On May 25, 2011, the U.S. Securities and Exchange Commission (SEC) passed, in a 3-2 split vote, its final whistleblower rules. The rules implement Section 21F of the Securities Exchange Act, which was added by the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”). Section 21F authorizes the SEC to reward individuals “who voluntarily provide the Commission with original information about a violation of the federal securities laws that leads to the successful enforcement of an action brought by the Commission that results in monetary sanctions exceeding $1,000,000.” Whistleblowers who meet these requirements are eligible to receive 10% to 30% of the monetary penalties recovered by the SEC. The Dodd-Frank Act substantially expanded the SEC’s authority to compensate whistleblowers. Prior to the Dodd-Frank Act, the SEC’s bounty program was limited to insider trading cases and the amount of the award was capped at 10% of the penalties collected in the action.

Impact on Internal Compliance Programs

One of the most controversial aspects of the proposed whistleblower rules was the impact on companies’ internal compliance processes. Many commenters urged the SEC to require that whistleblowers report violations through the company’s internal compliance and reporting systems before submitting the information to the SEC to, among other things, allow companies to take appropriate actions to remedy improper conduct at an early stage through compliance processes already in place. Other commenters strongly opposed a requirement that a whistleblower report internally before reporting to the SEC because it was inconsistent with the Dodd-Frank Act and would dissuade whistleblowers from coming forward. Although the rules as adopted do not require a whistleblower to first report through internal company compliance channels before reporting to the SEC, the rules offer the following financial incentives for internal reporting:

  • Whistleblowers will qualify to receive a reward if, after reporting internally, the company then reports the violations to the SEC, even if the whistleblower does not.
  • An employee will be treated as a whistleblower as of the date the employee reports the information internally, as long as the employee provides the same information to the SEC within 120 days (as opposed to the 90 days suggested by the proposed rules). The SEC noted that through this provision, employees are able to report their information internally first while preserving their “place in line” for a possible award from the SEC.
  • Whistleblowers who report internally first will be considered for higher rewards, and the SEC will also consider a whistleblower’s voluntary participation with internal compliance procedures as a factor to increase the size of the reward. Conversely, a whistleblower’s interference with internal compliance and reporting will be a factor that can decrease the amount of the reward.  

After receiving a whistleblower complaint, the SEC may, depending on the circumstances, choose to notify the company and provide an opportunity to investigate and report back to the SEC. The SEC will consider a company’s cooperation when deciding whether to pursue a case.

Whistleblower Eligibility

Under the rules, a whistleblower is defined as any person who voluntarily provides original information to the SEC relating to a “possible violation” of the securities laws that “has occurred, is occurring, or is about to occur.” A whistleblower is deemed to have provided information “voluntarily” if he or she provided the information before it is requested by the government, a self-regulatory organization, or the Public Company Accounting Oversight Board (PCAOB). Information is deemed to have led to a successful enforcement action triggering the whistleblower’s eligibility for an award if:

  1. the information is sufficiently specific, credible and timely to cause the SEC to open a new exam or investigation, reopen a closed investigation, or open a new line inquiry in an existing exam or investigation
  2. the conduct is already under investigation when the information is submitted and the information significantly contributed to the success of the action, or
  3. the whistleblower reports original information through internal compliance mechanisms before or at the same time it is reported to the SEC; the employer provides the whistleblower’s information to the SEC; and the employer’s report satisfies prongs (a) and (b) above

The rules expressly provide whistleblower protection to anyone who provides a tip, even if the information does not lead to a successful enforcement action.

Certain individuals would not be considered for whistleblower awards, including all of the following:

  • individuals with a pre-existing legal or contractual duty to report to the SEC
  • attorneys (including in-house counsel) whose whistleblower claims are based on information from client engagements
  • people who obtain the information in violation of federal or state criminal law
  • foreign government officials
  • officers, directors, trustees or partners who are informed by another person or who learn of the information through the company’s internal compliance mechanisms
  • compliance and internal audit personnel
  • public accountants working on SEC engagements where the information relates to client violations

The rules provide an exception for compliance and internal audit personnel and public accountants when:

  • the whistleblower believes disclosure may prevent substantial injury to the entity or its investors
  • the whistleblower believes that the entity is engaging in conduct that will impede an investigation, or
  • at least 120 days have passed since the whistleblower first reported internally or received the information, if the information was received under circumstances indicating that such people are already aware of the information

Attorneys can also qualify as whistleblowers if disclosure is permissible pursuant to the SEC’s attorney conduct rules, applicable state statutes, or local bar rules.


The anti-retaliation provisions protect a whistleblower who provides information to the SEC if the whistleblower possesses a reasonable belief that the information relates to a possible securities law violation that has occurred, is ongoing, or is about to occur. The rules also prohibit interfering with a whistleblower’s efforts to communicate with the SEC. The anti-retaliation provisions only apply to whistleblowers who report to the SEC; they do not apply to whistleblowers who only report the violation internally.

Office of the Whistleblower

In addition to the whistleblower rules, the SEC has created an Office of the Whistleblower to handle tips and complaints. The office has been staffed and the Investor Protection fund, which will be used to pay awards to eligible whistleblowers, has been fully funded.

Impact on Companies

As a result of these new rules, companies subject to the securities laws run the risk of facing increasing allegations of misconduct, whether justified or not. Many companies fear that employees will bypass internal compliance mechanisms and the SEC will be overwhelmed by an influx of whistleblower complaints, but SEC Enforcement Chief Robert Khuzami reported that there has been only an “uptick” – not a “flood” – of whistleblower tips since the passage of the Dodd-Frank Act in July 2010.

Although the SEC did not require that whistleblowers report internally before reporting to the SEC, it is critical that companies have robust internal compliance programs. As discussed above, the SEC provided incentives for whistleblowers to report internally. The SEC noted in the adopting release that this “approach should encourage companies to continue to strengthen their internal compliance programs in an effort to promote internal reporting. Potential whistleblowers are more likely to respond to Rule 21F-4(c)(3)’s financial incentive by reporting internally when they believe that the company or entity has a good internal compliance program – i.e., a compliance program that will take their information seriously and not retaliate.” The SEC anticipates that companies will “take steps to promote a corporate environment where employees understand that internal reporting can have a constructive result.”

To promote this corporate environment, companies should make sure their employees are aware of, and understand, the companies’ internal compliance policies and procedures for reporting violations internally. Employees need to clearly understand that there will be no retaliation. Companies should also review and update their existing policies and procedures for recording, tracking and acting on information regarding corporate wrongdoing provided by employees to ensure they are consistent with the new whistleblower rules.

The SEC’s final whistleblower rules are located at: