Preparing for the Increasing Role of Whistleblowers in FCPA Enforcement

WHISTLEBLOWERS Preparing for the Increasing Role of Whistleblowers in FCPA Enforcement By David M. Stuart and Omar K. Madhany Cravath, Swaine & Moore LLP As the SEC continues to recover significant monetary awards in FCPA cases and builds on the success of its Dodd-Frank Whistleblower Program, whistleblowers will play an increasingly important role in the investigation and prosecution of FCPA enforcement actions. Data from the Program, which is three-and-a-half years old now, is illuminating important trends that can provide useful lessons to companies at risk of FCPA violations. The recently released 2014 Annual Report on the Whistleblower Program reveals that awareness of the Program is growing (particularly in foreign countries) and that the SEC is receiving an increasing number of whistleblower tips about FCPA violations. With this growth in the Whistleblower Program, however, has also come pressure to clarify the scope of the whistleblower provisions in the Dodd-Frank Act. Given the Program s relatively young age, questions about the scope and application of the whistleblower provisions remain unsettled in the courts and in practice. A diverse group of stakeholders companies, whistleblowers, counsel, the SEC and Congress is now clamoring for answers. As the data rolls in, trend lines emerge and courts are given an opportunity to analyze the unique issues that arise from whistleblower cases, these answers will become increasingly important to companies that have operations abroad. Companies will need to evaluate and potentially strengthen their existing internal reporting mechanisms to enable a swift and appropriate response to allegations of misconduct and increase the likelihood that employees report potential FCPA issues internally. At the same time, companies must ensure that their encouragement of internal reporting is not perceived as preventing employees from reporting potential misconduct to the SEC. Origin of the Whistleblower Provisions The Dodd-Frank Whistleblower Program has its roots in the Sarbanes-Oxley Act of 2002, which was signed into law in the wake of accounting scandals that had shaken the public s confidence in the financial markets. Section 301 of Sarbanes-Oxley required public companies to provide a channel through which employees could submit anonymous complaints about accounting or auditing matters to the company s audit committee.[1] In addition, Section 806 protected employeewhistleblowers by providing a private right of action in an administrative proceeding to any employee who had been subjected to retaliation for reporting potential misconduct either internally or to the government.[2] Dodd-Frank Strengthens Sarbanes-Oxley Eight years later, in response to the country s financial crisis, Congress took the opportunity in Dodd-Frank to strengthen Sarbanes-Oxley s whistleblower provisions. Dodd-Frank extended the statute of limitations for a private administrative retaliation claim and precluded companies from enforcing pre-dispute arbitration agreements related to such claims.[3] In addition, Dodd-Frank strengthened the incentives for whistleblowers to report potential misconduct to the SEC. First, the law provided whistleblowers with a new right of action against companies for retaliation. This new retaliation action could be initiated in federal court and permitted greater relief than an administrative retaliation action under Sarbanes-Oxley.[4] It was not clear, however, whether the new retaliation action was available to whistleblowers who reported potential misconduct only internally rather than to the SEC. 1

Second, the law created a huge economic incentive for whistleblowing. Section 922 of Dodd-Frank authorized the SEC to make monetary awards to whistleblowers who provide the SEC with original information about securities law violations that result in successful enforcement actions yielding over $1 million in monetary sanctions.[5] The law specified that the amount of an award should be between 10% and 30% of the monetary sanctions recovered in the resulting SEC enforcement action and certain related actions also based upon the whistleblower s original information (e.g., a DOJ action).[6] Third, the law provided the basis for the SEC to enact a rule protecting whistleblowers from efforts to prevent them from communicating with the SEC about a securities law violation. Rule 21F-17 provides that [n]o person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement. [7] Success of the Whistleblower Program In order to administer the new whistleblower provisions, in 2011, the SEC created the Office of the Whistleblower. [8] Each year since its launch, the number of tips received and the number and size of awards made have steadily increased. This past year,[9] the Whistleblower Office reported having received 3,620 tips a 21% increase from two years prior. During the same period, tips alleging FCPA violations increased by nearly 40%. As SEC Director of Enforcement Andrew Ceresney predicted, FCPA violations have become an increasingly fertile ground for whistleblowers under the Whistleblower Program. This comes as little surprise given that the SEC and DOJ obtain their largest monetary sanctions in FCPA cases, creating the opportunity for massive whistleblower awards to employees and other persons knowledgeable about corrupt business practices. This past year alone, the SEC and DOJ obtained nearly $750 million in monetary sanctions in joint FCPA enforcement actions based on which the SEC could have awarded almost $225 million in whistleblower awards. See FCPA Corporate Settlements of 2014: Details, Trends and Compliance Takeaways, in this issue of The FCPA Report. In one of these cases, Weatherford International agreed to pay over $152 million in monetary sanctions to resolve both the SEC s action and a related DOJ action. See Oil and Gas Company Weatherford Settles Civil and Criminal FCPA Charges for $153 Million, The FCPA Report, Vol. 2, No. 24 (Dec. 4, 2013). If a whistleblower had timely contacted the SEC with original information about Weatherford s FCPA violations, that individual could have been eligible for an award of almost $46 million. Since the Whistleblower Program began, the SEC has made fourteen awards, including nine awards in the past year alone.[10] Included in the nine awards made this past year is the SEC s largest and most widely-publicized award to date a remarkable award of over $30 million to a foreign whistleblower whose information exposed an ongoing fraud. That award represented the fourth made to a whistleblower residing abroad since the beginning of the Program. Those four awards have not only increased awareness of the Whistleblower Program among individuals residing in foreign countries, but have also encouraged them to participate in the Program. Indeed, comparing the 2014 Whistleblower Report to the 2012 Whistleblower Report, the number of tips received by the SEC from individuals residing abroad increased by nearly 40% from 2012 2014. The growth of the Whistleblower Program in high-risk emerging markets has been even greater, with tips received by individuals residing in the BRIC countries increasing by an extraordinary 80% during the same period. As more awards are made to whistleblowers residing abroad and awareness of the Program in foreign countries continues to grow, companies can expect the number of whistleblowers contacting the SEC with information about FCPA violations to increase even further. As Director Ceresney noted in a recent speech, the Whistleblower Program has been very successful, 2

even transformative, in its impact thus far. In light of the success of the Whistleblower Program, important questions have emerged as to the reach and protections of the Dodd-Frank whistleblower provisions. Internal Reporting and Dodd-Frank Retaliation Claims One of the many open questions about the whistleblower provisions is the extent to which protection from retaliation under Dodd-Frank is available to a whistleblower who reports potential misconduct only internally rather than to the SEC. The anti-retaliation provision of Dodd-Frank prohibits, in relevant part, retaliation against any whistleblower who makes disclosures that are... protected under [Sarbanes-Oxley]. [11] Protected disclosures under Sarbanes-Oxley include disclosures about potential misconduct that are reported only internally.[12] Dodd-Frank defines a whistleblower more narrowly, however, as an individual who provides... information relating to a violation of the securities laws to the [SEC]. [13] This seeming conflict is the issue that the Fifth Circuit faced in Asadi v. G.E. Energy (USA), L.L.C., 720 F.3d 620 (5th Cir. 2013). In Asadi, the plaintiff an Iraq Country Executive at GE Energy was notified by Iraqi officials of a potential FCPA violation by the company. The plaintiff reported the matter to his supervisor and the GE Energy regional ombudsperson and, shortly thereafter, was pressured to take a position with diminished responsibility. When he refused, he was terminated. The plaintiff filed a Dodd-Frank retaliation claim against GE Energy, alleging that the company terminated him because of his internal report of the potential FCPA violation. The company moved to dismiss the claim, arguing that, since the plaintiff had not reported the alleged FCPA violation to the SEC, the plaintiff did not qualify as a whistleblower under Dodd-Frank s anti-retaliation provision. The plaintiff countered that, given the conflict between the definition of whistleblower and the retaliation provision in the law, the retaliation provision should be construed to protect internal reporting. On appeal, the Fifth Circuit began its analysis by noting that both district court case law and the relevant SEC regulation supported the plaintiff s reading of the statute. It then undertook a textual analysis of the statute, however, finding that the retaliation provision could co-exist with the law s definition of whistleblower without conflict. The court explained that Congress s use of the term whistleblower in the retaliation provision demonstrated an intent to limit the retaliation provision in the law to those individuals who qualified as whistleblowers as defined in the statute. Thus, the court concluded that, under the provision at issue, only individuals who made Sarbanes-Oxley-protected disclosures to the SEC could bring a Dodd-Frank retaliation suit. While the Fifth Circuit is the only federal appellate court to have addressed this question, the Third Circuit may soon address it in Safarian v. American DG Energy Inc., No. 14-2734 (3d Cir. Dec. 11, 2014) a pending case presenting the same question. The SEC has filed an amicus brief in the case in support of the plaintiff-whistleblower, arguing that Asadi was wrongly decided. Although the Asadi decision and district court cases that have held similarly appear to be favorable for companies, their impact on future employee whistleblowers may yield the opposite result. As the 2014 Whistleblower Report noted, a staggering 80% of current or former employees who received awards under the Whistleblower Program first reported internally before going to the SEC. This is consistent with a recent survey by the Ethics Resource Center (the National Business Survey), which observed that 92% of employees who discover misconduct first report it internally. In order to ensure protection from retaliation under Dodd-Frank, however, 3

many of these whistleblowers may in the future resist a natural human instinct to report internally and instead go directly to the SEC with their information. Three Strategies for Strengthening Internal Reporting Mechanisms As Director Ceresney recently stated, if the SEC discovers an FCPA violation through a whistleblower, rather than through self-reporting by a company, the result [of the ensuing SEC investigation] will be far worse. In the post-dodd-frank environment, simply establishing an anonymous reporting channel to a company s audit committee will not ensure that employees seriously consider reporting potential misconduct internally rather than going to the SEC. Instead, companies must ensure that internal reporting mechanisms create a culture of compliance that makes prospective whistleblowers feel comfortable with the decision to report internally. This culture can be cultivated in several ways. 1) Provide Tangible Benefits for Internal Reporting First, companies can incentivize employees to report internally by creating tangible benefits for doing so. Internal monetary awards programs and employee recognition for internal reporting can signal a company s commitment to learning about problematic conduct before it rises to the level of an FCPA violation. Conveying such a commitment increases the likelihood that employees will feel comfortable enough to report potential misconduct internally without fear of retaliation. 2) Create Multiple Avenues for Internal Reporting Second, companies can create multiple avenues of reporting potential misconduct beyond the anonymous reporting channel to the audit committee required by Sarbanes-Oxley. By establishing other contact points for reporting potential misconduct at various levels of the organization (e.g., immediate supervisor, department supervisor, CFO and board members), employees can report to whomever in the organization they feel most comfortable approaching. Companies may also consider establishing anonymous hotlines through which employees can report potential misconduct. A recent study by the Association of Certified Fraud Examiners (the 2014 Global Fraud Study) found that organizations with such hotlines detected misconduct 50% more quickly than organizations without such hotlines. Hotlines can also provide a rich source of data from which companies may identify gaps in existing anti-corruption programs and trends that may signal emerging FCPA risks. See How Does Your Company s Anti-Corruption Hotline Compare?, The FCPA Report, Vol. 3, No. 21 (Oct. 22, 2014). 3) Take Whistleblower Allegations Seriously Third, companies must ensure that they respond to whistleblowers professionally and take their allegations of wrongdoing seriously. The manner in which a company responds to a whistleblower has a significant and direct impact on the likelihood that future whistleblowers will report internally. The National Business Survey observed that 40% of respondents who decided to report misconduct externally cited the fear of retaliation as prompting their decision. Similarly, employees need to feel confident that when they report potential misconduct it will be reviewed thoroughly and in a timely manner by competent investigators, and that responsible parties will be held accountable. In the same survey, 50% of employees who reported externally attributed their decision to a feeling that outside help was necessary to stop the problem. It is also important that a company s culture of compliance extend beyond the company s employees to every person and entity with which the company does business. The 2014 Global Fraud Study found that over 40% of tips about misconduct received by organizations came from non-employees, such as customers and vendors. Indeed, the 2014 Whistleblower Report notes that 20% of whistleblower awards made by the SEC since the Whistleblower Program began have been to contractors 4

and consultants. To this end, educating customers, contractors and consultants about the company s internal reporting mechanisms and the company s commitment to compliance is important in ensuring that any potential misconduct is reported to the company first rather than to the SEC. The SEC has been supportive of companies efforts to encourage individuals to report potential misconduct internally. As SEC Chair Mary Jo White noted in June 2014, the Whistleblower Program is designed to encourage whistleblowers to work within their company s own compliance procedures. One factor that the SEC takes into account in determining the size of a whistleblower award is the extent to which the whistleblower utilized the company s internal reporting procedures.[14] Additionally, in determining the size of an award, whistleblowers who report internally before going to the SEC can be credited with providing any information they directly communicate to the SEC, as well as any information that the company subsequently learns in an internal investigation and discloses to the SEC.[15] Ensuring Employee Agreements Are Compliant While encouraging internal reporting is important, companies must also ensure that they do not run afoul of Rule 21F-17, which prohibits impeding an individual s efforts to report potential misconduct to the SEC.[16] As the SEC has yet to bring an enforcement action based on a violation of the rule, its reach is unclear. Based on public statements by the SEC staff, however, it appears that companies may face SEC scrutiny with respect to provisions in their employee agreements, such as employment, severance and confidentiality agreements. Chief of the Whistleblower Office, Sean McKessy, has stated that agreement provisions that condition a benefit on not communicating with the SEC about potential misconduct may violate the rule.[17] McKessy has also warned that provisions of these agreements may violate the rule even if they do not explicitly state that the signatory cannot report potential misconduct to the SEC.[18] Concrete guidance on the reach of the rule in this area may come soon as pressure from different stakeholders mounts. This past October, eight Democratic members of Congress sent a letter to Chair White encouraging the SEC to enforce Rule 21F-17 against what they described as preemptive legal maneuvering to silence prospective whistleblowers. The letter cited a Washington Post report on KBR s confidentiality agreements, which reportedly required employees seeking to report fraud internally to certify that they would keep their allegations confidential even from government regulators.[19] The content of KBR s confidentiality agreements came to light after a KBR whistleblower s lawyer discovered the problematic provisions during the whistleblower s lawsuit against the company.[20] Since that time, the SEC has reportedly opened an investigation into KBR based on the agreements.[21] As the 2014 Whistleblower Report reveals, while the majority of whistleblower award recipients are not represented by counsel when they first report misconduct, by the time they apply for an award the majority of whistleblower award recipients are represented. Whistleblower counsel have been vocal in their support for further clarification of Rule 21F-17. This past July, a law firm known for representing whistleblowers joined with a whistleblower advocacy organization in petitioning the SEC to issue additional regulations clarifying the reach of Rule 21F-17 with respect to employment, severance and confidentiality agreements.[22] In response to this mounting pressure, Chief McKessy recently stated that he has made the investigation of these agreements a priority.[23] Indeed, the SEC noted in its 2014 Whistleblower Report that the Whistleblower Office is actively working with the Enforcement staff to identify and investigate practices in the use of confidentiality and other kinds of agreements that may violate [Rule 21F-17]. 5

McKessy is confident that enforcement actions for violations of the rule are on the horizon, stating this past October that in the next year and half or so, if we haven t [brought an enforcement action based on these agreements], I ll be very surprised. [24] Thus, companies can soon expect guidance that should assist in navigating what McKessy has described as the fine line between encouraging reporting internally and forcing reporting internally to the exclusion of [going] to [the SEC]. [25] For now, in light of the SEC s recent focus on employee agreements, companies would be wise to examine their existing agreements to minimize the likelihood that the SEC will raise questions under Rule 21F-17. Conclusion The heightened awareness of the Whistleblower Program abroad, the demonstrable potential to obtain sizable awards and the increasing number of whistleblower tips suggest that whistleblowers will play an increasingly important role in the SEC s enforcement of the FCPA going forward. In this changing landscape, companies should be vigilant in monitoring court decisions and enforcement actions that address the open questions about Dodd-Frank s whistleblower provisions. As more courts examine these questions, and the SEC continues to bring enforcement actions in this area, companies will hopefully receive much-needed guidance concerning the scope of the provisions. In the meantime, companies would do well to review their internal reporting mechanisms, resources for addressing reports of misconduct and employee agreements to ensure that they are effective in encouraging employees to report FCPA issues internally without being perceived as impeding employees from providing information to the SEC. David M. Stuart is a partner in Cravath s Litigation Department. His practice focuses on government and internal investigations and matters related to regulatory enforcement, litigation and compliance. Mr. Stuart served for six years in the Division of Enforcement at the U.S. SEC and almost three years as Senior Counsel of Investigations and Regulatory Affairs for General Electric Company. Omar K. Madhany is an associate in Cravath s Litigation Department. Mr. Madhany joined Cravath as a summer associate in 2013 and returned to join the legal staff in 2014. Beginning September 2015, Mr. Madhany will serve as a law clerk to the Hon. Joseph A. Greenaway, Jr., U.S. Court of Appeals for the Third Circuit. 6

[1] See 15 U.S.C. 78j-1(m)(4)(B) (2012). [2] See 18 U.S.C. 1514A(b) (2012). [3] See id. 1514A(b)(2)(D); 1514A(e)(2). [4] See 15 U.S.C. 78u-6(h)(1) (2012). [5] See id. 78u-6(a)(1); 78u-6(a)(3); 78u-6(a)(5); 78u-6(b)(1). [6] See id. 78u-6(b)(1). [7] 17 C.F.R. 240.21F-17(a) (2014). [8] See 15 U.S.C. 78u-7(d) (2012). [9] All statistics about FCPA settlements, whistleblower awards made and whistleblower tips received are reported for the SEC s fiscal years, which end on September 30 of each calendar year. [10] Statistics about whistleblower awards made based on tips alleging an FCPA violation are not available as whistleblower awards are made on a confidential basis. See, e.g., Whistleblower Award Proceeding File No. 2012-1, Exchange Act Release No. 67698 (Aug. 21, 2012). [11] See 15 U.S.C. 78u-6(h)(1)(A) (2012) (emphasis added). [12] See 18 U.S.C. 1514A(a)(1)(C) (2012). [13] See 15 U.S.C. 78u-6(a)(6) (2012). [14] See 17 C.F.R. 240.21F-6(a)(4) (2014). [15] See id. 240.21F-4(c). [16] See id. 240.21F-17(a). [17] See Brian Mahoney, SEC Warns In-House Attys Against Whistleblower Contracts, Law360, Mar. 14, 2014. [18] See Stephanie Russell-Kraft, SEC Whistleblower Head To Punish Cos. That Silence Tipsters, Law360, Oct. 17, 2014 (McKessy Interview). [19] See Scott Higham & Kaley Belval, Workplace secrecy agreements appear to violate federal whistleblower laws, Wash. Post, June 29, 2014; see also Scott Higham, Lawsuit brings to light secrecy statements required by KBR, Wash. Post, Feb. 19, 2014 (KBR Agreements). [20] See KBR Agreements. [21] See Scott Higham, SEC has opened investigation into KBR, whistleblower s lawyer says, Wash. Post, Mar. 10, 2014. [22] See Tom Devine & Jordan A. Thomas, Petition for Rulemaking and the Issuance of a Policy Statement Regarding Certain Aspects of the Dodd-Frank Whistleblower Program (July 18, 2014). [23] See McKessy Interview. [24] See id. [25] See id. 7