MAY 27, 2011 SEC adopts final whistleblower rules: implications for internal compliance, governance and employment policies By Carolyn G. Nussbaum, David A. Feldman, Andrew B. Prescott, and Karl D. Belgum Join us for a webinar on June 15, 2011, to review the final rules and the impact they may have on internal compliance programs and employment practices. Click here to register. Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act ( Dodd-Frank ) created Section 21F of the Securities Exchange Act of 1934, 15 U.S.C. 78u-6, directing the Securities and Exchange Commission to pay rewards of between 10 percent and 30 percent to individuals who voluntarily provide the Commission with original information about a violation of the federal securities laws that leads to a successful action resulting in the collection of sanctions exceeding $1,000,000. On May 25, 2011, in a divided 3 2 vote, the Commission adopted final rules to implement the whistleblower provisions of Dodd-Frank, nearly seven months after the Commission issued its proposed rules on November 3, 2010. 1 In the wake of the publication of the proposed rules last fall, the Commission received hundreds of comments expressing diverse views. By far, the most controversial issue was the Commission s position that whistleblowers are not required to report internally before making a submission to the agency. The final rules still do not require internal reporting, but revisions reflect the Commission s stated philosophy that whistleblowers should be incentivized, rather than required, to invoke internal compliance processes. To that end, the final rules expanded three features intended to encourage internal reporting: A whistleblower s voluntary participation in an internal reporting program will be a factor that the Commission will consider to increase the percentage of the recovery to be awarded to the whistleblower. Rule 21F-6(a)(4). Conversely, an award may be decreased if the whistleblower undermined the integrity of an internal process, including by making false statements, or interference. Rule 21F-6(b)(3). If a whistleblower makes an internal report, the whistleblower will be credited for any information the company provides to the SEC as if it had been provided directly by the 1 See Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, Release No. 34-64545 (May 25, 2011), available at http://www.sec.gov/rules/final/2011/34-64545.pdf ( Release ).
whistleblower. This could allow the informant to receive credit for information gathered by the company during its own investigation in response to an internal report. Rule 21F-4(b)(5). The final rules extend the lookback period from 90 to 120 days, so that a whistleblower who reports internally first, and then submits the same information to the SEC within the lookback period, will be deemed to have made disclosure to the SEC as of the date of the internal report, even if another informant reports to the Commission during that interval. Rule 21F-4(b)(7). The internal reporting controversy continued during the Commission s May 25 open meeting discussing the final rules. 2 Commissioners Casey and Paredes voted against adoption of the final rules, citing the potential damage to internal compliance programs, and companies ability to identify and promptly address problems, including disputes outside the purview of the SEC. Whistleblower advocacy groups declared victory, and have begun aggressive advertising campaigns for clients, while the U.S. Chamber of Commerce sharply criticized the Commission s approach, saying it would leave internal compliance programs gathering dust by allowing whistleblowers to bypass robust processes in pursuit of a large payoff. Repeatedly, during the open meeting and in the Release, the Commission stressed the increased number of tips that it has received since the enactment of Dodd-Frank, and the enhanced quality of that information. Director of Enforcement Robert Khuzami described the flow as an uptick, but not the flood that some had predicted. The Release estimates that the Commission will receive approximately 30,000 tips annually, based upon its experience in recent months. Release at 209. Other key features of the final rules, which will be final 60 days after publication in the Federal Register, are discussed below. Definition of a whistleblower Under the final rules, whistleblowers are defined as one or more individuals who provide the Commission with original information relating to a possible violation of the federal securities laws (including any rules or regulations thereunder) that has occurred, is ongoing, or is about to occur. Rule 21F-2(a)(1). The possible violation standard requires that the information indicates a facially plausible relationship to some securities law violation. However, the Commission specifically declined to require that the violation be material or probable or even likely. Voluntary submission of information The final rule provides that a submission of information will be voluntary if the whistleblower acts before a request or demand that relates to the same subject matter is directed to the whistleblower by the Commission, or the Public Company Accounting Oversight Board or any self-regulatory organization, or in connection with investigation by certain identified regulators, and the information is not required to be reported under a pre-existing legal duty, a contractual duty owed to the Commission or specified regulatory authorities, or pursuant to a judicial or administrative order. Rule 2 The Commission's Fact Sheet describing the final rules and a video of the Commission s May 25, 2011, Open Meeting adopting the final rules are available at http://www.sec.gov/news/press/2011/2011-116.htm. 2
21F-4(a). These exclusions were significantly narrowed from the proposed rule, which would have disqualified submissions after an inquiry or demand to the whistleblower s employer, unless the employer failed to disclose the information to the requesting authority in a timely manner. Instead, the final rule provides that the prior request must have been directed to the actual individual involved, or his representative. Rule 21F-4(a)(1) and (2). However, as part of the determination of whether an individual s submission qualifies for an award, the Commission will evaluate whether the whistleblower provided substantially the same information that was elicited from the employer in response to the prior request. Similarly, the final rules eliminated the exclusion in the proposed regulation for information subject to the employer s duty to report; the final version excludes only information that the whistleblower individually had a duty to report to the SEC. Indeed, in the Release, the Commission clarified that employers cannot disqualify employees from becoming whistleblowers by contractually requiring reports of any evidence of securities violations. What qualifies as original information? As in the proposed rule, original information must be derived from the whistleblower s independent knowledge or independent analysis, not previously known to the Commission from any other source, not derived from another proceeding or allegation, and provided for the first time after the enactment of Dodd-Frank. Rule 21F-4(b)(1). To constitute independent knowledge, the information must not have been obtained from publicly available sources, although the whistleblower s independent analysis can include an examination and evaluation of publicly available information that reveals information not generally known or available to the public. Rule 21F-4(b)(2) and (3). One notable issue was the exclusion for information obtained from officers and directors, lawyers, internal and outside auditors, and compliance staff. As in the initial proposal, the final rules define original information to exclude information obtained by means of a privileged communication or in connection with legal representation of a client, whether of a whistleblower or his employer or firm, unless disclosure of the information would be permitted by an attorney under the Commission s attorney conduct rules or applicable state statutes or bar rules. Rule 21F-4(b)(4)(i) and (ii). The language of the final rule was modified to clarify that this exclusion applies to in-house attorneys as well as non-attorneys who learn information through confidential attorney-client communications. To aid the Commission in determining whether a submission includes privileged information, the Commission s published form for submitting whistleblower information specifically asks whether the whistleblower is or was counsel to the entity, and whether the submission includes information obtained from an attorney or where an attorney was present. Equally important are exclusions for submissions by officers and directors, employees with compliance and internal audit responsibilities, and employees of outside compliance or internal audit firms, as well as employees of public accounting firms who obtained the information through an engagement, even if that information is not protected by an established legal privilege. Rule 21F- 4(b)(4)(iii). In response to comments that these exclusions were too broad, the final rules expanded an exception that would allow the submission of such information if the person has a reasonable basis to believe that disclosure to the Commission is necessary to prevent conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors, or the entity is impeding an investigation of the misconduct (including by destroying documents or interfering with witnesses), or if 120 days have elapsed since the information was provided to a supervisor or audit 3
committee, chief legal officer, chief compliance officer, or supervisor. Rule 21F-4(b)(4)(v). Despite concerns that this exception might swallow the exclusion altogether, the Release suggests that a whistleblower could satisfy the substantial injury standard by demonstrating that management or compliance personnel were aware of an imminent violation and failed to take steps to prevent it. A successful prosecution resulting in collection of sanctions of $1,000,000 In the proposed rules, the whistleblower would have been required to show that the information submitted significantly contributed to the success of the SEC s actions. The final rules deleted that requirement. Instead, original information will be considered to have led to a successful enforcement when it is sufficiently specific, credible, and timely to cause the staff to commence an investigation, open an investigation, reopen a closed investigation, or inquire concerning different conduct as part of a current examination or investigation, and the Commission brings a successful judicial or administrative action based in whole or in part on the conduct that was the subject of that original information. Rule 21F-4(c)(1). If the information related to an ongoing investigation, then the information must have significantly contributed to the success of the action. Rule 21F-4(c)(2). The Release stresses that the determination of whether information led to a successful enforcement action will require an individualized inquiry. In response to comments, the final rules were substantially modified to provide that the Commission will aggregate two or more smaller actions that arise from the same nucleus of operative facts, based on a flexible analysis of a number of factors, for the purpose of determining whether the $1,000,000 threshold has been met. Rule 21F-4(d). The Commission noted that this should increase the number of cases in which whistleblower awards will be available. Calculating the amount of an award The final rules mirror the proposed rules, amplifying the statutory directive to the Commission to pay an award of at least 10 percent and no more than 30 percent of the total monetary sanctions collected. Language was added to emphasize that the determination of the amount of an award within that range is in the Commission s discretion. Rule 21F-5(a). The final rules include four factors that may increase the amount of the award and three factors that could decrease the award. Upward factors include the significance of the information provided, the whistleblower s assistance, law enforcement s interest in the matter, and the whistleblower s participation in the company s internal compliance systems. Rule 21F-6(a). In contrast, negative factors include the whistleblower s culpability, unreasonable reporting delay, and the whistleblower s interference with internal compliance and reporting processes. Rule 21F-6(b). The upward and downward adjustments linked to the whistleblower s cooperation with, or obstruction of, compliance and reporting systems were repeatedly cited as evidence of the balance the Commission struck between increasing high quality whistleblower submissions and encouraging internal reporting. Over significant opposition, the Commission declined to adopt a per se exclusion for culpable participants, who may still receive an award. However, Rule 21F-16 provides that monetary sanctions paid by the whistleblower will not be considered in determining whether the $1,000,000 threshold has been met. Instead, the degree of culpability will impact the size of the award. Additionally, as 4
proposed, members of law enforcement, certain regulatory agencies, and foreign governments are not eligible for awards. Anti-retaliation protection for whistleblowers Section 21F(h) of Dodd-Frank prohibits employers from retaliating against whistleblowers, including those who provide information to the Commission, as well as those who make disclosures required or protected under Sarbanes-Oxley Act of 2002, 15 U.S.C. 7201 et seq. An individual claiming retaliation may sue in federal court for reinstatement, double back pay with interest, and attorney s fees. The statute of limitations can extend as long as ten years from the date of the retaliation. Section 21F(h)(1)(B)(iii). The final rules clarify that a person may qualify for whistleblower protection, even if the SEC decides not to pursue the complaint or is unsuccessful, if the informant possessed a reasonable belief that the information provided to the SEC relates to a violation of the federal securities laws. The Release defines this standard to include both subjective and objective elements, requiring that the whistleblower hold a subjectively genuine belief that the information demonstrates a possible violation and that this belief is one that a similarly situated employee might reasonably possess. Employers should review their internal investigative processes to minimize the risk of retaliation claims by whistleblowers. As noted in the Release, the statute only prohibits adverse employment actions that are taken because of any lawful act to provide information; adverse employment actions taken for other reasons are not covered. Accordingly, disclosure of information about whistleblower reports and investigations should be restricted and, where possible, supervisors should not be informed about internal reports by subordinates. An employer who can prove that a supervisor made a termination or other adverse decision with no knowledge of the employee s protected whistleblower conduct will have a strong defense. On the other hand, coordination between human resources personnel and compliance is important so that those responsible for reviewing termination decisions have pertinent information. A potential adverse action against a whistleblower warrants extra scrutiny to determine the strength of proof that the action is being taken for reasons independent of any whistleblowing activity. And, of course, supervisors and those charged with investigating should receive comprehensive and frequent training, particularly to ensure that investigation protocols are documented and consistently applied. What does this mean for internal compliance programs? For many observers, the final rules appear to bear out the view expressed by former Commission Chairman Harvey Pitt upon reading the proposed rules that the new law contains the seeds for undermining corporate governance and internal compliance systems. Notwithstanding the various revisions that the Commission believes will provide incentives for internal reporting, the fact that no internal reporting effort is required as a prerequisite for a whistleblower claim will require companies even those with exemplary compliance programs in place to revisit, and possibly make substantial revisions to, their policies and procedures that relate to investigations of reported misconduct. 5
Companies should ensure that their policies and procedures provide that the individuals with operational responsibility for compliance and ethics programs have direct reporting obligations to the Board. Companies may also provide incentives (monetary or otherwise) for reporting internally first. The Commission s rules also augment the already high level of importance that attaches to effective training to ensure employees awareness of the relevant policies and procedures, including the existence and contours of the internal reporting system, and to foster a culture of compliance at all levels of the company. Even in instances where a whistleblower reports internally, a company should assume that the SEC has or will shortly receive the same information, and must be prepared to act and investigate quickly. Indeed, in appropriate cases, Commission staff may contact a company upon receiving a whistleblower complaint and suggest that the company investigate and report back. Such an approach by the Commission depends upon a number of factors, including the nature of the conduct, the level on which the conduct occurred, the company s existing culture, and the role of internal compliance in bringing the information to the attention of management or the Commission. See Release at 92 n. 197. Conclusion The rules will not be effective until sixty days after publication in the Federal Register, which has not yet occurred. There is no doubt that Dodd-Frank has already had, and will continue to have, an impact on corporate compliance programs. Tips to the SEC have increased, and the prospect of significant financial rewards may convert even the most loyal employees into tipsters. However, the full impact of this Dodd-Frank initiative, both on the SEC s operations and on internal compliance programs, is yet to come, as the final rules are implemented and administered by SEC staff, and bounty hunters realize potentially substantial monetary rewards. To learn more, join us for a webinar on June 15, 2011, at noon (EST). Click here to register. For more information on the content of this alert, please contact: Carolyn G. Nussbaum at (585) 263-1558 or cnussbaum@nixonpeabody.com David A. Feldman at (212) 940-3013 or dfeldman@nixonpeabody.com Andrew B. Prescott at (401) 454-1016 or aprescott@nixonpeabody.com Karl D. Belgum at (415) 984-8409 or kbelgum@nixonpeabody.com 6