On July 21, 2010, President Obama signed the Dodd-Frank Wall Street Reform and Protection Act ("Dodd-Frank"), implementing a monumental package of financial industry reforms that significantly strengthen the government's tools for enforcement. One aspect that will prove critical to enforcement and has caused an uproar in corporate America is Section 922, which provides huge monetary incentives for whistleblowers to come forward and report to the SEC information about securities law violations.1 The new program is intended "to motivate those with inside knowledge to come forward and assist the government to identify and prosecute persons who have violated the securities laws and recover money for victims of financial fraud." S. Rep. No. 176, 111th Cong., 2d Sess. 110-111 (2010). It will inevitably increase the number of securities law investigations and prosecutions. Indeed, the SEC estimates that the whistleblower provisions will result in 30,000 tips each year.
The new whistleblower program will be codified as Section 21F of the Securities Exchange Act of 1934. In a nutshell, it empowers the SEC to pay a bounty to whistleblowers who provide the SEC with "original information" that leads to a judicial or administrative action which results in the imposition of monetary sanctions of over $1 million. The SEC must pay a bounty to the whistleblower of 10% to 30% of the sanction imposed. Monetary sanctions are defined broadly to include fines, disgorged funds and interest imposed on any award. Given the fact that monetary awards for violations of the securities laws are often substantial – for instance, violations of the Foreign Corrupt Practices Act ("FCPA") routinely result in monetary sanctions exceeding many multiples of $1 million – the incentive for whistleblowers is tremendous.2 Dodd-Frank contains similar provisions for whistleblowers who report violations of the Commodity Exchange Act to the Commodity Futures Trading Commission.
Not only does Dodd-Frank's whistleblower provision arm the SEC with a formidable enforcement tool, but the provision itself is extremely broad in many respects. First, the information provided by a whistleblower can relate to not only inaccurate disclosures and improper accounting practices by public companies, but also encompasses violations of the FCPA, the Investment Advisers Act and the Investment Company Act. As a result, not only public companies but also investment advisers and private equity entities fall within its ambit. Furthermore, the new incentives apply to complaints concerning conduct occurring before the enactment of the legislation, as well as to reports filed after enactment but before the effective date of the implementing regulations.
According to the legislation, whistleblower reports must provide "original information," i.e., information that is: 1) derived from the whistleblower's independent knowledge or analysis; 2) not known to the SEC from any other source; and 3) not derived exclusively from allegations made in a government hearing, investigation or report, or from news media.
Finally, the SEC has discretion to determine the amount awarded to a whistleblower, but not whether an award will be made. Factors identified in Dodd-Frank for consideration by the SEC when deciding the amount of any award are: 1) the significance of the information; 2) the degree of assistance provided; and 3) the SEC's programmatic interest in deterring violations by making awards to whistleblowers. The SEC's decision is not appealable.
Dodd-Frank also proscribes retaliation against whistleblowers and its protections in this regard exceed those provided under the Sarbanes-Oxley Act. Specifically, Dodd-Frank provides a new federal cause of action for persons alleging retaliation for protected whistleblower activity. The Sarbanes-Oxley Act protections require that initial retaliation claims be filed at the administrative level. However, under Dodd-Frank, those retaliated against can bring an action directly in federal district court and, if successful, are entitled to reinstatement, double back pay, attorneys fees and court costs.
Needless to say, the whistleblower provisions have huge implications for corporate compliance, the most significant being: 1) how to ensure that to the extent there is a violation of the securities laws, an internal whistleblower will take advantage of internal reporting mechanisms as opposed to bypassing such mechanisms and immediately going to the SEC; 2) how to conduct an internal investigation without precipitating whistleblowers; and 3) how to successfully mediate any problems discovered.
THE PROPOSED RULE
On November 3, 2010 the SEC issued proposed Regulation 21F to implement the whistleblower program. The comment period for the rule ends December 17, 2010 and it must be finalized by April 2011. The rule purports to define terms used in the statute, outline procedures for reporting securities law violations and explain the scope of the program. It also attempts to address some of the concerns voiced regarding how to synchronize the whistleblower provisions with an entity's own corporate governance procedures, specifically inviting comment in this area.
Key Provisions of Regulation 21F
"Whistleblower" is limited to natural persons (although they may provide information alone or jointly with others) who provide information to the SEC relating to a potential violation of the securities laws.3 Certain categories of individuals are specifically excluded from the definition. These include members, officials and employees of regulatory agencies, such as the Department of Justice, a self-regulating entity, the Public Company Accounting Oversight Board ("PCAOB"), and other law enforcement organizations. The SEC will not disclose the identity of the whistleblower except in very limited circumstances, such as in connection with administrative or judicial proceedings.
"Original Information" means information based on the whistleblower's independent knowledge or analysis, not already known to the SEC, not derived exclusively from public sources, and provided for the first time to the SEC after July 21, 2010. Certain types of information are specifically excluded. For instance, "original information" does not include:
- information protected by the attorney-client privilege or learned during the course of legal representation;
- information learned by independent auditors during an audit required by the securities laws if the information relates to a violation by the engagement client or its directors, officers or other employees. However, this exclusion would not apply to the client's employees, even if they interact with the outside auditors;
- information learned by employees with a legal or contractual duty to report to governmental authorities, self-regulatory organizations or the PCAOB. For example, both a government contracting official who discovers and reports fraud in a government contract and an officer or employee of a city pension fund who discovers fraud in the management of the fund would not be entitled to whistleblower status; and
- information learned by a person with legal, compliance, audit, supervisory or other governance responsibilities for the entity. However, this exclusion comes with a caveat – the exclusion is not available if the entity does not disclose the information within a "reasonable time" or acts in "bad faith." "Reasonable time" is dependent on the particular facts. "Bad faith" includes conducting sham internal investigations, failing to preserve evidence and interfering with witnesses. Significantly, and in a nod to the importance of internal reporting mechanisms, a whistleblower may still be deemed to have provided original information if the whistleblower initially reports the information through an internal corporate mechanism, and the date of submission to the SEC will be deemed to be the date of internal submission (to preserve the whistleblower's place in line for the bounty). The information must still be reported to the SEC within 90 days of internal reporting, and there is no requirement that a whistleblower first avail his or herself of the available internal mechanisms. The SEC has stated in commentary to proposed Rule 21F that it will consider whether a whistleblower took advantage of internal reporting mechanisms when determining the bounty to be awarded. However, it remains to be seen how this will occur in actual practice. An employee can still qualify for a whistleblower award if the basis of the information is conclusions drawn by the types of questions asked during an internal investigation.
"Leads to Successful Enforcement Action" means 1) the information resulted in the opening of a new investigation and significantly contributed to the success of a resulting enforcement action; or 2) the conduct was already under investigation but the information was essential to success and would not otherwise have been discovered.
"Related Action" leading to a bounty must be based upon the same original information that led to the SEC's successful enforcement action, and the related action may be brought by the Attorney General of the United States, appropriate regulatory agencies, a self-regulatory organization or a state attorney general in a criminal case. Significantly, the SEC will not combine sanctions imposed in separate judicial or administrative actions to reach the $1 million threshold.
"Voluntarily" means the information is provided when there is no formal or informal request, inquiry or demand from the SEC, Congress, other federal, state, or local authorities, self-regulatory organizations or the PCAOB.
The proposed regulation does contain a few safeguards aimed to insure the integrity of whistleblowers. An anonymous whistleblower must be represented by counsel who must certify that the whistleblower's identity has been verified. Information must be submitted under penalty of perjury.4 Whistleblowers cannot get immunity from SEC actions based on their own conduct in connection with securities law violations.
As noted earlier, tension exists between the whistleblower program and the encouragement of strong corporate governance programs. The SEC in its commentary to proposed Rule 21F acknowledges this paradox and has specifically asked for comments to address it. For instance, some of the specific areas where the SEC has invited comment include:
- the intersection between proposed Rule 21F and established internal procedures for the receipt, investigation and response to complaints about potential violations of law;
- whether the definition of whistleblower should be limited to those who provide information about potential legal violations "by another person," thereby excluding those who report their own potential violations;
- whether the 90-day deadline for submitting a potential violation to the SEC (after reporting to an internal mechanism) is an appropriate length of time; and
- whether the SEC should require whistleblowers to first utilize employer-sponsored reporting mechanisms or, alternatively, make internal reporting a consideration in determining the award to a whistleblower.
STEPS TO TAKE NOW
What can an impacted organization do now? First, take advantage of the SEC's invitation to comment on proposed Rule 21F. The agency recognizes the tension posed by the proposed rule and wants input in addressing it. Second, review existing compliance, training, and audit functions and programs. Make sure they communicate clearly and forcefully that violations of the law are not condoned and will be punished, and that this message emanates from top management, including the Board. The stronger the compliance mechanisms the less likely there will be securities law violations in the first place. Ensure that the availability of internal reporting mechanisms such as hotlines are widely broadcast and easily accessible. Finally, review all anti-retaliation policies in light of the new cause of action provided in the legislation and the proposed Rule.
Footnotes
1 Prior to Dodd-Frank the SEC's bounty program was limited to insider trading cases, capped at 10% of the monetary sanctions, and seldom used.
2 For example, in 2010 BAE Systems plc and Technip, S.A. settled FCPA investigations for $400 million and $338 million, respectively. In 2009 Halliburton/KBR paid $579 million to resolve FCPA charges.
3 Use of the term "potential violation" is intentional to ensure the anti-retaliation provisions of Dodd-Frank apply irrespective of whether the whistleblower satisfies all conditions to qualify for an award and irrespective of an ultimate determination of whether the conduct reported constitutes a securities law violation.
4 The U.S. Attorney for the Southern District of New York in recent remarks at a PLI presentation stated that his office intends to prosecute those who lie or create fictitious information in order to claim entitlement to a bounty.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.