Final Whistleblower Rules

By Cydney Posner

For those who requested a more detailed summary of the final whistleblower rules, I've provided one below. For a briefer description of the changes from the proposed rules, see my article from May 25, 2011.

On May 25, 2011, the SEC adopted final rules implementing Section 21F of the Exchange Act, "Securities Whistleblower Incentives and Protection." Section 21F, which was added by the Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, directs the SEC to pay awards, subject to certain limitations and conditions, to eligible whistleblowers who voluntarily provide the SEC with original information about a violation of the federal securities laws that leads to a successful enforcement of a covered judicial or administrative action or a related action that results in monetary sanctions exceeding $1 million. The awards are to be between 10% and 30% of the total monetary sanctions collected.

The SEC's original proposal to implement whistleblower provisions of Section 922 has been quite controversial among legislators and the business community since it was initially introduced in November 2010. The most contentious issue has been the interplay of the SEC's whistleblower program and companies' internal compliance programs – more specifically, whether the SEC should mandate internal compliance reporting, prior to or contemporaneously with SEC reporting, as a prerequisite to eligibility for a whistleblower bounty. Critics have charged that mandatory internal reporting would deter many whistleblowers, while advocates have contended that allowing whistleblowers to bypass companies' internal compliance programs would have a corrosive effect on these programs -- carefully nurtured as a result of provisions of SOX – and undermine companies' ability to identify and promptly remediate fraud or other wrongdoing. Because the SEC was concerned about the quality of some companies' internal compliance processes, the final rules do not mandate internal reporting as a prerequisite to awards. The release notes that, consistent with past practice, the SEC staff may, in appropriate cases, contact a company, describe the nature of the whistleblower allegations and allow the company to investigate the matter and report back. The SEC will consider the company's actions in determining the level of the company's "cooperation."

Below are some of the key points of the rules as adopted:

• Whistleblower incentives for internal reporting. Although the SEC did not ultimately decide to require that whistleblowers report problems through internal compliance programs as a prerequisite to collecting an award, it did include provisions designed to encourage internal reporting:
  • a whistleblower's voluntary participation in an entity's internal compliance system is a factor that can increase the amount of an award and interference with internal compliance can decrease the amount of an award.
• a whistleblower will still be able to receive an award if
  • he or she reports original information through the entity's internal compliance program before or at the same time as the whistleblower reports to the SEC, 
  •  the entity reports to the SEC either the whistleblower's information or the results of an investigation initiated in response to the whistleblower's information and
  • the information leads to a successful action.

In that event, all the information provided by the entity to the SEC will be attributed to the whistleblower. As a result, the whistleblower will potentially earn a greater award for any additional information generated by the entity in its investigation.

• The final rules extend the "lookback period" -- the time for a whistleblower to report to the SEC after first reporting internally and still be credited as if he or she had reported to the SEC at the earlier internal reporting date – from 90 days to 120 days. As a result, if, in the interim, another whistleblower makes a submission that results in a staff investigation into the same matter, the whistleblower who had first reported internally will be considered the first whistleblower who reported to the SEC.
  • Note, however, that an individual who reported only through internal compliance and not to the SEC would presumably not have the protection of these specific anti-retaliation provisions, a factor that could encourage SEC reporting.
  • Note also that new Rule 21F-17(a) prohibits any action to impede an individual from communicating directly with the SEC staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement. Companies considering offering financial rewards for internal reporting should use caution with the formulation of those awards to avoid running afoul of this rule. 
    • Procedural simplification. The final rules simplify the whistleblower claim process by combining two proposed forms into a single form that would be submitted by a whistleblower under penalty of perjury. Submissions can be made anonymously so long as they are accompanied by a certification from counsel that he or she has reviewed the form for completeness and accuracy and verified the identity of the whistleblower. The SEC will not hold attorneys accountable if they possess a good faith belief that the information they are submitting on behalf of the whistleblower is true, correct and complete.
      • Aggregation of actions. To exceed the requisite $1 million threshold, two or more smaller actions that arise from the same nucleus of operative facts can now be aggregated.
      • Voluntary submission. A submission of information is considered to be "voluntary" if the whistleblower makes the submission before a request, inquiry or demand -- even if a response is not compelled by subpoena or other applicable law -- that relates to the subject matter of the submission is directed to the whistleblower or anyone representing the whistleblower (such as an attorney) (i) by the SEC, (ii) in connection with an investigation, inspection or examination by the PCAOB or any SRO or (iii) in connection with an investigation by Congress, any other authority of the federal government, or a state Attorney General or securities regulatory authority.
        • A whistleblower can still make a "voluntary" submission after being contacted for information in the course of an internal investigation.
          • A submission relates to the same subject matter if it describes only additional instances of the same or similar conduct, provides additional details, or describes other conduct that is closely related as part of a single scheme, even if the submission provides more information than was specifically requested. 
            • A request to an employer will not be treated as request to all employees whose documents or information fall within the scope of the request, although it could be a factor in determining whether a submission led to a successful enforcement action.
              • Information is not submitted "voluntarily" if the whistleblower is required to report his or her original information to the SEC (or one of the other identified authorities) as a result of a pre-existing individual duty.
              • Original information. "Original information" means information that is (i) derived from the independent knowledge or independent analysis of the whistleblower, (ii) not already known to the SEC from another source, (iii) not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit or investigation, or from the news media, unless the whistleblower is a source of the information and (iv) provided to the SEC for the first time after July 21, 2010 (the date of the enactment of Dodd-Frank). Information may be considered "original information" even if a company may have addressed the issue through remedial action, but remediation would be a factor in the SEC's exercise of discretion in determining whether to open an investigation or bring an enforcement action and the nature and scope of any action filed and relief granted.

• "Independent knowledge" is defined as factual information not derived from publicly available sources and may include knowledge obtained from any of the whistleblower's experiences, observations or communications. Because independent knowledge need not be first-hand, however, commenters raised concerns that whistleblowers would report unsubstantiated rumors and other unreliable information. The SEC believes that the requirements that information be sufficiently specific, credible and timely to cause the staff to open an investigation or that it significantly contribute to the success of an enforcement action will suffice to discourage speculation. 
  • "Independent analysis" is defined as the whistleblower's own examination and evaluation of information (which may or may not be publicly available) that provides some additional evaluation, assessment or insight revealing information that is not generally known or available to the public. Whether or not an award is made would depend on the quality of the analysis and whether it either causes the staff to open an investigation or significantly contributes to a successful enforcement action.

• Exclusions from definitions of "independent knowledge" or "independent analysis." The final rules provide greater clarity and specificity about the scope of the exclusions applicable to senior officials within an entity or outside professionals who learn information about misconduct in connection with the entity's processes for identifying, reporting and addressing possible violations of law. Generally, exclusions apply to information or analysis acquired by an individual (i) on behalf of a third party operating in a sensitive legal, compliance or governance role, or (ii) in the performance of an engagement required by the federal securities laws or (iii) by illegal means. These exclusions are largely designed to ensure that the persons most responsible for an entity's conduct and compliance with law are not incentivized to promote their own self-interest at the possible expense of the entity's.
• Attorney-client privilege and other attorney conduct. One of the exclusions applies to information subject to the attorney-client privilege or otherwise obtained in connection with the legal representation (including by in-house counsel) of a client on whose behalf the whistleblower, or his or her employer or firm, are providing services. Neither of these exclusions applies where an attorney is permitted to disclose otherwise privileged information (e.g., as a result of a waiver or ethics rules). Both exclusions apply to non-attorneys as well as attorneys.

• Responsible company personnel, compliance processes and independent public accountants. The SEC elected to adopt tailored exclusions for "core" persons and processes related to internal compliance mechanisms. Specifically, information is not treated as "independent knowledge" or "independent analysis" under the rules if the individuals obtained the information because they were:
  • officers, directors, trustees or partners of an entity if they obtained the information either because another person informed them of allegations of misconduct or in connection with the entity's processes for identifying, reporting and addressing potential non-compliance with law; 
  • employees whose principal duties involve compliance or internal audit responsibilities, as well as employees of outside firms that are retained to perform compliance or internal audit work for an entity (for example, compliance officers, but not counsel, who would be subject to the specific rules covering attorneys);
  • employees or other persons associated with firms that are retained to conduct an internal investigation or inquiry into possible violations of law (in circumstances where the information is not already excluded under the rules applicable to attorney conduct and privilege); and
  • employees of, or other persons associated with, a public accounting firm through an audit (including quarterly reviews) or other engagement required under the federal securities laws, if that information relates to a violation by the engagement client or the client's directors, officers, or other employees.
  • There are, of course, exceptions to these exclusions if:
    • the person has a reasonable basis to believe that disclosure of the information to the SEC is necessary to prevent conduct likely to cause substantial injury to the financial interest or property of the entity or investors (generally requires demonstration that responsible management or governance personnel at the entity were aware of the imminent violation and were not taking steps to prevent it);
      • the person has a reasonable basis to believe that the entity is engaging in conduct that will impede an investigation of the misconduct; or
        • at least 120 days have elapsed since the whistleblower provided the information to the audit committee, chief legal or compliance officer, his or her supervisor, or since the whistleblower received the information, if he or she received it under circumstances indicating that these persons were already aware of the information. The release makes clear, however, that an officer, director or other designated person cannot receive a report of misconduct and remain silent while waiting for the 120-day period to run to become eligible for a whistleblower award. The SEC notes that the defined time period is not intended, on the one hand, to suggest that entities have a 120-day "grace period" for determining their response to the violations; rather, leniency determinations based on cooperation by entities will take into account promptness of voluntarily self-reporting. On the other hand, the 120-day period should not be viewed to create any new or special duties of disclosure or even to create an implicit "deadline" for completion of internal investigations; the staff will continue to have the discretion to receive the results of early stage investigations and to await further results of internal investigations before deciding its own investigative course.

• Violations of Law. A whistleblower's information will be excluded from the definition of "independent knowledge" if he or she obtained the information by a means or in a manner that is determined by a domestic court to violate applicable federal or state criminal law. The exclusion will not apply to information obtained in violation of domestic civil or foreign law or judicial or administrative protective orders.
• Information Obtained from Excluded Persons. A submission will not be deemed to be derived from "independent knowledge" or "independent analysis" if the whistleblower obtained the information from a person who is excluded under these rules (unless the information is not excluded from that person's use, i.e., because of the exceptions to the exclusions) or the whistleblower is providing the SEC with information about possible violations involving that person.
• Original source. A whistleblower will be considered to be the "original source" of the same information that the SEC obtained from another source if the information satisfied the definition of "original information" and the other source obtained the information from the whistleblower or the whistleblower's representative. If the whistleblower claimed to be the "original source" of information provided by any of the regulatory authorities identified above (relating to the "voluntary" submission of information), then the whistleblower would be required to have "voluntarily" provided the information to that other authority. There may be more than one whistleblower submission that qualifies for an award based on the same information. If the SEC already has some information about a matter from other sources at the time of a submission, the whistleblower would be an "original source" of any information he or she provided that was derived from the whistleblower's independent knowledge or independent analysis and that materially added to the information already in the SEC's possession.
• Information that Leads to Successful Enforcement. With regard to information about conduct not already under investigation or examination, the final rules provide that information will be considered to have led to successful enforcement when (i) it is sufficiently specific, credible and timely to cause the staff to commence an examination, open an investigation, reopen an investigation that had been closed or to inquire concerning different conduct as part of a current examination or investigation, and (ii) the SEC brings a successful judicial or administrative action based in whole or in part on the conduct identified in the original information. A whistleblower will be eligible for an award in a matter already under investigation or examination if his or her information "significantly contributes" to the SEC's success by, for example, expediting the action or adding more claims or more malefactors. The release cautions that whistleblowers who obstruct an investigation will not be rewarded.
• Monetary Sanctions. "Monetary sanctions" means any money, including without limitation penalties, disgorgement and interest, ordered to be paid and any money deposited into a disgorgement fund as a result of an SEC action or a related action. 
•  Determining the amount of an award. Dodd-Frank requires that awards be at least 10% and no more than 30% of the total monetary sanctions collected on an action, with the possibility that an award may be divided among multiple whistleblowers. Under the final rule, when the SEC is determining, in its discretion, the percentage applicable to a whistleblower award, it will consider the following required criteria, which may increase a whistleblower's percentage:
  • significance of the information provided by the whistleblower;
    • assistance provided by the whistleblower;
    • law enforcement interest in making a whistleblower award; and
      • participation by the whistleblower in internal compliance systems.

• The following required criteria may decrease a whistleblower's percentage:
• culpability of the whistleblower (although there is no per se exclusion);
• unreasonable reporting delay by the whistleblower; and
• interference with internal compliance and reporting systems by the whistleblower.

• The rules also provide optional considerations related to many of these required criteria.
• Confidentiality. The SEC will not reveal the identity of a whistleblower or disclose other information that could reasonably be expected to reveal the identity of a whistleblower, except under specified circumstances, such as to a defendant in a related criminal action or to specified regulators. Anonymous submissions are permitted so long as the anonymous whistleblower is represented by an identified attorney. The whistleblower's identity must be disclosed before payment of an award. The SEC declined to adopt any rules prohibiting the payment to whistleblowers' counsel of contingency fees, which some commenters feared would create a cottage industry in whistleblower claims. 
• Anti-retaliation. The anti-retaliation provisions will apply to an individual who possesses a reasonable belief that the information provided relates to a possible securities law violation that has occurred, is ongoing or is about to occur, and reports that information to the SEC in the required manner. The "reasonable belief" standard requires that the employee hold a subjectively genuine belief that the information demonstrates a possible violation, and that this belief be one that a similarly situated employee might reasonably possess. The final rules provide that the retaliation protections apply to a whistleblower irrespective of whether he or she is ultimately entitled to an award. Employers may not require employees to waive or limit their anti-retaliation rights. Companies may want to revisit their codes of ethics to be sure they do not create issues under these rules, for example, by making it a punishable violation of the code to report directly to the SEC without first reporting through the company's internal compliance program.
• Culpable whistleblowers. Whistleblowers will not automatically receive amnesty or immunity for their misconduct, but their cooperation will be taken into account in determining any penalty. The SEC declined to exclude culpable whistleblowers from eligibility for awards; however, for purposes of determining whether the required $1,000,000 threshold has been satisfied or calculating the amount of an award payment, no monetary sanctions will be included that the culpable whistleblower is ordered to pay or that an entity is ordered to pay if the entity's liability is based substantially on conduct that the whistleblower directed, planned or initiated.

• Note that this rule is not a general bar; it would not, for example, preclude eligibility for an officer who discovered information indicating that other members of senior management were engaged in a securities law violation.
• 2 This exclusion applies only to engagements for entities that are not "issuers." Engagements for most public companies, as issuers, would instead be covered by Rule 21F-8(c)(4), which excludes from whistleblower eligibility persons who obtained the original information through an audit (including an interim review) of a company's financial statements, and making a whistleblower submission would be contrary to requirements of Section 10A of the Exchange Act. (Section 10A refers only to audits of financial statements of "issuers.") For example, a submission would be contrary to 10A if the auditor did not file a "10A Report" with the SEC OCA, but instead submitted information about the company's illegal act to the SEC to be considered for the award under the whistleblower program. The exceptions to the accountant exclusion described above, other than the 120-day exception, are applicable to this exception a s well. A person is also ineligible if he or she acquires original information from a person who is ineligible under this provision, unless the information is not excluded from that person's use or the whistleblower is providing information about possible violations involving that person. Under these rules, an accountant could make a submission alleging that his accounting firm violated Section 10A or professional standards.
• 3 This exclusion would not preclude an individual from making a submission alleging that the public accounting firm violated the federal securities laws or professional standards.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.