SEC FLASH REPORT
SEC Issues Rules for Implementing the Whistleblower Provisions
of Section 21F of the Securities Exchange Act of 1934
May 25, 2011
Today, the Securities and Exchange Commission (SEC) voted 3 to 2 to adopt its new rules for implementing the controversial whistleblower provisions of Section 21F of the Securities Exchange Act of 1934, entitled “Securities Whistleblower Incentives and Protection.” Section 21F was created by Section 922 of the Dodd-Frank Wall Street Reform and Consumer
Protection Act, enacted on July 21, 2010 (DFA). Section 922 of DFA established a
whistleblower program that requires the Commission to pay an award, under regulations prescribed by the Commission and subject to certain limitations, to eligible whistleblowers who voluntarily provide the Commission with original information about a violation of the federal securities laws that leads to the successful enforcement of a covered judicial or administrative action, or a related action. DFA also prohibits retaliation by employers against individuals who provide the Commission with information about possible violations of the securities laws. The purpose of the final rules issued today is to reward individuals who provide the SEC with high-quality tips that lead to successful enforcement actions. The rules will be effective 60 days after publication in the Federal Register. The rule is 305 pages long and will be a fertile ground for law firms serving as advisors to boards, companies and individuals. We have highlighted major points of interest below.
Changes Were Made to the Proposing Release
In November last year, the SEC issued proposed rules (see Protiviti Flash Report dated November 8, 2010 entitled “SEC Proposes Whistleblower Rules” on www.protiviti.com). The proposed rules defined certain terms critical to the operation of the whistleblower program, outlined the procedures for applying for awards, described the SEC’s procedures for making decisions on claims, and generally explained the scope of the whistleblower program. These rules have met with stiff resistance from executives and board members alike. The Commission received more than 240 comment letters and approximately 1300 form letters on the proposal from individuals, whistleblower advocacy groups, public companies, corporate compliance personnel, law firms and individual lawyers, academics, professional associations, nonprofit organizations and audit firms.
Addressing a wide range of issues, the comments largely focused on the interplay of the whistleblower program and company internal compliance processes, the proposed exclusions from award eligibility for certain categories of individuals or types of information, the availability of awards to culpable whistleblowers, the procedures for submitting information and making a claim for an award, and the application of the statutory anti-retaliation provision. In response to the comments, the SEC reports that it made a number of revisions and refinements to the
proposed rules. The focus of the changes was to “better achieve the goals of the statutory whistleblower program and advance effective enforcement of the federal securities laws.”
Definition of a Whistleblower
Regarding the definition of a whistleblower, the Commission did away with the term, “potential violation”, to address the concern of commenters who argued the term was imprecise. The focus is now on a violation that “has occurred, is ongoing, or is about to occur.” With this change, a whistleblower is defined as an individual who, alone or jointly with others, provides the Commission with information in accordance with the Commission’s established procedures and that information relates to a possible violation of the federal securities laws (including any applicable rules or regulations) that has occurred, is ongoing, or is about to occur.
To obtain a bounty award, a whistleblower must submit “original information.” Such information must be derived from the whistleblower’s independent knowledge or independent analysis and must not already be known by the Commission from any other source and is not exclusively derived from an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation, or from the news media, unless the whistleblower is the source of the alleged information. For purposes of this provision:
•
“Independent knowledge” means “factual information in [the whistleblower’s] possession that is not derived from publicly available sources.” The whistleblower “may gainindependent knowledge from…experiences, communications and observations in…business or social interactions.”
•
“Independent analysis” means the whistleblower’s “own analysis, whether done alone or in combination with others.” Analysis means the whistleblower’s “examination and evaluation of information that may be publicly available, but which reveals information that is not generally known or available to the public.”Whistleblowers Are Protected from Retaliation
Employers are prohibited from retaliating against whistleblowers if the whistleblower possesses “a reasonable belief” that the information he or she is providing relates to a possible securities law violation and the whistleblower provides the information in the manner prescribed by the SEC’s rules. For purposes of providing this protection, the anti-retaliation protections apply whether or not the whistleblower satisfies the requirements, procedures and conditions to qualify for an award.
While the Sarbanes-Oxley Act laid the groundwork for protecting whistleblowers from retaliation, DFA expanded these protections. The SEC’s final rules released today, pursuant to the
provisions of DFA, cover a broad swath of turf for employers to consider in updating their anti-retaliation provisions.
Internal Compliance
A highly controversial issue discussed in the proposed rules was the impact of the whistleblower program on companies’ internal compliance processes. The Commission did not propose a requirement that whistleblowers report through internal compliance processes as a prerequisite to be eligible for an award. Instead, the proposed rules did not penalize and, in fact,
encouraged employees to use internal compliance reporting mechanisms by providing that a whistleblower who reports information internally first will still be eligible for an award so long as he or she reports the same information to the SEC within 90 days and by suggesting that the
SEC will consider higher percentage awards to employees who first report concerns internally. The SEC then requested comment on its proposal and on this topic in general.
According to the SEC, commenters were sharply divided on the issues raised by this topic, with the primary issue being whether the rules adequately recognize the importance of internal compliance programs and whether having the government pay bounties is consistent with the principles underlying good corporate governance and compliance. In the end, the SEC debated the competing forces of preserving internal corporate compliance structures and culture on the one hand and compliance with the securities laws on the other, with the overriding question of what constitutes sound public policy hanging in the balance.
After considering the different viewpoints, the Commission decided not to include a requirement that whistleblowers report violations internally, but have made additional changes to the rules to further incentivize whistleblowers to utilize their companies’ internal compliance and reporting systems when appropriate. For example, with respect to the criteria for determining the amount of an award, the final rules expressly provide:
•
First, that a whistleblower’s voluntary participation in an entity’s internal compliance and reporting systems is a factor that can increase the amount of an award.•
Second, that a whistleblower’s interference with internal compliance and reporting is a factor that can decrease the amount of an award.The final rules contain a provision under which a whistleblower can receive an award for reporting original information to an entity’s internal compliance and reporting systems, IF the entity also reports information to the Commission that leads to a successful Commission action. Under this provision, all the information provided by the entity to the Commission will be
attributed to the whistleblower, which means that the whistleblower will get credit -- and potentially a greater award -- for any additional information generated by the entity in its investigation.
Also, the final rule extends the time for a whistleblower to report to the Commission after first reporting internally and still be treated as if he or she had reported to the Commission at the earlier reporting date. As noted earlier, the SEC originally proposed a “lookback period” of 90 days after the whistleblower’s internal report. In response to comments, the Commission extended this period to 120 days in the final rules.
Procedures for Submitting Information and Claims
The proposed rules set forth a two-step process for submitting information, which required the submission of two different forms. In response to comments urging the Commission to
streamline the procedures for submitting information, the final rules adopted a simpler process, combining the two proposed forms into a single Form TCR (“Tip, Complaint or Referral”) that would be submitted by a whistleblower under penalty of perjury.
With respect to the claims application process, the Commission has made one section of that form optional to make the form less burdensome. It also offered several other features of the process to assist whistleblowers that is expected to become part of the standard practice of the Commission’s Office of the Whistleblower.
Aggregation of Smaller Actions to Meet $1 Million Threshold
To be considered for an award, the SEC’s rules require that a whistleblower must voluntarily provide the Commission with original information that leads to its successful enforcement of a federal court or administrative action in which the agency obtains monetary sanctions totaling
more than $1 million. The proposed rules stated that awards would be available only when the Commission had successfully brought a single judicial or administrative action in which it
obtained monetary sanctions of more than $1,000,000. In response to comments, the final rules provide that, for purposes of making an award, the SEC will aggregate two or more smaller actions that arise from “the same nucleus of operative facts.” This will make whistleblower awards available in more cases.
Exclusion from Award Eligibility for Certain Persons and Information
The proposed rules set forth a number of exclusions from eligibility for certain categories of persons and information. In response to comments suggesting that some of these exclusions were overly broad or unclear, the SEC revised a number of these provisions. Most notably, the Commission reports that it is of the view that the final rules provide greater clarity and specificity about the scope of the exclusions applicable to senior officials within an entity who learn
information about misconduct in connection with the entity’s processes for identifying, reporting, and addressing possible violations of law.
While the exclusions are complex, they generally pertain to individuals who:
(1) Obtained their information through a communication that was subject to the attorney-client privilege (unless disclosure is otherwise permitted by the SEC’s rules or state bar rules).
(2) Obtained the information in connection with the legal representation of a client on whose behalf the individual or his or her employer or firm are providing services (unless
disclosure is otherwise permitted by the SEC’s rules of the state bar rules). (3) In circumstances not covered by (1) and (2), obtained the information as:
−
An officer, director, trustee, or partner of an entity and was informed by another person of allegations of misconduct, or who learned the information in connection with the entity’s established processes for identifying, reporting, and addressing possible violations of law (such as through the company’s hotline(s));−
An employee whose principal duties involve compliance or internal auditresponsibilities, or were employed by or otherwise associated with a firm retained to perform compliance or internal audit functions for an entity;
−
An employee or associate of a firm retained to conduct an inquiry or investigation into possible violations of law; or−
An employee of, or other person associated with, a public accounting firm, if the information was obtained through the performance of an engagement required of an independent public accountant under the federal securities laws, i.e., an audit of the financial statements of a company listed on a U.S. stock exchange.(4) Have a pre-existing legal or contractual duty to report their information to the Commission.
(5) Are designated as a foreign government official.
(6) Obtained the information by a means or in a manner that is determined by a United States court to violate applicable federal or state criminal laws (subject to certain exceptions).
In certain circumstances, compliance and internal audit personnel as well as public accountants could become whistleblowers when:
(1) They believe (a) disclosure may prevent substantial injury to the financial interest or property of the entity or investors and (b) the entity is engaging in conduct that will impede an investigation, and
(2) At least 120 days have elapsed since the whistleblower reported the information to his or her supervisor or the entity’s audit committee, chief legal officer, chief compliance officer – or at least 120 days have elapsed since the whistleblower received the information, if the whistleblower received it under circumstances indicating that the aforementioned officers and directors are already aware of the information.
Note that certain other people – such as employees of certain agencies and people who are criminally convicted in connection with the conduct – are already excluded by DFA. Further, under the final rules, the Commission will not pay awards to culpable whistleblowers to prevent wrongdoers from benefitting by, in effect, blowing the whistle on themselves.
These provisions are complex. Given the exclusions, the exceptions to the exclusions and that a Form TCP is submitted to the SEC Office of the Whistleblower under the penalty of perjury, it is difficult to envision anyone attempting to position him or herself as a whistleblower without seeking advice of counsel.
Summary
In the SEC’s press release issued today, Chair Mary Schapiro stated:
For an agency with limited resources like the SEC, it is critical to be able to leverage the resources of people who may have first-hand information about violations of the securities laws. While the SEC has a history of receiving a high volume of tips and complaints, the quality of the tips we have received has been better since Dodd-Frank became law. We expect this trend to continue, and these final rules map out simplified and transparent procedures for whistleblowers to provide us critical information.
The SEC’s press release is posted on its website at http://www.sec.gov/news/press/2011/2011-116.htm. The final rule itself can be found at http://www.sec.gov/rules/final/2011/34-64545.pdf. Needless to say, these whistleblower rules are a game changer for corporate compliance programs. No matter how well internal whistleblowing and other channels for providing
sensitive information are designed and communicated, or how effective a company’s follow-up and investigatory processes are, or how these programs are positioned to provide protection to employees who use the available channels, the risk that employees will be encouraged to reach out to the Feds is now a scenario companies must face. The reality is that this external
whistleblowing channel is now in play as an alternative to concerned employees and other individuals and there is nothing public companies can do other than to presume it is a permanent fixture of the whistleblowing landscape. Executive management and boards of directors are still in the same position they’ve always been: They can reduce their risk and insulate themselves from liability by establishing a control environment and culture that fosters a tone from the top which emphasizes doing the right thing and ensures that internal programs and processes are operating effectively as intended.
© 2011 Protiviti Inc. An Equal Opportunity Employer.
Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer attestation services.
About Protiviti
Protiviti (www.protiviti.com) is a global business consulting and internal audit firm composed of experts specializing in risk, advisory and transaction services. The firm helps solve problems in finance and transactions, operations, technology, litigation, governance, risk, and compliance. Protiviti’s highly trained, results-oriented professionals provide a unique perspective on a wide range of critical business issues for clients in the Americas, Asia-Pacific, Europe and the Middle East.
Protiviti has more than 60 locations worldwide and is a wholly owned subsidiary of Robert Half International Inc. (NYSE symbol: RHI). Founded in 1948, Robert Half International is a member of the S&P 500 index.
