How Will the Dodd-Frank Whistleblower Rules Affect Companies?

Transcription

1 How Will the Dodd-Frank Whistleblower Rules Affect Companies? The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), signed into law by President Obama on July 21, 2010, created a whistleblower program that will reward and protect from employer retaliation individuals who report violations of federal securities laws to the Securities and Exchange Commission. On May 25, 2011, the SEC adopted rules to implement the program, which became effective on Aug. 12, By: Katayun I. Jaffari As originally published as a Special to the Legal Intelligencer, PLW, September 15, 2011 Katayun I. Jaffari is a partner in Saul Ewing s business department and co-chair of the securities transactions and regulations practice group. She has extensive experience counseling public and private companies in the areas of corporate governance and securities law and compliance, including reporting requirements under NYSE and NASDAQ regulations. She has also written and lectured extensively in these areas. She can be reached at kjaffari@saul.com or The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), signed into law by President Obama on July 21, 2010, created a whistleblower program that will reward and protect from employer retaliation individuals who report violations of federal securities laws to the Securities and Exchange Commission. On May 25, 2011, the SEC adopted rules to implement the program, which became effective on Aug. 12, The new whistleblower program is designed to motivate company insiders to report possible violations of federal securities laws directly to the SEC rather than through a company's internal compliance department. In effect, the whistleblower program will be competing with internal compliance processes to collect inside information on corporate misconduct. Fortunately, the SEC added a provision in the final rules that provides incentives for employees to report whistleblower information to their internal compliance departments; unfortunately, the rules do not require employees to use their companies' internal processes to qualify for an award. If the program becomes successful, companies will be at risk of being repeatedly blindsided by damaging whistleblower reports being made public. These reports could have a severe and damaging effect on a company because every response to an SEC inquiry or investigation will require resource expenditures that negatively affect shareholder value. Investigations that result in fines and other monetary sanctions being levied against a company will have an even more significant and negative direct impact on shareholder value. The indirect costs, such as reputation cost and employee morale, although impossible to calculate, could have an even more longstanding dampening effect on shareholder value. As such, whistleblower reports have the

2 potential to put internal information in the public realm that could impact a company's value regardless of the severity of the information. It is in a company's best interest to mitigate against the risks posed by the whistleblower program. Although the whistleblower rules do not require employees to report information internally to qualify for an award, companies can encourage employees to report information internally by implementing business processes that effectively capture relevant information before it is reported to the SEC. In addition, the SEC has left the door open for companies to enhance their own programs. To develop an appropriate mitigation strategy, it is important for executives to understand the new whistleblower rules. Thus, this article facilitates the task by explaining the elements of the rules and providing a summary of the risks that public companies now face along with some steps companies may take to mitigate against those risks. The Whistleblower Rules Under the new whistleblower rules, an individual is eligible for a cash reward and anti-retaliation protection if he or she "voluntarily" provides the SEC with "original information" of a possible violation of "federal securities laws" that leads to the successful enforcement of a federal court or administrative action. An eligible individual receives "anti-retaliation protection" under the rules whether or not he or she receives an award. The rules do not require individuals to report the information to their internal compliance departments to be eligible for an award; rather, the rules provide individuals with an award "incentive to use their internal compliance departments." The rules generally "exclude a core group of company insiders" from qualifying for whistleblower awards, but also provide "exceptions" to those exclusions under certain circumstances. The rules require that the aggregated "monetary sanctions" resulting from the enforcement action total more than $1 million in order for a whistleblower to receive an award. Voluntary Submission The whistleblower rules require an individual to satisfy the "voluntary submission" criteria to be considered eligible for an award. A submission of information to the SEC will be considered voluntary if the individual provides the information to the SEC before being asked for it. A submission will not be considered voluntary if the individual has a pre-existing legal or contractual duty to report the information to a government agency. Original Information The rules also require the individual to satisfy the "original information" criteria to qualify for an award. To meet these criteria, information provided to the SEC must be: (1) provided for the first time after July 21, 2010 (the date of the enactment of the Dodd-Frank Act); and based on the whistleblowers' independent knowledge or analysis; (2) not already known to the SEC from any other source; and (3) not exclusively derived from allegations made in judicial hearings, in a government report, audit or investigation, or from the news media. The rules define "independent knowledge" as factual information in the whistleblower's possession; this means, according to the rules, that the knowledge must be derived from the -2-

3 whistleblower's own experiences, observations or communications. The original information must also be sufficiently specific, credible and timely so as to satisfy the required causal connection that the information be deemed as having led to a successful enforcement action. Federal Securities Laws The whistleblower rules require an individual to report information about a violation or potential violation of federal securities laws to be eligible for an award. Federal securities laws are a complex body of law contained in various statutes, the two principal statues of which are the Securities Act of 1933 (Securities Act) and the Securities Exchange Act of 1934 (Exchange Act). The new whistleblower rules are applicable only to conduct that is governed by federal securities laws and do not apply to forms of internal misconduct that may be governed by other federal laws, like employment discrimination or harassment. Anti-Retaliation Protection Under the rules, anti-retaliation protection is given to any eligible employee who reasonably believes that the information he or she is providing to the SEC relates to a possible federal securities law violation, even if the information does not lead to a whistleblower award. The rules make it unlawful for anyone to interfere with a whistleblower's efforts to communicate with the SEC, even by trying to enforce a confidentiality agreement. The anti-retaliation provision gives whistleblowers a private cause of action if they are discharged or otherwise discriminated against by their employers for reporting a potential violation of federal securities law. The rules also allow whistleblowers to maintain anonymity and still be considered for an award if they submit the required information through an attorney. Internal Compliance Departments The whistleblower rules do not require employees, or other personnel who become whistleblowers, to report violations internally to qualify for an award. The rules do provide, however, additional award incentives that may increase a whistleblower award if internal channels are used first and the company informs the SEC about the violation. For example, voluntary participation in a company's internal compliance and reporting system is one of the variables used to calculate the amount of a whistleblower award. This change to the proposed rule opens the door for companies to strengthen their programs and protect against the risks of the whistleblower program. Exceptions The rules generally exclude certain individuals from participation in the whistleblower awards program if the information they could provide might undermine the operation of internal compliance systems. Persons excluded include: Officers, directors, trustees or partners of an entity if they obtained the information in connection with the entity's processes for identifying and addressing noncompliance with the law. Employees with primary responsibilities in compliance and internal audit. -3-

4 Employees of outside firms that are retained to perform compliance and audit work. Attorneys (including in-house counsel). Accountants who have obtained information from client engagements. The rules provide three exceptions where such excluded individuals are permitted to be considered as whistleblowers. First, compliance and internal audit personnel, as well as public accountants (designated persons), are allowed to become whistleblowers if they possess a reasonable belief that reporting information to the SEC is necessary to prevent the entity from engaging in conduct that will cause substantial injury to the financial interests or property of the entity or investors. Second, designated persons are allowed to become whistleblowers if they have a reasonable belief that the entity is engaging in conduct that will impede an investigation. Third, designated persons are allowed to become whistleblowers after 120 days have elapsed since the time the person provided the information to the appropriate senior responsible person at the entity or if the excluded person receives the information under circumstances indicating that the appropriate responsible person was already aware of the information. Monetary Sanctions over $1 million Under the whistleblower rules, an award will be paid to an individual only if the enforcement action results in monetary sanctions over $1 million. The rules define monetary sanctions as any money, including penalties, disgorgement, and interest, ordered to be paid and any money deposited into a disgorgement fund or other fund as a result of an SEC enforcement action. To meet the monetary threshold of $1 million, the rules permit the aggregation of multiple cases where the whistleblower provided original information as a single action if there is a common nucleus of facts that gave rise to the violations. The Potential Impact The whistleblower program's objective is to motivate company insiders to report high-quality information about violations of federal securities laws directly to the SEC. The program may create an information pipeline that bypasses a company's internal compliance department and directly informs the SEC. Such a pipeline exposes a company to potential losses that ultimately could take a toll on shareholder value. The monetary sanctions that accrue against a company as a result of an SEC enforcement action are only the tip of the iceberg; the true expense of undergoing an investigation and an enforcement action is the key to be measured against shareholder value. In addition to penalties and other monetary sanctions, the business may also suffer, among other things, losses associated with: The cost to the businesses' reputation. The cost of damage control (public response, internal response, etc.). The cost of loss productivity. Low employee morale. -4-

5 Companies without effective compliance systems are exposed to the greatest amount of risk from the implementation of the whistleblower program. How to Respond to the Whistleblower Rules Companies should ensure that their businesses are prepared to operate effectively under the whistleblower program that threatens to cut ineffective compliance departments out of the picture by funneling information directly to the SEC. Any public company that does not have formal compliance practices should develop and implement effective practices that include business processes that systematically collect information to detect violations and potential violations of federal securities laws. Any company that does have a formal compliance practice should evaluate its effectiveness in detecting and deterring violations of federal securities laws and, if necessary, enhance its business processes. Companies can improve their internal compliance programs by implementing and enforcing business processes that are most likely to inform its compliance staff of potential violations of federal securities laws. Compliance executives must ensure that these business processes systematically collect high-quality information so the company can be first in detecting and responding to internal misconduct. Effective programs encompass a strong tone at the top that supports a compliance culture and communication; effective training and supervision on compliance issues, ensuring effective hotlines and prompt responses to reports; and requiring compliance as a measure of job performance in evaluations. A proactive approach to compliance will likely decrease the risks represented by the whistleblower program. While it may be cost-prohibitive for most companies to attempt to control the flow of inside information with their own whistleblower rewards program, an effective use of business processes may prevent a company from being subjected to costly, timeconsuming and damaging investigations. This article is reprinted with permission from the September 15, 2011 issue of The Legal Intelligencer. (c) 2011 ALM Properties Inc. Further duplication without permission is prohibited. All rights reserved. -5-