On May 25, 2011, by a divided 3-2 vote, the Securities and Exchange Commission adopted a final rule implementing the whistleblower incentives provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (“Dodd-Frank”). In an earlier Client Alert, we summarized and discussed the key provisions of the proposed rule that the SEC unanimously submitted last November.1 Both the proposed rule and the final rule set forth the criteria that the SEC would employ in making monetary awards to whistleblowers pursuant to Section 922 of Dodd-Frank, incorporated into the Securities Exchange Act of 1934 in a new Section 21F. That section created a bounty program allowing individuals who provide information leading to a successful SEC enforcement action (resulting in sanctions of greater than $1 million) to receive 10 to 30 percent of the amount collected. The final rule, in several ways, relaxed standards set forth in the proposed rule, expanded definitions, and makes it possible for more whistleblowers, in a greater number of circumstances, to submit less information yet remain eligible to receive an award. Most significantly, the final rule reflects the Commission’s decision not to require whistleblowers to first report information through internal channels before providing award-eligible tips to the SEC.2

We set out below a summary of the final rule with particular attention paid to those provisions that depart substantially from the proposed rule.

Eligibility Expanded

Like the proposed rule, the final rule defines a whistleblower as one or more natural persons acting jointly who provide the SEC with information relating to a violation of the securities laws. The proposed rule suggested that the information provided relate to a “potential violation of the securities laws”; in the final rule, an individual would meet the definition of whistleblower if he or she provides information about “a possible violation of the federal securities laws (including any rules or regulations thereunder) that has occurred, is ongoing, or is about to occur.”3 The Commission expressly rejected calls to require that submitted information relate to a material violation of the securities laws, citing concerns that a materiality threshold might limit the number of whistleblower submissions.

Dodd-Frank authorizes the SEC to make awards when the whistleblower’s original information leads to successful enforcement by the SEC. Under the initial, proposed rule, information would be considered as having led to successful enforcement if it 1) caused the SEC staff to commence an examination, toopen (or reopen) an investigation, or to inquire into new or different conduct, and 2) “significantly contributed” to the investigation’s success, if the investigation led to an enforcement action pursuant to which at least $1 million of monetary sanctions were collected. Where the government, an SRO, or the PCAOB was already examining or investigating a company’s conduct, an award would be given if the information would not have been obtained otherwise and was “essential” to the success of the resultant enforcement proceeding. Believing these standards to be too onerous, in the final rule, the SEC decided to make awards when whistleblowers provide original information either “sufficiently specific, credible, and timely” to cause the staff to commence an examination or to open (or reopen) a successful investigation or when the information significantly contributed to the success of an investigation already under way.4 Consistent with the proposal, the SEC will make further payments based on amounts collected in subsequent “related actions” brought by the U.S. Department of Justice, “appropriate regulatory agencies” (e.g., Federal Deposit Insurance Corporation), self-regulatory organizations (e.g., FINRA), and state attorneys general in a criminal case.5

In response to some of the more than 1,500 letters received during the notice and comment period,6 the SEC decided that, for the purpose of determining whether the $1 million sanctions threshold has been met, it will treat as a single Commission action two or more administrative or judicial proceedings brought by the Commission if those proceedings arise out of the same nucleus of operative facts.7 Interpreting Congress’s use of the singular term “action” in Section 21F, the SEC believes that “Congress did not intend for a meritorious whistleblower to be denied consideration for an award simply because [the Commission] chose to bring separate proceedings against respondents or defendants involved in the same or closely related conduct.”8

Wrongdoers Remain Award-Eligible

Like the proposed rule, the final rule limits but does not eliminate the ability of significantly culpable individuals to collect awards in cases where they have effectively blown the whistle on themselves. In determining whether the $1 million threshold has been satisfied and the amount of total sanctions for purposes of making an award, the SEC will exclude any monetary sanctions ordered to be paid by either the whistleblower or an entity whose liability is the result of conduct directed, planned or initiated by the whistleblower.9

However, the fact that a whistleblower has assisted the Commission and provided information leading to a successful enforcement action and the ultimate payment of a whistleblower award will not preclude the Commission from bringing a separate action against the whistleblower based on his or her own conduct. The final rule states explicitly that Dodd-Frank and the regulations promulgated thereunder “do not provide amnesty to individuals who provide information to the Commission.”10

Voluntariness Standard Relaxed

Under the proposed rule, a submission would not be considered to have been made “voluntarily” if a whistleblower had received a prior request, inquiry, or demand from the SEC, Congress, any other federal, state or local authority, any SRO, or the PCAOB about a matter to which the information in the whistleblower’s submission was relevant. Additionally, the proposed rule provided that a whistleblower’s submission of documents would not be deemed “voluntary” if the documents were within the scope of a prior request, inquiry, or demand received by the whistleblower’s employer, unless the employer failed to produce the documents to the requesting authority “in a timely manner.” Rather than apply to all information requests of any kind, the final rule narrows the types of requests that that may preclude a later whistleblower submission from being treated as “voluntary.” Though all requests from the Commission are still covered, only investigative requests from other authorities trigger the new rule, which identifies state attorneys general and state securities regulatory authorities as the only non-federal authorities whose investigative requests affect voluntariness.11

The Commission expressly rejected the suggestion to preclude whistleblowers from making “voluntary” submissions after being contacted for information in the course of an internal investigation. While acknowledging that internal investigations are an important component of corporate compliance, the Commission concluded that “providing information to persons conducting an internal investigation, or simply being contacted by them, may not, without more, achieve the statutory purpose of getting high-quality, original information about securities violations directly into the hands of Commission staff.”12

With regard to the effect of requests directed to a whistleblower’s employer, the Commission decided not to adopt that portion of the proposed rule that would have treated such a request as having been directed to the whistleblower as well.13 Similarly, though a whistleblower cannot voluntarily submit information that the whistleblower is required to report to the SEC pursuant to a pre-existing legal duty,14 that exclusion will govern only in cases where the whistleblower has an individual duty to report — not where the duty belongs to the whistleblower’s employer.15

Information Obtained from Compliance and Legal Personnel Can Be Used by Whistleblowers in Limited Circumstances

To ameliorate concerns that its bounty program might create “incentives for company personnel to seek a personal financial benefit by ‘front running’ internal investigations and similar processes that are important components of effective company compliance programs,”16 the new rule provides that the Commission will not consider information to be derived from independent knowledge (and, therefore, will be excluded from award eligibility) under certain circumstances: when it was obtained (i) through a communication subject to the attorney-client privilege, or as a result of legal representation of a client;17 (ii) by means or in a manner that results in a federal or state criminal conviction;18 or (iii) because the whistleblower was (a) a high-level company official who was informed of the misconduct by someone raising allegations or through the entity’s internal compliance procedures; (b) an employee or contractor whose principal duties involve compliance or audit responsibilities; (c) a person employed “to conduct an inquiry or investigation into possible violations of law”; or (d) an employee of a public accounting firm who learned the information during the course of an engagement.19

However, the exclusion for responsible company personnel, compliance officers, accountants, and auditors is, in turn, subject to several exceptions. Acknowledging that there may be circumstanceswhere an entity informed of wrongdoing fails to self-report or proceeds in bad faith, the final rule allows excluded personnel to receive awards when such an individual has “a reasonable basis to believe that disclosure of the information to the Commission is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors”;20 has “a reasonable basis to believe that the relevant entity is engaging in conduct that will impede an investigation of the misconduct”;21 or at least 120 days have elapsed since the individual reported the information to certain corporate officers or to the individual’s supervisor, or the individual’s supervisor was already aware of the information.22 In explaining her decision to vote against the final rule, Commissioner Kathleen Casey suggested that these exceptions were overbroad, commenting that “what the rule gives with one hand, it appears to take away with the other.”23

In another subsection, the final rule permits a whistleblower to use information obtained from an excluded person when that person’s use would be permitted (e.g., where the attorney-client privilege has been waived) or to provide the SEC with information about possible violations involving the excluded person.24

Whistleblowers May Bypass Internal Compliance Procedures Without Jeopardizing Award Eligibility

The most controversial aspect of the final rule — and what led Commissioners Casey and Troy Parades to oppose it — is its failure to require whistleblowers to report through internal compliance processes before filing an award-eligible submission with the SEC. In explaining his decision to vote against the final rule, Commissioner Parades expressed concern that failing to require internal reporting “could unduly erode the value of internal compliance programs . . . [that] may be able to detect and remedy misconduct more swiftly than the SEC can.”25

During the comment period, dozens of corporations, attorneys, and trade associations argued in favor of an internal reporting requirement. Those commenters suggested that such a requirement would allow companies to take appropriate actions to remedy improper conduct at an early stage; allow companies to self-report; avoid undermining internal compliance programs and preserve systems already in place that are designed to deter, identify, and correct violations; allow the whistleblower program to supplement, rather than supersede the internal control requirements under the SarbanesOxley Act of 2002; allow the Commission to preserve its scarce resources by relying upon corporate internal compliance programs; promote a working relationship between the Commission and companies; allow compliance personnel to address conduct that does not yet rise to the level of a violation or is not a violation (based on a misunderstanding of fact or law); increase the quality of tips the Commission receives; and avoid internal investigations being compromised by unwillingness on the part of whistleblowers to participate.26

With its final rule, the SEC responded that it was “not persuaded that such a requirement would achieve better overall enforcement of the federal securities laws.”27 It further noted its belief that “internal compliance programs are not substitutes for rigorous law enforcement.”28 Citing its concern that “a general requirement that employees report internally as a condition of participating in the whistleblower program would impose a barrier that in some cases would dissuade potential whistleblowers from providing information to the Commission, contrary to the purpose of the whistleblower provision,”29 the SEC left in the hands of whistleblowers the decision whether to utilize the internal reporting mechanisms that Sarbanes-Oxley required fewer than 10 years ago.

The final rule sets forth three incentives for whistleblowers to report possible violations to internal compliance programs either before or concurrent with a report to the SEC. First, the Commission will consider whether, and to what extent, the whistleblower participated in or interfered with internal compliance processes in determining the amount of an award.30 Under the rule, interfering with an internal investigation can decrease the size of, but not eliminate, a whistleblower’s award.31 However, Dodd-Frank requires the SEC to award of a minimum of 10 percent of the amount collected, and the Commission has stated that it lacks discretion to reduce that statutory minimum.32

Second, the SEC will give credit to a whistleblower whose company passes along to the SEC information that the whistleblower reported internally, even if such information standing alone would not have resulted in a successful enforcement action.33 The SEC has commented that this provision will allow information provided by the entity to be “attributed to the whistleblower, which means that the whistleblower will get credit — and potentially a greater award — for any additional information generated by the entity in its investigation.”34

Third, relative to the proposed rule, the final rule extends from 90 days to 120 days the time for a whistleblower to make an award-eligible report to the SEC after first reporting internally. This decision reflects the “almost uniform view” of commenters suggesting an extension of the so-called “lookback period” that would allow a whistleblower to be treated as an “original source of information” and preserve his or her place in line for an award.36

SEC’s Ability To Enforce Dodd-Frank’s Anti-Retaliation Provisions

In addition to authorizing the SEC to pay bounties, Dodd-Frank provides whistleblowers with significant protection against employers who would otherwise retaliate against individuals who provide information to the Commission.37 While the final rule does not devote much attention to DoddFrank’s anti-retaliation provisions, new Rule 21F-2(b)(2) states that the whistleblower protections set forth in the statute “shall be enforceable in an action or proceeding brought by the Commission.”38 The SEC claims that its jurisdiction is derived from the fact that the anti-retaliation provisions are codified in the Exchange Act.39

Though the final rule will become effective 60 days after it is submitted to Congress or published in the Federal Register, it will apply retroactively to whistleblower submissions made after July 21, 2010 — the date that Dodd-Frank was enacted. An anonymous whistleblower who submitted information after July 21, 2010 but before the effective date of the final rule will have 60 days after the rule takes effect to comply with a new requirement designed to effectuate the “penalty of perjury” provision in the whistleblower’s declaration and to enable the Commission to enforce that provision in appropriate cases.40

Endnotes

1 See Arthur H. Aufses III, David S. Frankel, Alan R. Friedman & Theodore S. Hertzberg, SEC Proposes Rules To Implement DoddFrank Whistleblower Program, Sec. & White Collar Litig. Alert (Kramer Levin Naftalis & Frankel LLP, New York, N.Y.), Nov. 2010.

2 Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934, Exchange Act Release No. 64545 (May 25, 2011) [hereinafter Final Release], available at http://www.sec.gov/rules/final/2011/34-64545.pdf.

3 Rule 21F-2(a) (to be codified at 17 C.F.R. § 240.21F-2(a)) (emphasis added).

4 Rules 21F-4(c)(1)-(2) (to be codified at 17 C.F.R. §§ 240.21F-4(c)(1)-(2)).

5 Rule 21F-3(b) (to be codified at 17 C.F.R. § 240.21F-3(b)).

6 The SEC has posted the comment letters at http://www.sec.gov/comments/s7-33-10/s73310.shtml and http://www.sec.gov/ comments/df-title-ix/whistleblower/whistleblower.shtml.

7 Rule 21F-4(d) (to be codified at 17 C.F.R. § 240.21F-4(d)).

8 Final Release, supra note 2, at 109.

9 Rule 21F-16 (to be codified at 17 C.F.R. § 240.21F-16)).

10 Rule 21F-15 (to be codified at 17 C.F.R. § 240.21F-15)).

11 Rules 21F-4(a)(1)-(2) (to be codified at 17 C.F.R. §§ 240.21F-4(a)(1)-(2)).

12 Final Release, supra note 2, at 34.

13 Id. at 35-36.

14 Rule 240.21F-4(a)(3) (to be codified at 17 C.F.R. § 240.21F-4(a)(3)).

15 Final Release, supra note 2, at 37.

16 Id. at 64-65.

17 Rules 21F-4(b)(4)(i)-(ii) (to be codified at 17 C.F.R. §§ 240.21F-4(b)(4)(i)-(ii)).

18 Rule 21F-4(b)(4)(iv) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(iv))

19 Rule 21F-4(b)(4)(iii) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(iii)).

20 Rule 21F-4(b)(4)(v)(A) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(v)(A)).

21 Rule 21F-4(b)(4)(v)(B) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(v)(B)).

22 Rule 21F-4(b)(4)(v)(C) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(v)(C)).

23 Kathleen L. Casey, Comm’r, Sec. & Exch. Comm’n, Adoption of Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 (May 25, 2011), available at http://www.sec.gov/news/speech/2011/ spch052511klc-item2.htm.

24 Rule 21F-4(b)(4)(vi) (to be codified at 17 C.F.R. § 240.21F-4(b)(4)(vi)).

25 Troy A. Parades, Comm’r, Sec. & Exch. Comm’n, Statement at Open Meeting To Adopt Final Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 (May 25, 2011), available at http://www.sec. gov/news/speech/2011/spch052511tap-item2.htm.

26 Final Release, supra note 2, at 95-96.

27 Id. at 103.

28 Id. at 97.

29 Id. at 105.

30 Rules 21F-6(a)(4) & (b)(3) (to be codified at 17 C.F.R. §§ 240.21F-6(a)(4) & (b)(3)).

31 Rule 21F-6(b)(3) (to be codified at 17 C.F.R. § 240.21F-6(b)(3)).

32 Final Release, supra note 2, at 118.

33 Rule 21F-4(c)(3) (to be codified at 17 C.F.R. § 240.21F-4(c)(3)).

34 Final Release, supra note 2, at 6.

35 Rule 21F-4(b)(5) (to be codified at 17 C.F.R. § 240.21F-4(b)(5)).

36 Final Release, supra note 2, at 89.

37 Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 § 922(a) (to be codified at 15 U.S.C. § 78u-6(h)(1)(A)).

38 Rule 21F-2(b)(2) (to be codified at 17 C.F.R. § 240.21F-2(b)(2)).

39 Final Release, supra note 2, at 18.

40 Rule 21F-9(d) (to be codified at 17 C.F.R. § 240.21F-9(d)).