New SEC Whistleblower Rules Fall Short Overview

Transcription

1 November 19, 2010 New SEC Whistleblower Rules Fall Short Overview The SEC recently released its proposed rules implementing the whistleblower program established under Section 922 of the Dodd-Frank Act. The proposed rules do not go far enough to avoid undermining corporate compliance systems. We summarize our key observations in this memo, and a more detailed discussion of the proposal and the issues it presents is attached. To be eligible for a bounty, a whistleblower must supply original information which the SEC has not otherwise already obtained. This creates an incentive to race in to the SEC to stake the first claim, rather than report up through established corporate compliance channels. The rules would allow a whistleblower s report to the SEC to relate back to the date of the same person s earlier internal corporate report, as long as the whistleblower contacts the SEC within 90 days of reporting internally. While this provision would allow for internal reporting, it would do nothing to encourage it. We propose that internal reporting should be a prerequisite to an SEC whistleblower report, absent extraordinary circumstances, and that up to 120 days should be permitted for the internal review to proceed. The proposed rules create an opening for second-guessing of internal reviews, by allowing for whistleblower bounties when such reviews are not completed in a reasonable time or are conducted in bad faith. Both of these concepts have the potential to be applied in an overly expansive manner, and the SEC needs to be vigilant to avoid that result. Finally, while the rules contemplate that the SEC s staff will have a variety of communications with whistleblowers, there is a need for precise ground rules to govern those communications (and to protect against incursions upon the attorneyclient privilege and possible Privacy Act and constitutional violations). Whatever form the final rules may take, the enactment of Section 922 is an occasion for companies to: Review the overall structure of the ethics and compliance function and its role within the organization, including ensuring the availability of robust internal reporting mechanisms; Think creatively about effective ways to raise employee awareness of the importance of surfacing compliance concerns internally and of the mechanisms available to do so; Look for ways to reinforce to employees the company s genuine commitment to appropriate handling of compliance concerns; Review protections for known whistleblowers so as not to run afoul of the newly strengthened anti-retaliation provisions in Section 922; and Revisit the firm s approach to conducting internal inquiries to assess whether any changes are warranted in light of the new rules, including steps to expedite the completion of such inquiries. Theodore A. Levine John F. Savarese Wayne M. Carlin If your address changes or if you do not wish to continue receiving these memos, please send an to Publications@wlrk.com or call W/

2 November 19, 2010 New SEC Whistleblower Rules Fall Short The SEC recently released for comment its proposed rules implementing the whistleblower program established under Section 922 of the Dodd-Frank Wall Street Reform legislation. In our memo dated July 21, 2010, we expressed concern that Section 922 may undermine established corporate compliance programs by giving employees a substantial financial incentive to bypass internal reporting mechanisms in pursuit of bounty payments from the SEC. The SEC s latest proposal reflects an effort to respond to these concerns. In a number of respects, however, the proposed rules do not go far enough, or leave important questions unanswered, as we detail below. 1. Preserving the Role of Internal Corporate Reporting and Compliance In order to be eligible for a Section 922 bounty payment, a whistleblower must provide original information to the SEC, defined as information that the SEC has not previously obtained from another source. This requirement creates a substantial financial incentive for whistleblowers to go directly to the SEC, rather than voicing their concerns internally, so as not to jeopardize their eligibility for a bounty by running the risk that another employee or even the corporate employer itself might report the matter to the SEC first. Proposed Rule 21F-4(b)(7) attempts to address this concern. It provides that a whistleblower s report to the SEC will relate back to the date of the whistleblower s internal report to a corporate legal, compliance, audit or similar function, provided that the whistleblower contacts the SEC within 90 days of having reported internally. This 90-day provision is only a half-measure. It removes for a short time the incentive for a whistleblower to race in to the SEC. It stops short, however, of providing any positive incentive for employees to use internal corporate reporting mechanisms. While the proposing release notes that the Commission will consider increasing the bounty payments for whistleblowers who initially report their concerns through their employers corporate compliance programs, that is a speculative and weak incentive, if it is an incentive at all. A more productive message would be sent by (1) requiring employees first to use internal compliance mechanisms, absent extraordinary circumstances; and (2) allowing a reasonable time for the internal process to proceed before the employee becomes eligible for whistleblower status with the SEC. The 90-day period contemplated by the proposed rules is unrealistically short for all but the simplest internal inquiry. A 120-day period would be more reasonable, although even that amount of time will often be insufficient for a thorough and balanced inquiry to be completed. Many companies have ethics and compliance policies in place that require employees to report possible misconduct internally through any one of a variety of mechanisms, including channels that provide for anonymous reporting. It is not uncommon, moreover, for companies to require employees to certify on some periodic basis that they have reported any such concerns of which they are aware. Public policy has long supported such internal corporate reporting mechanisms because they allow responsible companies to stop wrongdoing promptly and take appropriate remedial action swiftly, without the need to use scarce public enforcement resources to conduct a lengthy, expensive and often cumbersome investigation. Consistent with those purposes, the public interest would be better served by an SEC approach that embraces and endorses these internal reporting programs for example, by requiring prospective whistleblowers to allow the internal review process to proceed for a period of If your address changes or if you do not wish to continue receiving these memos, please send an to Publications@wlrk.com or call

3 120 days before reporting to the SEC. The SEC could revise the proposed rules to establish a presumption that a whistleblower who makes full disclosure internally and waits for 120 days while the internal review proceeds will receive a bounty at the high end of the statutory 10% to 30% range. Employees could be exempted from the internal reporting requirement if their company lacks a trustworthy compliance mechanism, or if there are truly compelling and extraordinary reasons why internal reporting is not appropriate. Given the widespread availability of anonymous reporting mechanisms in many companies, such circumstances should be rare. If the internal review does not reach a conclusion within 120 days, the employee would be free to report the matter to the SEC and still be eligible for a bounty. As a practical matter, in many cases, after 120 days have elapsed, companies would likely determine to make their own report to the SEC. The company could then disclose to the SEC the existence of and internal reporting date for the whistleblower and ask the SEC staff to await the completion of the internal review before commencing an investigation. The SEC should also instruct its staff to extend substantial deference to an ongoing internal review when a company has self-reported in this manner. Requiring an internal report to precede submission of a whistleblower report to the SEC would permit companies with a strong compliance culture to identify instances of misconduct, halt any improper practices and perform remediation. Such an approach would simultaneously permit the continued effective functioning of the compliance regimes in which companies have invested their time and resources; give such companies appropriate credit with the SEC for their efforts, including self-reporting; and also allow whistleblowers to claim a bounty, with their original information status dating back to the time of their internal report. Requiring internal reporting also would better align the whistleblower rules with policies under the Sarbanes-Oxley Act, the US Sentencing Guidelines and the DOJ Principles of Federal Prosecution of Business Organizations, all of which encourage companies to maintain robust compliance and reporting programs. This measure of deference to effective corporate compliance systems is not out of step with the SEC s own views or with the realities within companies today. The SEC s proposing release acknowledges that many employers have compliance processes that are well-documented, thorough and robust, and offer whistleblowers appropriate assurances of confidentiality.... The SEC s recognition of the role of corporate legal and compliance functions is also reflected in Proposed Rule 21F-4(a)(2), which provides that an employee cannot be eligible for a bounty payment if the employee s whistleblower report occurs after the employer received a request for information on the same subject matter from the SEC or other investigative or regulatory authorities. The rule provides an exception only where the employer has failed to provide the whistleblower s documents or information in response to the prior request in a timely manner. The SEC also clearly intends to continue its own practice of relying on companies to conduct internal reviews. As explained in the proposing release, in many instances, the SEC intends to refer whistleblower complaints to the employer for review and a report of findings: We expect that in appropriate cases, consistent with the public interest and our obligation to preserve the confidentiality of a whistleblower, our staff will, upon receiving a whistleblower complaint, contact a company, describe the nature of the allegations, and give the company an opportunity to investigate the matter and report back

4 This is a prudent approach to handling many whistleblower claims, and one that the SEC should employ whenever possible. Employers who respond to such inquiries by conducting a thorough and balanced review will be in the best position to seek a resolution of any issues identified. 2. Protecting Attorney-Client Communications and Internal Compliance Processes The new proposed rules also appear to indicate that the SEC does not seek to invade otherwise privileged attorney-client communications. Here too, the SEC has made some attempt to avoid undermining the integrity of corporate processes for conducting internal legal, compliance or supervisory reviews or audits. These efforts, however, fall short of what is needed. To qualify for a bounty, a whistleblower s report to the SEC must be based on the whistleblower s independent knowledge or independent analysis. This does not mean that the whistleblower must have direct personal knowledge of the facts being reported. A report can be based on information communicated to the whistleblower by third parties, such as co-workers. Proposed Rules 21F-4(b)(4)(i) and (ii) define independent knowledge to exclude information obtained through an attorney-client privileged communication, or otherwise obtained by a lawyer (whether in-house or outside counsel) while engaged in representation of a client. These carve-outs are qualified by reference to any disclosure by a lawyer that may be permitted under applicable state rules of professional conduct, or under the SEC s rules of conduct for lawyers representing issuers. Thus the proposed rules appear to seek to preserve the status quo with respect to any reporting by lawyers with respect to matters protected by privilege or subject to the work product doctrine. The effect of the proposed rules on internal corporate legal, compliance and supervisory reviews is considerably less clear. Proposed Rule 21F-4(b)(4)(iv) excludes from the definition of independent knowledge or independent analysis information that was communicated to a person with legal, compliance, audit, supervisory or governance responsibilities with the reasonable expectation that he or she would take steps to cause the company to respond appropriately to the alleged violation. Similarly, Proposed Rule 21F-4(b)(4)(v) excludes information obtained by any person solely through a company s process for conducting internal legal, compliance, audit or similar reviews (e.g., an employee who learns of potential misconduct solely by being asked questions in the course of an internal review of the conduct cannot qualify for a bounty by reporting that conduct to the SEC). Proposed Rules 21F-4(b)(4)(iv) and (v), however, contain important exceptions. Any person who learns of potential misconduct in the course of an internal inquiry may still qualify for a bounty upon reporting such matters to the SEC if the company did not disclose the information to the Commission within a reasonable time or proceeded in bad faith.... This carve-out risks creating inappropriate pressures in conducting internal reviews. The proposed rules do not define reasonable time or bad faith. The proposing release recognizes that the amount of time that is reasonable may vary greatly from one inquiry to another. A potential whistleblower contemplating the prospect of a large bounty payment, however, may have a foreshortened view of how much time is reasonable. The proposing release does provide some examples of bad faith conduct: efforts by company officials to destroy documents or interfere with witnesses or carrying out a sham investigation. The proposing release thus suggests that only egregious conduct would constitute bad faith

5 Taken together, the proposed rules relating to personnel involved in internal reviews should be read to reflect a judgment by the SEC that the review process should be permitted to run its course absent circumstances verging on obstruction of justice by the persons overseeing the review. It remains to be seen whether the SEC will hew to this line in applying the rules. The practical reality is that internal reviews take time. It would be unfortunate if the reasonable time exception created pressure on legal or compliance personnel to complete internal reviews more rapidly than is desirable to achieve a thorough or fair result. While the standard for bad faith appears intended to be stringent, it would also be unfortunate if the provision led to a practice of examining and second-guessing the conduct and conclusions of internal reviews, as well as decisions concerning whether or not a particular matter warranted reporting to the SEC. These considerations may well be a reason to think carefully about whether a particular review should be conducted by compliance or legal personnel so as to maximize the privileged nature of the inquiry. The proposed rules should be revised to state expressly that mere disagreement with the conclusions of an internal review is not a basis to invoke the bad faith exception. In short, the process of conducting internal corporate reviews is one that generally operates effectively and with integrity. In writing and applying these rules, the SEC should take care not to undermine that process. 3. Defining the Proper Scope of SEC Communications with Whistleblowers The proposed rules shed some light on the nature of the communications that the SEC foresees its staff may carry on with whistleblowers. Proposed Rule 21F-8(b) informs prospective whistleblowers that they may be required, among other things; to: (1) provide explanations and other assistance; (2) provide all information in their possession that is related to the inquiry; and (3) enter into a confidentiality agreement. The proposing release further explains that a confidentiality agreement may be necessary if the staff determines to share non-public information with a whistleblower for example, to obtain the whistleblower s assistance in interpreting documents. While the rules thus set the stage for potential collaboration between the staff and a whistleblower, important aspects of that process are not addressed: The proposed rules do not provide any guidance to the SEC staff concerning any limitations on the subject matter of their communications with a whistleblower. The SEC has not, for example, instructed its staff either to warn whistleblowers not to divulge attorney-client privileged information, or to decline to receive such information from whistleblowers. Proposed Rule 21F-16(b) states that, if an officer, director, employee or agent of an entity that is represented by counsel initiates contact with the SEC as a whistleblower, the SEC s position is that its staff is permitted to communicate with the whistleblower without seeking consent of the entity s counsel. This is an area in which careful judgments may be required in particular cases, and it is not suited to a blanket rule. The Division of Enforcement should establish a mechanism for review by an appropriate senior official before the staff proceeds with communications in these circumstances. Once again, the proposed rules do not address any limitations on these communications, including any protection for attorneyclient privileged information

6 The scope of the requirement that the whistleblower provide additional information is not clear. The SEC should not permit its staff to request that whistleblowers bring corporate documents out from the workplace, or seek additional information through conversations with co-workers. Those limitations should be made clear in these rules. Failure to prevent such actions may well raise concerns under the Privacy Act of 1974, or even constitutional concerns. In exigent circumstances such as an ongoing fraud, there are other time-tested investigative techniques available to the SEC and to other law enforcement authorities those methods are effective and should continue to be employed where appropriate. 4. Assessing the Reliability and Credibility of Whistleblowers Finally, the proposed rules also reflect some appropriate caution on the part of the SEC with respect to the reliability of whistleblower information. In order to be eligible for a bounty payment, a whistleblower must submit a declaration to the SEC under penalty of perjury. The proposing release informs lawyers who represent whistleblowers that they are deemed to be engaged in the practice of law before the Commission, and are thus subject to SEC Rule 102(e) in the event of professional misconduct. Finally, Rule 21F-14 warns that no amnesty attaches to whistle-blowing: The fact that you may become a whistleblower and assist in Commission investigations and enforcement actions does not preclude the Commission from bringing an action against you based upon your own conduct in connection with violations of the federal securities laws. This is a welcome cautionary signal. * * * One theme runs through much of our discussion of the proposed whistleblower rules while the SEC expressly recognizes the value and legitimacy of corporate compliance and ethics programs, the proposed rules do not do nearly enough to support and reinforce these programs. Modifications to the proposed rules are necessary to ensure that they do not have the effect of undermining corporate compliance systems and the ability to conduct thorough and balanced internal reviews. The SEC is accepting public comments on the proposed rules until December 17, 2010 and interested parties should take the opportunity to provide input. Whatever form the final rules may take, the enactment of Section 922 is an occasion for companies to: Review the overall structure of the ethics and compliance function and its role within the organization, including ensuring the availability of robust internal reporting mechanisms; Think creatively about effective ways to raise employee awareness of the importance of surfacing compliance concerns internally and of the mechanisms available to do so; Look for ways to reinforce to employees the company s genuine commitment to appropriate handling of compliance concerns; Review protections for known whistleblowers so as not to run afoul of the newly strengthened anti-retaliation provisions in Section 922; and - 5 -

7 Revisit the firm s approach to conducting internal inquiries to assess whether any changes are warranted in light of the new rules, including steps to expedite the completion of such inquiries. Theodore A. Levine John F. Savarese Wayne M. Carlin - 6 -