On May 25, 2011, Securities and Exchange Commission (“SEC”) adopted final rules implementing the whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank Act”). The final rules, which take effect on August 12, 2011, are amongst some of the most debated and controversial rules to be promulgated in the wake of the financial crisis. Much of the controversy surrounding the proposed rules is the absence of any requirement that a whistleblower report initial findings through a company’s internal compliance program. Commentators have argued that the rules will serve to undermine existing compliance programs by providing large financial incentives for employees to bypass such programs to reap life-changing rewards. Despite the objections of numerous commentators, the final rules do not require a whistleblower to report violations internally in order to qualify for an award. Rather, the final rules provide certain incentives for whistleblowers to utilize internal compliance programs instead of creating an internal reporting requirement. This corporate alert provides a summary of key provisions of the new whistleblower rules and discusses the potential impact on a company’s internal compliance program.

Background

Section 922 of the Dodd-Frank Act requires the SEC to establish a new whistleblower program that will pay awards, subject to certain limitations and conditions, to whistleblowers that voluntarily provide the SEC with information about violations of securities laws that lead to a successful enforcement action resulting in monetary sanctions exceeding $1 million. By statute, whistleblowers are entitled to receive anywhere between 10% to 30% of total monetary sanctions recovered. Section 922 of the Dodd-Frank Act, also provides protection to whistleblowers by prohibiting retaliation by employers against individuals who provide information regarding potential securities violations to the SEC.

Summary of New Whistleblower Rules

Regardless of commentator opposition, the new rules will take effect in less than fifteen days and will have a profound impact on companies. These new rules do not require a whistleblower to report potential violations internally through a company’s compliance program and enable the SEC to pay a large award to eligible whistleblower when:

• The whistleblower gives information to the SEC voluntarily
• The information provided is original
• The information leads to a successful enforcement action brought by the SEC resulting in monetary sanctions in excess of $1 million

By leveraging the potential receipt of large financial awards, the SEC is aggressively encouraging individuals to provide quality leads to the agency - posing significant challenges to the viability of existing corporate compliance programs.

Key Provisions 

Definition of Whistleblower

The new rules narrowly define a whistleblower as an individual, who alone or jointly with others, provides the SEC with information that relates to potential violations of federal securities law. Embedded in the definition of whistleblower are several key points that should be noted. The definition expressly excludes corporations and other legal entities from qualifying as a whistleblower. Further, the final rules clarify that the rules are limited in scope to violations of federal securities law. Thus, violations regarding state or foreign securities laws will not result in an award. Finally, there is no requirement that the potential violation reported be “material”. The SEC specifically rejected commentators’ requests for a materiality qualifier noting it prefers individuals provide all relevant information to the SEC who will, in turn, determine whether such information warrants action.

Voluntary Information

In order for information to be deemed voluntary, a whistleblower must submit the information to the SEC before a request, inquiry or demand is made by the SEC or a request is made in relation to any investigation, inspection or examination by any other federal authority, state attorney general or state securities regulatory authority. It is important to note that under the final rules, the prior request must be directed at the whistleblower or his or her legal representative. A request made to a whistleblower’s employer prior to the whistleblower’s submission would not preclude the submission from being considered voluntary under the final rules. This exclusion was significantly narrowed from the proposed rule, which would have disqualified such submissions after an inquiry or demand to the whistleblower’s employer. However, companies are afforded some protection under the final rules. The SEC will not consider a submission to be voluntary if the whistleblower is required to report violations to the SEC under a pre-existing legal duty, a contractual duty owed to the SEC or any of the other enumerated authorities, or a duty that arises out of a judicial or administrative order.

Original Information

The final rules define original information to mean information that is derived from the individual’s “independent knowledge” or “independent analysis” and not otherwise known to the SEC or derived from publicly available information. “Independent knowledge” means factual information in the individual’s possession. However, under the final rules, the information does not need to be obtained through “firsthand” knowledge. Rather the knowledge can be obtained from the individual’s experience, observation, or communication with others. Further, information derived from an individual’s “independent analysis” may include analysis of information that is publicly available, but that reveals information not generally known or available to the public. These definitions are intended to broaden the scope of intended whistleblowers to include not only those involved in the conduct at issue but outside analysts and observers that can derive possible conclusions from such information.

Successful Enforcement Actions leading to Monetary Sanctions in excess of $1 million

To qualify for an award, a whistleblower’s original information must lead to a successful enforcement action brought by the SEC with resulting monetary sanctions totaling in excess of $1 million. In order for an enforcement action to be deemed successful, the information provided must lead to a new investigation, the reopening of a closed investigation, a new line of inquiry in an existing investigation, or a significant contribution to the success of an ongoing investigation. Further, under the new rules, it is not necessary for a whistleblower to meet the $1 million threshold from a single investigation. Rather, the new rules allow aggregation of multiple investigations that arise out of a common nucleus of operative facts to constitute a single action needed to achieve the $1 million threshold. The SEC has noted that this aggregation will likely lead to an increase in the number of cases in which whistleblower awards will be available. Large financial incentives, coupled with the ability to aggregate cases, will likely lead to a rapid increase in whistleblower activity.

Awards

If a whistleblower can meet the conditions set forth in the final rules, he or she may receive between 10% -to- 30% of the total monetary sanctions recovered by the SEC. However, the final determination of the amount of the award is solely within the SEC’s discretion. In considering the amount of the award, the SEC will weigh various factors in its examination of matters related to the information provided on a case by case basis. Factors that may increase an award include:

1. Significance of the information provided
2. Assistance provided by the whistleblower
3. Law enforcement interest in deterring securities violations
4. Participation with internal compliance programs

Factors that may decrease an award include:

1. Culpability of whistleblower
2. Unreasonable reporting delay
3. Interference with internal compliance programs

The significance of these factors should not go unnoticed. Over much commentator opposition, the SEC declined to per se exclude a culpable employee from receipt of an award unless he or she is found to be criminally liable. Under the final rules, the degree of culpability will only impact the size of the award. Thus, an employee can still potentially reap an award for his or her own misconduct under the final rules at the employer’s expense. In addition, the fact that an employee whistleblower’s interference with its employer’s compliance program will only serve to decrease the size of the award undermines the effectiveness of the compliance program. The mere fact that an employee can intentionally evade and/or interfere with an employer’s internal reporting systems and still potentially reap a minimum award of 10% does little to deter such behavior.

Anti-Retaliation Protection

In addition to providing large financial incentives to whistleblowers, the new rules also protect individuals from employer retaliation when they possess a reasonable belief that the information provided relates to a possible securities law violation that has occurred, is about to occur, or is ongoing. These retaliation protections apply regardless of whether or not the whistleblower is ultimately eligible for an award. Further, the final rules expressly provide that the SEC has the ability to enforce the anti-retaliation regulations.

Limitations and Exclusions of Award Recipients

The final rules limit the eligibility of certain persons from being considered a whistleblower based on their relationship with or role played within a company. These include, but are not limited to:

1. Attorneys (including in-house counsel) who attempt to use information obtained from client engagements to make whistleblower claims for themselves
2. Officers, directors, trustees or partners of a company who are informed by another person, such as by an employee, of allegations of misconduct, or who learn the information in connection with the company’s processes for identifying, reporting and addressing possible violations of law, such as through the company hotline
3. Employees or third parties who obtain information in a manner that violates applicable federal and state criminal law
4. Any person employed or associated with a firm retained to investigate possible violations
5. Employees whose principal duties involve compliance or internal audit responsibilities
6. Public accountants working on SEC-related engagements, if the information relates to violations by the engagement client company

These exclusions are intended to fortify use of internal compliance programs by encouraging open communication with outside counsel, consultants, and auditors, as well as company executives. However, in certain circumstances, compliance and internal audit personnel, as well as public accountants may still become whistleblowers. The final rules allow such parties to become eligible for an award when they have a reasonable basis to believe either that tipping the SEC is necessary to prevent substantial injury to investors or that the company is engaging in conduct that will impede an investigation or if 120 days have elapsed since the proposed whistleblower reported the information to his or her supervisor.

Incentives to Utilize Internal Compliance Programs

While SEC made no apologies for ignoring numerous commentators’ requests for an internal reporting requirement, certain other provisions of the new rules are intended to encourage continued use of internal compliance programs when appropriate. The new rules provide that:

• A whistleblower who makes an initial report through an internal compliance program will still receive credit for all information relating to the same matter ultimately provided by the company to the SEC
• As noted above, participation by a whistleblower in his or her company’s internal compliance program will be considered a factor that may result in a larger award, and interference with internal procedures may be a factor that can decrease an award
• Any whistleblower information initially reported internally but subsequently reported to the SEC within 120 days will be deemed to have been reported to the SEC on the date of the initial internal report, thus preserving the initial date and “place in line” for a possible award from the SEC
   

Even though these incentives are intended to encourage use of a company’s internal compliance function, companies cannot prevent whistleblowers from approaching the SEC directly. In fact, companies are not permitted to take any action to impede an individual from communicating directly with the SEC staff about a federal securities law violation, including enforcing or threatening to enforce, a confidentiality agreement. Further, the new rules specifically authorize SEC staff to communicate directly with employees, including control persons of companies, without first notifying the company or its lawyers, where the employee initiated communications with the SEC as a whistleblower.

Impact on Compliance Programs

While it is unclear whether the SEC will succeed in achieving harmony between encouraging quality leads and supporting corporate compliance programs, it is clear at first blush that the rules are intended to aggressively incentivize individuals to submit potential company infractions directly to the SEC. At a minimum, the new rules will radically increase the speed and frequency with which whistleblowers report information to the SEC. Without specific language requiring internal reporting, companies face potential exposure from employees tempted by large financial rewards to circumvent existing internal compliance programs. The result could well erode the effectiveness of corporate compliance programs and leave companies otherwise bearing the risk of defending claims by the SEC.

Corporate Response: Maintain an Effective Internal Compliance Program

In the wake of these new rules, companies must now recognize that the enticement of large rewards may cause employees to usurp internal compliance programs and race to the SEC at the first sign of a potential infraction rather than discussing the issue internally. In order to combat the challenging climate created by these new rules, companies must take a proactive approach to address their compliance programs and potential whistleblowers. Companies must review existing compliance programs and reporting systems to make sure they are effective and provide for timely reporting to management. This includes streamlining internal investigation processes to ensure that allegations of misconduct are evaluated timely. This is of particular importance in light of the 120-day window noted above that would allow compliance and internal audit personnel to report information communicated internally to the SEC. In addition, companies should ensure that their employees are sufficiently informed about the existence of internal reporting programs and related procedures. Companies must be proactive in engaging their employees and reinforce the importance of a corporate culture that promotes legal compliance and ethical conduct in the face of a potential infraction. Educating employees and instilling attitudes of compliance should help prevent, or at a minimum mitigate, rogue employees from prematurely reporting violations to the SEC. Finally, compliance programs must allow for a speedy corporate response in dealing with potential violations and corporations must be more willing to self-report violations.

Current Developments: New Proposed Legislation

Given the attention and controversy surrounding the new whistleblower rules and continued outcry by commentators about the rules’ inherent negative effect on corporate compliance programs, it comes as no shock that members of Congress are currently entertaining new proposed legislation that would seek to preserve the viability of a company’s internal reporting system. The Whistleblower Improvement Act of 2011, which was introduced in the U.S. House of Representatives on July 11, 2011, would dramatically weaken much of the original force of the whistleblower provisions of the Dodd-Frank Act. The proposed legislation would, among other things:

1. Require internal reporting, with limited exceptions, as a prerequisite to receipt of an award
2. Remove 10% minimum award requirement
3. Deny awards to culpable whistleblowers that are found civilly liable for their misconduct
4. Require employer notification before SEC could commence any investigation related to information obtained from a whistleblower

Given the current focus on other financial matters in Washington, it is unlikely that this legislation will get much traction prior to the new whistleblower rules taking effect. However, the proposed legislation certainly will provide more validity to the continued debate as to the merit of the new whistleblower rules.

Conclusion

While new legislation looms, the new whistleblower rules will become effective in less than 15 days. Companies are advised to review their existing whistleblower policies and/or internal reporting systems as soon as possible to consider making changes to such policies and systems to further encourage employees to report potential federal securities infractions internally. Companies should implement policies that incentivize employees to report internally or otherwise risk being blindsided by potential investigations and/or examinations by the SEC.