Jump to Navigation


The SEC's Proposed Whistleblower Rules for Dodd-Frank

December 2, 2010

On November 3, 2010, the U.S. Securities and Exchange Commission (the "SEC" or the "Commission") issued proposed rules to implement the new whistleblower provisions of the recently-enacted Dodd-Frank Act. Please click here to read our previous client alert on this topic, Blowing the Whistle on the New Whistleblower Protections Created by the Dodd-Frank Act, published on August 16, 2010. Under the newly-created Section 21F of the Securities Exchange Act of 1934 (the "Exchange Act"), qualified whistleblowers are entitled to substantial financial rewards for reporting "original information" to the SEC, that leads to a successful enforcement action for a violation of the federal securities law, and that results in a recovery of more than $1 million in penalties.2 Employers are prohibited from retaliating against employees for making such a report.

The proposed rules identify dual – and often competing objectives: (1) promoting adherence to robust corporate compliance programs; and (2) encouraging the identification and enforcement of securities laws violations. Because the SEC is becoming more aggressive in its enforcement of the Foreign Corrupt Practices Act ("FCPA") and other securities laws, public companies and other issuers of securities (including private issuers) are increasingly taking specific measures to help safeguard against whistleblowing, or other civil or criminal liability. Companies acting in good faith by responsibly enforcing robust internal compliance programs may face stiff obstacles posed by the financial incentives offered to employees (and others) to make reports to the SEC. As a result, Dodd-Frank could undermine corporate efforts to impose and enforce their compliance programs. Issues of privacy, confidentiality, and privilege may also be implicated.

Acknowledging this dilemma, the SEC attempts to strike a balance between these competing interests by expanding some statutory provisions while restricting others. For example, instead of an immediate report to the Commission, whistleblowers may first report "original information" to company compliance officers, internal counsel and other appropriate personnel while preserving their status as a qualified whistleblower. By making an internal report first, a whistleblower would then have 90 days to submit the information to the SEC if the company failed to report the information to the Commission within a reasonable amount of time or acted in bad faith.

However, the proposed regulations may actually provide scant protection. Faced with the prospect of enormous financial incentives, an employee may find the temptation irresistible to go directly to the Commission. The proposed 90-day grace period may do little to alter that temptation. 

A Proposed Alternate Approach

To help strike more of a balance, the Commission should consider a mandatory procedure: (i) first requiring – not merely allowing – the employee to make an internal report first; and (ii) then providing the company the opportunity to investigate and submit a written response to the employee (for example, within 60 days), including a determination of whether a securities violation, or potential violation, was committed. Such a procedure would be more consistent (and would promote non-interference with) a company's compliance program. It would also preserve the legitimate interests of the whistleblower, target and discourage frivolous claims and promote the good faith submission of reports of violations and potential violations.

Noteworthy Modifications Based on Regulation 21F's Proposed Rules

Expanded Definition for Individuals Who Qualify as a Whistleblower

Proposed Rule 21F-2(a) makes clear that  a whistleblower must be an individual, not an entity, who, alone or jointly with others, provides "original information" to the Commission relating to a potential violation of the securities laws. Thus, information submitted to the Commission is not limited to "actual, proven securities violations."

Limitations for Persons Engaging in the Misconduct They Are Reporting

The Commission proposes that, when determining whether the $1 million threshold recovery has been satisfied, it will not include any amount that the whistleblower is ordered to pay or that is assessed against an entity attributable to "conduct that the whistleblower directed, planned, or initiated." The Commission requested comment as to whether the proposed limitations are appropriate or whether wrongdoers should be categorically excluded from eligibility.

The Proposed Rules Broaden the Anti-Retaliation Protections for Whistleblowers

The SEC proposes extending the protections against employment retaliation in Section 21F(h)(1) to any individual who provides information to the Commission about potential violations of the securities laws, "regardless of whether the whistleblower fails to satisfy all of the requirements for award consideration set forth in the Commission's rules."

Accordingly, the anti-retaliation protections set forth in Section 21F(h)(1) will not depend on an ultimate adjudication or finding that the conduct identified by the whistleblower constituted a violation of the securities laws. Thus, employees who make misguided or misinformed reports to the Commission are protected from retaliation by their employer.

Voluntarily Provide "Original Information"

For a submission to be voluntary, the individual must come forward with the information before he, or his agent or employer, receives any formal or informal request, inquiry or demand from the Commission, or any other authority, "about a matter to which the information in [his] submission is relevant." Disclosure is not voluntary if the individual has a pre-existing legal or contractual duty to report violations of the type at issue to the authorities. However, if the employer fails to provide the information to the requesting authorities "in a timely manner," subsequent reporting to the Commission by an employee may be considered voluntary. 

"Original Information" Derived from "Independent Knowledge"

Among other qualifications, "original information" must be derived from either "independent knowledge" or "independent analysis." Proposed Rule 21F-4(b)(2) defines "independent knowledge" as factual information in the whistleblower's possession that is not obtained from publicly available sources. Direct, first-hand knowledge of potential violations is not required.  Instead, knowledge may be obtained from any of the whistleblower's experiences, observations or communications (subject to the exclusion for knowledge obtained from public sources).

"Original Information" Derived from "Independent Analysis"

Proposed Rule 21F-4(b)(3) defines "independent analysis" as the whistleblower's own analysis, whether conducted alone or in combination with others. "Analysis" means the whistleblower's examination and evaluation of information that may be generally available, but which reveals information that is not generally known or available to the public.

Typically, one would expect an insider's analysis of company financial or email records to help guide the Commission toward consideration of a potential violation. Conceivably, an individual could review publicly available information, and, through additional evaluation and analysis, provide "original information" to the SEC. However, establishing eligibility by this method can be an uphill challenge.

Exclusions from "Independent Knowledge" or "Independent Analysis"

Proposed Rule 21F-4(b)(4) asserts that reported information generally will not be considered to derive from an individual's "independent knowledge" or "independent analysis" in seven circumstances: 

  • Attorney-Client Privilege:  Lawyers who obtain information through a communication that is subject to the attorney-client privilege.
  • Legal Representation:  Lawyers who obtain information (not just privileged information) through a client's representation. 
  • Independent Public Accountant:  Individuals who obtain information through the performance of an engagement required under the securities laws by an independent public accountant, if the information relates to a violation by the engagement client, or the client's directors, officers or other employees.
  • Legal, Compliance, Audit, Supervisory or Governance Responsibilities:  An individual with legal, compliance, audit, supervisory or governance responsibilities for an entity that receives information about potential violations, if the information was communicated to the person with the reasonable expectation that the person would take appropriate steps to cause the entity to respond to the violations.  EXCEPTION: If the company failed to disclose the information to the Commission within a reasonable time, or proceeded in bad faith.
  • Through Legal, Compliance, Audit, Supervisor or Governance Functions or Processes:  Any other time an individual obtains information from or through an entity's legal, compliance, audit, or similar function or process for identifying, reporting and addressing potential non-compliance with applicable law.  EXCEPTION: If the company failed to disclose the information to the Commission within a reasonable time, or proceeded in bad faith.
  • Violation of Applicable Federal or State Criminal Law:  Individuals who obtain information by a means or in a manner that violates applicable federal or state criminal law.
  • Recipient or Third Party Exclusion:  Individuals who obtain information from anyone who is subject to the first six exclusions (above).

Practical Application of the Exceptions

Some concrete examples may help illuminate these exceptions.  For example, attorneys who obtain information through document discovery from an opposing party are ineligible to participate in the whistleblower bounty program based on the information they acquire.  Officers, directors, employees and consultants who learn of potential violations while discharging their corporate responsibilities may not use what they learn to qualify for the whistleblower bounty program. Similarly, company counsel or compliance officers may not benefit under the whistleblower program based on information obtained in connection with their responsibilities; nor may individuals (including lower-level employees) who are apprised of such issues or information in connection with an audit, legal inquiry or other internal supervisory or governance-related matter. In addition, a family member or friend of any individual from any of the categories above is not eligible to be a whistleblower based on information received from an insider contact.  It remains an open issue for the Commission to determine whether these whistleblower-ineligible employees are protected by the anti-retaliation measures proposed for all reporting individuals. 

Reporting to Another Authority

"Original information" must be provided to the SEC in order for the anti-retaliation provision to apply. The proposed rules do not cover reports to the Department of Justice ("DOJ") or other authorities, alone; nor do they extend bounty benefits for such reports, without a separate report as well to the SEC within 90 days of the original submission. For example, if a report is originally made to the DOJ, the whistleblower must "submit the same information to the Commission" within 90 days to be eligible for an award and for protection under the Exchange Act's anti-retaliation provisions.

Two-Step Process for Submission of "Original Information"

The SEC proposes a two-step process consisting of multiple forms for the submission of original information under the whistleblower bounty program:

  • Step 1:  The first step requires the submission of information either on a standard form or through the Commission's online database for receiving tips, complaints and referrals.
  • Step 2:  The second step requires the whistleblower to complete a Whistleblower Office form, signed under penalty of perjury, asserting the veracity of the information provided and the whistleblower's eligibility for a potential award.

Anonymous Submissions

Dodd-Frank permits anonymous whistleblower submissions with conditions. Proposed Rule 21F(h)(b)(1) requires an anonymous whistleblower to be represented by an attorney, and the attorney's contact information must be provided to the SEC at the time of the whistleblower's initial submission. In addition, Proposed Rule 21F-9(c) requires the attorney representing an anonymous whistleblower to provide the SEC with a form that certifies the attorney verified the identity of the whistleblower.

The SEC will accept public comment on its proposed rules until December 17, 2010.


1 Dodd Frank Wall Street Reform and Consumer Protection Act.  As mandated by the Dodd-Frank Act, the SEC will issue final regulations within 270 days of its passage, or April 2011.  These final regulations will have a significant impact on the effects of Dodd-Frank.
2 For our previous client update on this topic, please click here.