United States: SEC Adopts Final Rules On Dodd-Frank Whistleblower Program

On May 25, 2011, the U.S. Securities and Exchange Commission (SEC) adopted final rules (the "Rules") for the expanded whistleblower program established by the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank).¹ Dodd-Frank directed the SEC to adopt regulations to provide payment of awards to eligible individuals for reporting violations of federal securities laws to the federal government. Specifically, Dodd-Frank requires the SEC to award qualifying whistleblowers a bounty of 10% to 30% of the aggregate money over a $1 million threshold recovered by the SEC in eligible actions resulting from original information provided to the SEC by the whistleblowers. The Rules take effect on August 12, 2011.² The Rules raise some challenging issues, perhaps the most significant being the impact on existing compliance and corporate governance procedures. Listed entities may be concerned that their compliance programs will be bypassed by whistleblowers who now have strong incentives to place their personal interests ahead of loyalties to their employers.

Who Qualifies as a Whistleblower Under the Rules?

Under Dodd-Frank, a whistleblower is a person who provides information about a possible violation of the securities laws that he or she reasonably believes has occurred, is ongoing or is about to occur, and includes employees, agents or any other individual who provides relevant original information, including independent contractors, consultants, joint venture partners, sales agents, persons involved with a private, wholly owned subsidiary consolidated in a publicly traded entity's balance sheet or even persons involved with a wholly owned foreign subsidiary consolidated in a publicly traded entity's balance sheet.

The Rules, however, further limit the pool of qualified applicants by restricting the eligibility of certain individuals – including officers and directors, lawyers, auditors and compliance personnel – from receiving an award under the program, unless certain exceptions apply.³ Significantly, many commentators, including two SEC Commissioners, expressed concerns that the exceptions for lawyers who owe fiduciary responsibilities to a company likely will swallow the rule. As Commissioner Kathleen L. Casey noted, "[t]he . . . exclusion will not apply where the attorney whistleblower has a reasonable basis to believe that disclosure of the privileged information is necessary to prevent substantial injury to the financial interest or property of investors."⁴ In such cases, it may be difficult for the SEC to challenge a whistleblower lawyer who claims that an immediate reporting was necessary to avoid significant harm to innocent investors and others involved with a company. The Rules also allow anonymous reporting, if done through counsel.

What Information Is Considered for an Award Under the Rules?

To qualify for an award, a whistleblower must provide "original information" to the SEC. "Original information" is defined as information:

• derived from the "independent knowledge"⁵ or "independent analysis"⁶ of the whistleblower;
• not already known to the SEC from any other source, unless the whistleblower is the "original source"⁷ of the information;
• not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation, or from the news media, unless the whistleblower is a source of the information; and
• provided to the SEC for the first time after July 21, 2010.⁸

The Rules provide some notable exceptions to the definition of original information that reflect the agency's attempt to balance the congressional mandate to implement this program with public-policy concerns about the value of preserving attorney-client privilege and a company's internal and external audit functions. In particular, the Rules generally exclude information obtained:

• through a communication subject to attorney-client privilege, unless disclosure would otherwise be permitted;⁹
• by a person with compliance or audit responsibilities if the information was communicated to the whistleblower in connection with the company's internal compliance processes, unless the person has: (a) a reasonable basis to believe that disclosure is necessary to prevent substantial injury to the financial interest or property of the company or its investors; (b) a reasonable basis to believe that the company is engaged in conduct that will impede an investigation of the misconduct; or (c) 120 days have elapsed since such person either reported the violation to the appropriate company compliance personnel or received such information under circumstances indicating that the appropriate company personnel were already aware of it;
• in a manner that is determined by a U.S. court to violate applicable federal or state criminal law; or
• from a person who is subject to the exceptions outlined above, unless the information is not excluded from such person's use as provided above, or information is being provided about possible violations involving such person.

Additionally, the Rules specify that only information of high quality, reliability and specificity will warrant an award under the program. Accordingly, the SEC will not grant an award to every tip and complaint, but only to information from a whistleblower that "leads to" a successful action.

How Is an Award Determined Under the Rules?

The Rules require that the award must be between 10% and 30% of the monetary recovery from successful SEC and related actions.¹⁰ To determine the amount, the Rules require the SEC to consider:

• the significance of the information to the success of the action;
• the degree of the whistleblower's assistance in the action;
• the SEC's "programmatic interest" in deterring violations of the securities laws by making such an award; and
• whether an award otherwise enhances the SEC's ability to enforce the federal securities laws, protect investors and encourage the submission of high-quality information by future whistleblowers.

Additionally, the Rules provide that an award may be increased (but not higher than the 30% ceiling) if a whistleblower voluntarily participates in a company's internal compliance and reporting systems; conversely, an award may be decreased (but not below the 10% floor) if a whistleblower interferes with such internal compliance and reporting systems. In short, the SEC may exercise a high degree of discretion regarding the granting of awards under the program.¹¹

How Do the Rules Affect Existing Internal Compliance and Reporting Systems?

Although many corporations requested that the Rules require a whistleblower to report problems internally to management prior to becoming eligible under the program, the Rules do not require internal reporting. Instead, to encourage the use of existing internal compliance and reporting systems, the Rules:

• allow an award to be made to a whistleblower who reports a potential violation internally before or at the same time that the whistleblower reports it to the SEC;¹²
• provide that an award may be increased if a whistleblower utilized the internal reporting system; and
• give full credit to a whistleblower for additional information that is developed by a company following the whistleblower's internal reporting and subsequently provided to and used by the SEC in a successful enforcement action.

It appears problematic that granting credit to a whistleblower for information developed by a company might further undermine the internal compliance and reporting systems because a whistleblower would stand to reap an even larger benefit from reporting to the SEC on or after the date the whistleblower internally reports.¹³

What Protections Are Provided to Whistleblowers Against Employer Retaliation?

In order to provide whistleblowers with protection and comfort that their employers will not retaliate against them for acting as a whistleblower, the Rules prohibit retaliation by employers and afford both the whistleblower and the SEC the right to sue an employer if a whistleblower is discharged or otherwise discriminated against by such employer in connection with his or her whistleblowing actions.¹⁴ These protections supplement similar provisions contained in the Sarbanes-Oxley Act by increasing a whistleblower's potential recovery to an amount equal to double lost wages. Additionally, the Rules expand the scope of such anti-retaliation protections to apply to all otherwise-eligible whistleblowers who possess a "reasonable belief" that the information they provided relates to a possible securities law violation that has occurred, is ongoing or is about to occur, rather than only those who have met all of the procedural and other prerequisites to receiving a whistleblower award.¹⁵

Steps to Potentially Minimize Dodd-Frank Whistleblowers

In light of the significant risks that Dodd-Frank presents to publicly traded companies – and particularly for multinational enterprises under the Foreign Corrupt Practices Act – companies may now want to reassess the adequacy of existing compliance programs (including training) to try to potentially limit these risks. Compliance is a key part of business operations, which requires periodic assessments since what may have been acceptable in the past may no longer remain so in the eyes of a government regulator.

While some companies have considered rewarding employees for using their internal compliance mechanisms, the value of such measures may be viewed as controversial and problematic. At a minimum, companies may want to conduct exit interviews of departing employees to assess why they are leaving the company and whether they are aware of serious wrongdoing within the organization and have reported it internally or otherwise.

Businesses should consider seeking legal counsel regarding what measures are needed because there are many significant risks, including obstruction of justice or unnecessarily aggravating a regulatory agency.

Even when a company learns about a whistleblower issue that has been or likely will be reported to the SEC, opportunities still remain for companies to limit the damage. For one thing, companies may be able to help shape the SEC's decision about whether to proceed with an enforcement action. This is because the SEC currently is not fully staffed nor prepared to handle the expected number of whistleblower complaints, which it estimates to be about 30,000 annually.¹⁶ Moreover, the SEC has said that its staff will continue the practice of receiving information from companies in the early stages of an internal investigation and may agree to await further results from the investigation before deciding what may be its next step.¹⁷ Therefore, companies may want to seek outside counsel to help advise them and oversee an expedited but thorough internal investigation.

Footnotes

1. The adoption of the final rules follows the November 3, 2010, issuance of proposed rules and the subsequent criticism view that such rules potentially undermined corporate internal reporting and compliance programs established under the Sarbanes-Oxley Act by incentivizing employees to report directly to the SEC.

2. See http://www.sec.gov/rules/final/2011/34-64545.pdf (the "Release").

3. Such individuals are not eligible to receive an award under the whistleblower program unless: (a) the whistleblower has a reasonable belief that disclosure "may prevent the issuer from committing a material violation that is likely to cause substantial injury to the financial interest or property" of the entity or its investors; (b) the entity is engaging in conduct that will impede an investigation of the misconduct; or (c) 120 days have passed since the whistleblower reported the information to the appropriate supervisor or senior responsible person, or the whistleblower learns that 120 days have passed since such persons became aware of the information. See footnote 15, below.

4. Citing ABA Model Rule of Professional Conduct 1.6(b)(3), which states "[a] lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary: . . . to prevent, mitigate or rectify substantial injury to the financial interests or property of another that is reasonably certain to result or has resulted from the client's commission of a crime or fraud in furtherance of which the client has used the lawyer's services." Statement by SEC Commissioner: Adoption of Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 by Commissioner Kathleen L. Casey, U.S. Securities and Exchange Commission (May 25, 2011), available at http://www.sec.gov/news/speech/2011/spch052511klc-item2.htm.

5. "Independent knowledge" does not have to be the whistleblower's direct, firsthand knowledge, as long as such knowledge consists of factual information not derived from publicly available information.

6. "Independent analysis" means the whistleblower's own examination and evaluation of information that may be publicly available, but which reveals information that is not generally known or available to the public.

7. The SEC will consider the whistleblower to be the "original source" of information that it obtains from another source if the information satisfies the definition of "original information" and the other source obtained the information from the whistleblower in compliance with the rules.

8. July 21, 2010, was the date of the enactment of Dodd-Frank.

9. ABA Model Rule 4.2 ("Communication with Person Represented by Counsel") provides: "In representing a client, a lawyer shall not communicate about the subject of the representation with a person the lawyer knows to be represented by another lawyer in the matter, unless the lawyer has the consent of the other lawyer or is authorized to do so by law or a court order." Comment 3 to Model Rule 4.2 instructs that the rule applies "even though the represented person initiates or consents to the communication" and instructs a lawyer to "immediately terminate communication with a person if, after commencing communication, the lawyer learns that the person is one with whom communication is not permitted." This standard, however, may be perceived as relaxed by Comment 5, which addresses communications "authorized by law" and says that such communications may "include communications by a lawyer on behalf of a client who is exercising a . . legal right to communicate with the government." Comment 7 to Model Rule 4.2, in turn, excludes from the no-contact prohibition contact with former employees and those individuals in nonsupervisory roles. It also indicates that when the individual has an attorney, that counsel's consent to a communication satisfies this rule.

10. If multiple actions result from the information provided by the whistleblower, the monetary recovery from such actions may be aggregated for purposes of determining the award.

11. It is interesting to note that awards may be granted to individuals who are liable for the reported securities violation as long as such individuals, or entities under the direction of such individuals, have not been required to pay monetary sanctions relating to the reported violation. However, the SEC may adjust a whistleblower's award based upon such whistleblower's culpability.

12. It is likely that a whistleblower, on his or her own accord or on the advice of counsel, will report the potential violations to the company, thereby acting in accordance with the rules and thus possibly enhancing his or her award from the SEC, and shortly thereafter will submit a report to the SEC, thereby alerting the SEC of the potential violation. This dual reporting would bring the SEC into the process and would provide the whistleblower further assurance that the company, knowing that the SEC had been alerted, would handle the matter more professionally and perhaps more dispassionately. The whistleblower may gain confidence that, with the SEC watching, the potential violation will be fully investigated by the company, and any whistleblowing award by the SEC will be more effectively preserved.

13. On the other hand, a company considering a whistleblower report it finds to be valid may be highly motivated to self-report to try to receive some benefit under the federal Sentencing Guidelines and the SEC's Seaboard Report (such as reduced fines/penalties, a deferred or nonprosecution agreement and avoiding suspension or debarment from government programs). The predictable effect from this will be increased numbers and costs of internal investigations, along with self-reporting – as well as follow-on litigation, such as shareholders' derivative suits and class action securities-fraud strike suits. In fact, there is nothing in the language of Dodd-Frank or the Rules that preclude a qualifying whistleblower from recovering both a bounty for providing original information that leads to an enforcement action and later being a lead plaintiff in a private securities fraud class action, or even obtaining double recoveries by taking advantage of the Dodd-Frank bounty provisions and filing a qui tam action if available under the federal False Claims Act seeking the same percentage of recovery from the defendant for violating that statute.

14. Damages for a Dodd-Frank retaliation claim include: reinstatement with the same seniority status; two times the amount of back pay owed plus interest; and compensation for litigation costs, expert-witness fees and reasonable attorneys' fees. Section 806 of the Sarbanes-Oxley Act of 2002 protects employees of public companies for reporting conduct they reasonably believe violates federal laws prohibiting mail, wire or bank fraud; any rule or regulation of the SEC; or any provision of federal law relating to fraud against shareholders. While Sarbanes-Oxley, like Dodd-Frank, does not provide for punitive damages, a prevailing individual is entitled to compensation for any special damages sustained as a result of discrimination, including litigation costs; expert-witness fees; and reasonable attorneys' fees; and may include damages for impairment of reputation, personal humiliation, mental anguish and suffering, and other noneconomic harm resulting from retaliation. Sarbanes-Oxley also provides that state and federal laws are not preempted, so the direct causes of action and remedies under applicable state laws are available to whistleblowers. Moreover, section 1107 of Sarbanes-Oxley imposes criminal liability (fines or imprisonment for not more than 10 years) for knowing retaliation in such matters.

15. For purposes of determining whether a whistleblower had such a "reasonable belief," the information provided by such whistleblower must: (1) be specific, credible and timely; (2) make a "significant contribution" to a matter already under investigation by the SEC; or (3) satisfy the first or second prong of the definition and be provided through the internal compliance mechanism of the employer and subsequently reported to the SEC by the employer.

16. See Release at 209.

17. See id. at 92.

If you have any questions regarding the issues or guidance described in this Alert, including how they may affect your company or its executives, please contact Michael E. Clark, Laurence S. Lese, F. Reid Avett, any member of the Corporate Practice Group, any member of the White-Collar Criminal Law Practice Group or the attorney in the firm with whom you are most regularly in contact.

This article is for general information and does not include full legal analysis of the matters presented. It should not be construed or relied upon as legal advice or legal opinion on any specific facts or circumstances. The description of the results of any specific case or transaction contained herein does not mean or suggest that similar results can or could be obtained in any other matter. Each legal matter should be considered to be unique and subject to varying results. The invitation to contact the authors or attorneys in our firm is not a solicitation to provide professional services and should not be construed as a statement as to any availability to perform legal services in any jurisdiction in which such attorney is not permitted to practice.

Duane Morris LLP, a full-service law firm with more than 700 attorneys in 24 offices in the United States and internationally, offers innovative solutions to the legal and business challenges presented by today's evolving global markets. Duane Morris LLP, a full-service law firm with more than 700 attorneys in 24 offices in the United States and internationally, offers innovative solutions to the legal and business challenges presented by today's evolving global markets. The Duane Morris Institute provides training workshops for HR professionals, in-house counsel, benefits administrators and senior managers.