United States: Living With The SEC’s Whistleblower Rules

On May 25, 2011—with two Commissioners dissenting—the Securities and Exchange Commission ("SEC" or "Commission") released final rules implementing the new whistleblower program created by The Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank Act"), which was enacted on July 21, 2010.¹ While the Dodd-Frank Act sets forth a basic framework for the whistleblower program, Congress left many of the thorny details to the SEC to resolve through rulemaking.² To that end, the SEC released proposed rules for comment on November 3, 2010.³ Over the next month-and-a-half, more than 1,000 organizations and individuals—including blue chip companies, trade associations, whistleblower advocates, academics, and others—commented on the Proposed Rules.⁴ Many of the comment letters voiced concerns that the whistleblower program would undermine existing corporate compliance programs by permitting whistleblowers to bypass internal reporting mechanisms and providing whistleblowers with too much protection from adverse employment actions.

As discussed below, while the SEC made some modest revisions to the Proposed Rules, the Commission's basic approach remained unchanged. Now that these issues have been resolved, compliance personnel should closely reexamine the adequacy of their existing compliance programs through the lens of the Dodd-Frank Act's whistleblower program. In addition to discussing aspects of the whistleblower program, this article highlights several core areas that compliance personnel should focus on as they begin that process.

Overview of the Dodd-Frank Act's Whistleblower Provision

Among other things, the Dodd-Frank Act authorizes substantial cash rewards and provides strong job protections to whistleblowers who voluntarily provide the SEC with information leading to the successful prosecution of securities law violations. Under the Dodd-Frank Act, the SEC is required to pay whistleblowers cash rewards of between 10 and 30 percent of any monetary sanctions in excess of $1,000,000 that the government, as a result of the whistleblower's assistance, recovers through either civil or criminal proceedings, based on a violation of the securities laws by private or public companies.⁵

Specifically, the whistleblower program applies to monetary sanctions recovered by the SEC, the Department of Justice, self-regulatory organizations, state attorneys general, and other specified regulators.⁶ In order to qualify for such rewards, whistleblowers must provide the SEC with "original

information," which (i) must be "derived from the independent knowledge or analysis of a whistleblower;" (ii) cannot be "known to the Commission from any other source;" and (iii) cannot be "exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation, or from the news media."⁷

Because whistleblowers were eligible for rewards as soon as the Dodd-Frank Act was enacted (even though the implementing rules had not yet been adopted), within two months of its enactment, the SEC was already reporting a substantial increase in the number of "high quality" tips that it had received.⁸ Voicing her support for the Final Rules, SEC Chairman Mary Schapiro stated that "[f]or an agency with limited resources like the SEC, I believe it is critical to be able to leverage the resources of people who may have first-hand information about potential violations of the securities laws...."⁹ Indeed, the federal government is increasingly relying on the promise of substantial cash bounties to encourage would-be whistleblowers to report possible misconduct. For example, the Internal Revenue Service recently paid a whistleblower $4.5 million for reporting that a Fortune 500 company owed significant unpaid taxes.¹⁰ Substantial whistleblower awards are certain to garner media attention, which will increase public awareness about whistleblower programs and likely encourage more would-be whistleblowers to step forward.

The whistleblower program is one of the many new enforcement tools at the SEC's disposal. On June 17, 2011, for example, the SEC announced a new rule delegating authority to the Director of the Enforcement Division to issue witness immunity orders, under which the SEC can compel testimony from witnesses who assert their privilege against self-incrimination. Such orders will likely become increasingly common in the future, particularly for individuals who have significant knowledge about securities law violations, despite only playing a minor role in the misconduct.¹¹

The Final Rules Do Not Require Whistleblowers to Internally Report Possible Securities Law Violations

Under the Final Rules, whistleblowers are not required to report possible securities law violations through internal reporting mechanisms prior to reporting to the SEC.¹² The SEC ultimately adopted (with some modifications) the approach set forth in the Proposed Rules.¹³ Nevertheless, as discussed below, the SEC included a number of provisions in the Final Rules designed to encourage whistleblowers to rely, in the first instance, on internal reporting mechanisms. For example, whether whistleblowers rely on internal reporting procedures will be a factor that the SEC considers in determining award amounts (within the 10%-30% range). In addition, as discussed below, the Final Rules allow whistleblowers who internally report to maintain their "place in line" so long as they report the possible securities law violation to the SEC within 120 days. Finally, if a whistleblower's employer self-reports a securities law violation to the SEC based on information that it received from a whistleblower, the SEC will give that whistleblower "credit" for the total universe of information that the company reports (and not just the information that the whistleblower provided).¹⁴

The extent to which whistleblowers should be required to exhaust internal reporting mechanisms before contacting the SEC was a hotly contested issue. The comment letters show a clear division between business interests, that favored an internal reporting requirement, and whistleblower advocates, that did not. For example, General Electric, Google, Honeywell, JPMorgan Chase, Microsoft, and Northrop Grumman jointly wrote that permitting whistleblowers to bypass internal reporting mechanisms would "weaken internal corporate compliance programs and inhibit the efforts of responsible entities to investigate and remediate potential compliance violations."¹⁵ The American Bar Association's Committee on Federal Regulation of Securities similarly argued that "whistleblowers who are company employees should be required to demonstrate that they have made a good faith attempt to use the range of internal reporting mechanisms a company has put into place to enable the reporting of such complaints, up to and including reporting to the company's audit committee."¹⁶

In contrast, the Project on Government Oversight ("POGO") expressed concern "that the SEC's proposed rules might be overly deferential to the internal compliance programs that were established at many firms in the aftermath of Enron and after the passage of the Sarbanes-Oxley Act."¹⁷ Similarly, the National Whistleblowers Center ("NWC") submitted a report examining historical experience with the whistleblower provisions in the False Claims Act that concluded that the "existence of a qui tam or whistleblower rewards program has no negative impact whatsoever on the willingness of employees to utilize internal corporate compliance programs or report potential violations to their managers."¹⁸ Other commenters also expressed concern that internal control systems may be ill-suited to adequately uncover and report certain types of misconduct. For example, the Auditing Standards Committee of the Auditing Section of the American Accounting Association wrote that "there are cases of securities violations for which internal control systems are not designed to prevent, detect, or correct and....[f]orcing whistleblowers to use a specific private system administered by the organization suspected of the wrongdoing would severely limit the effectiveness of the program."¹⁹

In explaining the Staff's recommendation not to require internal reporting, Director of Enforcement Robert Khuzami stressed four points. First, he stated that there is no empirical data supporting the view (expressed by many commenters) that a permissive internal reporting rule would undermine internal compliance programs. Second, he predicted that most companies, as good corporate citizens, would continue to maintain robust internal compliance programs whether or not whistleblowers are required to report internally. Third, he noted that Congress drafted the whistleblower provisions to increase the number of reports being made to the SEC, and that requiring internal reporting could discourage certain employees from reporting possible securities law violations. Finally, he stated that nothing in the Dodd-Frank Act itself requires internal reporting, and that creating such a requirement would impede the discovery of many common schemes, including boiler room operations and Ponzi schemes, where an entire entity is corrupt.²⁰

Although the Final Rules seek to encourage whistleblowers to internally report possible securities law violations (as discussed above), some whistleblowers may still be inclined to report possible violations directly to the SEC. For example, whistleblowers may be leery of discussing possible securities law violations with anyone but a government employee out of fear of getting "scooped" and losing out on a bounty even though the Final Rules attempt to address that concern through the 120-day "look back period." Similarly, even though whistleblowers are protected from employer retaliation under the Dodd-Frank Act, employees are nonetheless likely to be concerned about retaliation and may believe that any such claims will be taken more seriously if they have a "record" of having contacted the SEC. Whistleblowers are also likely to fear more subtle forms of retaliation, such as being ostracized by their employers and co-workers and stripped of their substantive job responsibilities. Despite these obstacles, companies can effectively encourage would-be whistleblowers to internally report possible securities law violations. While employers are legally prohibited from impeding employee reports to the SEC,²¹ companies can and should actively promote internal reporting mechanisms as a viable (and, in some cases, superior) alternative.

Audit Committee Members, Legal and Compliance Personnel, and Human Relations Professionals Should Take This Opportunity to Reexamine Their Corporate Whistleblower Policies and Make Sure That Employees are Aware of Their Internal Reporting Options

Following the collapse of Enron and WorldCom in the late 1990s, Congress passed and the president signed the Sarbanes-Oxley Act ("SOX"). Among other things, SOX required audit committees of public companies to establish procedures to allow employees to raise concerns about accounting or auditing issues on a confidential basis. As a result, internal reporting procedures are now a common aspect of corporate compliance programs. However, because SOX focused on a relatively narrow area—financial reporting—companies should reexamine the adequacy of their internal reporting functions in light of the Dodd-Frank Act's much broader coverage of all securities law violations. For example, while certain violations of the Foreign Corrupt Practices Act ("FCPA") may not necessarily implicate SOX (e.g., an issuer paying bribes to a foreign government official), such violations fall within the scope of the Dodd-Frank Act's whistleblower provisions.²² Accordingly, compliance policies should, among other things, establish a process for reporting any possible impropriety to designated compliance personnel (and not just conduct relating to financial reporting). Because some employees may feel uncomfortable directly reporting possible misconduct to management or compliance personnel (particularly at smaller companies, where management/compliance personnel may know the suspected violator), many companies have developed procedures to facilitate anonymous reports. To that end, an increasing number of companies are relying on external vendors to accept (typically through toll-free hotlines) and process reports.

Of course, corporate compliance programs have little value unless employees are alerted to their existence and believe them to be credible. In addition to training all new employees, companies should provide current employees with periodic "refresher" courses to emphasize key policies. With respect to corporate whistleblower policies, companies should actively promote the internal reporting options that are available to employees. For example, companies might promote internal reporting options by posting promotional materials in break rooms and on internal intranet sites. The more committed companies appear to be (and are), the more likely it is that employees will feel comfortable using internal reporting mechanisms.

Companies Should Welcome Internal Reports by Whistleblowers and, to the Extent Possible, Communicate That the Company is Responding Appropriately to Their Allegations

In our experience, some whistleblowers have limited visibility into corporate processes and become genuinely concerned about something they observe in isolation that would not at all be troubling if the whistleblower had more facts and could see the broader corporate context. Having raised the concern internally, these isolated whistleblowers may remain unduly troubled, absent some feedback from the company. While companies need to be sensitive about sharing detailed information about ongoing internal investigations with whistleblowers, companies should weigh the feasibility of implementing a process to keep whistleblowers (even those that choose to remain anonymous) informed about the status of any internal investigations into the reported conduct in order to demonstrate their commitment to following up on such reports. Otherwise, whistleblowers have no way to know whether their complaints are being taken seriously, and may erroneously assume they are being ignored.

In addition to interviewing whistleblowers and asking for their suggestions about how their reports should be investigated (who should be interviewed, where responsive documents are maintained, etc.), companies should consider reinterviewing whistleblowers as they learn new facts. Reinterviewing whistleblowers and generally referencing new facts in the questioning can send a strong signal to whistleblowers that their reports are being taken seriously and are being actively investigated. Of course, in order to maintain the integrity of internal investigations and preserve any applicable privileges (including the attorney-client privilege), companies should not share detailed information about internal investigations with whistleblowers. For example, companies should not specifically identify other personnel with whom they are speaking or detail what other witnesses have said.

Another way for companies to demonstrate, both to whistleblowers and to regulators, that they take reported misconduct seriously is by specifically promoting corresponding compliance activities. For example, if an employee internally reports possible violations of the FCPA, the company (in addition to conducting an appropriate internal investigation) should consider upgrading its procedures, retraining its employees about FCPA compliance, and rolling out an internal campaign to promote FCPA awareness and compliance.

Whistleblowers Have 120 Days From When They Internally Report to File a Report With the SEC

Putting aside situations where a company has an affirmative duty to disclose or provide a specific notice to a regulator or trading market, the question of whether and when to voluntarily self-report possible securities law violations has always been a nuanced and complicated decision.²³ While companies previously had the opportunity to conduct a thorough investigation and consider whether to self-report largely on their own timelines, the Final Rules dramatically limit the window of time that companies have to complete that process. Companies may choose to self-report for a variety of reasons. For example, cooperation credit in government investigations and/or leniency at sentencing can create strong incentives to self-report.²⁴ In addition, companies may want to demonstrate that they are good corporate citizens. On the other hand, self-reporting is not always the right answer.

To encourage would-be whistleblowers to internally report possible securities law violations, the SEC initially proposed giving whistleblowers a 90-day "look back period" to file a report with the SEC while maintaining their "place in line."²⁵ In response to strong criticism that 90 days was too little time to conduct an adequate internal investigation and decide whether to self-report, the SEC ultimately adopted a 120-day "look back period" in the Final Rules.²⁶ The Committee on Federal Regulation of Securities, for example, wrote that "[i]mposing a 90-day deadline may make it more likely that the companies would find themselves reporting the status of investigations, rather than the conclusions, which may not be in the best interests of the company and its shareholders."²⁷ However, certain commenters, like the Auditing Standards Committee noted that "[a] defined time frame, perhaps 90 days, would encourage those in charge to prioritize and expedite the investigation."²⁸ In the end, the Commission concluded 120 days set the right middle ground.

For a narrow group of potential whistleblowers, however, 120 days is the beginning point, not a time limit. While the Final Rules maintain the exclusions set forth in the Proposed Rules relating to officers, directors, compliance personnel, auditors, and attorneys acting as whistleblowers, they create a significant new exception that Commissioner Kathleen Casey described as the "exception that utterly swallows the rule."²⁹ Under the Final Rules, any such individuals can become a whistleblower after "[a]t least 120 days have elapsed since [the whistleblower] provided the information to the relevant entity's audit committee, chief legal officer, chief compliance officer (or their equivalents), or [the whistleblower's] supervisor, or since [the whistleblower] received the information, if [he or she] received it under circumstances indicating that the entity's audit committee, chief legal officer, chief compliance officer (or their equivalents), or [his or her] supervisor was already aware of the information."³⁰ In addition, any such individuals can also act as whistleblowers if they have "a reasonable basis to believe that disclosure of the information to the Commission is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors."³¹ Finally, any such individuals can also act as a whistleblower if he or she "has a reasonable basis to believe that the relevant entity is engaging in conduct that will impede an investigation of the misconduct."³² This exception further underscores the importance of maintaining robust whistleblower policies and actively investigating allegations of possible wrongdoing.³³

Companies Should Develop Protocols to Investigate Whistleblower Tips

Despite the SEC's decision to increase the "look back period" from 90 to 120 days, companies will still need to investigate whistleblower tips on an expedited timeline. Accordingly, as part of their general crisis management planning, companies should adopt effective systems to log, keep track of, and investigate reports within the 120-day "look back period." Companies, for example, may want to "map" the review process and designate personnel to be responsible for each step of the process. Companies will also need to elevate concerns to senior management, and as appropriate, to the audit committee or full board of directors, on an accelerated basis in order to leave enough time for those parties to make a well-informed decision about whether to self-report and/or take other corrective action.

Companies should also review internal processes for issuing "document holds" to relevant personnel to preserve documents (including electronic communications) relating to whistleblower reports. Moreover, given the prevalence of electronic communications in today's environment (and the important role that emails and other forms of electronic communication tools play in most internal and government investigations), companies should consider developing review platforms to facilitate the review of whistleblower reports. Reviewing relevant emails is one of the first steps in any whistleblower investigation. Moreover, persons tasked with investigating whistleblower reports should have no connection with the factual allegations in the report. Finally, companies should consider when to engage outside counsel and/or experts (such as information technology experts and/or forensic accounting experts) to help investigate whistleblower reports. In addition to lending companies a wealth of investigative experience, communications between the company and external counsel may be better protected from disclosure than similar communications with internal counsel in certain jurisdictions.³⁴

Whistleblowers are Broadly Protected From Employer Retaliation

The anti-retaliation provision under the Dodd-Frank Act prohibits an employer from discharging or otherwise discriminating against a person because of his or her whistleblower status.³⁵ The Final Rules make clear that the anti-retaliation provision even protects whistleblowers who report "possible" securities law violations when the alleged conduct ultimately proves to be lawful or when no government action follows the tip.³⁶ Moreover, retaliation under the provision is punishable by, among other things, reinstatement, double back pay with interest, and reasonable attorney's fees.³⁷

Many commenters expressed concern about the broad scope of the Dodd-Frank Act's anti-retaliation provision, and were fearful that it would overly restrict employers from making employment decisions unrelated to an employee's status as a whistleblower. The Committee on Federal Regulation of Securities, for example, predicted that the Dodd-Frank Act's anti-retaliation provision would invite frivolous claims by employees looking for a "shield that could prevent companies from terminating or otherwise changing the[ir] employment status...."³⁸ The U.S. Chamber of Commerce similarly cautioned that "the whistleblower program should not be implemented in a way that inhibits companies from taking appropriate employment or other action against internal wrongdoers."³⁹

In contrast, POGO welcomed a broad anti-retaliation provision and supported the SEC's proposal to define a whistleblower "as an individual who, alone or jointly with others, provides the Commission with information relating to a potential violation of the securities laws."⁴⁰ In the Proposed Rules, the SEC explained that it used the term "potential violation" to highlight the anti-retaliation provision's applicability to whistleblowers who are ultimately found not to be eligible for a bounty.⁴¹ The District of Columbia Bar Association presciently (as discussed below) recommended "expanding the anti-retaliation protections to whistleblowers who report to persons with legal, compliance, audit, supervisory or governance responsibilities for the entity"—since the anti-retaliation provision, as proposed, expressly applies only to whistleblowers who provide information to the SEC.⁴²

In dismissing suggestions to carve out exceptions for disciplinary actions taken against employees independent of their whistleblower status, the SEC highlighted that "[b]y its terms, the statute only prohibits adverse employment actions that are taken "because of" any lawful act by the whistleblower to provide information...."⁴³ The SEC similarly declined to require that whistleblower reports relate to a "material" violation of the securities law. On that issue, the SEC wrote that "it is preferable for individuals to provide us [the SEC] with any information they possess about possible securities violations (irrespective of whether it appears to relate to a material violation) and for us to evaluate whether the information warrants action."⁴⁴

Although anti-retaliation policies are standard components of most corporate compliance programs, compliance personnel should ensure that their anti-retaliation policies are compliant with the Dodd-Frank Act's broad anti-retaliation prohibition. As a threshold matter, unlike Section 806 of SOX, which prohibits public companies from retaliating against whistleblowers, the Dodd-Frank Act's anti-retaliation provision applies to all employers (whether publicly held or private). As such, private companies, which were previously outside the scope of SOX, need to carefully examine the adequacy of their internal compliance infrastructure (including their anti-retaliation policies and confidentiality restrictions) in light of the Dodd-Frank Act.

Although the Dodd-Frank Act is less than one year old, courts are already beginning to interpret its parameters. For example, a recent Southern District of New York decision, Markey v. J.P. Morgan Chase & Co., et. al., 10 Civ. 3824 (S.D.N.Y. Jan. 14, 2011), which concerned Section 806 of SOX, suggests that the Dodd-Frank Act's anti-retaliation provision may protect employees who blow the whistle on third parties, including clients of their employer. In that case, a former vice president at a large investment bank was allegedly terminated after telling her supervisor about her belief that a client was engaged in illegal conduct. Although the court dismissed the employee's retaliation claim (with leave to replead), it rejected the employer's argument that the whistleblowing was not protected by Section 806. After reviewing SOX's legislative history, the court concluded that Section 806 should be read broadly to protect employees who blow the whistle on third-parties.

In another recent decision, Egan v. TradingScreen, Inc., et. al., 10 Civ. 8202 (S.D.N.Y. May 4, 2011), a court in the Southern District of New York held that the Dodd-Frank Act's anti-retaliation provision does not necessarily protect whistleblowers who rely on internal reporting mechanisms, but do not subsequently make a report to the SEC. In Egan, the plaintiff, a senior executive at TradingScreen, learned that the chief executive officer was misusing corporate assets for the benefit of another company that he owned. The plaintiff subsequently reported the chief executive officer's alleged misconduct to TradingScreen's president, who notified the company's independent directors. The plaintiff alleged that he was then terminated for reporting that conduct. Although the Court dismissed the plaintiff's retaliation claim (with leave to replead), it left open the possibility that the plaintiff's conduct would be entitled to protection under the Dodd-Frank Act if the law firm retained by TradingScreen's independent board members reported the complained of conduct to the SEC.

In light of the uncertainty regarding the Dodd-Frank Act's anti-retaliation provision, companies should carefully reevaluate their current compliance policies to ensure that they comply with the Dodd-Frank Act. In addition, companies should continually highlight their commitment to not retaliate against whistleblowers through employee training programs and related training materials.

Conclusion

The new whistleblower rules underscore the importance of companies revisiting their internal reporting requirements to ensure that sufficient measures are in place for a person to report wrongful conduct, without fear of retaliation. Having a strong internal reporting system in place may encourage individuals to utilize internal reporting mechanisms prior to reporting to the SEC. Companies may also want to consider adopting their own incentive programs to encourage individuals to remain vigilant and attentive to wrongful conduct. Nevertheless, just as compliance personnel are beginning to get a handle on the Final Rules, Congress has already held a hearing about amendments to the Dodd-Frank Act's whistleblower provision. During that hearing, Representative Michael Grimm of New York introduced a proposed bill that would, among other things, require whistleblowers to first report possible securities law violations internally.45 In any case, as the scope and protections of the new whistleblower program are tested in the coming years, companies should be prepared to handle what may turn out to be an influx of tips as a result of its implementation.

Footnotes

1 Securities Whistleblower Incentives and Protections, 76 Fed. Reg. 34300 (June 13, 2011) (to be codified at 17 C.F.R. pts. 240, 249) (hereinafter "Final Rules").

2 Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, 124 Stat. 1376, § 924(a) (2010) (hereinafter "Dodd-Frank Act").

3 Proposed Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, 75 Fed. Reg. 70488 (Nov. 17, 2010) (to be codified at 17 C.F.R. pts. 240,249) (hereinafter "Proposed Rules").

4 U.S. Securities and Exchange Commission, http://www.sec.gov/comments/s7-33-10/s73310.shtml .

5 Dodd-Frank Act at § 922(a). The Final Rules require the SEC to consider a number of factors in determining the amount of an award, including: (i) the significance of the information provided by the whistleblower; (ii) the assistance provided by the whistleblower; (iii) the SEC's programmatic interest in deterring particular violations of the securities laws; (iv) participation in internal compliance systems; (v) culpability; (vi) unreasonable reporting delay; and (vii) interference with internal compliance and reporting systems. Final Rules at 34331.

6 Dodd-Frank Act at § 922(a).

7 Id.

8 Dodd-Frank Act at § 924(b); Jessica Holzer & Fawn Johnson, Larger Bounties Spur Surge in Fraud Tips, WALL STREET J., Sept. 7, 2010. See also Mary L. Schapiro, Chairman, U.S. Securities and Exchange Commission, Opening Statement at SEC Open Meeting: Item 2 — Whistleblower Program (May 25, 2011), available at http://www.sec.gov/news/speech/2011/spch052511mls-item2.htm (hereinafter "Schapiro's Opening Statement") ("While the SEC has a history of receiving a high volume of tips and complaints, the quality of the tips we have received has been better since Dodd-Frank became law. We expect this trend to continue, and these final rules map out simplified and transparent procedures for whistleblowers to provide us critical information.").

9 Schapiro's Opening Statement.

10 Ashby Jones, Accountant Gets Whistleblower Payout, WALL STREET J., Apr. 8, 2011.

11 Delegation of Authority to the Director of Its Division of Enforcement, 76 Fed. Reg. 35348 (June 17, 2011) (to be codified at 17 C.F.R. pt. 200).

12 Final Rules at 34325 ("Although many commenters argued that we should require whistleblowers to report possible violations internally either before or contemporaneously with reporting to us, we are not persuaded that such a requirement would achieve better overall enforcement of the Federal securities laws than the approach we are adopting for several reasons.").

13 Proposed Rules at 70496.

14 Final Rules at 34325.

15 Letter from General Electric Company, Google Inc., Honeywell Inc., JPMorgan Chase & Co., Microsoft Corporation, Northrop Grumman Corporation, to Elizabeth Murphy, Secretary, U.S. Securities and Exchange Commission (Dec. 17, 2010) at p.1.

16 Letter from Jeffrey W. Rubin, Chair of the Committee on Federal Regulation of Securities of the Section of Business Law of the American Bar Association, to the U.S. Securities and Exchange Commission (Jan. 4, 2011) at p.16 (hereinafter "ABA Letter"). Carmen Lawrence served as a member of the drafting committee for the ABA Letter.

17 Letter from Danielle Brian, Executive Director, Project on Government Oversight, to Elizabeth Murphy, Secretary, U.S. Securities and Exchange Commission (Dec. 17, 2010) at p.1 (hereinafter "POGO Letter").

18 National Whistleblowers Center, "Impact of Qui Tam Laws on Internal Compliance: A Report to the Securities [sic] Exchange Commission," (Dec. 17, 2010) at p. 4. The NWC based its conclusion on a review of all qui tam cases filed between 2007 and 2010 under the False Claims Act, and found that 89.7% of employees who eventually filed a qui tam case initially reported their concerns internally. See also John T. Boese, SEC's Whistleblower Rules Show What the SEC Has Learned (at Least For Now) From the False Claims Act About Avoiding Whistleblower Abuses, FRIED FRANK FRAUDMAIL ALERT, Dec. 9, 2010, available at http://friedfrank.com/siteFiles/Publications/Fried%20Frank%20FraudMail%20Alert®%20No.%2010-12-08.pdf .

19 Letter from Eileen Taylor, North Carolina University, James Bierstaker, Villanova University, Past Chair Auditing Standards Committee, and Joseph Brazel, North Carolina State University, Chair, Auditing Standards Committee, to Elizabeth Murphy, Secretary, U.S. Securities and Exchange Commission (Dec. 17, 2010) at p.2 (hereinafter "Auditing Standards Committee Letter").

20 Robert S. Khuzami, Director, Div. of Enforcement, U.S. Securities and Exchange Commission, Remarks at Open Meeting — Whistleblower Program (May 25, 2011), available at http://www.sec.gov/news/speech/2011/spch052511rk.htm.

21 17 C.F.R. § 240.21F-17. Companies should also review their standard confidentiality agreements and internal policies relating to the enforcement of those agreements to avoid taking any action that might be deemed to "impede an individual from communicating directly with the Commission staff about a possible securities law violation...."

22 Under the Dodd-Frank Act, "securities laws" is defined by reference to Section 3 of the Securities Exchange Act of 1934 ("1934 Act"). Dodd-Frank Act at § 2(15)(A). Section 3 of the 1934 Act defines "securities laws" as "the Securities Act of 1933, the Securities Exchange Act of 1934, the Sarbanes-Oxley Act of 2002, the Public Utility Holding Company Act of 1935, the Trust Indenture Act of 1939, the Investment Company Act of 1940, the Investment Advisers Act of 1940, and the Securities Investor Protection Act of 1970." (citations omitted). Given that the anti-bribery provisions of the FCPA amended the 1934 Act (see § 30A of the 1934 Act), violations of those provisions constitute securities law violations under the Dodd-Frank Act.

23 We are preparing a follow-up article on this topic, to be published in July 2011.

24 See, e.g., U.S. SENTENCING GUIDELINES MANUAL § 8C2.5(g)(1) (2010) ("If the organization (A) prior to an imminent threat of disclosure or government investigation; and (B) within a reasonably prompt time after becoming aware of the offense, reported the offense to appropriate governmental authorities, fully cooperated in the investigation, and clearly demonstrated recognition and affirmative acceptance of responsibility for its criminal conduct, subtract 5 points [from the organization's total culpability score.]"); U.S. Securities and Exchange Commission, Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934 and Commission Statement on the Relationship of Cooperation to Agency Enforcement Decisions, Release No. 44969 (Oct. 23, 2001); Financial Industry Regulatory Authority, Regulatory Notice 08-70, FINRA Provides Guidance Regarding Credit for Extraordinary Cooperation (2008).

25 Proposed Rules at 70516.

26 Final Rules at 34322.

27 ABA Letter at p.19.

28 Auditing Standards Committee Letter at p.6.

29 Kathleen L. Casey, Commissioner, U.S. Securities and Exchange Commission, Statement by SEC Commissioner: Adoption of Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 (May 25, 2011), available at http://www.sec.gov/news/speech/2011/spch052511klc-item2.htm .

30 17 C.F.R. § 240.21F-4(b).

31 Id.

32 Id.

33 We plan to release an article specifically examining these issues later this summer.

34 Notably, the European Court of Justice ruled that communications between in-house counsel and company employees are generally not protected from disclosure. Thus, companies with operations in Europe should consider the risk that internal investigations conducted by in-house legal personnel may not be privileged (at least in Europe). See Case C-550107 P, Akzo Nobel Chemicals Ltd v. Commission (Sept.14, 2010 E.C.R); Alasdair Balfour & Ianis Girgenson, EU Court Limits the Scope of Legal Professional Privilege, FRIED FRANK MEMORANDUM TO OUR FRIENDS AND CLIENTS, Sept. 14, 2010, available at http://www.friedfrank.com/siteFiles/Publications/51DFD520BA1258667DB66F4E55A3FADA.pdf .

35 Dodd-Frank Act at § 922(h).

36 Final Rules at 34302.

37 Dodd-Frank Act at § 922(h).

38 ABA Letter at p.5.

39 Letter from U.S. Chamber of Commerce, et. al., to Elizabeth Murphy, Secretary, U.S. Securities and Exchange Commission (Dec. 17, 2010) at p.8.

40 POGO Letter at p.8.

41 Proposed Rules at 70489.

42 Letter from District of Columbia Bar Section on Corporation, Finance and Securities Law, to Elizabeth Murphy, Secretary, U.S. Securities and Exchange Commission (Dec. 17, 2010) at p.4.

43 Final Rules at 34304.

44 Id. at 34303.

45 Ashby Jones, For Whistleblower Fans, A Grimm Proposal, THE WALL STREET J., March 5, 2011 ("The proposed changes address corporate concerns that the promise of multimillion-dollar payouts will spur their employees to stampede to the SEC with allegations of corporate malfeasance, undercutting the anonymous hotlines and other internal reporting channels companies put in place after the 2002 Sarbanes-Oxley law.").

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.