The SEC recently proposed a new Regulation 21F under the Exchange Act to implement the whistleblower directive under the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank). Section 922 of Dodd-Frank added Section 21F to the Exchange Act directing the SEC to establish a program conforming to the guidelines of Section 21F that would incentivize individuals to act as whistleblowers regarding potential violations of the securities laws. The statute authorizes the SEC to pay awards to individuals who voluntarily provide the SEC with original information about a possible violation of the securities laws that leads to an enforcement action resulting in monetary sanctions exceeding $1 million. The SEC's proposed regulation is intended to provide a complete and self-contained set of rules for whistleblowers that reflects the statutory provisions. Proposed Regulation 21F is described in Release No. 34-63237. December 17 is the deadline for submitting comments on the proposal.

Key elements of proposed regulation

Proposed Regulation 21F, which consists of 16 separate rules, would supplement the requirement in the Sarbanes-Oxley Act that all public companies establish whistleblower programs. The regulation would provide bounties to whistleblowers of between 10% and 30% of the amounts obtained by the SEC in successful enforcement actions. To qualify for an award under the regulation, an individual would have to:

  • Satisfy specified eligibility standards;
  • Comply with the requirements that the submission to the SEC (1) be voluntary, (2) include original information derived from independent knowledge or analysis, (3) relate to a potential violation of the federal securities laws and (4) lead to successful SEC enforcement proceedings involving monetary sanctions exceeding $1 million; and
  • Provide the information in accordance with the procedures specified in the regulation.

The proposed regulation also contains provisions that would protect whistleblowers from retaliation for their actions regardless of whether they qualify for an award.

Eligibility standards

Whistleblower. Under Regulation 21F, a "whistleblower" would be any natural person who alone, or jointly with others, provides information to the SEC relating to a potential violation of the securities laws. Because only individuals could be whistleblowers, a corporate or other entity would not qualify for an award.

Ineligible persons. The following individuals would not be eligible to receive awards:

  • Persons who, at the time they acquired the information submitted to the SEC, were members, officers or employees of the SEC or any other law enforcement organization, the Public Company Accounting Oversight Board (PCAOB), or a foreign government, foreign instrumentality or foreign financial regulatory authority;
  • Persons convicted of a criminal violation related to an enforcement action for which the person otherwise would be eligible to receive an award;
  • Persons who obtained the information provided to the SEC through an audit of a company's financial statements where providing the information would be contrary to Section 10A of the Exchange Act;
  • Persons who acquired the information provided to the SEC from any of the ineligible individuals described above;
  • Any person who is a spouse, parent, child or sibling of a member or employee of the SEC, or who resides in the same household as an SEC member or employee; and
  • Persons who knowingly and willingly make false statements or representations in their whistleblower submission or other dealings with the SEC or other authorities.

In addition to the foregoing individuals, lawyers, auditors, compliance personnel and certain other persons who have a duty to respond appropriately would be disqualified from consideration for an award, as explained below under "Voluntary Submission" and "Original Information."

Voluntary submission

A submission by a whistleblower to the SEC would satisfy the requirement that it be made voluntarily only if:

  • The whistleblower does not have a pre-existing legal or contractual duty to report violations of the type at issue; and
  • The submission is made before the whistleblower (or any person representing the whistleblower) receives a formal or informal request, inquiry or demand from the SEC, Congress, any other federal, state or local authority, any self-regulatory organization, or the PCAOB, about a matter to which the information in the whistleblower's submission is relevant.

Requests, inquiries or demands from the entities mentioned above to a whistleblower's employer for the documents or information submitted by the whistleblower would be considered directed to the whistleblower and therefore not voluntarily submitted. Thus, a pre-existing legal or contractual duty to report violations to the government would disqualify a submission unless the employer were to fail to provide the documents or information in the employee's possession in a timely manner.

Original information

Applicable standards. The whistleblower would have the burden of showing that he or she has submitted "original" information about a potential securities-law violation to the SEC. Information about a potential violation not already known by the SEC would be considered "original" if it is derived from an individual's "independent" knowledge or independent analysis. Knowledge of a potential violation would be considered independent if it is not obtained from publicly available sources. For example, knowledge gained through personal experience or communications would be deemed independent, but knowledge gained through court filings would not qualify as independent. Analysis of a potential violation would be considered independent if the analysis involves an individual's examination and evaluation, either alone or with others, of information that generally may be publicly available, but reveals information not generally known or available to the public. For example, an analysis through academic or professional studies that identifies potential securities-law violations by virtue of an understanding of complex schemes would be considered independent.

Exclusions. The proposed regulation enumerates seven situations in which information would be deemed not to be original, and therefore excluded, because it is obtained in the following ways:

  1. Through communications protected by the attorney-client privilege;
  2. Through the legal representation of a client where the lawyer (or a person such as an accountant or other expert hired to assist counsel) seeks a personal benefit by making a whistleblower submission;
  3. Through an audit or similar engagement required under the securities laws by an independent public accountant where the information relates to a violation by the engagement client or its directors, officers or other employees;
  4. Through the performance of legal, compliance, audit, supervisory or governance responsibilities for an entity, where the information was communicated to the individual with the reasonable expectation that the individual would take steps to cause the entity to respond appropriately to the violation (unless the company fails to report the information to the SEC within a reasonable time or acts in bad faith);
  5. Otherwise from or through an entity's legal, compliance, audit or other similar functions or processes for identifying, reporting and addressing potential non-compliance with the law (unless the company fails to report the information to the SEC within a reasonable time or acts in bad faith);
  6. By a means that violates applicable federal or state criminal law; or
  7. From anyone who learned the information secondhand from any individual who first learned the information in one of the six ways enumerated above.

Company obligations to report. The definition of original information makes it clear that the fourth and fifth exclusions noted above are dependent upon the company having reported the information to the SEC within a "reasonable time" and not having "acted in bad faith" by, for example, having destroyed documents or other evidence or having conducted a sham internal investigation. Although the SEC did not define what is meant by "reasonable time," it did emphasize in the proposing release that this may mean immediately in the case of an ongoing fraud that poses substantial risk of harm to investors. Thus, companies would have to determine quickly whether the conduct is ongoing and presents a substantial risk to investors and, even where it does not, have procedures for determining if and when to report the information to the SEC. In the proposing release, the SEC further clarified that an individual who learns the information while being interviewed by company legal or compliance personnel in the course of an internal investigation will be deemed not to possess original information, unless the company did not provide the information to the SEC within a reasonable time or acted in bad faith in conducting the internal investigation.

Relates to potential violation of securities laws

Under the proposed regulation, an individual would be deemed to be a whistleblower if the information submitted by an individual to the SEC relates to a potential violation of the securities laws. The word "potential" is not in the statute, but the SEC proposes to include it in the regulation so that the agency would be able to consider an individual to be a whistleblower at the time information is submitted to the SEC, rather than at some later date when the violation is proved. The SEC believes this approach is necessary to afford confidential treatment from the outset to any information that otherwise might reveal the whistleblower's identity.

Leads to successful SEC enforcement proceedings

To receive a bounty under the proposed regulation, the whistleblower must supply original information that leads to a successful enforcement proceeding with monetary sanctions exceeding $1 million. The proposed regulation indicates that the SEC would consider the following factors in deciding whether a whistleblower's information met this requirement:

  • The information caused the SEC staff to commence an examination, open an investigation, reopen an investigation that had been closed, or inquire concerning new and different conduct as part of a current examination or investigation, and the information "significantly contributed" to the success of the SEC's enforcement action; or
  • The information related to conduct already under examination or investigation by the SEC, Congress, any other federal, state or local authority, any self-regulatory organization, or the PCAOB, and the information otherwise would not have been obtained and was essential to the success of the action.

The calculation of the monetary sanctions on which an award would be based would include penalties, disgorgement, and interest, as well as any money deposited into a disgorgement fund.

Procedural requirements

To obtain an award under the proposed whistleblower program, an individual initially would have to submit the information regarding the potential violation to the SEC online according to instructions on the SEC's website, or on proposed Form TCR by mail or fax. At the same time, the whistleblower would have to file proposed Form WB-DEC attesting to the original nature of the information submitted and the person's eligibility for an award. Finally, to complete the process, the person would need to file proposed Form WB-APP formally applying for an award. The SEC and the Department of Justice have made it clear that persons who intentionally submit false information to the SEC under the whistleblower program will be prosecuted.

Protections against retaliation

The proposed regulation incorporates by reference the provisions of Dodd-Frank (now included in Section 21F(h)(1) of the Exchange Act) that afford protection to whistleblowers against retaliation by their employers. One of the effects of regulation would be to extend to a maximum of ten years the statute of limitations for filing retaliation claims. Claims generally could be filed six years after the adverse action, or three years after actual or imputed notice of the action, but no more than ten years after the action.

Efforts to foster use of existing company compliance programs

In the proposing release, the SEC expressed a policy interest in fostering robust corporate whistleblower and related compliance programs designed to receive, handle and respond to complaints about potential violations of law. Although it does not propose requiring a whistleblower to use such internal programs to be eligible for an award, the SEC has proposed two incentives for employees initially to report their information to their companies. The first proposed incentive is that, in determining the amount of an award, the SEC will consider, among other factors, increasing the award size where the information is reported initially under an existing corporate program. The SEC also indicated, however, that it still might give a whistleblower more than the minimum percentage of 10% of the monetary sanctions where the whistleblower eschews reporting to the company "for fear of retaliation or other legitimate reasons." The second proposed incentive would deem the date of reporting original information to the SEC to be the earlier date on which the whistleblower reported it to the company, so long as the employee files a claim form with the SEC within 90 days after the internal report. Whether these measures would provide sufficient incentives to foster a robust corporate compliance program is open to question, and substantial comment on this topic seem likely.

Whistleblower communications with SEC

The proposed regulation would prohibit any action to impede a whistleblower's communications with the SEC. For example, a company could not seek to enforce a confidentiality agreement with an employee to prevent the employee from disclosing information relating to a potential securities-law violation to the SEC, except to the extent the information is protected by the attorney-client privilege. The proposing release does not address the company's ability to prevent a whistleblower from communicating other information, such as trade secrets, that companies have a legitimate interest in keeping confidential. Accordingly, this aspect of the proposed regulation likely will engender significant comment.

The proposed regulation also would make clear that the SEC staff could communicate directly with the whistleblower without first seeking the consent of the company's counsel, even if the individual is an officer or director. Given the obvious clash of this provision with various state bar rules of professional responsibility, which the SEC acknowledged in the proposing release, this part of the proposal also is likely to be the subject of considerable comment.


Some companies have expressed concern that the bounties available under the proposed regulation would spawn a multitude of unsupportable complaints that they would have to use scarce corporate resources to investigate after being notified by the SEC of the complaints. Some companies also are worried that the regulation likely will have a negative impact on their internal compliance programs by establishing the SEC as an alternative outlet for complaints these programs were designed to handle. There also is the concern, discussed above, that the disclosure of corporate information could harm the company's business. Some members of the plaintiffs' bar, on the other hand, have asserted that many of these criticisms are misguided or unwarranted. But even the SEC Commissioners expressed concern at the meeting in which they considered the proposed regulation that it might have "unintended consequences." They noted in particular the possibility that corporate employees might bypass their company's internal compliance program to obtain a reward under the regulation.

Notwithstanding these concerns, a whistleblower regulation conforming to the guidelines in Dodd-Frank is mandated by law and eventually will be adopted. This prospect should not discourage companies and others from commenting on the proposed regulation, particularly in light of the reservations expressed by the SEC Commissioners. The Commissioners appear open to considering changes in the proposed regulation that could provide practical approaches to resolving troublesome aspects of the proposal.

Recognizing that adoption of a final whistleblower regulation will proceed, companies should consider taking action now to prepare for the new reporting regime, including the following measures:

  • Reviewing internally (and perhaps externally through legal or other advisers) existing whistleblower and compliance programs, including the company's up-the-line reporting program required by the Sarbanes-Oxley Act, to make sure that they are effective and result in timely reports to management;
  • Enhancing communications and training efforts regarding internal whistleblower and compliance programs to ensure a proper understanding of the company's programs and to reinforce an appropriate "tone at the top"; and
  • Reminding officers and other supervisors that retaliation is unlawful and will not be permitted, and that, upon learning the identity of a whistleblower, all employment-related documents regarding the individual should be retained for the entire ten-year period during which a retaliation claim may be made by the employee.