On Wednesday, May 25, 2011, the Securities and Exchange
Commission issued its long-awaited final rules implementing the
"Securities Whistleblower Incentives and Protection"
provisions of the Dodd-Frank Act.1 New Regulation 21F
defines the meaning and scope of the SEC's obligation to pay an
award to one or more "whistleblowers" who
"voluntarily" provide "original information" to
the SEC that "leads to the successful enforcement" of an
"action" or "related action" in any judicial or
administrative action brought by the SEC under the federal
securities laws that results in monetary sanctions of more than $1
million. The rules become effective 60 days after publication in
the Federal Register.
Following the November 2010 issuance of the SEC's proposed
rules,2 the SEC received over 240 comment letters from
individuals, whistleblower advocacy groups, attorneys, public
companies, audit firms and other interested industry participants.
According to SEC Chairman Mary Schapiro, "The final
recommendation strikes the correct balance—a balance
between encouraging whistleblowers to pursue the route of internal
compliance when appropriate—while providing them the
option of heading directly to the SEC. This makes sense as well
because it is the whistleblower who is in the best position to know
which route is best to pursue." Adoption of this rule is a
significant development and is yet another step in a broader
initiative the SEC has undertaken to encourage and reward real-time
reporting of possible wrongdoing.3
The final rules were adopted by a narrow 3-2 vote, with
Commissioners Casey and Paredes dissenting. Both dissenters echoed
comments from the corporate community in objecting to the lack of
an internal reporting requirement. Commissioner Casey noted that
without such a requirement, the large financial awards available
through the program may encourage individuals with information
about potential wrongdoing to "completely bypass" company
compliance procedures, thereby depriving companies of any
opportunity to identify and reprimand wrongdoers swiftly and
efficiently. Commissioner Paredes added that even without an
internal reporting mandate, the final rules could have done more to
ensure that the SEC's whistleblower program does not
"unduly erode" the value of internal compliance
programs.
Key Revisions to the Proposed Rules
Internal Compliance
As noted, notwithstanding strong objections by the corporate
community, the final rules do not require employees to report
possible violations of law through internal compliance processes as
a prerequisite to eligibility for an award. Rather, the SEC made
the following changes to the proposed rules in an effort to
incentivize whistleblowers to utilize employer-sponsored complaint
and reporting procedures:
- The SEC will consider voluntary participation in an
entity's internal compliance and reporting systems as a factor
that could increase the amount of an award. Conversely, a
whistleblower's attempt to discourage or interfere with
internal compliance and reporting may decrease the amount of an
award.
- Whistleblowers who report a potential violation internally will
be eligible to receive an award if the company simultaneously or
later reports information to the SEC that leads to a successful
enforcement action. Thus, an employee or other individual who opts
to report internally is given credit not only for the original
information provided to the company, but also for any additional
information that the company learns in its investigation.
- The final rules extend the grace period for a whistleblower to report a potential violation to the SEC after reporting internally from 90 to 120 days. Thus, if a whistleblower offers information to a company and within 120 days provides the same information to the SEC, that whistleblower will be deemed to have reported to the SEC on the earlier date at which he reported to the company. As a result, the whistleblower's information may still be considered "original" even if, in the interim, the SEC acquired that information from another source.
The SEC noted that in "appropriate cases," it will
notify a company of its receipt of a whistleblower complaint, and
give the company an opportunity to investigate the matter and
report back to the SEC. In determining whether to give a company
such an opportunity, the SEC may consider a number of factors,
including, but not limited to, the nature of the alleged conduct,
the level at which the conduct allegedly occurred, and the
company's existing culture related to corporate
governance.
Exclusions for Certain Persons and Information
The proposed rules, with some exceptions, excluded from eligibility
certain professionals such as attorneys, auditors and internal
compliance personnel, whose knowledge of potential violations does
not, according to the SEC, constitute "independent knowledge
or analysis of a whistleblower." The final rules maintain each
of the exclusions, subject to some modifications:
- Information obtained through a communication that is subject to the attorney-client privilege or in connection with legal representation remains excluded under the final rules, except where disclosure is permitted under the rules of professional responsibility. The final rules clarify, however, that the exclusion also applies to non-attorneys who learn information through confidential attorney-client communications. The final rules also clarify that the exception applies equally to outside and in-house counsel.
- Like the proposed rules, the final rules exclude information
that is learned by employees of, or other persons associated with,
a public accounting firm through an audit or other engagement
required under the federal securities laws. In addition, public
company auditors are ineligible for awards where the information
was obtained through an audit of a company's financial
statements, and making a whistleblower submission would be contrary
to the requirements for auditor reporting of potential illegal
activity specified in Section 10A of the Exchange Act. The SEC
declined to extend this exclusion to company employees involved in
control or accounting functions.
- Under the final rules, compliance and internal audit personnel, outside auditors, and persons retained to investigate possible violations who are otherwise excluded from eligibility may nonetheless qualify for an award under the following three circumstances: (i) there is a reasonable basis to believe disclosure is necessary to prevent substantial injury to the financial interest or property of the company or its investors; (ii) there is a reasonable basis to believe that the company is impeding an investigation of the misconduct; or (iii) at least 120 days have elapsed since the whistleblower either reported the information internally, or learned that the information had already been reported internally.4
The final rules exclude officers, directors, trustees, and
partners from eligibility if they are informed of allegations of
misconduct, or they learned about misconduct through the
company's investigative processes. They remove the language in
the proposed rules that only excluded these individuals if the
information was communicated to them with the reasonable
expectation that they would take steps to cause the company to
respond.
Eligibility of Culpable Whistleblowers
In response to the proposed rules, the SEC received comment letters
advocating that the definition of "whistleblower" be
limited to an individual who provides information about potential
violations of the securities laws "by another person,"
thus excluding culpable whistleblowers from eligibility. While the
SEC recognized the policy concerns associated with paying culpable
whistleblowers for their own misconduct or for violations that they
directly caused, the final rules contain no per se
exclusion for culpable whistleblowers. Rather, Section 21F-6
stipulates that the SEC will consider culpability as a factor in
determining the amount of an award. In addition, in determining
whether the $1 million threshold has been met, the SEC will not
take into account monetary sanctions ordered against any company
whose liability is based substantially on conduct that the culpable
whistleblower directed, planned or initiated.
Aggregation of Monetary Sanctions
For purposes of calculating whether monetary sanctions meet the $1
million threshold, the proposed rule defined an "action"
as a single captioned judicial or administrative proceeding. Under
the final rules, the SEC retained the original definition of an
"action," but the agency now permits aggregation when
multiple proceedings arise from the same nucleus of operative
facts. As a result, the final rules may allow aggregation where
multiple actions arise from a single investigation.
Key Provisions that Remained Unchanged from the Proposed Rules
Independent Knowledge
The proposed rules defined "independent knowledge" to
include knowledge obtained from any of the whistleblower's
experiences, observations, or communications, including third-party
sources—subject to the exclusion of knowledge derived
from publicly available sources. The final rules adopt this
definition of "independent knowledge" as proposed without
imposing restrictions on second-hand information. The final rules
specify, however, that in order to be eligible for an award, a
whistleblower must provide information that is sufficiently
specific, credible, and timely that it causes the staff to open an
investigation, or significantly contributes to the success of an
enforcement action.
Scope of Anti-Retaliation Provisions
Under the proposed rules, Section 21F's anti-retaliation
provisions would apply regardless of whether all of the procedural
requirements to receive an award have been satisfied.
Notwithstanding suggestions from commenters to limit
anti-retaliation protection to those who qualify for an award, the
final rules make clear that the statute's whistleblower
protections apply to anyone who "possess[es] a reasonable
belief that the information" provided "relates to a
possible securities law violation . . . that has occurred, is
ongoing, or is about to occur,"5 irrespective of
whether the whistleblower is ultimately entitled to an award.
Contingency Fees for Whistleblower Counsel
The SEC declined to adopt provisions to limit fees attorneys may
collect from representing whistleblowers who receive an award under
the SEC's program. Rather, the SEC opted to defer to state bar
authorities and to contractual arrangements between prospective
whistleblowers and their attorneys to determine appropriate
fees.
Whistleblower Office
On February 18, 2011, the SEC named Sean McKessy as the Chief of
the Office of the Whistleblower. The creation and staffing of the
office, which is mandated by Section 924(d) of the Dodd-Frank Act,
had been deferred in late 2010 due to budget uncertainty. To date,
the functions of the office continue to be assigned to existing SEC
staff. The SEC indicated that the office will be developing
procedures in the coming months.
Conclusion
In adopting the rules, the SEC emphasized the challenge it
faced of trying to modify the proposed rules in a manner that
balanced the policy goals of the Dodd-Frank whistleblower provision
with the goal of supporting and encouraging robust internal
reporting programs. It remains to be seen whether the SEC's
limited provisions to encourage internal reporting will have any
meaningful impact. As highlighted by Commissioner Paredes, the
corporate community will also watch closely to determine whether
the exceptions to the exclusions for outside auditors and various
compliance and audit personnel will effectively swallow the general
rule against eligibility for these persons.
As the new Section 21F is implemented in the coming months, we
recommend that companies reexamine their internal processes to
ensure that they are designed to actively encourage self-reporting
and to effectively investigate reports of potential violations. We
further recommend that companies review their anti-retaliation
policies to ensure that they are in accordance with Section
21F(h)(1) of the Exchange Act.
Footnotes
1 Dodd-Frank Wall Street Reform and Consumer Protection
Act of 2010 ("Dodd-Frank Act"), Pub. L. No. 111-203, 124
Stat. 1376 (2010). Section 922 of the Dodd-Frank Act adds new
Section 21F to the Securities Exchange Act. The Final Rule,
Exchange Act Release No. 34-64545 (May 25, 2011), is available
at:
www.sec.gov/rules/final/2011/34-64545.pdf.
2 For a description of the proposed rules, see our November 17,
2010
Client Alert.
3 As the SEC Director of the Division of Enforcement Robert Khuzami
explained recently, "The Madoff and Stanford frauds reminded
us of the importance of getting evidence early on of wrongdoing.
It's important to have people come forward, and we are amenable
to incentives. That means increasing corporate cooperation,
encouraging self-reporting and reduced sanctions, deferred
prosecution and non-prosecution agreements." Samuel Howard,
"SEC Enforcement Chief Exalts Partnership Programs,"
Law360 (May 19, 2011), available at
www.law360.com/articles/246227/sec-enforcement-chief-exalts-partnership-programs.
4 Rule 21F-4(b)(4)(v)(C) stipulates that the 120-day
grace period begins as of the date the whistleblower reported the
information to the company's audit committee, chief legal
officer, chief compliance officer (or their equivalents), or the
whistleblower's supervisor, or the date the whistleblower
learned that any of these persons were already aware of the
information.
5 Section 240.21F-2(b)(1)(i).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.