United States: The Proposed Rules For The New SEC Whistleblower Law: Resolving The "Tension" Between Compliance And Whistleblowing

The SEC has released its proposed rules for implementation of the much-anticipated whistleblower law enacted last summer as part of the Dodd-Frank financial overhaul bill (the "Act").¹ The proposed rules and the commentary explaining them cover almost 200 pages. Much has been written and discussed about the new law. Some corporate counsel fear the law will undermine compliance programs by encouraging employees to run to the government before reporting problems through internal channels. Some commentators predict a mother lode of new whistleblower allegations, others are doubtful. The golden age of whistleblowing may be upon us, or it may turn out to be a big bust.

The commentary makes clear the SEC is concerned with what it perceives to be the "tension" between the whistleblower provisions in the Act and the need for effective corporate compliance programs. Both SEC Chair Mary Schapiro and SEC Enforcement Director Rob Khuzami have indicated recently that the SEC does not want the whistleblower program to "undermine" corporate compliance programs.² This is a worthy objective, for such programs are an important part of corporate and government efforts to prevent and discover fraud. Companies are encouraged by the SEC and DOJ to initiate robust compliance programs. Under current policy, decisions on whether to prosecute errant corporations criminally may turn on the perceived effectiveness of their governance programs.

However, this concern for compliance programs has caused the SEC, in drafting its proposed rules, to tilt in favor of protecting those programs over its support for whistleblowing. If the proposed rules take effect as drafted, the clear Congressional mandate in the Act to encourage and protect whistleblowers could be undone by a complicated set of rules (and exceptions to rules) likely to discourage and confound would-be whistleblowers and reduce their chances of successfully obtaining an award. The sad history of whistleblowing laws may be repeated here: good intentions followed by regulations and court decisions which substantially restrict the law's effectiveness. The SEC can ill afford to let this law, which if successful could materially aid securities enforcement, be strangled in its infancy by rules which, however well intentioned, may serve only to discourage and thwart many potential whistleblowers.³

1. THERE IS NO BASIS IN THE DODD-FRANK ACT TO PROTECT COMPLIANCE PROGRAMS AT THE EXPENSE OF WHISTLBLOWERS

The SEC's mandate is to keep the whistleblower rules clear, simple, and user-friendly. The commentary to the proposed rules acknowledges at the outset: "...we have taken several steps to address Congress's suggestion that the Commission's rules be clearly defined and user-friendly." (such as using "plain English")(Release p.3). But the proposed rules are anything but clear, and hardly "user friendly." Congress wrote the law in concise, direct, unambiguous language. Congress did not express concern for potentially impacting compliance programs; nor did it draft the law to protect or favor such programs. While giving the SEC authority to write implementing rules, the Act indicates that SEC rules implementing the Act should in every respect serve to encourage those goals and do nothing to discourage or frustrate would-be whistleblowers.⁴

The SEC however, acknowledges up front that it feels that it must consider "competing interests" in drafting the rules, viz. the fear of reducing "the effectiveness of a company's existing compliance, legal, audit and similar internal processes for investigating and responding to potential violations of the federal securities laws." (Release at 4) Thus, "with this possible tension in mind", the SEC rule writers say they tried to write the rules so as "not to discourage whistleblowers who work for companies that have robust compliance programs to first report the violation to appropriate company personnel" while still preserving their whistleblower status and eligibility for an award.

This may be a noble goal, but it is not found in the Act. The law is clear—a whistleblower has the absolute right to go first to the SEC. As long as he has the requisite "original information" as defined rather succinctly in the Act, he can only be disqualified from receiving an award (assuming the enforcement action nets over $1 million) if he falls into clearly specified categories, such as being convicted of a crime in the case or being one of a select group of government employees or the company's auditor. See Sec. 21F(c)(2)(A-D) Denial of Award. The Act places no restraint on the ability of a whistleblower to come directly to the SEC at any time and under any circumstances, except for the narrowly defined group that cannot qualify. The Act does not make initial resort to a compliance program a factor in determining the size of an award.

In short, in passing a law with a clear emphasis on supporting whistleblowers, the Congress must be taken at its word—whistleblowers are permitted to go directly to the SEC, can do so anonymously if they wish, and, while having to meet specified requirements, do not have to resort first to their company compliance department to remain eligible for an award.

2. THERE IS NO "TENSION" BETWEEN WHISTLEBLOWERS AND COMPLIANCE PROGRAMS.

The legal right of any whistleblower to present his information directly to the SEC and remain eligible for an award is not detrimental to the effectiveness of compliance programs. Well implemented programs, supported by top management, encourage employees to step forward and report wrongdoing. Obviously, given the numerous cases of corporate fraud uncovered in recent years that were neither prevented nor discovered in timely fashion by the compliance officials, these programs need all the help they can get. However, if an employee chooses to report first to the SEC, the result is the same: the alleged wrongdoing is exposed, and can be investigated by the company, the SEC, or both. Compliance officers and company lawyers should be relieved that the problem has been exposed by whatever means and the company can get to work on correcting the wrongdoing and protecting shareholders and the public as soon as possible. Indeed, in most cases where serious wrongdoing is reported up through compliance and legal channels, the SEC is notified almost immediately so the company can get maximum benefit from cooperation.

The only "tension" introduced by Act is that compliance and legal departments and their outside counsel will on occasion not have the option of evaluating the whistleblower disclosures first, if those employees have gone to the SEC before the company has discovered the problem. When an employee whistleblower goes first to the SEC, he does not "undermine" the company's compliance program. All it means in practice is that the SEC will sometimes be calling the company before the company calls the SEC. This does not reflect poorly on the compliance program, unless the information indicates the program has suppressed the information already, something the SEC should learn about. From the SEC's standpoint, it should not tilt in favor of the compliance industry and create traps in the rules to deny awards to employees who choose to go directly to the agency, as Congress intended and provided for in the Act.

3. NEW "DEFINITIONS" ADDED IN THE PROPOSED RULES MAY SIGNIFICANTLY REDUCE WHISTLEBLOWER TIPS AND AWARDS

In its effort to assist compliance programs, the SEC has proposed rules that in some cases contravene the clear language of the Act, and may discourage potential whistleblowers who are trying to evaluate whether they should run the risk of going to the SEC. The proposed rules needlessly muddy the water by introducing additional "definitions" to key parts of the Act.⁵ For example, the SEC elects to define the word "voluntary" found in the sentence "...whistleblowers who voluntarily provided original information to the Commission..." Sec. 21F(b)(1). This is not a word that really needs re-definition: Webster defines "voluntary" as "proceeding from the will or from one's own choice or consent" or as "done by design or intention." We all instinctively seem to know when an act is "voluntary." Under the proposed rules, it seems that a clearly voluntary act can become "involuntary," and thus ineligible for an award.

a) Once the SEC is investigating your employer, even if you are unaware of it, you cannot go to the SEC with relevant information and qualify as a whistleblower.

The SEC proposed rules define a voluntary submission as one that must come to it "before [the whistleblower or his employer has received] any formal or informal request, inquiry or demand from the commission [or other government agencies] about a matter to which the information in the whistleblower's submission is relevant." (Release, p. 11)(Proposed Rule 21F-4(a)(1).(emphasis added). This could be as little as a request for information in a broad SEC "sweep" which can cover an entire industry. The wide swath of disqualification this provision may cause is further suggested in the observation that a whistleblower is still given credit as such if he comes to the SEC even after being questioned by internal investigators about possible violations, "unless...the [whistleblower's] information is within the scope of a request, inquiry, or demand directed to the employer by one of the designated authorities." (Release, p. 12, n. 11). Thus any whistleblower who freely undertakes to bring his "original information" to the SEC is not considered to be making a "voluntary" submission if his information is "relevant" to any request previously made by the SEC to his employer, even if the whistleblower was completely unaware of the request.

To illustrate the problem, imagine you are a mid- level manager at a company which has received some form of request from the SEC. Your information is important, and is arguably within the "scope" of the inquiry (the existence of which is unknown to you or anyone else in the company, outside the legal department at corporate HQ hundreds of miles away). Or maybe you have heard something about an investigation and are fearful evidence may disappear, or you are aware of employees who have not been truthful with the internal investigators or are destroying documents. After agonizing over whether to risk it, you contact the SEC and provide your information which is material and ultimately is the basis for a large enforcement penalty. You believe yourself to be a bona fide whistleblower. The SEC, however, decides that your information was within the "scope" of an informal request (to enforcement lawyers, just about anything is within the "scope" of their broadly worded requests) made earlier to your employer, and informs you that you don't qualify, under Sec. 240.21F-4.

Thus, under the proposed rule, you should have given your information directly to your company (even though you were fearful your supervisor or others would retaliate), and then waited around for months until all document production was concluded to find out if you got lucky and the company failed to give your information to the SEC (in which case you may "re-qualify" after all). But that will never happen now because, since you went to the SEC first with the material information, the SEC asked the company about the matter and the company turned your tip over in a "timely manner."

Instead of wasting months wading through thousands of documents and taking extensive testimony, the SEC could cut right to the chase in a fraud investigation if a whistleblower employee emerges early on who has direct knowledge of this matter. Why require employees to report first to the very people they may believe to be corrupt, or at least prone to retaliate? Moreover, who will decide, and when, if the whistleblower loses because his information is "within the scope of an inquiry directed to the employer"? The uncertainly introduced into the whistleblower's calculation by this convoluted rule will probably deter most employees from giving either the company or the SEC the information, which is a net loss for compliance programs and the investing public.

b) If the SEC decides you should have provided your information to some other authority earlier, you cannot qualify as a whistleblower now.

In drafting the Act, Congress wisely provided that certain specified government employees should not benefit from becoming whistleblowers, such as employees of regulatory agencies, law enforcement officials, and auditors. The law sets forth these categories specifically, Sec. 21F(c)(2)(A). The SEC proposed rules would broaden that prohibition to "other similarly-situated persons..." (Release p. 14). Thus government contracting officers cannot be whistleblowers on government contracts. But neither can a broadly defined group of corporate managers who under recent procurement rule changes are now themselves obligated to report "credible evidence" of violations of various federal criminal laws, False Claims Act violations and overpayments on government contracts. 73 Fed. Reg. 67064 (December 2008); FAR Subpart 9.4. The SEC commentary offers this helpful hint: "a city officer or employee with responsibility for the city's pension fund might have a pre-existing legal duty to report fraud in connection with the fund's management or financial reporting to appropriate city authorities." (Release p.14). The SEC even asks if the rule should "preclude submissions for all Government employees." (Release p. 16).

Congress directly addressed the issue of rewarding those with some degree of "unclean hands" but kept the list very narrow, i.e. those who are "convicted of a criminal violation related to the...action for which the whistleblower could otherwise receive an award..." are not eligible for that award. Sec.21F(c)(2)(B). This is as it should be, but note that Congress did not disqualify someone who "should have" reported the matter but failed to do so, for whatever reason. What if the whistleblower should report but is fearful of retaliation? What if her superiors are involved in the wrongdoing? What if she did report it, nothing was done, and she should have gone over the heads of her immediate superiors, but did not? Many government agencies and self-regulatory organizations require that entities under their jurisdiction (and thus their employees and managers) may be under such "a pre-existing legal or contractual duty to report the securities violations" (Proposed rule 17 CFR Part 240.21F-4(3) (Release p. 128). Are all these potential whistleblowers disqualified if they fail to report for any reason but decide instead to go first to the SEC? Why would the SEC want to unilaterally eliminate these vast and varied sources of information from whistleblower consideration?

Indeed, why would the SEC want to insert itself into the messy process of trying to decide in each case (including potentially thousands of state and local jurisdiction laws) if the would-be whistleblower was under some pre-existing obligation to report the fraud internally? Such a rule will surely dissuade most potential whistleblowers from reporting anything to anyone if they fear punishment for not previously reporting the information internally. Why should a would-be whistleblower take the chance of going first to the SEC, possibly to face the consequences of a finding by the SEC that she should have reported up internally? After all, these whistleblowers may be the only ones who will talk and can really break open the case. Later, if required, they can face within their own organization the consequences of their failure to report earlier (assuming that failure is not excusable, as it could well be).

4. When your testimony is not derived from your "Independent knowledge"---confronting the SEC's list of disqualifying "exceptions."

The Act defines the "Original Information" given by a whistleblower to qualify for an award to be that which is "derived from the independent knowledge or analysis of a whistleblower." Sec. 21F(a)(3)(A). The proposed rules set forth seven "circumstances" or "exceptions" in which information will not be considered to derive from an individual's independent knowledge or analysis (even if it really did). Several of these "exceptions" erect major roadblocks to classes of would-be whistleblowers who otherwise could provide very valuable information.

a) If you have "legal, compliance, audit, supervisory or governance responsibilities", and receive information the SEC should know about, do not tell the SEC right away if you want a whistleblower award. Wait a "reasonable time" to see if the company reports it first.

"Independent knowledge" can be derived from "communications and observations in your business or social interactions." (Proposed rule 17 CRF Part 240.21F-4(b)(2)(Release p. 128). However, the proposed fourth exception to the "independent knowledge" requirement would exclude from whistleblower status anyone "with legal, compliance, audit, supervisory, or governance responsibilities for an entity [who] receives information about potential violations" when the information came from someone who reasonably expected the recipient "would take appropriate steps to cause the entity to respond to the violation." (Release at 24)(Proposed rule 17 CFR Part 240.21F-4(b)(4)(iv). The fifth proposed exclusion is even broader, denying whistleblower status to anyone who supplies the SEC with information that is obtained through "an entity's legal, compliance, audit or other similar functions or processes for identifying, reporting and addressing potential non-compliance with law..." Under both exceptions, a whistleblower may still qualify if the company does not disclose the information to the [SEC] "within a reasonable time" or "proceeded in bad faith." Id. at (v).

These broad exceptions, and the exceptions to those exceptions, are fraught with problems. They basically eliminate from consideration a vast swath of potential whistleblowers unlucky enough to be involved in the legal, audit, supervisory, governance or compliance areas. Of course, these are the very people who are most likely to learn the type of information that most demands immediate disclosure to the SEC. The SEC seems content to let the information stay in house, and to disqualify anyone who would come directly to them, at least until after passage of a "reasonable time." If the information is related to an "ongoing fraud that poses substantial risk of harm to investors", the commentary states the "reasonable time" for disclosure "may be almost immediate." The SEC reserves to itself to evaluate afterward in each case what that "reasonable time" might be, or whether the company "proceeded in bad faith." (Release p.27).

The SEC is concerned about corporate officials "front-running" internal investigations for their own potential gain. But there are many legitimate reasons why such a person would take the risk of going to the SEC with the information before or while reporting it through channels to superiors. For example, some of those to whom that information would have to be reported may themselves be implicated, or the officer believes the investigation is being mishandled. He may know that, in the past, the company compliance department has ignored similar complaints, or retaliated in subtle ways (or worse) against those reporting such information. But if there is any chance the SEC will take the whistleblower's information, decide he should have told the company first, and then contact the company and (even unintentionally) expose him, very few will take the chance of coming forward.

In reality, most legal and compliance professionals who are part of a legitimate compliance program will not likely risk their career for the chance of an award by immediately running to the SEC with information they obtained in their official capacities. Chances are this will be the exception, not the rule, and may only happen in circumstances where it will clearly be justified by the facts.

The uncertainty is not cured by the safe-harbor for the would-be whistleblower whose company does not disclose the information within a "reasonable time" or otherwise "proceeds in bad faith." Who decides how long the whistleblower has to wait before pulling the trigger and going to the SEC? How will he know what the company is doing with regard to its disclosure to the SEC? Is he supposed to threaten his employer with going to the SEC himself unless it expedites disclosure of the information to the SEC staff? How can the company compliance program function if the company perceives that it is under the gun to go to the SEC within some undefined "reasonable time" before its employee decides to take matters into his own hands? If there is what appears to be an ongoing fraud, the commentary suggests the compliance officer can go right to the SEC, which would seem to give him considerable leverage over his employer. In effect, this rule makes every frustrated in house compliance officer, lawyer, or other individual who has material information a ticking time bomb, ready to go off (to the SEC) at any time he feels it to be "reasonable." It should be apparent that this proposed "exclusion" is unworkable in practice and will only serve to undermine the Act while doing little to enhance compliance programs. Whistleblowers want some assurance that they will not be hung out to "twist in the wind" after disclosing their information to the government. This proposed rule introduces considerable uncertainly all around, confounding whistleblowers and subjecting compliance programs to Monday-morning scrutiny when the SEC tries to decide later if an award is appropriate.

5. The SEC's "Lookback" guarantee: report to the company first, think it over, then wait no more than 90 days to report to the SEC to qualify for an award.

This proposed rule seeks to protect awards for employees who qualify as whistleblowers and who could have gone right to the SEC first but instead report their information to the employer first. After reporting their information to they company, they will still have 90 days to report the same information to the SEC, which will consider the date of disclosure to the company as the date of disclosure to the SEC, thus allowing them to be eligible for an award. (Release p. 25, n.35; Proposed Rule 21F-4(b)(7)). They apparently do not have to wait for any "reasonable period." Thus, regardless of how long the allegation might require adequately to investigate, the employer is now held hostage by the employee and must almost certainly make a quick disclosure to the SEC to protect itself from the employee going in first. Likewise, if the employee waits more than 90days to go the SEC, he loses out. Why should that be, if he was the original source of the information?

The SEC, trying to explain who wins and who does not, has even added a chart to its commentary at p. 27 of the Release parsing out the three categories of potential whistleblowers who may or may not have sufficient "independent knowledge" to qualify for an award. This mind-boggling effort to slice and dice potential whistleblowers into winners and losers creates tremendous uncertainty, will put undue pressure on employers to "outrun" the employee to the SEC, and will infuriate whistleblowers who act in good faith but end up disqualified for an award because of some technical violation of these complicated and arbitrary rules.

6. SEC to potential whistleblowers: talk to your compliance officer first or risk being given the smallest possible award.

As a final deflator for potential whistleblowers, the SEC's proposed imply that whistleblowers who choose not to report their information first through "effective internal whistleblower rules, legal or compliance procedures" will be penalized at award time. Although the Act itself set forth a specific set of factors for it to consider in determining the size of the award, the proposed rules allow the SEC to consider whether the whistleblower reported internally first as a factor in determining the final amount of an award between 10 and 30 percent. The SEC states it "will consider higher percentage awards for whistleblowers who first report violations through their compliance programs." (Release p. 51). The clear message: come to us first and it could cost you.

Nothing in the Act suggests this is a valid criterion for limiting an award. Moreover, who decides, and when, whether the compliance program in a particular company was "effective"? Does an employee who sees an FCPA bribe taking place in a foreign branch of a multinational corporation have any way to know that he should report first to the company (even though his local boss is a tyrant) because, far off in New York, the company has a great compliance program? Does the SEC really want to undertake this open-ended invitation to litigation with successful whistleblowers who get less than 30% because they made the "mistake" of not reporting internally first? How does a lawyer advise a client who wants to report anonymously to the SEC that he may be hurting his chances of an award above 10% unless he goes first to the company, thereby exposing his identity? This proposed rule virtually forces whistleblowers who hope for any award above 10% to report internally to the very entity they are accusing of wrongdoing as opposed to encouraging them to come directly to the SEC itself.

7. A Simple Suggestion to Protect Compliance Programs and Encourage Whistleblowing.

The SEC's proposed rules create a confusing minefield that is certain to send the wrong message to would be whistleblowers and eventually may cause many to fail to qualify even after taking the huge risks associated with whistleblowing. At the same time the rules put undue pressure on compliance programs to report quickly to the SEC or face the wrath of an impatient whistleblower. These "unintended consequences" are not necessary to achieve what the SEC wants: successful compliance programs and a smooth road to encourage successful whistleblowing.

There is at hand a straightforward solution to the alleged "tension" between whistleblowing and support of compliance, the seed of which is contained within the SEC's commentary itself. The SEC obviously wants whistleblowers to resort to company compliance programs first, and come to it only as a last resort. Of course, this is totally counterintuitive, since by their very nature whistleblowers are those who go generally go outside the company to report on wrongdoing. Nevertheless, in the commentary, the SEC notes the following:

Thus, any employee who reports first to the company has no reason to fear she will not be eligible for an award as long as the company ultimately reports to the SEC, and reports that she is the original source of the information. The SEC could, by rule, require the company bringing information to it to identify the original source (as it would presumably do anyway if there was an ensuing SEC investigation) and thus protect the whistleblower. The company could also be required to give a status report to the whistleblower as to whether and when it will go to the SEC, or if it has decided not to take the information given by the whistleblower to the SEC. At that point the employee could choose for herself if she believes the company has resolved the matter properly, or if she will instead go to the SEC. There are no time deadlines, no uncertainties, no different classes of whistleblowers, no penalty for making the wrong choice initially. If anonymity is important, the whistleblower's counsel can make the disclosure to the company on behalf of his client, just as he would have made it to the SEC.

This approach does not require any employee to go to the employer first to preserve her right to an award, thus employers will have to make clear to all their employees that they will be protected if reporting internally, and credited as the source of original information, so as to encourage them to report first through the company's compliance program. The better the job the company does in giving its own people the comfort that they will be protected, the better the chance the compliance program will work and employees will report up first. In cases where, for whatever reason, the employee chooses to go first to the SEC, she will not be penalized or disqualified for an award for that reason alone. While there may be a few "front runners," rogue compliance officers, or others who choose to go first to the SEC for reasons which are less than admirable, the agency and Congress can watch the program unfold for several years to see if this becomes a real issue (my guess is it will not be), and pass legislation or draft rules at that point to fix the problem. But initially, the simplicity of the Act will be preserved, and whistleblowers will come to understand that the risk they are taking stands a fair chance of being rewarded.

CONCLUSION: THE NEED TO MAKE IT WORK

The SEC has a lot riding on the success of the whistleblower provisions of the Act. If the programs fails to live up to expectations, it will be seen as another missed chance by the Agency to step up its enforcement program (and the SEC's aggressive Inspector General will be sure to drive that point home in his first annual report on the progress of the program). However well-intentioned, the complex and confusing set of rules as now proposed do little to help whistleblowers, which was clearly what Congress intended. They also put undue pressure on companies to report information from internal whistleblowers immediately to the SEC. A much simpler set of rules should be proposed, with far fewer hurdles for whistleblowers. The SEC should make this Act truly "user friendly" for the real "users" themselves: the courageous individuals who do not choose to remain silent, but rather to risk their careers by stepping forward to report violations of the securities laws.

Footnotes

1. "Propose Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934." 17 CFR Parts 240 and 249. Release No. 34-63237; File No. S7-33-10. November 3, 2010. (hereafter referred to as the "Release")

2. Likewise, the U.S. Attorney in Manhattan recently warned of "whistleblowers run amok" and emphasized that false reports may merit criminal prosecution. Whistleblowers seem to be viewed in some quarters like the band of grizzled marauders in the credit card commercial. One would hope the government is at least as aggressive in prosecuting high corporate officers who lie to and mislead shareholders in their SEC filings as it threatens to be with all these fraudulent whistleblowers.

3. To be fair, the SEC at this point has proposed rules and asked for reaction and suggestions for improvements. Nevertheless, the level of detail in the proposed rules, and the thrust of the commentary, strongly suggests that the rules as proposed reflect the approach favored by the SEC, particularly with regard to the issue of protecting compliance programs.

4. See, e.g. Sec. 21F(j) RULEMAKING AUTHORITY.—The Commission shall have the authority to issue such rules and regulations as may be necessary or appropriate to implement the provisions of this section consistent with the purposes of this section. [emphasis added].

5. As the commentary innocuously puts it: "Proposed Rule 21F-4 would define some additional terms that are important to understanding the scope of the whistleblower reward program, in order to provide greater clarity and certainty about the operation and scope of the program." (Release p. 11).

Daniel J. Hurson is former Assistant Chief Litigation Counsel at the SEC and a former Assistant U.S. Attorney. He practices securities enforcement and white collar defense law in his own firm in Washington D.C. His email is dan@hursonlaw.com. His website is http://www.hursonlaw.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.