SEC Whistleblower Rules Encourage but Do Not Require Internal Reporting

A month after their scheduled release date, the Securities and Exchange Commission (“SEC”) voted 3-2 to adopt final rules implementing the hotly-debated whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”).[1] Differences between the proposed rules released in November 2010 and the final rules approved on May 25, 2011 center around the role of internal compliance programs in the reporting process, the extent of anti-retaliation protections, eligibility criteria for awards, and the factors affecting award amounts.

Comments and debate about the proposed rules focused on whether a whistleblower should be required to report possible violations internally before contacting the SEC to be eligible to receive an award. Several commentators argued that the absence of an internal reporting requirement would undercut internal compliance programs. While the SEC’s final rules do not require internal reporting, they encourage internal reporting by providing whistleblowers with credit for internally-reported information that is later provided by the company to the SEC, and factoring in cooperation with internal compliance programs when determining the amount of an award.

Background

The Dodd-Frank Act added Section 21F to the Securities Exchange Act of 1934. It requires the SEC to award whistleblowers — individuals who provide original information that leads to successful SEC enforcement actions — 10 to 30 percent of the total monetary sanctions collected if sanctions exceed $1 million. The $1 million threshold may be met by aggregating monetary sanctions in SEC and “related” actions by federal or state criminal authorities, appropriate regulatory agencies or self-regulatory organizations.

Expanded Whistleblower Eligibility

Under the final rules, a “whistleblower” is an individual — an employee, consultant, or other person outside the company — who provides the SEC with information about a possible violation of the federal securities laws that has occurred, is ongoing or is about to occur. To receive an award, a whistleblower must meet several requirements:

• Only natural persons are eligible to receive awards, although they may provide information alone or jointly with others and may do so anonymously. Corporations or other legal entities cannot receive whistleblower awards.
• A whistleblower must “voluntarily” provide the SEC with the information. In general, a whistleblower will be deemed to have provided information voluntarily if he provides information before a request, inquiry or demand relating to the information is directed to the whistleblower by the SEC or by the Public Company Accounting Oversight Board (“PCAOB”), a self-regulatory organization or the government in connection with an investigation, inspection or examination.
• A whistleblower must provide “original” information based on his independent knowledge or independent analysis — not on information already known to the SEC and not on information derived exclusively from certain public sources.
• The whistleblower’s information must lead to “successful enforcement” by the SEC of a federal court or administrative action. The information may be deemed to have led to successful enforcement in three circumstances: (1) if the information is sufficiently specific, credible, and timely to cause the SEC to open an investigation, reopen an investigation, or inquire about different conduct in a current examination, and the SEC brings a successful judicial or administrative action based on the conduct that was the subject of the information; (2) if the conduct was already under investigation when the information was submitted, and the information significantly contributes to the success of the action; or (3) information is provided to an internal compliance program before or at the same time as it is provided to the SEC, the company reports the information to the SEC, and a successful action under (1) or (2) results.

If a whistleblower reports a potential violation to the SEC within 120 days of reporting the same potential violation through an internal compliance program, the whistleblower will be deemed to have reported the potential violation to the SEC as of the date he reported it to his employer. The proposed rules provided for a 90-day “grace period.”

Inclusion of the third category of “successful enforcement” reflects the outcome of the debate over whether internal reporting should be mandatory. Many commentators expressed concern that failing to require internal reporting, coupled with the possibility of a significant monetary reward, would incentivize employees to report information to the SEC before reporting problems internally, if at all. In a statement before the SEC’s vote, Chairman Schapiro stated that the final rules strike “the correct balance between encouraging whistleblowers to pursue the route of internal compliance when appropriate — while providing them the option of heading directly to the SEC.”[2] The SEC also noted that this provision increases the likelihood that a whistleblower will receive an award, because the award could be based solely on the whistleblower’s tip to the SEC, or on the information provided by the whistleblower’s employer. For instance, the employer’s submission may meet the “specific” and “credible” requirements, even though the original tip did not, thus qualifying the whistleblower for an award that he would not have otherwise received.

In light of comments on the proposed rules, and concerns about deterring submissions, the final rules expand the range of information deemed to be given “voluntarily.” The proposed rules excluded information that was provided to the PCAOB, a self-regulatory organization, or the government in response to any request or inquiry. Under the final rules, information is given “voluntarily” unless it is provided to regulators in response to a request or inquiry relating to an investigation.

Other Key Issues

Eligibility Exclusions: The proposed rules excluded certain individuals from whistleblower awards to ensure that those most responsible for an entity’s conduct and compliance lacked any incentive to promote their own interests at the expense of the entity. Those excluded included individuals with pre-existing legal duties to report information to the SEC, such as attorneys and accountants. The SEC’s final rules cut back on these exclusions, although the following individuals generally are not eligible to receive whistleblower awards:

• Officers, directors, trustees and partners who learn information in connection with an entity’s internal controls or legal processes;
• Employees whose principal duties involve compliance or internal audit responsibilities, and employees of independent firms that have compliance or audit responsibilities;
• Employees of entities retained to investigate violations of law; and
• Independent public accountants who obtain information in connection with an engagement required under federal securities laws.

Persons in these categories may, however, receive a whistleblower award if they report a possible violation to the SEC and (1) reasonably believe that disclosure is necessary to prevent the entity from causing substantial injury to the financial interest or property of the entity or investors, (2) reasonably believe the entity is impeding investigation of the misconduct, or (3) at least 120 days have passed since they provided the information to internal authority or compliance programs, or learned that they were aware of the information.

Attorneys who learn information through privileged communications or in connection with legal representation are not eligible to receive whistleblower awards except when disclosure of the information is permitted under SEC or state bar rules.

Criteria for Award Amounts: Dodd-Frank Section 21F mandates awards of 10 to 30 percent of monetary sanctions collected based on the information provided by the whistleblower. Under the SEC’s proposed rules, the award amount was based on evaluation of four mandatory factors and 11 discretionary factors. The SEC’s final rules jettisoned the mandatory/discretionary dichotomy in favor of identifying factors that will increase or decrease the amount of a whistleblower’s award.

Factors that may increase the amount of a whistleblower’s award include:

• Significance of information — including reliability, completeness, and degree to which it supported successful actions;
• Timeliness, degree, reliability and effectiveness of the whistleblower’s assistance, including attempts to remediate harm;
• Programmatic interest of the SEC in deterring violations by rewarding whistleblowers, including whether the subject matter is an SEC priority and the danger to investors or others from the underlying violations; and
• Participation in internal compliance systems — whether the whistleblower reported internally and assisted with internal investigation. Factors that may decrease the amount of a whistleblower’s award include:
• Culpability — including role in actions, education, training, responsibility, scienter, and egregiousness of underlying fraud;
• Unreasonable reporting delay — failing to take action or acting only after an investigation began; and
• Interference with internal compliance and reporting systems.

Cooperation or interference with internal compliance programs will affect the amount of a whistleblower’s award — thus encouraging internal reporting. The SEC will not pay awards to whistleblowers when the monetary sanctions are based on payments by the whistleblowers themselves or by entities whose liability is substantially based on the whistleblower’s unlawful conduct.

Whistleblower Anti-Retaliation Protections

In addition to the incentive provisions, the Dodd-Frank Act significantly enhances whistleblower protections by prohibiting employers from discharging, demoting, suspending, threatening, harassing or otherwise discriminating against whistleblowers who provide information to enforcement authorities. The Dodd-Frank Act also creates a private right of action for employees who experience retaliation as a result of whistleblower activity. Such protections and rights do not extend to non-employee whistleblowers, even though they are eligible for awards.

The final rules clarify that a whistleblower need not be eligible for an award or even report an actual violation of the securities laws to be protected from retaliation. To be protected, a whistleblower need only have a reasonable belief that the reported information relates to a possible violation. The anti-retaliation provision, however, does not apply to employees who only report possible violations internally. Generally, to be protected from retaliation, the employee must report the possible violation to the SEC, directly or indirectly.

Implications of the Whistleblower Rules

In recent remarks, Chairman Schapiro acknowledged the impact of the SEC’s whistleblower program to date, including the increased volume and quality of tips since the Dodd-Frank Act became law. There is little doubt that the new whistleblower program will result in increased complaints and SEC enforcement activity. Unfortunately, the SEC’s final rules do little to quell concerns voiced regarding the proposed rules. Despite provisions intended to encourage whistleblowers to report possible violations internally, whistleblowers are eligible to receive awards if they bypass internal reporting procedures, and generally are protected from retaliation only if they report violations to the SEC. Accordingly, all companies should:

• Review codes of conduct to assess whether changes are appropriate, including provisions regarding reports of potential whistleblower concerns and anti-retaliation policies;
• Review internal reporting and investigation processes, including documentation requirements for internal investigations and any adverse employment actions taken against potential whistleblowers;
• Train employees to understand relevant policies and procedures including how they can bring possible violations to management’s attention without surrendering eligibility for any whistleblower awards;
• Consider whether to require, or provide rewards or other incentives for, employees to report possible violations internally, whether periodic acknowledgements that employees are not aware of potential violations are appropriate, whether and how to permit anonymous reporting, and whether and to what extent to promise no retaliation for internal reporting; 
• Prepare for an increased need to conduct internal investigations, establish basic protocols for investigating whistleblower complaints and develop processes for reports to senior management and, if appropriate, to the SEC;
• Investigate whistleblower complaints as warranted, recognizing that employees may report complaints to the government notwithstanding the results of an internal investigation; and
• Be prepared to explain to the SEC what management did in response to complaints and to defend the investigative efforts and findings, regardless of whether violations are established.

Authored by David K. Momborquette, Richard J. Morvillo, Holly H. Weiss and Jeffrey F. Robertson.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

---

[1] The SEC’s final rules are available at http://sec.gov/rules/final/2011/34-64545.pdf. An SRZ Client Alert about the proposed whistleblower program is available at http://www.srz.com/111210_SEC_Proposes_Whistleblower_Program_Rules/. The final rules, which implement Section 922 of the Dodd-Frank Act, are effective 60 days from publication in the Federal Register.

[2] Speech by Mary Schapiro, Opening Statement at SEC Open Meeting: Item 2 - Whistleblower Program, May 25, 2011, available at http://www.sec.gov/news/speech/2011/spch052511mls-item2.htm.

---

This information has been prepared by Schulte Roth & Zabel LLP (“SRZ”) for general informational purposes only. It does not constitute legal advice, and is presented without any representation or warranty as to its accuracy, completeness or timeliness. Transmission or receipt of this information does not create an attorney-client relationship with SRZ. Electronic mail or other communications with SRZ cannot be guaranteed to be confidential and will not (without SRZ agreement) create an attorney-client relationship with SRZ. Parties seeking advice should consult with legal counsel familiar with their particular circumstances. The contents of these materials may constitute attorney advertising under the regulations of various jurisdictions.