Today, the Securities and Exchange Commission (SEC or Commission) voted to approve final rules to implement the SEC whistleblower provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), enacted by Congress on July 21, 2010. The vote was split, with three Commissioners voting in favor of implementation and two voting against. According to the majority of the Commissioners, the final rules attempt to balance the tension between encouraging whistleblowers to come forward to the SEC while simultaneously discouraging them from bypassing internal company compliance programs. The dissenting Commissioners disagreed, taking the position that the failure to require mandatory internal reporting would have a detrimental effect on internal compliance and spur whistleblowers to bypass those internal mechanisms in favor of directly reporting to the SEC.

Whistleblowers Protected from Retaliation

A key component of the final rules is the definition of "whistleblower," which reflects the SEC's view that the antiretaliation protections of the Dodd-Frank Act do not depend on a finding of an actual violation of securities laws. The final rules provide that "[y]ou are a whistleblower if, alone or jointly with others, you provide the Commission . . . and the information relates to a possible violation of the federal securities laws (including any rules or regulations thereunder) that has occurred, is ongoing, or is about to occur" (emphasis added). This definition tracks the statutory definition, but adds the "possible violation" language, a standard that does not require an actual violation for the antiretaliation protections to apply. In its proposed rules, the SEC had included the phrase "potential violation"; it replaced that phrase with "possible violation" in the final rules.

However, the final rules also require that, to be afforded protection from retaliation, the whistleblower must possess a "reasonable belief" that the employer is violating the securities laws. The SEC has defined "reasonable belief" in three ways: (1) specific, credible, and timely information; (2) information related to a matter already under investigation by the SEC, but that makes a "significant contribution" to the investigation; or (3) information that was provided through the employer's internal compliance mechanisms, which is subsequently reported to the SEC by the employer, and which satisfies the first or second prong of the definition. This standard is a significant change from the proposed rules (which included no such requirement), and the final rules echo and cite to specific comments and proposals that Morgan Lewis submitted to the Commission on December 17, 2010.

Finally, the SEC makes clear that the antiretaliation provisions do not depend on whether the whistleblower ultimately qualifies for an award (see below). An otherwise-eligible whistleblower is protected from retaliation even if the award requirements are not met.

Rules Relating to Eligibility for an Award

To be considered for an award, the whistleblower must (1) voluntarily provide the SEC (2) with original information (3) that leads to the successful enforcement by the SEC of a federal court or administrative action (4) in which the SEC obtains monetary sanctions totaling more than $1 million.

The final rules provide that an individual whistleblower may be eligible for an award of 10% to 30% of the recovery, depending on a number of factors. This range reflects the SEC's attempt to balance competing interests: receiving high-quality information directly from whistleblowers and encouraging whistleblowers to utilize internal compliance procedures.

Reporting Through Internal Compliance Procedures

As an initial matter, a whistleblower need not report information through an employer's internal compliance procedures in order to be eligible for an award. This issue was left undecided under the proposed rules. In the final rules, however, the SEC has left the decision of whether to use internal compliance up to the individual whistleblower. This reflects the SEC's belief that whistleblowers will utilize robust internal compliance measures if they exist, despite having no requirement that they do so.

The SEC has set up financial incentives as a further effort to encourage the use of internal compliance measures. In determining the amount of an award, voluntary participation in corporate internal reporting programs can increase the reward, while interference with corporate internal reporting programs can decrease the reward. These incentives had not been included in the proposed rules.

Moreover, if any individual reports information to the company's internal compliance team or other similar department, the individual has 120 days from the original date of submission to report the information to the SEC. The individual will receive credit as if he or she had reported "original" information to the SEC on the date he or she disclosed it internally. This provision is also designed to promote internal compliance measures.

Similarly, the final rules provide that if a whistleblower reports information through the employer's internal compliance systems, and if the company subsequently self-reports to the SEC, the original whistleblower is credited with the report and any resulting award.

Original and Voluntary Information

Further, to obtain an award, the final rules require that the whistleblower come forward voluntarily. The SEC has defined "voluntarily" to exclude information provided pursuant to a subpoena, judicial order, demand from government authority or the Public Company Accounting Oversight Board, or pre-existing legal obligation (such as those of certain corporate officers).

The whistleblower must also provide "original information" to qualify for an award. "Original information" must be derived from the whistleblower's "independent knowledge or independent analysis."

The final rules exclude certain categories of information from the definition of "original information." For example, the SEC would not generally consider information obtained through an attorney-client privileged communication to be derived from independent knowledge or analysis. The carveout for attorneys reflects the SEC's concern that the monetary incentives of the SEC whistleblower program may deter companies from consulting with attorneys about potential securities laws violations.

The final rules also exclude any information gained through the performance of an engagement required under the securities laws by an independent public accountant if the information relates to a violation by the engagement client or its directors, officers, or other employees. This exception reflects the SEC's recognition of the role of independent public accountants and their pre-existing duty under securities laws to detect illegal acts.

The SEC also excludes from "original information" any information the whistleblower obtained as a person with legal, compliance, audit, supervisory, or governance responsibilities for an entity, such as an officer, director, or partner, if the information was communicated to the whistleblower through the company's internal compliance mechanisms. However, this exclusion is not absolute, and several exceptions allow such individuals to still be whistleblowers (e.g., if the person believes that disclosure is needed because the company is engaging in conduct likely to cause substantial injury to the financial interest or property of the entity or investors). Here, the SEC attempts to reconcile the tension between the potential bounty available to whistleblowers and its recognition that effective internal compliance programs can promote the goals of federal securities laws.

Misconduct and Aggregation

Finally, the final rules do not necessarily disqualify a whistleblower who has engaged in fraud or misconduct, even if it is the same fraud or misconduct the whistleblower is reporting. The degree and nature of the misconduct is simply a factor the SEC will consider in determining the award to a whistleblower.

In determining whether the $1 million in monetary sanctions threshold has been satisfied (a necessary precondition for award eligibility), the SEC will aggregate awards from separate proceedings if the proceedings were based on the same nucleus of operative facts.

Impact on FCPA Investigations

The whistleblower provisions of the Dodd-Frank Act will almost certainly result in a significant increase in the number of Foreign Corrupt Practices Act (FCPA) investigations initiated by current and former employees through allegations related to bribery of foreign officials. In recent years, some of the highest SEC recoveries have been in FCPA books and records cases, including, in recent months, settlements of $77 million, $137 million, and $218 million. Whistleblowers, who stand to obtain awards of 10% to 30% of those staggering amounts, will be highly incentivized to report allegations of the books and records provision of the FCPA, which the SEC enforces through civil enforcement proceedings.

Impact on Covered Entities

According to the SEC, through these final rules it has attempted to "incentivize" whistleblowers to use company internal compliance programs while simultaneously offering whistleblowers the right to contact the SEC directly. Although this compromise may dissuade some from reporting internally, having robust internal mechanisms is still of utmost importance. In light of these rules, companies should undertake a thorough review of their internal compliance programs and assess their effectiveness. The quality of these programs may significantly impact whether (1) a whistleblower approaches the SEC in the first instance, or (2) the employee complains internally and waits to see how effectively the company handles the internal complaint. Further, the availability and quality of these programs will have a significant effect on whether the SEC decides to initiate an investigation, or whether it believes that the company has cured any problematic conduct such that no investigation or enforcement action is necessary.

It is too early to tell whether the final rules will lead to a flood of tips to the SEC that may lack depth and credibility, or if the rules will enhance the quality of information and enforcement. Since the passage of the Dodd-Frank Act, the SEC has reported that it has seen an increase in high-quality tips. It remains to be seen, however, whether increased publicity around whistleblower awards will have an adverse impact on the quality of the reports the SEC receives.