SEC Adopts Whistleblower Rules

By Cydney Posner

At an open meeting this morning, the SEC adopted rules and forms to implement Section 21F of the Exchange Act, "Securities Whistleblower Incentives and Protection," which was added by Section 922 of Dodd-Frank. Section 21F directs the SEC to pay awards, subject to certain limitations and conditions, to eligible whistleblowers who voluntarily provide the SEC with original information about a violation of the federal securities laws that leads to a successful enforcement of a covered judicial or administrative action (or a related action) that results in monetary sanctions exceeding $1 million. The awards will be between 10% and 30% of the total monetary sanctions collected. The rules are designed to allow the SEC to leverage information from those with firsthand knowledge of bad acts. According to Robert Khuzami, Director of Enforcement, since Section 922 was adopted, the quality of tips to the SEC has increased.

As I emailed yesterday, the proposal has been quite controversial, and that controversy continued into today's meeting, with both Commissioners Casey and Paredes voting against adoption. In particular, as noted yesterday, the issue of whether the SEC should mandate prior or contemporaneous internal compliance reporting has been extremely contentious, with some arguing that mandatory internal reporting might deter some whistleblowers and others contending that allowing whistleblowers to bypass the entities' internal compliance programs would undermine the ability of these entities to identify and promptly remediate fraud or other wrongdoing, especially if the bad acts were not ultimately within the province of the SEC.

According to the majority, the rules have successfully calibrated the balance on this and other challenging policy issues:

• The SEC did not opt to mandate that whistleblowers report through an entity's internal compliance program as a condition to receiving awards, instead leaving that decision in the hands of each whistleblower; however, as discussed below, the final rules did increase the incentives for internal reporting. The SEC believed that the optimal approach was to encourage internal reporting where appropriate, but, where inappropriate, to allow the individual whistleblower to make that determination. The SEC concluded that mandatory internal reporting would not be advisable for several reasons:
  • There was no empirical data supporting the concept that internal compliance programs would be undermined. (The staff even provided anecdotal evidence of a whistleblower who saved the SEC six to twelve months of investigation time on a tip that had previously been raised to the entity's internal compliance and management to no effect.)
  • Companies that are committed to fulfilling their fiduciary obligations to shareholders will take the design and implementation of their internal compliance programs seriously in any event 

  • Congress' intent was to incent whistleblowers to provide information as a tool to increase the effectiveness of fraud prevention.

  • The statute does not require internal reporting as a condition to receipt of awards.

  • If the internal compliance program were controlled by wrongdoers or otherwise not effective, a requirement for internal reporting would place an undue burden on whistleblowers and could deter others.

Instead, the new rules expand the incentives for internal reporting:

• Whistleblowers will be able to receive awards by reporting to internal compliance if the entity then reports to the SEC; in that event, all of the information provided by the entity will also be attributed to the whistleblower. As a result, it may be possible that a whistleblower, whose information alone may not have been sufficient to lead to a successful action, could, with the company's information, qualify to receive an award. At the same time, if the whistleblower did not believe that the company would self-report, the whistleblower would not be required to report internally as a prerequisite to receiving an award.
• The amount of an award will increase or decrease based on the level of voluntary participation in, or conversely, interference with, internal compliance.
• The final rules increase from 90 to 120 days the time period for the whistleblower to report to the SEC following his or her report to the entity's internal compliance program.

• The exclusion in the proposal for attorneys, auditors and others with a compliance role has been narrowed and more exceptions provided. Certain categories of individuals and information will also be excluded from eligibility for a whistleblower bounty, such as information from attorneys (including in-house counsel) subject to the attorney-client privilege (unless permitted under state bar rules), information gained in the course of an accountant's engagement, information provided by an entity's officers or directors who learned of the information as part of the compliance process or information provided by internal compliance and internal audit personnel. However, attorneys and various other compliance and internal audit personnel would still be eligible for an award if there were a reasonable basis to believe that disclosure of the information to the SEC were necessary to prevent conduct likely to cause substantial injury to the financial interest or property of the entity or the investors or if there were a reasonable basis to believe that the entity was impeding an investigation of the misconduct. There was apparently no change to the exclusion regarding culpable whistleblowers, who may still be eligible for some amount of award depending on their level of culpability. Notably, whistleblowers who initiated, planned or directed the wrongdoing would not be eligible. The rationale given by Khuzami for rewarding certain culpable actors is that often only those who are part of the fraud can help to uncover it.
• Procedures for reporting have been simplified, now requiring only a single form and a certification that the information provided is true, correct and complete. Whistleblowers may still report anonymously with certification by counsel.
• Anti-retaliation protections have been expanded to cover any whistleblower, even if the whistleblower is ineligible for an award or the resulting action is not successful; however, to be covered, the whistleblower must possess a reasonable belief that a violation occurred or is about to occur.
• Information is deemed to be "voluntarily" provided if it is provided before the government or PCAOB ask for it. The report would not be voluntary if the whistleblower was already obligated to report to the SEC; however, the final rules eliminate the proposed rule that investigative requests sent to the company would be deemed to have been sent to all employees.
• Actions may be aggregated (for example, to reach the $1 million threshold amount) if the actions are based on a common nucleus of facts.
• The amount of the bounty to be paid may be increased based on quality, significance and timeliness of the information, the level of assistance provided and the SEC interest in the matter. Amounts can be decreased depending on the culpability of the whistleblower, any delay involved and any interference by the whistleblower. Apparently, the release also cites a number of optional considerations.

Not surprisingly, Commissioners Casey and Paredes voted against adoption, arguing principally that the final rules did not appropriately take into account the role of internal compliance programs as a complement to SEC investigations. Casey expressed the concern that the SEC was significantly underestimating the negative impact of the final rules on internal compliance programs and overestimating the SEC's ability to triage the massive number of whistleblower complaints that are anticipated under the new rules. She believes that whistleblowers will now bypass internal compliance programs entirely, thus eliminating a company's ability to step in, collect additional information and prevent further wrongdoing through a private process that may be better and more efficient than the government's, especially in light of the expected high volume of complaints that will strain SEC resources. Her preference was to mandate contemporaneous internal and SEC reporting. Casey also criticized the new exception that would permit attorneys and other compliance personnel to receive awards under some circumstances, arguing that the exception would swallow the basic rule. (Khuzami said that he believed the exception did not apply to privileged information.) Paredes largely echoes her views on those points, noting the "opportunity cost" involved in the investigation of anticipated volumes of speculative and otherwise poor quality leads. Finally, Casey raised again her argument that the SEC's cost-benefit analysis was inadequate because it took into account only that portion of the rule that was discretionary to the SEC. For example, she said that defense costs for companies would increase significantly in light of higher frequency of SEC involvement, but there was no effort in the SEC's analysis to quantify those costs. Khuzami noted that he expected the SEC generally to proceed as it had in the past by allowing companies, where appropriate, to conduct their own investigations internally under SEC oversight. Paredes also disapproved of the process for whistleblowers to submit complaints, arguing that it was still too complex and should be more user friendly.

The SEC also voted to propose amendments to Reg D to disqualify securities offerings involving certain felons and other 'bad actors' from reliance on the Rule 506 safe harbor exemption from Securities Act registration. This proposal is designed to implement Section 926 of Dodd-Frank and takes into account all disqualifying events, even if they preceded the effectiveness of the rules. There was also some heat here, as both Casey and Paredes objected to the proposal because of this retroactive application.

Following is a link to the 305-page release on the SEC's final whistleblower rules. http://www.sec.gov/rules/final/2011/34-64545.pdf