SEC Adopts Final Rules for Whistleblower Program under Dodd-Frank Act

On May 25, 2011, the Securities and Exchange Commission adopted by a 3-2 vote final rules implementing the whistleblower program under Section 21F of the Securities Exchange Act of 1934 (the “Exchange Act”) as required by Section 922 of the Dodd- Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”). The program authorizes the SEC to pay rewards to individuals who voluntarily provide the SEC with original information about a violation of the federal securities laws that leads to a successful enforcement action that results in monetary sanctions totaling more than $1 million. The total amount of the award is between 10% and 30% of the monetary sanctions. Although the SEC received a significant number of comments urging a requirement that a whistleblower is only eligible to receive an award if the whistleblower first reported the matter through the relevant entity’s internal compliance program, the SEC chose not to mandate internal reporting and instead provided additional protections and incentives to encourage individuals to report suspected violations internally. The final rules are effective 60 days following publication in the Federal Register, which has not yet occurred.

Whistleblowers Eligible for Awards

A person may be deemed a whistleblower pursuant to the rules if, alone or together with others, such individual provides the SEC with information pursuant to the procedures required under Rule 21F-9 and the information relates to a possible violation of federal securities laws. Only natural persons may be whistleblowers.

Pursuant to Rule 21F-8(c), the following individuals are not eligible to receive awards:

• individuals who are presently, or were at the time such individual acquired the information provided to the SEC, a member, officer or employee of:
  – the SEC, the Department of Justice, an appropriate regulatory agency, a self-regulatory organization, the Public Company Accounting Oversight Board (“PCAOB”), or any law enforcement organization; or
  – a foreign government, any political subdivision, department, agency or instrumentality of a foreign government, or any other foreign financial regulatory authority;
• individuals who are convicted of a criminal violation related to the SEC action or a related action;
• individuals who obtain the information provided to the SEC through an audit of a company’s financial statements;
• a family member of, or someone sharing a household with, a member or employee of the SEC;
• individuals who receive the information from a person involved with the audit, unless it qualifies as original information of that person, or the whistleblower is providing the SEC with information about possible violations involving that person; or
• individuals who, in dealings with the SEC or another authority in a related action, knowingly and willfully make any false, fictitious or fraudulent statement or representation, or knowingly use any false writing or document with the intent to mislead or otherwise hinder the SEC or another authority.

Eligibility Requirements

Under Rule 21F-3(a), to be eligible for an award, a whistleblower must voluntarily provide the SEC with original information that leads to the successful enforcement by the SEC of an action in which the SEC ultimately obtains monetary sanctions totaling in excess of $1 million. Each of these requirements is discussed below.

Voluntarily

A whistleblower must provide information “voluntarily” in order to be eligible for an award. Under Rule 21F-4(a), information is deemed voluntarily provided if such information is provided by the whistleblower before a request, inquiry or demand that relates to the subject matter of the whistleblower’s report is made to the whistleblower or anyone representing the whistleblower (such as an attorney) by any of the following in connection with an investigation, inspection or examination:

• the SEC;
• any self-regulatory organization (such as the PCAOB); or
• Congress or the federal government, a state Attorney General, or a securities regulatory authority.

Additionally, a submission will not be deemed voluntary if the whistleblower is required to report the information to the SEC as a result of a pre-existing legal or contractual duty owed to the SEC or the other authorities listed above (rather than to a third party) such as a cooperation agreement or a duty that arises out of a judicial or administrative order. However, a legal or contractual duty to an employer requiring an individual to report known or suspected violations of federal securities laws to the employer or the SEC would not preclude the reporting from being voluntary.

Original Information

The information voluntarily provided by the whistleblower must be “original information” in order to be eligible for an award. Under Rule 21F-4(b), information is considered original if it is:

• derived from the whistleblower’s independent knowledge or independent analysis (discussed below);
• not already known by the SEC;
• not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation or from the news media; and
• provided to the SEC for the first time after July 21, 2010 (the enactment date of the Dodd-Frank Act).

Independent knowledge is factual information in the whistleblower’s possession that is gained from the whistleblower’s experiences, communications and observations and not from publicly available sources. Independent analysis is the whistleblower’s examination and evaluation of information, including publicly available information, done alone or with others, which reveals information that is not generally known or available.

Information provided will not be considered derived from the whistleblower’s independent knowledge or independent analysis if the whistleblower obtained the information in violation of federal or state criminal law, in a communication subject to the attorney-client privilege, or in connection with legal representation of a client on whose behalf the whistleblower or the whistleblower’s firm is providing services. Information could qualify as independent knowledge of an attorney whistleblower if the attorney whistleblower would be permitted to disclose the information under SEC or applicable state attorney conduct rules or otherwise.

Additionally, information is not derived from the whistleblower’s independent knowledge or independent analysis if the whistleblower obtained the information:

• as an officer, director, trustee or partner of an entity and another person informed the whistleblower of the misconduct or the whistleblower acquired the information through the entity’s internal compliance procedures;
• as an employee of an entity or an outside consultant whose principal responsibility involves compliance or internal audit responsibilities;
• as an employee or individual otherwise associated with a firm hired to conduct an inquiry or investigation into possible violations of law; or
• as an employee or individual otherwise associated with a public accounting firm, if the information was obtained in performance of an engagement required by an independent public accounting firm under the federal securities laws, other than an audit. (Auditors are not eligible to receive awards.)

However, the rules provide broad exceptions where:

• the whistleblower has a reasonable basis to believe that disclosure to the SEC is necessary to prevent the relevant entity from engaging in conduct likely to cause substantial injury to the financial interest or property of the entity or investors;
• the whistleblower has a reasonable basis to believe that the relevant entity is engaging in conduct that will impede an investigation of the misconduct; or
• at least 120 days have elapsed since the whistleblower reported the information to the entity’s audit committee, chief legal officer, chief compliance officer or the whistleblower’s supervisor or since the whistleblower received the information under circumstances indicating that such individuals or their supervisors were already aware of the information.

If the SEC obtains the information from another source, a whistleblower may still be deemed the source of “original” information if such other source obtained the information from the whistleblower, and the SEC is satisfied that the whistleblower established him or her as the source.

Leads to Successful Enforcement

Under Rule 21F-3(a), a whistleblower will only be eligible for an award if the original information voluntarily provided by the whistleblower leads to successful enforcement in a judicial or administrative action in which the SEC obtains monetary sanctions in excess of $1 million. Under Rule 21F-4(c), this requirement is satisfied if the information reported:

• to the SEC was sufficiently specific, credible and timely to cause the SEC to commence or reopen an examination or investigation, and the SEC brought a successful action based in whole or in part on conduct that was the subject of the whistleblower’s original information;
• to the SEC significantly contributed to the success of an ongoing investigation; or
• through the entity’s internal whistleblower, legal or compliance procedures for reporting allegations of possible violations of law is submitted before or at the same time as it is reported by the whistleblower to the SEC and the entity then provides such information to the SEC and either of the criteria in the prior two bullets are met. In any event, the whistleblower must report this information to the SEC within 120 days of reporting to the entity following the procedures in the final rule.

Monetary Sanctions

Under Rule 21F-3(a), the final requirement is that the SEC obtain monetary sanctions totaling in excess of $1 million, which under Rule 21F-4(e) includes penalties, disgorgement and interest. Rule 21F-4(d) permits the aggregation of multiple SEC actions that arise out of a common nucleus of operative facts as a single action.

Under Rule 21F-3(b), where the monetary sanctions exceed $1 million in the SEC action, the SEC will pay awards based on amounts obtained in “related actions.” Related actions are those brought by the Attorney General of the United States, an appropriate regulatory authority, a self-regulatory organization or a state attorney general in a criminal case based on the same original information that the whistleblower voluntarily provided to the SEC and that led the SEC to obtain monetary sanctions of more than $1 million. The monetary sanctions obtained in the related actions are not used to determine if the $1 million threshold is met, but rather to determine the size of the final award. Additionally, the SEC will not make an award based on monetary sanctions received in a related action if the whistleblower has already been granted an award, or denied an award, by the Commodity Futures Trading Commission for the same action pursuant to the CFTC’s whistleblower program.

Incentives for Internal Reporting

As discussed above, under Rule 21F-4(c), a whistleblower is not required to report the information to the entity first in order to obtain an award from the SEC. However, under Rule 21F-6, in exercising its discretion to determine the amount of the award, the SEC will consider, among several other factors, whether, and the extent to which, the whistleblower timely reported the possible violations through the entity’s internal compliance procedures and whether, and the extent to which, the whistleblower assisted with any internal investigation. Further, an award may be decreased if the whistleblower interfered with the relevant entity’s established legal, audit or compliance procedures, made any material false, fictitious or fraudulent statements, or knowingly provided any false writing or document to the relevant entity that hindered the relevant entity’s ability to detect, investigate or remediate the reported securities violations. As a further incentive for reporting initially to the entity, the date that the whistleblower initially reported through the entity’s compliance procedures will be treated as the date the whistleblower reported to the SEC, as long as the whistleblower follows the reporting procedures to the SEC within 120 days of such initial report date. Thus, the earlier date of reporting to the entity is preserved for the SEC’s determination of the award in the event that another whistleblower subsequently reported to the SEC on the same matter. Also, in the SEC’s determination of the whistleblower award, all the information provided to the SEC developed by the entity in its investigation will be attributed to the whistleblower. Therefore, the whistleblower may potentially get a higher reward where there is also reporting to the entity.

Procedures for Submitting Original Information

To be eligible for an award, a whistleblower must comply with the SEC’s procedures set forth in Rules 21F-9 through 21F-11, including submitting the original information online or by mailing or faxing a Form TCR (Tip, Complaint or Referral) and declaring under penalty of perjury that the information provided is true and correct to the best of the whistleblower’s knowledge and belief. If a whistleblower wishes to submit the information anonymously, the information must be submitted through the whistleblower’s attorney and otherwise in accordance with the procedural requirements of the rules. Additionally, once a “Notice of Covered Action” related to the matter on which the whistleblower submitted original information is posted on the SEC’s website following the entry of a final judgment or order that alone or with other previously entered orders, exceeds $1 million, an individual must file a Form WB-APP, Application for Award for Original Information Provided Pursuant to Section 21F.

Whistleblower Protections

Rule 21F-2(b) provides that the anti-retaliation protections under Section 21F(h)(1) of the Exchange Act are applicable to whistleblowers who possess a reasonable belief that the information he or she provided in the prescribed manner relates to a potential violation of federal securities laws that has occurred, is ongoing or is about to occur. The anti-retaliation provisions apply whether or not such individual ultimately meets the requirements to qualify for an award.

Compliance Program Considerations

While many companies have never received a whistleblower complaint, companies should nonetheless consider reviewing their existing compliance programs and complaint reporting systems in light of the significant financial incentives provided to whistleblowers by the Dodd-Frank Act and the possibility that whistleblower’s claims will be pursued by contingent fee lawyers. Robust compliance programs and timely self-reporting to the SEC will benefit companies in the negotiation and resolution of any SEC inquiries or enforcement actions arising out of a whistleblower complaint.

In addition to assessing the overall effectiveness of internal compliance programs, there should be specific consideration of the policies and procedures for the handling of whistleblower information. Company policies regarding the timeliness of review, follow-up communications with the whistleblower, and reporting the matter to company management and/or to the SEC should be reviewed. Additionally, to the extent matters have been reported to the company, particularly those reported since the enactment of the Dodd-Frank Act, the manner and timing in which such whistleblower claims were received, tracked and reported to compliance professionals and the Board should be reviewed. For those companies that have experienced complaints, consider any recent trends in the volume and quality of information reported and consider enhancements to existing policies and procedures or augmentation of internal resources.

In part because companies may not be aware of when a whistleblower reports to the SEC and also because of the broad exceptions described above that allow an entity’s officers, directors and compliance professionals to file a whistleblower report 120 days after their receipt of whistleblower information, we expect companies will opt for more self-reporting and at an earlier stage of internal review. The company’s procedures and authorizations for self-reporting should be evaluated so that decision-making can be streamlined when addressing whistleblower complaints. Self-reporting benefits the company under the SEC’s enforcement guidelines for considering the company’s cooperation.

Companies should also consider reviewing and updating employee information materials and methods of publicizing their hotlines or procedures for reporting by employees, including the opportunity for anonymous reporting. In the context of the publicity that the SEC’s final rules will receive, consider a current reminder (and periodic follow-ups) to encourage initial reporting to the company.