement Section 21F of the Securities Exchange Act of 1934, as amended (the “Exchange Act”) – “Securities Whistleblower Incentives and Protection.” The Final Rules create a program designed to reward individuals who voluntarily provide the SEC with original information that leads to successful enforcement actions by the SEC resulting in monetary sanctions in excess of an aggregate amount of $1,000,000.1 The Final Rules also establish the SEC’s Office of the Whistleblower.
Following an active comment period, during which the SEC received more than 1,000 comments and held more than 50 meetings with concerned parties, the SEC made a number of revisions to the program set forth in its proposed rules published on November 3, 2010 (the “Proposed Rules”).2 The Final Rules will be effective 60 days from either the date that they are published in the Federal Register or the date that they are provided to Congress, whichever is later.
THE FINAL RULES
The Final Rules fulfill the mandate set forth by Congress in the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”)3 by establishing procedures under which potential informants (“whistleblowers”) can provide critical information to the SEC regarding violations of the federal securities laws and thereby qualify for significant monetary awards. The Final Rules are intended to encourage and reward whistleblowers who expose violations and provide information that helps the SEC to bring successful enforcement actions. However, they raise some significant challenges that are likely to increase the cost of business for many companies, including the need to consider establishing or enhancing internal processes for investigating and responding to possible securities law violations, and the risk of retaliatory claims.
Under the Final Rules, a whistleblower is defined as a person who, alone or with others, provides information to the SEC pursuant to the procedures set forth in the Final Rules “and the information relates to a possible violation of the federal securities laws (including any rules or regulations thereunder) that has occurred, is ongoing, or is about to occur.”4 In order to earn an award, a whistleblower must voluntarily provide the SEC with original information that leads to the successful enforcement by the SEC of a federal court or administrative action in which the SEC obtains monetary sanctions of more than $1,000,000 in the aggregate.5 The SEC will also pay awards based on amounts collected in certain “related actions.”6 According to the SEC, the requirement that the information relate to a “possible violation” requires the information to indicate a “facially plausible” relationship to some violation of the securities laws, but falls short of requiring a “probable” or “likely” violation.7 The SEC found it unnecessary to adopt a materiality threshold, concluding that the use of the term “possible violation” sufficiently addressed the risk of frivolous submissions.8
Information will be considered voluntarily provided if the whistleblower submits it before a request, inquiry, or demand that relates to the subject matter is directed to the whistleblower (or anyone representing the whistleblower) by: (i) the SEC; (ii) in connection with an investigation, inspection, or examination by the Public Company Accounting Oversight Board, or any selfregulatory organization; or (iii) in connection with an investigation by Congress, any other authority of the federal government, or a state Attorney General or securities regulatory authority.9 A whistleblower will be precluded from making a voluntary submission when the whistleblower has already received a request, inquiry, or demand from one of the sources enumerated above, even if a response was not compelled, for example by subpoena or other applicable law;10 however, a whistleblower will be considered to have made a voluntary submission even after being contacted for information in the course of an internal investigation.11 Submissions will not be considered voluntary if the whistleblower is under a pre-existing legal duty, a contractual duty to report the information to the SEC or to another authority designated in Rule 21F-4(a)(1), or a duty that arises under a judicial or administrative order;12 however, whistleblowers will not be precluded from an award if they are under a contractual duty to report information to the SEC because of an agreement with a third party, such as an employer.13
The information provided by the whistleblower must be original, i.e., it must be based on the whistleblower’s independent knowledge or analysis, which is not already known to the SEC and is not derived exclusively from publicly available sources.14 “Independent analysis” can be based on the whistleblower’s evaluation of publicly available sources, although this would require the whistleblower to add to the public information some additional evaluation, assessment, or insight.15 Information will be deemed to have led to successful enforcement when it is “sufficiently specific, credible, and timely” to lead to a new examination, or a new or reopened investigation or inquiry, that results in a successful judicial or administrative action brought by the SEC, based in whole or in part on the conduct identified in the original information.16 However, if a matter is already under investigation, then a whistleblower may be eligible for an award if his or her information “significantly contributes” to a successful enforcement.17 The SEC will generally not consider information to have significantly contributed to the success of an action if: (i) the SEC or some other law enforcement agency had to issue a subpoena or other document request, inquiry, or demand to an entity or an individual other than the whistleblower; (ii) there is evidence that the whistleblower was aware of the request, inquiry, or demand; and (iii) the whistleblower withheld or delayed providing responsive documents prior to making the relevant submission.18
Determining the Amount of an Award
If all of the Final Rules’ conditions are met, the SEC will pay an award of between 10 and 30 percent of the total monetary sanctions collected in a successful SEC action and related actions. The exact percentage of the award will be determined in the SEC’s discretion. Where multiple whistleblowers are entitled to an award, the SEC will independently determine the appropriate allocation for each whistleblower, but total award payments, in the aggregate, will not exceed between 10 and 30 percent of the monetary sanctions collected.19 The percentage awarded in connection with an SEC action may differ from the percentage awarded in related actions.20 Although the SEC decides whether, to whom, and in what amount to make awards, its determination of whether or to whom may be appealed to the U.S. Court of Appeals. Where the SEC follows the statutory mandate and awards between 10 and 30 percent of the monetary sanctions collected in the action, however, its determination regarding the amount of an award, or its allocation between multiple whistleblowers, is not appealable.21
The Final Rules offer revised criteria for determining the amount of an award.22 In determining whether to increase a whistleblower’s award, the SEC will consider: (1) significance of the information provided by the whistleblower; (2) assistance provided by the whistleblower; (3) law enforcement interest in making a whistleblower award; and (4) participation by the whistleblower in internal compliance systems. The first three criteria are taken from Dodd-Frank and the Proposed Rules, while the fourth criterion is new. In deciding whether to decrease an award, the SEC will consider: (1) culpability of the whistleblower; (2) unreasonable reporting delay by the whistleblower; and (3) interference with internal compliance and reporting systems by the whistleblower. The Final Rules also provide certain optional considerations that may be taken into account when considering the required criteria.23 According to the SEC, “[s]ince every enforcement matter is unique,” the criteria in the Final Rules are intended to provide “general principles without mandating a particular result.”24 Thus, “no attempt has been made to list the factors in order of importance, weigh the relative importance of each factor, or suggest how much any factor should increase or decrease the award.”25
Under the Final Rules, certain persons are not eligible for awards. Along with persons with a pre-existing legal duty, a contractual duty to report the information, or a duty that arises as a result of a judicial or administrative order, the SEC has excluded certain persons who are deemed not to have an independent knowledge or to have made an independent analysis of the information, because they acquired the information: (1) on behalf of a third party operating in a sensitive legal, compliance, or governance role; (2) in the performance of an engagement required by the federal securities laws; or (3) by illegal means.26 Among the excluded persons are attorneys (including in-house attorneys) and nonattorneys who attempt to use information obtained from confidential attorney-client communications to make whistleblower claims for themselves, unless disclosure of the information is permitted under SEC Rule 205.3 (Standards of Professional Conduct for Attorneys Appearing and Practicing Before the Commission in the Representation of an Issuer) or applicable state bar rules such as waiver of privilege or a crime-fraud exception.27 This responds to concerns that non-attorneys who learn privileged information through confidential attorney-client communications would be able to report the information to the SEC. If an attorney would be precluded from receiving an award based on the information, a non-attorney who learns the information through a confidential attorney-client communication will be similarly disqualified.28
Also generally excluded are independent public accountants, as well as employees of or other persons associated with public accounting firms, who obtain information through an audit or other engagement required under the federal securities laws, when the information relates to a violation by the engagement client or the client’s directors, officers, or other employees.29 The Final Rules also exclude certain persons involved in internal compliance programs, whose use of information could undermine the proper operation of those programs.30 However, rather than applying this principle broadly to include any supervisor, or any employee involved in control functions or in processes related to required CEO and CFO certifications, the Final Rules identify three specific categories of excluded “core” personnel: (1) officers, directors, trustees, or partners of an entity, when they learn the information from another person or through their responsibilities relating to “the entity’s processes for identifying, reporting, and addressing potential non-compliance with law”31; (2) employees whose principal duties involve compliance or internal audit responsibilities and employees of outside firms who are retained to perform compliance or internal audit work for an entity; and (3) employees or other persons associated with firms that are retained to conduct an internal investigation into possible violations of law in circumstances where the information is not already excluded.32
The Final Rules also provide several exceptions to the exclusions relating to officers, directors, auditors, or similar responsible personnel.33 One exception is when the designated person has a reasonable basis to believe that disclosure of the information to the SEC is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial harm to the entity or investors.34 Another is when the designated person has a reasonable basis to believe that the entity is engaging in conduct that will impede an investigation of the misconduct.35 A third exception arises when at least 120 days have elapsed since the whistleblower provided the information to the entity’s audit committee, chief legal officer, chief compliance officer, or the whistleblower’s supervisor, or since the whistleblower received the information if he or she received it under circumstances indicating that the audit committee, chief legal officer, chief compliance officer, or supervisor was already aware of the information.36
There is no per se exclusion of whistleblowers who engage in culpable conduct in the Final Rules.37 According to the SEC, allowing certain less-culpable whistleblowers to receive awards provides incentives for persons involved in wrongdoing to come forward and disclose illegal conduct involving others. However, for purposes of determining whether the $1,000,000 threshold has been satisfied, or for purposes of calculating the amount of an award to the whistleblower, the SEC will not include any monetary sanctions that the whistleblower is ordered to pay, or that an entity is ordered to pay if its liability is based substantially on conduct that the whistleblower directed, planned, or initiated. The SEC will also consider the culpability or involvement of the whistleblower as a negative factor in determining the amount of an award.38 Even if a culpable whistleblower is eligible to obtain an award, the Final Rules do not provide whistleblowers with amnesty or immunity for their own misconduct.39 However, the SEC will consider a whistleblower’s cooperation in accordance with its “Policy Statement Concerning Cooperation by Individuals in [SEC] Investigations and Related Enforcement Actions.”40
An individual who uses any false writing or document that contains a false, fictitious, or fraudulent statement or entry is excluded from the whistleblower program, when the whistleblower intends to mislead or otherwise hinder the SEC or another authority in connection with a related action. Foreign officials, including employees of foreign instrumentalities, also are excluded.41
Information will not be deemed to be derived from “independent knowledge” or “independent analysis” if the whistleblower obtained the information for the submission from a person who is subject to one of the excluded categories covered in Rule 21F-4 or Rule 21F-8(c)(4), unless the information is not excluded from that person’s use or the whistleblower is providing the Commission with information about possible violations involving that person.42
Under Rule 21F-4(b)(4)(iv), a whistleblower’s information will be excluded from the definition of “independent knowledge” if it was obtained by a means or in a manner that is determined by a domestic court to violate applicable federal or state criminal law.
Internal Compliance Programs
Perhaps the most controversial aspect of the Final Rules is the fact that the SEC chose not to require whistleblowers to first report violations internally, despite numerous comments expressing concern about the damage that it would do to the efforts of companies that have established robust procedures to encourage employees, agents, and others to report suspected illegal and inappropriate conduct internally, and to protect those who make such reports. Instead, the SEC made the whistleblower’s decision to use internal procedures entirely voluntary, although it did make certain changes to the Proposed Rules in an effort to “further incentivize whistleblowers to utilize their companies’ internal compliance and reporting systems when appropriate.”43 Thus, when determining the amount of an award, a whistleblower’s voluntary participation in internal compliance programs will be a factor that can increase the amount of an award, while a whistleblower’s interference with internal compliance and reporting is a factor that may decrease the award.
Perhaps a greater incentive is the fact that a whistleblower can receive an award for reporting original information to the company pursuant to a company’s internal compliance and reporting systems, if the company then reports information to the SEC that leads to a successful action.44 In that case, all of the information that the company provides to the SEC will be attributed to the whistleblower, not just the information that he or she first provided. This means that the whistleblower will get credit, and possibly a larger bounty, for any additional information provided by the company as a result of its investigation. To lock in such an award, the whistleblower would have to report the information to the SEC within 120 days of first reporting it to the company.45
Exchange Act Section 21F(h)(1)(A) prohibits employers from taking retaliatory action against whistleblowers for lawfully: (i) providing information to the SEC; (ii) initiating, testifying in, or assisting in any SEC investigation or judicial or administrative action based on or related to such information; or (iii) making disclosures that are required or protected under the Sarbanes- Oxley Act, the Exchange Act, 18 U.S.C. Section 1513(e) (Retaliating Against a Witness, Victim, or an Informant) and/or any other law, rule, or regulation subject to the SEC’s jurisdiction.46 Rule 21F-2(b) provides that a whistleblower is protected if the person has a “reasonable belief” that the information he or she is providing relates to a possible securities law violation that has occurred, is ongoing, or is about to occur, and provides that information in the prescribed manner. The whistleblower must “hold a subjectively genuine belief that the information demonstrates a possible violation and that this belief is one that a similarly situated employee might reasonably possess.”47 These anti-retaliation protections apply whether or not the whistleblower satisfies the requirements, procedures, and conditions to qualify for an award.48
Moreover, no person may take any action to impede a whistleblower from communicating directly with the SEC staff about a possible securities law violation, including by enforcing, or threatening to enforce, a confidentiality agreement.49 Addressing concerns that the Final Rules could inhibit companies from taking legitimate disciplinary action against employees with respect to matters unrelated to whistleblowing, the SEC explained that Dodd-Frank only prohibits adverse employment actions that are taken because of any lawful act to provide information; adverse employment actions taken for other reasons are not covered.50
In addition, Rule 21F-7 incorporates the requirement in Exchange Act Section 21F(h)(2) that the SEC not disclose information that could reasonably be expected to reveal the identity of a whistleblower, except when disclosure is required to a defendant or respondent in connection with a federal court or administrative action filed by the SEC, or in another public action or proceeding filed by another authority to which the SEC provided the information. Also, when the SEC determines that it is necessary to accomplish the purposes of the Exchange Act and to protect investors, it may provide whistleblower information to the Department of Justice and/or certain other federal, state, or foreign legal or regulatory authorities, each of which is subject to the confidentiality requirements of Exchange Act Section 21F(h). The SEC also may disclose information in accordance with the Privacy Act of 1974.
Procedure for Submitting Original Information
In order to qualify as a whistleblower, an individual must submit information in accordance with the procedures set forth in Rule 21F-9(a). The Final Rules establish a streamlined procedure for potential whistleblowers to submit information to the SEC, simplifying the two-step process set forth in the Proposed Rules. A potential whistleblower will be required to submit a single Form TCR (Tip, Complaint, or Referral). One section of the form has been made optional in order “to make the form less burdensome.”51 The Final Rules require that in order to be eligible for an award, a whistleblower must declare, under penalty of perjury, that the information that he or she is providing is true and correct to the best of his or her knowledge and belief, at the time that the Form TCR is submitted.52 Furthermore, in order to help protect the attorney-client privilege, Form TCR now adds “counsel” to the list of possible positions held by a whistleblower and the form asks the whistleblower to describe how he or she obtained the information that supports the claim, and to identify with particularity any information submitted by the whistleblower that was obtained from an attorney or in a communication where an attorney was present.
Importantly, Form TCR now requests a potential whistleblower to specifically state whether he or she reported the violation to his or her supervisor, compliance office, whistleblower hotline, ombudsman, or any other available mechanism at the entity for reporting violations. The SEC stated that this would be consistent with how the “rules encourage, but do not require, whistleblowers to utilize their companies’ internal compliance and reporting systems when appropriate.”53
Whistleblowers may submit information anonymously; however, in such cases whistleblowers must have an attorney representing them in connection with the submission of information and the claim for an award, and the attorney’s name and contact information must be provided to the SEC when the information is submitted. Before the SEC will pay any award, the whistleblower must disclose his or her identity to the SEC and that identity must be verified by the SEC.54
There is little doubt that the Final Rules will provide employees, protected by the anti-retaliation provisions, with a strong incentive to bring information regarding potential violations of the federal securities laws to the SEC’s attention. In some cases this may prove to be a very positive result, providing additional assistance to the SEC in its efforts to detect and deal with securities law violations. Nevertheless, the negative impact on internal compliance procedures designed to detect and prevent improper activity by company personnel could be significant. There also is a very real risk that the Final Rules will encourage a certain amount of improper and unscrupulous activity.
Many companies have robust internal compliance procedures specifically designed to encourage personnel to report suspected violations of applicable law, and to protect those who make such reports. They include policies and procedures designed to prevent illegal activity from going undetected by providing means to encourage employees and others to report suspected problems, irregularities, or illegal conduct. Unfortunately, the Final Rules “encourage” but do not require whistleblowers to use internal procedures. As a result, companies will have to consider:
- How to improve their procedures in order to encourage employees to use them, so that companies receive the information as quickly as possible.
- Improving other aspects of their compliance programs. Compliance, surveillance, internal audit, and other control functions will become more critical than ever. Companies will have to increase their vigilance or risk learning of problems for the first time when they are contacted by the SEC.
- How to respond to a call from the SEC resulting from a whistleblower complaint. While the SEC may allow companies to have the first crack at investigating whistleblower allegations,55 such companies will have to be prepared to act quickly in order to avoid the SEC starting its own investigation.
- Developing other ways to establish a sufficient “culture of compliance” to encourage employees with information about possible illegal or improper activities to bring it to the company’s attention, and to respond to it within 120 days (the outside limit before the whistleblower must go to the SEC to lock in an award).56
- Establishing methodologies for communicating with the whistleblower during the pendency of an investigation.
There also remains an unanswered question regarding the effect of the Final Rules on existing company policies that require employees to report suspected problems, irregularities, or illegal conduct, and impose disciplinary action if they fail to do so.
- While the SEC made some effort to protect companies that have established programs for addressing potential violations of the securities laws by adding incentives for whistleblowers to use those programs, the size of the potential awards creates a strong incentive for whistleblowers to bypass internal procedures and go directly to the SEC. Moreover, there is little to protect companies that are faced with retaliatory whistle blowing, i.e., a disgruntled employee who chooses to use the whistleblower process to make baseless claims as a means of settling scores. Although the whistleblower must possess a “reasonable belief” that the information provided relates to a possible securities law violation, and certify under penalty of perjury that the information submitted to the SEC is true, correct, and complete, it remains to be seen whether this will be a sufficient deterrent against false, malicious, or spurious claims. The anti-retaliation provisions also may encourage employees to make claims in order to stave-off anticipated termination or other disciplinary action.57
- Finally, there is the risk of the hidden “whistleblower tax.” Rule 21F-14(a) provides that awards must be paid from the “Securities and Exchange Commission Investor Protection Fund” (the “Fund”). Exchange Act Section 21F(g)(3)(A) provides that there will be deposited into or credited to the Fund an amount equal to “any monetary sanction collected by the Commission in any judicial or administrative action brought by the Commission under the securities laws that is not added to a disgorgement fund or other fund under section 308 of the Sarbanes-Oxley Act . . . or otherwise distributed to victims of a violation of the securities laws, or the rules and regulations thereunder, underlying such action” (emphasis added). Thus, the Fund will consist of monies from all relevant SEC enforcement actions, not just those involving whistleblowers.
The SEC cannot take into consideration the amount of money in the Fund when determining how much to give a whistleblower. Exchange Act Section 21F(c)(1)(B)(ii) explicitly forbids that. So, if a whistleblower provides original information to the SEC that warrants an award greater than the amount of money in the Fund, the balance must come from somewhere else. Under Section 21F(g)(3)(B), “[i]f the amounts deposited into or credited to the Fund . . . are not sufficient to satisfy an award . . . , there shall be deposited into or credited to the Fund an amount equal to the unsatisfied portion of the award from any monetary sanction collected by the Commission in the covered judicial or administrative action on which the award is based” (emphasis added). In essence, the whistleblower receives an award paid for out of the victims’ pockets. According to the SEC, “[i]n this situation, there would be a tension between the competing interests of paying an award to a whistleblower (as provided for in Section 21F) and compensating victims with monies collected from wrongdoers.”58
Because the SEC possesses wide discretion in the assessment of monetary sanctions, it could seek to resolve that tension by generally assessing larger sanctions in all actions in order to keep the Fund solvent. This would force companies to pay larger sanctions not because of their conduct or offense, but solely to keep the Fund adequately financed. This would be particularly unfair to companies facing sanctions stemming from actions that do not involve whistleblowers.
The Final Rules are certain to increase the number of reports that the SEC receives regarding purported violations of the federal securities laws, and thus increase the number of inquiries and investigations directed toward public companies. While the ultimate impact remains to be seen, each company subject to the Final Rules will certainly need to be more vigilant in looking for misconduct, addressing it as soon as the company becomes aware of it, and encouraging employees to bring it to the attention of management at the earliest possible moment. The challenge will be to convince employees that doing so will not jeopardize their ability to reap the significant bounties that the SEC will be paying to whistleblowers.