In September, the U.S. Securities and Exchange Commission (the “SEC”) announced the settlement of three enforcement actions for violations of SEC whistleblower protection laws. In the actions, the SEC asserted that the companies – both public and private – had violated the SEC whistleblower protection laws in various types of separation, confidentiality, employment and other agreements, and imposed penalties of up to $10 million. The recent actions are particularly notable because certain of the companies had taken some action to comply with the rule by updating agreements and/or notifying employees of their rights under the rule, but the SEC found the actions to be incomplete or inconsistent. The actions also emphasize the importance of company remedial actions as a potential means to minimize penalties. Companies are advised to review their existing agreements to confirm whether action is needed to comply with the SEC rules. 

The SEC’s whistleblower protection rule, Rule 21F-17 under the Securities and Exchange Act of 1934, as amended, prohibits any person from taking any action to impede an individual from communicating directly with the SEC about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement related to such communications. The SEC brought a number of enforcement actions in the years following the rule’s 2011 adoption, and many companies modified their agreements as a result. Generally, the updated provisions clarify that employees have a right to communicate with the SEC or other regulatory agencies regarding potential claims, the employees do not need to notify the company of such communications and the employee is not prohibited from receiving a whistleblower award from the SEC in connection with such communications. The recent actions charged each company with violations of Rule 21F-17. 

The discussion below briefly summarizes the three enforcement actions: 

• D.E. Shaw & Company: In the enforcement action against D.E. Shaw & Company (“D.E. Shaw”), the SEC charged D.E. Shaw with impeding whistleblowing by requiring employees to sign agreements prohibiting the disclosure of confidential corporate information to third parties, without an exception for potential SEC whistleblowers, and by requiring departing employees to sign releases affirming that they had not filed any complaints with any government agency in order for the employees to receive certain compensation. After the SEC settled several actions against other companies for whistleblower violations, D.E. Shaw sent a firm-wide e-mail to all employees advising them of their whistleblower rights, notwithstanding the terms of any agreement. While the company also revised its internal policies, no updates were made to employment agreements or releases affirming that departing employees had not filed any complaints with any governmental agencies, which employees were required to sign in order to receive certain compensation and other benefits. D.E. Shaw updated its employment agreements in 2019, requiring employees to sign revised employment agreements, and updated its releases in June 2023, after the SEC had already begun its investigation that led to the recent action. In connection with the settlement, D.E. Shaw agreed to pay a civil penalty in the amount of $10 million, which far exceeds prior penalties.¹
   
• CBRE, Inc.: In the enforcement action against CBRE, Inc. (“CBRE”), a Dallas-based commercial real estate services firm, the SEC asserted that CBRE Group, Inc., a wholly-owned indirect subsidiary of CBRE, required employees to sign a release attesting that they had not filed a complaint against CBRE with any federal agency, which the SEC believed impeded potential whistleblowers from reporting complaints to the SEC. According to the SEC order, once CBRE was notified of the investigation, the company began taking remedial action, including (i) revising over 300 template agreements to bring them into compliance with whistleblower protections; (ii) updating their standards of business conduct; and (iii) recertifying over 100,000 employees worldwide in a mandatory recertification process in which employees attested to their understanding that they were not limited in their “ability to file a charge or complaint or fully cooperate (including providing documents or other information) with any government agency, including the SEC, without notice to or approval from CBRE.”² CBRE also agreed to cease and desist from causing any violations of the same rule and to pay a civil penalty of $375,000. 
   
• Monolith Resources LLC: In the enforcement action against Monolith Resources LLC (“Monolith”), a Nebraska-based privately held energy and technology company with 250 employees, the SEC charged Monolith with requiring certain departing employees to explicitly waive their right to any monetary whistleblower rewards, despite language indicating that nothing impeded the employees’ right to file a whistleblower claim. After being notified by the SEC of the investigation, Monolith undertook remedial action including voluntarily revising its separation agreements to include language providing that “nothing in this Agreement shall bar or impede in any way your ability to seek or receive any monetary award or bounty from any governmental agency or regulatory or law enforcement authority in connection with protected ‘whistleblower’ activity.”³ In connection with the order, Monolith agreed to cease and desist from committing further violations under the same law and to pay a civil penalty of $225,000. 

In the cases of both CBRE and Monolith, the SEC considered the remedial actions taken by each company in determining its civil penalties. 

The above actions should serve as a reminder to employers to review relevant company policies and agreements to ensure they are in compliance with whistleblower protection laws. 

¹https://www.sec.gov/files/litigation/admin/2023/34-98641.pdf 
²https://www.sec.gov/files/litigation/admin/2023/34-98429.pdf
³https://www.sec.gov/files/litigation/admin/2023/34-98322.pdf