Rules recently adopted by the U.S. Securities and Exchange Commission define the scope and procedures of the whistleblower provisions under the Dodd-Frank Wall Street Reform and Consumer Protection Act.

On May 25, 2011, the U.S. Securities and Exchange Commission (SEC), in a 3-2 split vote, adopted the final rules implementing the whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank).  Section 922 of Dodd-Frank authorized the SEC to reward whistleblowers for reporting violations of federal securities laws to the government.  Specifically, eligible persons who voluntarily provide the SEC with original information leading to an enforcement action with monetary sanctions greater than $1 million may receive 10 percent to 30 percent of the total sanctions collected.  Dodd-Frank also protects whistleblowers by providing them with a cause of action in cases where employers discharge or retaliate against them for reporting information (either internally or to the government) of possible securities law violations, and provides relief in the form of reinstatement, double-back pay and attorney fees.  Unlike monetary awards, retaliation protections apply whether or not a successful enforcement action ultimately results.

The SEC initially issued its proposed whistleblower rules for public comment on November 3, 2010 (see SEC Announces Proposed Rules on Dodd-Frank Whistleblower Program).  The proposed rules generated substantial controversy, and a large number of comments and letters (more than 1,500) to the SEC, focused primarily on the issue of whether the draft rules would incentivize employees to circumvent internal compliance programs and go directly to the government in the hope of reaping large monetary awards.  Such an effect could undercut the intent of the Sarbanes-Oxley Act of 2002, pursuant to which many companies have established robust internal safeguards and procedures.

Many comments urged that the final rules require whistleblowers to report information to their company contemporaneously with their report to the SEC in order to qualify for a whistleblower award. The final rules rejected this approach, though certain changes were made to purportedly incentivize employees to report information to their company.  These changes, however, did not go far enough for the two Republican Commissioners, who voted against the final rules.  It is likely that the final rules will be challenged in court by those who still believe that the whistleblower rules will undermine and damage internal compliance programs.  It is also possible that Congress may consider legislative changes to the Dodd-Frank whistleblower provisions.

In addition to the areas described herein, the newly adopted rules (codified in the Securities Exchange Act §21F, “Securities Whistleblower Incentives and Protection”) create procedures for submitting information to the SEC, for making an award claim after a successful action is brought and for challenging the SEC’s award amount.  Click here to view all the new rules.

While the SEC adopted its proposed rules largely unchanged, the final rules do provide some additional incentives for employees to work with their internal compliance departments.  For example, under the new rules:

• Employees who report violations internally first may still qualify for a whistleblower award, so long as they subsequently provide the same information to the SEC within 120 days (up from the 90-day waiting period under the proposed rules)
   
• The SEC may increase awards for employees who first go in-house with suspected violations, and who subsequently cooperate with internal investigations; conversely, a whistleblower’s interference with his/her company’s internal investigation can reduce the ultimate award
   
• A whistleblower can receive an award for reporting original information to a company’s internal compliance system, if the entity reports information to the SEC that leads to a successful enforcement action; under this provision, all of the information provided by the company to the SEC will be attributed to the whistleblower, which means the whistleblower will get credit—and potentially a greater award—for any additional information generated and reported by the company from its internal investigation

Another area that generated substantial commentary was the proposed rules exempting certain persons from whistleblower status.  The SEC noted that it was not its intent to incentivize whistleblowing from those with the greatest duty to prevent securities violations in the first place. Thus, under the newly adopted rules, the following are ineligible for whistleblower awards:

• Those with a pre-existing legal or contractual duty to report securities violations to the SEC (such as law enforcement officers)
• Those who obtain their information in violation of the law
• Foreign government officials
• Attorneys who obtain information through representation of a client company, including in-house counsel (information gleaned from attorney-client communications or ongoing investigations cannot be the basis of a whistleblower award, nor can information provided in response to a government inquiry/subpoena)
• Officers, directors, trustees and partners of an entity, and anyone who learns of a potential violation in connection with the entity’s processes for identifying, reporting and addressing possible violations of law
• Employees whose principal duties involve compliance or internal audit responsibilities

Importantly, as to the last two categories (e.g., officers, directors, compliance and internal auditors), these prohibitions cease to be applicable—and such persons may thus become whistleblowers under Dodd-Frank—if a company fails to self-report to the SEC within 120 days of discovering a suspected violation, if the person reasonably believes disclosure is necessary to stop the company from obstructing justice or that disclosure is necessary to prevent substantial injury to the entity or its investors. 

It is worth noting that employees who are themselves liable for the reported securities violation may still be eligible for whistleblower awards so long as they have not been criminally convicted of an offense relating to the reported violation.  The SEC can, however, decrease the whistleblower’s award in proportion to his/her culpability in the violation (and can further decrease an award based on the tardiness of a report or a lack of cooperation with an investigation).

In light of the SEC’s new whistleblower program, every U.S. publicly traded company or regulated entity, must be mindful of the need to establish and promote a culture of compliance and to reinforce training and internal reporting among its workforce.  Companies must make internal reporting fast and easy for employees, have zero tolerance for retaliating against those who report matters internally, and ensure that there is a quick and appropriately thorough response to issues raised. 

While the final whistleblower rules provide some additional incentive for employees to report issues to their company, the prospect remains quite real that employees may still choose to go directly to the government or to file a report with the SEC if they believe their company has been slow to respond to an internal report.  Companies should take stock now of the effectiveness of their compliance programs and make whatever changes may be needed to ensure that they, and not the SEC, are the recipients of whistleblowers’ reports.