On November 3, 2010, the SEC published proposed rules to implement a whistle­blower program to reward individuals who provide the agency with original information that leads to a successful enforcement action resulting in monetary sanctions in excess of $1,000,000. The SEC has proposed these rules to implement the provisions of new Section 21F of the Securities Exchange Act of 1934, which was added by Section 922 of the Dodd-Frank Wall Street Reform and Con­sumer Protection Act (the “Dodd-Frank Act”) to create monetary incentives and job protections for securities whistleblowers. Comments on the proposed rules are due no later than December 17, 2010. Final rules are due in mid-April 2011.

Although final rules are not yet in effect, the whistleblower bounties and job protections under Section 21F became effective on July 21, 2010 for information provided after that date. Public companies should expect an increase in whistleblower activity in response to this new legislation (even before the SEC published the proposed whistleblower rules, the staff had already received a large number of tips from potential whistleblowers under the Dodd-Frank Act). Thus, public companies and other entities regulated under the securities laws should not delay gaining an understanding of, and preparing to deal with, these provisions.

This e-alert summarizes the key components of the SEC’s proposed rules implementing the whistleblower provisions of new Section 21F, as well as practical implications that the proposed rules have for public companies and other entities that could be alleged to have violated the securities laws. A PDF of the full text of the proposing release is available here.

Background

Federal law has long included statutes and rules that provide bounties and job protec­tions to persons who provide information that leads to the successful prosecution of certain types of claims. For example, the False Claims Act, enacted during the Civil War, enables private indi­vi­duals, with knowledge of a fraud against the federal government, to bring fraud claims on the government’s behalf against the party alleged to have committed the fraud. If the action is successful, such whistleblowers share in the recoveries against the defrauding party. The False Claims Act also prohibits the employer from firing or otherwise retaliating against the whistle­blower.

The SEC has had, since 1989, authority to grant bounties to whistleblowers, but that authority was strictly limited to insider trading cases and has been used sparingly.¹ In an effort to bring more securities fraud under regulatory scrutiny (and to cause that scrutiny to occur earlier), the Dodd-Frank Act establishes whistleblower incentives for all types of securities fraud and securities law violations (including violations of the Foreign Corrupt Practices Act) and directs the SEC to adopt implementing rules. It also greatly expands the job protections for securities-related whistleblowers that were first enacted under the Sarbanes-Oxley Act of 2002.

Proposed Whistleblower Award Rules

The new rules proposed by the SEC generally track the requirements and whistleblower protec­tions of Section 21F, although they provide some refinements of the requirements for being eligible for receiving a whistleblower bounty and of the whistleblower protections provided in the statute. The proposed rules define a “whistleblower” as any individual (corpora­tions and other entities are not eligible) who “alone or jointly with others … provide[s] the Commission with information relating to a potential violation of the securities laws.” Proposed Rule 21F-3(a) provides that—subject to certain other requirements—the SEC will pay an award to one or more whistleblowers who:

1. Voluntarily provide the Commission
2. With original information
3. That leads to the successful enforcement by the Commission of a federal court or administrative action
4. In which the Commission obtains monetary sanctions totaling more than $1,000,000. (Emphasis added.)

Proposed Rule 21F‑3(b) provides that a whistleblower will be entitled to an award based on amounts collected in “related actions” by certain other governmental or quasi-governmental entities as well.

Where all of the conditions to an award are met (and none of the exclusions are applicable), Section 21F requires the SEC to award the whistleblowers between 10 and 30 percent of the amounts actually recovered.² Each of the italicized terms above, and various exclusions from the whistleblower program, are discussed further below.

First Requirement—Voluntary Reporting. Proposed Rule 21F‑4(a) provides that, to be “voluntary,” the whistleblower must provide the tip to the SEC or other authority before he or she receives any request from one of those authorities about the relevant matter.³ A request from the SEC or other authority to an employer is deemed to be directed to the employees who possess the requested information. Therefore, in order to be eligible for an award, any such employee must provide the information to the government before his or her employer receives a request that covers such information.

A tip that is provided after a demand has been made by the SEC or other authority will be con­sidered voluntary if, after receiving that demand, the employer fails to provide the requested information within a reasonable period of time. The proposing release explains that: “The determination of what is a ‘reasonable time’ in this context will necessarily be a flexible concept that will depend on all of the facts and circumstances of the particular case. In some cases—for example, an ongoing fraud that poses substantial risk of harm to investors—a ‘reasonable time’ for disclosing violations to the Commission may be almost immediate.”

Second Requirement—Original Information. Proposed Rule 21F‑4(b)(1) defines original information as information derived from the whistleblower’s “independent knowledge” or “independent analysis” that is not otherwise known to the SEC from any other source. “Independent knowledge” is defined as factual infor­ma­tion in the whistle­blower’s possession that is not derived from publicly available sources. There is no requirement that the whistleblower have direct, first-hand knowledge of the alleged violations, and the “independent knowledge” may be gleaned from the whistleblower’s experi­ences, communica­tions and observations (including information imparted by third parties). “Independent analysis” means the whistleblower’s own analysis (whether done alone or with others) which reveals information that is not generally known or available to the public.⁴

The new whistleblower program may discourage employees from reporting securities law viola­tions directly to their employers. The proposing release extensively discusses the tension between this outcome and the SEC’s interest in seeing that companies develop and implement effective internal compliance mechanisms. In an effort to balance these competing interests, proposed Rule 21F-4(b)(7) provides that any disclosure of whistle­blower information to the SEC will relate back to (and be deemed to made as of) an earlier disclosure of the same information to Congress, the other regulatory bodies described above or a person with legal, compliance, audit, supervisory or governance responsibility for the company that is the subject of the disclosure as long as the disclosure to the SEC occurs no later than 90 days after that earlier disclosure. Because a whistleblower is permitted to keep a “place in line” during this 90-day period, employees may be willing to consider reporting potential violations internally in the first instance.⁵

Third Requirement—Successful Enforcement. The SEC has identified two circum­stances that constitute information leading to successful enforcement:

• “information that caused the staff to commence an examination, open an investigation, reopen an investigation that the [SEC] had closed, or to inquire concerning new or different conduct as part of a current examination or investigation, and [that] information significantly contributed to the success of the action”; or
• “information about conduct that was already under examination or investigation by the [SEC, Congress or various other authorities] … , and [that] information would not otherwise have been obtained and was essential to the success of the action.” (Proposed Rule 21F-4(c).)

Generally, the SEC believes that awards should be limited to cases where “whistleblowers provide original information about violations that are not already under investigation.” However, the second standard described above allows for “rare circumstances where information received from a whistleblower… is so significant” that an award on that basis should be considered.

Fourth Requirement—Monetary Sanctions. The action must be a single civil or administrative proceeding that results in monetary sanctions (including penalties, disgorgement and interest) ordered to be paid exceeding $1,000,000.

Various Exclusions. The proposed rules include certain partial or complete exclusions from eligibility for a whistleblower award.

Pre-existing duty. Disclosure to the government is not considered voluntary, and the disclosing person is therefore ineligible for an award, if the would-be whistleblower has a “a pre-existing legal or contractual duty to report the securities violations that are the subject of” the tip to the SEC or another authority. (Proposed Rule 21F-4(a)(3).) The purpose of this restriction is to prevent whistleblower awards to employees, officers or members of the SEC, the Department of Justice, other regulatory entities, the Public Company Accounting Oversight Board or an auditor.

Lack of independent knowledge. Certain classes of individuals are deemed not to possess “independent knowledge” and not to have performed “independent analysis” (and therefore are ineligible for awards):

• Attorneys. Neither an attorney who receives information as part of a privileged attorney-client communication, nor any person providing services to any such attorney, is eligible to receive a whistleblower award. The eligibility exclusion for attorneys does not apply if the privilege has been waived or if disclosure of the information imparted is permitted pursuant to 17 C.F.R. § 205.3(d)(2)⁶ or applicable state bar ethical rules. Although the proposed rules place limitations on whistle­blower awards to attorneys, they also establish economic incentives and employment protections for an attorney to “report out” possible violations to the government where disclosure is permitted as described above.

• Auditors. An independent public accountant (and its employees) performing an engagement for an audit client required under the securities laws is not eligible to receive a bounty if the information disclosed “relates to a violation by the engagement client or the client’s directors, officers or other employees.” This exclusion does not apply to the engagement client’s employees (even if they are working with the outside auditor), to the auditor’s violation of its obligations with respect to the audit or to information obtained performing non-audit work.

• Compliance personnel. An individual with legal, compliance, audit, supervisory or governance responsibilities for an entity cannot claim a whistleblower award if the information was communicated to that person with the reasonable expectation that the individual would cause the entity to respond to a possible violation. This exclusion apparently does not apply to accounting employees who do not have any of the responsibilities described above and to whom information regarding a possible violation is communicated. In addition, any person who learns of a possible securities law violation from or through personnel in these functional areas is also ineligible. For example, an employee who is interviewed by internal audit staff member—and thereby learns about a possible securities law violation—would not be eligible for a whistleblower bounty.⁷ However, the exclusion for compliance personnel does not apply if the entity fails to disclose the information to the SEC within a reasonable time or it proceeds in bad faith.

• Individuals who violate criminal laws. An individual who obtains information in violation of an applicable federal or state criminal law (e.g., through an illegal wiretap or interception of U.S. mail) is ineligible for a whistleblower award.

• Individuals who obtain ineligible information. An individual who acquires information from a person who lacks independent knowledge for one of the reasons described above is also ineligible for a whistleblower award.

Other categories. Certain proposed rules make other categories of individuals ineligible for bounties. For example, a person is ineligible to receive a whistleblower award if that person (1) is convicted of a criminal violation that is related to the action brought on account of the information or (2) makes any false statement or acts dishonestly in his or her information submission or other dealings with the government.

Proposed Whistleblower Anti-Retaliation Provisions

If a person meets the basic definition of a whistleblower (i.e., a person who provides information regarding a possible securities law violation to the SEC), the proposed rules clarify that he or she will be entitled to the anti-retaliation protections of Section 21F regardless of whether the whistleblower satisfies the additional requirements for an award. Thus, an employee claiming the benefit of the anti-retaliation provisions of Section 21F does not have to be correct about the existence of a securities violation, does not have to provide any “original information” and does not have to be providing the information “voluntarily.” Section 21F(h) broadly prohibits many types of adverse employment and other actions against a whistleblower for any lawful act done in providing information to the SEC, in initiating, testifying or assisting in an investigation or judicial or administrative action or in making certain disclosures that are required or protected under the Sarbanes-Oxley Act of 2002.

The proposed rules do not otherwise implement the anti-retaliation protections under the Dodd-Frank Act, but the SEC release seeks comment on whether it should promulgate rules regarding the interpretation or implementation of these provisions.

Practical Advice under the Proposed Rules

Section 21F and the proposed rules raise potentially significant issues for public companies and other entities subject to the securities laws.

Timing. Although the proposed rules attempt to avoid creating disincentives for employees to report internally, public companies and other entities subject to the securities laws will need to try to complete internal investigations more quickly. As noted above, if an employee discovers a potential securities law violation and the employee chooses to report that violation internally to legal, internal audit or compliance personnel, that whistleblower can maintain “first in line” status only if the employee then makes a whistleblower report to the SEC within 90 days after making the internal report. Therefore, a company that receives a whistleblower report from an employee will have to assume that the employee will want to “monetize” the infor­ma­tion by reporting that matter to the SEC within 90 days and plan its investigation accordingly.⁸ If the investigation finds a violation (or if a securities law violation is a strong possibility), the company will have to consider self-reporting to the SEC within that same 90-day period so as to report the violation to the SEC before the whistleblower (or, if that is not possible, so as to minimize the lag between the whistleblower’s and the company’s own reports to the SEC). SEC officials have indicated that they will consider the lapse of time between the whistleblower report and the entity’s self-report in granting credit for cooperation.

Loss of Incentives to Proceed Internally. Although the proposed rules give an employee an opportunity to report potential violations internally while retaining a “first in line” position for an award (and perhaps include some incentives for an employee to report internally first), it is not clear that employees will necessarily perceive any advantages of internal reporting. A company may, therefore, consider monetary awards to employees or other efforts to promote use of its hotline.⁹ In addition, because of the tension between the whistleblower rules and internal com­pliance measures, the SEC indicated that, in certain instances, it will contact the company that is the subject of a whistleblower report, describe the nature of the allegations and ask the company to investigate the matter and report back. How a company acts in responding to any such reports will be evaluated by the SEC in determining how and whether to give that company credit for cooperation.

Challenges for Human Resources. The proposed whistleblower rules present challenges in communicating with employees. Should an employer explain to its employees the provisions of the new law that encourage internal reporting, at the risk of further publicizing the SEC’s bounty program? Or should the employer not bring to its employees’ attention the Dodd-Frank whistleblower provisions in the hope that employees will simply report internally and not think about reporting to the SEC? There is no easy or obvious answer to these questions.

In addition, employee communications must avoid any appearance of attempting to dissuade employees from reporting possible securities law violations to the SEC. Proposed Rule 21F‑16(a) provides: “No person may take any action to impede a whistleblower from communicating directly with the [SEC] staff about a potential securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement” other than agreements dealing with attorney-client privileged information or other information obtained in connection with the legal representation of a client. Moreover, the rules specifically authorize communications directly between the staff and a whistleblower notwith­stand­ing the ethical issues that might otherwise be applicable.

Issues for Dealmaking. The rule prohibiting the enforcement of a confidentiality agreement where it impedes a would-be whistleblower raises troubling issues in the M&A context. Suppose Company A is in discussions to acquire Company B and, in the course of customary due diligence, a Company A employee discovers that Company B has serious potential problems under the Foreign Corrupt Practices Act. Proposed Rule 21F‑16(a) may be construed as pro­hibit­ing both (1) Company B from suing Company A’s employee to enforce a standard confidentiality agreement entered into in connection with accessing an online data room, and (2) Company A from seeking to prevent its own employee from reporting a third party’s (i.e., Company B’s) possible violation to the SEC. Because of this, the proposed rules may cause the target in an acquisition to withhold information on certain sensitive topics or to limit and delay disclosure of possible securities law violations to the acquirer in a way that minimizes the possibility of whistleblower release by Company A and its employees.¹⁰ In addition, because it is not clear that Company A’s employee is eligible to take advantage of the 90-day relation-back provision, discussed above, to report Company B’s potential violation to Company A, an employee that wants to “monetize” the information seems likely to report the violation initially—and perhaps only—to the SEC (with potentially disastrous consequences to Company A).

Protections for Wrongdoers. Even an individual who participated in the actions underlying the potential securities law violations can be a whistleblower and can claim entitlement to the anti-retaliation provisions of Section 21F (and under certain circumstances claim an award as well). Thus, an employee who participated in wrongdoing and is being investigated by a company’s internal audit function (or merely fears being caught) might choose to become a whistleblower in the hopes of earning a reward, and delaying or precluding dismissal, demotion or other adverse employment actions. Moreover, because the anti-retaliation protections attach only after a report is made to the SEC, that employee may choose to tip off the SEC and bypass his or her employer’s internal processes. Similarly, an employee who did not take part in the wrongdoing but who was aware of it (or who should have discovered it earlier) may likewise find that the benefits of reporting the violation directly to the SEC outweigh the risks of reporting a matter internally and possibly being fired.

Risks of Employment Disputes. Public companies and other entities subject to the securities laws should monitor grievances that might result in whistleblower complaints and take prompt action. Human resources personnel should communicate with the company’s legal department regarding any such grievances. As noted above, the proposed rules and Section 21F include broad anti-retaliation protection for employees that may make it difficult to terminate an employee in the midst of an investigation.

Sarbanes-Oxley Certifications. If a public company’s CEO and CFO receive a Sarbanes-Oxley sub-certification that indicates a concern about financial reporting or material misstatements or omissions in disclosure documents, the company should be alert to a possible whistleblower claim. Likewise, if an employee refuses to provide a sub-certification in advance of an SEC filing, the company should consider whether the employee may be holding back information for a whistleblower report.

Disclosure of Whistleblower Reports in Public Filings. Although disclosure of whistleblower reports is not required by the proposed rules, in determining whether disclosure should be made, a company will want to consider the materiality of the investigation, based on, among other things, the stage of the investigation, the materiality of the allegations, the reliability of the information and any offering or corporate action then being considered

 * * * * *

1. This bounty provision played a role in the SEC’s recent successful case against Pequot Capital Management, Inc., Arthur J. Samberg and David E. Zhilka. Zilkha’s ex-wife apparently discovered a key email communica­tion between Zilkha and a Microsoft employee that was not turned over to the SEC in an earlier investigation of possible insider trading in Microsoft stock. The whistle­blower later received a $1 million bounty from the $27 million in penalties and disgorgement Pequot and Samberg agreed to pay to settle the case.

2. Section 748 of the Dodd-Frank Act requires the CFTC to award bounties to commodities-related whistle­blowers under similar circumstances. The CFTC has proposed similar rules for whistleblowers subject to its jurisdiction.

3. These other authorities include any other federal, state or local authority, any self-regulatory body and the Public Company Accounting Oversight Board, but does not include (as currently proposed) foreign regulatory or law enforcement bodies.

4. In theory, the academics who prepared the analyses that disclosed suspicious patterns in the grant dates for certain executives’ options that ultimately led to a large number of back-dating investigations could have claimed whistleblower status if the proposed rules had been in effect in 2006 and if they had submitted their analyses first to the SEC.

5. In addition, the proposing release suggests that an employee’s decision to report a possible violation internally will be one of the positive factors considered in determining whether to make an award above the 10 percent minimum level.

6. This rule, which was adopted following the enactment of the Sarbanes-Oxley Act of 2002, permits attorneys practicing before the SEC to disclose client information to the SEC if necessary to prevent (or rectify the consequences of) a material violation of the securities laws that is likely to cause substantial injury and/or to prevent the committing or suborning of perjury in an SEC investigation.

7. On the other hand, an employee who hears office rumors about the potential violation, but does not receive such information from the employer’s legal, compliance or audit functions, would appear to possess independent knowledge even if those rumors resulted from the actions of the legal, compliance or audit functions.

8. Even if there is no employee who provided a tip and thus the 90-day clock has not started ticking, Section 21F creates new pressures to complete the investigation early and, if a violation is found, to self-report to the SEC. As noted above, the proposed rules would allow personnel in legal, internal audit and compliance functions to report possible securities violations to the SEC and claim an award if the employer does not report such information itself within a reasonable time or otherwise acts in bad faith.

9. Because of Rule 21F-16(a), discussed below, it is doubtful that a company offering such rewards should tie them to making a submission of whistleblower information before making disclosure to the SEC in the absence of exemptive or other interpretive relief.

10. At the same time, it is not clear that the proposed rules would prevent Company B from suing Company A for damages arising from the whistleblower disclosure by Company A’s employee.