On May 25, 2011, the U.S. Securities and Exchange Commission (SEC) adopted final rules (the "Rules") for the expanded whistleblower program established by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank).1 Dodd-Frank directed the SEC to adopt regulations to provide payment of awards to eligible individuals for reporting violations of federal securities laws to the federal government. Specifically, Dodd-Frank requires the SEC to award qualifying whistleblowers a bounty of 10% to 30% of the aggregate money over a $1 million threshold recovered by the SEC in eligible actions resulting from original information provided to the SEC by the whistleblowers. The Rules take effect on August 12, 2011.2 The Rules raise some challenging issues, perhaps the most significant being the impact on existing compliance and corporate governance procedures. Listed entities may be concerned that their compliance programs will be bypassed by whistleblowers who now have strong incentives to place their personal interests ahead of loyalties to their employers.
Who Qualifies as a Whistleblower Under the Rules?
Under Dodd-Frank, a whistleblower is a person who provides information about a possible violation of the securities laws that he or she reasonably believes has occurred, is ongoing or is about to occur, and includes employees, agents or any other individual who provides relevant original information, including independent contractors, consultants, joint venture partners, sales agents, persons involved with a private, wholly owned subsidiary consolidated in a publicly traded entity's balance sheet or even persons involved with a wholly owned foreign subsidiary consolidated in a publicly traded entity's balance sheet.
The Rules, however, further limit the pool of qualified applicants by restricting the eligibility of certain individuals – including officers and directors, lawyers, auditors and compliance personnel – from receiving an award under the program, unless certain exceptions apply.3 Significantly, many commentators, including two SEC Commissioners, expressed concerns that the exceptions for lawyers who owe fiduciary responsibilities to a company likely will swallow the rule. As Commissioner Kathleen L. Casey noted, "[t]he . . . exclusion will not apply where the attorney whistleblower has a reasonable basis to believe that disclosure of the privileged information is necessary to prevent substantial injury to the financial interest or property of investors."4 In such cases, it may be difficult for the SEC to challenge a whistleblower lawyer who claims that an immediate reporting was necessary to avoid significant harm to innocent investors and others involved with a company. The Rules also allow anonymous reporting, if done through counsel.
What Information Is Considered for an Award Under the Rules?
To qualify for an award, a whistleblower must provide "original information" to the SEC. "Original information" is defined as information:
- derived from the "independent knowledge"5 or "independent analysis"6 of the whistleblower;
- not already known to the SEC from any other source, unless the whistleblower is the "original source"7 of the information;
- not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation, or from the news media, unless the whistleblower is a source of the information; and
- provided to the SEC for the first time after July 21, 2010.8
The Rules provide some notable exceptions to the definition of original information that reflect the agency's attempt to balance the congressional mandate to implement this program with public-policy concerns about the value of preserving attorney-client privilege and a company's internal and external audit functions. In particular, the Rules generally exclude information obtained:
- through a communication subject to attorney-client privilege, unless disclosure would otherwise be permitted;9
- by a person with compliance or audit responsibilities if the information was communicated to the whistleblower in connection with the company's internal compliance processes, unless the person has: (a) a reasonable basis to believe that disclosure is necessary to prevent substantial injury to the financial interest or property of the company or its investors; (b) a reasonable basis to believe that the company is engaged in conduct that will impede an investigation of the misconduct; or (c) 120 days have elapsed since such person either reported the violation to the appropriate company compliance personnel or received such information under circumstances indicating that the appropriate company personnel were already aware of it;
- in a manner that is determined by a U.S. court to violate applicable federal or state criminal law; or
- from a person who is subject to the exceptions outlined above, unless the information is not excluded from such person's use as provided above, or information is being provided about possible violations involving such person.
Additionally, the Rules specify that only information of high quality, reliability and specificity will warrant an award under the program. Accordingly, the SEC will not grant an award to every tip and complaint, but only to information from a whistleblower that "leads to" a successful action.
How Is an Award Determined Under the Rules?
The Rules require that the award must be between 10% and 30% of the monetary recovery from successful SEC and related actions.10 To determine the amount, the Rules require the SEC to consider:
- the significance of the information to the success of the action;
- the degree of the whistleblower's assistance in the action;
- the SEC's "programmatic interest" in deterring violations of the securities laws by making such an award; and
- whether an award otherwise enhances the SEC's ability to enforce the federal securities laws, protect investors and encourage the submission of high-quality information by future whistleblowers.
Additionally, the Rules provide that an award may be increased (but not higher than the 30% ceiling) if a whistleblower voluntarily participates in a company's internal compliance and reporting systems; conversely, an award may be decreased (but not below the 10% floor) if a whistleblower interferes with such internal compliance and reporting systems. In short, the SEC may exercise a high degree of discretion regarding the granting of awards under the program.11
How Do the Rules Affect Existing Internal Compliance and Reporting Systems?
Although many corporations requested that the Rules require a whistleblower to report problems internally to management prior to becoming eligible under the program, the Rules do not require internal reporting. Instead, to encourage the use of existing internal compliance and reporting systems, the Rules:
- allow an award to be made to a whistleblower who reports a potential violation internally before or at the same time that the whistleblower reports it to the SEC;12
- provide that an award may be increased if a whistleblower utilized the internal reporting system; and
- give full credit to a whistleblower for additional information that is developed by a company following the whistleblower's internal reporting and subsequently provided to and used by the SEC in a successful enforcement action.
It appears problematic that granting credit to a whistleblower for information developed by a company might further undermine the internal compliance and reporting systems because a whistleblower would stand to reap an even larger benefit from reporting to the SEC on or after the date the whistleblower internally reports.13
What Protections Are Provided to Whistleblowers Against Employer Retaliation?
In order to provide whistleblowers with protection and comfort that their employers will not retaliate against them for acting as a whistleblower, the Rules prohibit retaliation by employers and afford both the whistleblower and the SEC the right to sue an employer if a whistleblower is discharged or otherwise discriminated against by such employer in connection with his or her whistleblowing actions.14 These protections supplement similar provisions contained in the Sarbanes-Oxley Act by increasing a whistleblower's potential recovery to an amount equal to double lost wages. Additionally, the Rules expand the scope of such anti-retaliation protections to apply to all otherwise-eligible whistleblowers who possess a "reasonable belief" that the information they provided relates to a possible securities law violation that has occurred, is ongoing or is about to occur, rather than only those who have met all of the procedural and other prerequisites to receiving a whistleblower award.15
Steps to Potentially Minimize Dodd-Frank Whistleblowers
In light of the significant risks that Dodd-Frank presents to publicly traded companies – and particularly for multinational enterprises under the Foreign Corrupt Practices Act – companies may now want to reassess the adequacy of existing compliance programs (including training) to try to potentially limit these risks. Compliance is a key part of business operations, which requires periodic assessments since what may have been acceptable in the past may no longer remain so in the eyes of a government regulator.
While some companies have considered rewarding employees for using their internal compliance mechanisms, the value of such measures may be viewed as controversial and problematic. At a minimum, companies may want to conduct exit interviews of departing employees to assess why they are leaving the company and whether they are aware of serious wrongdoing within the organization and have reported it internally or otherwise.
Businesses should consider seeking legal counsel regarding what measures are needed because there are many significant risks, including obstruction of justice or unnecessarily aggravating a regulatory agency.
Even when a company learns about a whistleblower issue that has been or likely will be reported to the SEC, opportunities still remain for companies to limit the damage. For one thing, companies may be able to help shape the SEC's decision about whether to proceed with an enforcement action. This is because the SEC currently is not fully staffed nor prepared to handle the expected number of whistleblower complaints, which it estimates to be about 30,000 annually.16 Moreover, the SEC has said that its staff will continue the practice of receiving information from companies in the early stages of an internal investigation and may agree to await further results from the investigation before deciding what may be its next step.17 Therefore, companies may want to seek outside counsel to help advise them and oversee an expedited but thorough internal investigation.
SEC's Dodd-Frank whistleblower rules may incentivize employee bounty-hunting at public companies. Com- panies need to improve their compliance programs to limit the potential hazards.