On May 25, 2011, the Securities and Exchange Commission issued final rules to implement provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act designed to encourage whistleblowers to report suspected securities violations to authorities. Dodd-Frank, enacted in July 2010, established a whistleblower program that instructed the SEC to pay awards (referred to by some as "bounties"), worth between 10 and 30 percent of sanctions collected, to whistleblowers whose tips lead to the recovery of monetary sanctions exceeding $1 million. Under the new rules, whistleblowers can report violations directly to the SEC instead of going through their companies' internal reporting channels. However, the rules include provisions designed to encourage whistleblowers to utilize their companies' internal compliance and reporting systems. The rules will become effective on August 12, 2011.
Internal Reporting Not Required Before Going to SEC
The most controversial aspect of the new rules is the lack of a requirement for whistleblowers to report violations of securities laws first through their companies' internal reporting and compliance systems before submitting the information to the SEC. The SEC staff believes that there are a significant number of whistleblowers who would not report violations if they were required to report internally. In addition, the SEC anticipates that the new rule will motivate companies to promote a corporate environment where whistleblowers would feel more comfortable reporting violations internally. Further, in some cases, law enforcement interests will be better served if the SEC is notified of a company's violations without the company's knowledge, particularly when the company may try to hinder or obstruct an SEC investigation.
In response to concerns that the proposed rules would provide an incentive for whistleblowers to bypass internal reporting procedures, the SEC included some provisions in the new rules designed to continue to encourage use of internal programs. First, the SEC will consider a whistleblower's participation in internal reporting as a factor that can increase the amount to be awarded, and it will consider a whistleblower's interference with internal reporting systems as a factor that can adversely affect the amount to be awarded.
Second, a whistleblower will still receive an award for reporting a violation internally as long as the company provides that information to the SEC. The whistleblower could potentially receive a greater award under this provision because he or she would be attributed credit for any information uncovered during the company's subsequent internal investigation.
Third, the SEC provides whistleblowers a window of time, during which they can first report violations internally but still be eligible for an award from the SEC. The final rules set the length of this window of time, known as a "lookback period," at 120 days. Thus, a whistleblower will have 120 days after initially reporting violations internally, during which he or she can then report the violation to the SEC and still be treated as if he or she had reported to the SEC at the earlier reporting date (i.e., the date at which the whistleblower reported the violations internally). As a result, making an internal report will not preclude the whistleblower from collecting an award, as long as he or she reports the same information to the SEC within 120 days.
Not All Personnel Eligible for Whistleblower Awards
In order for a whistleblower to be eligible for an award, four elements must be fulfilled: the whistleblower must (1) "voluntarily provide" the SEC with (2) "original information" about a violation of securities laws that (3) leads to the successful enforcement of an action by the SEC that (4) results in sanctions exceeding $1 million. For purposes of calculating whether the collected monetary sanctions exceed the $1 million threshold, the rules provide for aggregation of multiple monetary sanctions arising out of the same nucleus of operative facts.
Certain categories of persons and information are not eligible for the new whistleblower program. These include, among others and with some exceptions such as to prevent substantial injury to the financial interests of investors, (1) individuals with a pre-existing legal or contractual duty, or a duty arising from a judicial or administrative order, to report violations to authorities, (2) attorneys who become aware through communications subject to the attorney-client privilege, unless state attorney conduct rules, SEC regulations, or other applicable laws permit disclosure, (3) internal compliance personnel to whom violations are internally reported as part of their investigative responsibilities, (4) foreign government officials, including employees of foreign state-owned entities, and (5) whistleblowers who are substantially responsible for the violations they report.
Rules Continue to Provide Anti-Retaliation Protection
The new rules provide anti-retaliation protection to whistleblowers who have a reasonable belief that violations have occurred. This protection applies whether the whistleblower satisfies all of the conditions to qualify for an award or not and even if it is determined that the issue reported by the whistleblower did not constitute a violation. Whistleblowers are protected by the anti-retaliation provisions in Dodd-Frank, which include a private right of action against employers for retaliation as a result of the whistleblower's reporting of a violation or disclosure of information pursuant to an investigation.
Moreover, in certain cases, the Dodd-Frank anti-retaliation provisions protect whistleblowers who report violations related to private companies. Whistleblowers who provide tips to the SEC voluntarily or pursuant to an investigation will be protected even if their tips pertain to private companies. However, whistleblowers who make disclosures that are required or protected under the Sarbanes-Oxley Act, Securities Exchange Act, or any other law subject to the jurisdiction of the SEC will generally only be protected if their tips pertain to public companies.
Companies Need to Assess the Implications
The new rules surrounding the whistleblower program may result in an increase in the number of reports submitted by whistleblowers both internally and to the SEC. Although the rules do not require whistleblowers to report violations internally, there could be an uptick in internal tips because of the rules' incentives for internal reporting, such as the possibility of earning a greater award, and the 120 day "lookback period."
The final rules have a number of implications for companies. Companies should review and update their compliance systems to ensure that they are able to sufficiently process and investigate the potential for an increased number of tips. Companies should assume that the reports they receive from whistleblowers will also be submitted to the SEC shortly thereafter; therefore, they should be prepared to conduct investigations of tips in accordance with SEC demands.
In addition, in order to encourage whistleblowers to report possible violations internally rather than directly to the SEC, companies should promote a corporate environment that fosters compliance with securities laws. The SEC suggested that where employees feel that compliance is a priority and tips are thoroughly investigated, whistleblowers will be more likely to submit reports internally because they will be eligible for a potentially greater award.
Lastly, in dealing with an increased number of whistleblowers, companies should be mindful of the anti-retaliation protections provided by Dodd-Frank and Sarbanes-Oxley. Accordingly, companies should take steps, such as limiting the access of supervisors to information about the identities of whistleblowers, to avoid even the appearance of retaliation in any subsequent adverse employment action against the whistleblower.