SEC Approves Final Whistleblower Rules Under Dodd-Frank

On May 25, the Securities and Exchange Commission adopted the final rules to establish a whistleblower program that Congress required as part of the Dodd-Frank Act.  The program rewards individuals who provide the agency with high-quality tips that lead to successful enforcement actions for securities law violations.  The SEC received such a large number of comments in response to the proposed rules released in November 2010 that, in considering those comments, the final rules were adopted over a month later than the statutory deadline.  Companies should familiarize themselves with the important changes and update internal compliance and anti-retaliation policies to best position themselves to investigate and respond to whistleblower complaints. We list at the end of this update some practical suggestions for companies to consider when dealing with these new rules.

No Requirement That Whistleblowers Report Internally First

Most significantly, the SEC is not requiring whistleblowers to report potential violations through internal compliance programs prior to reporting them to the SEC.  As provided in one of the most highly criticized provisions of the proposed rules, the final rules allow whistleblowers to be eligible to receive a bounty from the SEC even if they bypass reporting internally.  As SEC Chairman Schapiro said in adopting the final rules, the SEC seeks to strike a balance by adding provisions that incentivize, but do not require, whistleblowers to utilize internal compliance programs.  Because the SEC may be aware of information before the company is aware of it, it is critically important to have a plan in place that facilitates rapid internal investigation of allegations of wrongdoing.  The final rules will change the manner and speed in which companies must respond to whistleblower complaints, and should cause entities to rethink their internal compliance plans so as to incentivize internal reporting from whistleblowers.

Congress Created the Bounty Program in Dodd-Frank

Congress intended for the whistleblower program to reward individuals who expose violations and provide sufficiently detailed information that helps the SEC bring successful cases.  The SEC’s final rules implement Dodd-Frank’s mandate in Section 922 of that statute that a whistleblower may receive an award for voluntarily providing original information to the SEC that leads to a successful enforcement action in which the SEC obtains monetary sanctions exceeding $1 million.  The various terms and conditions of the government paying such a bounty are defined in the statute and the rules, and the award may be from 10% to 30% of the monetary sanctions collected by the government for violations of the securities laws.  Many terms are left undefined in Dodd-Frank, including the scope of the “securities laws.”  The SEC’s view is that its role in enforcement of the Foreign Corrupt Practices Act (“FCPA”), for example, means that whistleblowers whose information leads to monetary sanctions for violations of the FCPA are eligible for awards.  Recent SEC announcements of large FCPA sanctions in several cases are certain to lead to increased whistleblower reporting in the hope that a large award awaits.

The SEC’s Final Rules

The SEC’s rules provide definitions and details where the statute does not.  In particular, the rules describe who is eligible for awards by defining what it means “voluntarily” to provide the SEC with “original information,” and what “successful enforcement,” “action” and “monetary sanctions” include.  Individuals whose employers receive an SEC request or subpoena for documents, for example, may still qualify as whistleblowers eligible for an award.  If individuals are interviewed in connection with an internal investigation, they are not disqualified from whistleblower status.  Given the new whistleblower incentives, companies must continue to carefully consider whom to interview when conducting an investigation with counsel.

Other categories of individuals are excluded from eligibility, such as wrongdoers who directed or planned the misconduct, certain compliance personnel, attorneys and accountants (under most but not all circumstances) and individuals who received their information in violation of the law.  The Dodd-Frank Act excluded criminally convicted wrongdoers and certain categories of government employees, but did not address these other categories.

Whistleblowers may also recover awards for “related actions,” defined in the final rules to include judicial or administrative actions by the Attorney General of the United States, appropriate regulatory authorities, self-regulatory organizations or state attorneys general in criminal cases based on the same original information voluntarily provided by the whistleblower.  While whistleblowers cannot recover twice, the rules broaden the scope of the type of action that may lead to an award.

The procedures set out by the SEC for submitting a whistleblower tip include, among other user-friendly guidelines, an online form from the SEC’s Office of the Whistleblower, run by Sean McKessy.  The Office was mandated by the statute but has been the subject of much recent Congressional testimony concerning how it will be funded.  The final rules provide for the process and criteria that the SEC will consider when evaluating whether and how much of an award the whistleblower may receive.

Important Changes from the Proposed Rules

While many aspects of the November 2010 proposed rules stayed the same, multiple provisions of the final rules changed.  The more notable changes include the efforts to incentivize, as opposed to require, whistleblowers to report internally first:

• The SEC lengthened the period of time (from 90 to 120 days) that a whistleblower can wait before coming to the SEC after reporting internally and still remain eligible for an award.  A whistleblower who first reports through an entity’s internal compliance procedures and, within 120 days, then reports to the SEC, can be eligible for an award as if the report was made to the SEC as of the first, internal reporting date.  The SEC uses that “look back period” so that the date by which the whistleblower’s submission is measured would be the earlier internal reporting date.
• In reaction to comments that there may be abuses of the anti-retaliation provisions, the SEC added in the final rule that for the anti-retaliation provisions to apply, the whistleblower must have a “reasonable belief” that there has been a violation of the securities laws.
• The final rules allow a whistleblower to obtain an award where the company passes along the information to the SEC through self-reporting after the whistleblower reports internally, thus allowing potential recovery of an award for a whistleblower who might not have otherwise received one because their evidence was not sufficiently developed to go directly to the SEC.  The whistleblower would get credit for the full information reported by the company, which might increase the amount of the reward.
• When considering the amount of an award, the SEC can consider how much a whistleblower participated in or interfered with the internal compliance process, and can increase the amount of an award for a whistleblower’s voluntary participation in internal compliance. 

Practical Preparedness

The SEC’s final rules provide a disincentive for employees to report potential wrongdoing internally, and instead incentivize whistleblowers to go directly to the SEC.  In order to maximize the internal reporting incentives, companies should revisit their whistleblower and hotline reporting and anti-retaliation policies and make them as simple and productive as possible, including reviewing training programs under those policies.  Employers should explore how best within their culture to encourage reporting internally, whether through management training or offers of perks or other benefits to those reporting true securities violation concerns.

The expansion of the rules’ look back period to 120 days may provide companies more time to investigate complaints than the proposed rules’ 90-day period, but this time is still far less than is sometimes necessary to understand fully whether violations have occurred.  The SEC has reported a steep increase in the number of tips since the Dodd-Frank’s effective date in July 2010, and it has indicated that, in order to investigate complaints, it may, where appropriate, go to companies and ask them to explain why violations did not occur.  Companies that receive such a complaint will have to act quickly to investigate and determine whether the complaint has any merit.  Establishing a plan for scoping, investigating and analyzing specific complaints will vary of course, based on the facts, circumstances and allegations involved.  Allegations involving complex accounting issues may require external expertise, and investigations of potential FCPA violations may span multiple jurisdictions, for example.  Companies should consider a plan for the mechanics of rapidly gathering information from the company’s systems, and for designating management and board responsibility for particular types of investigations.