Editor: Please comment on how the new rules for whistleblowers differ from the SEC's current whistleblower program.
Hsu: In July 2010, the Dodd-Frank Act added Section 21F to the Securities Exchange Act of 1934. This new section requires the SEC, pursuant to such rules as it adopts, to pay individuals who voluntarily provide information that leads to a successful SEC enforcement action an award of 10 to 30 percent of total monetary sanctions collected if sanctions exceed $1 million. In November 2010, the SEC circulated proposed rules for comment and adopted final rules at the end of May.
The new rules significantly change the SEC's current whistleblower program. Under the old program, only insider trading cases were eligible, the maximum award was 10 percent, and the SEC had discretion on whether and how much to award. Under the new rules, bounties will be available for all federal securities law violations, the size of awards will range from a minimum of 10 percent to a maximum of 30 percent of all monetary sanctions collected in the SEC action as well as related actions, and the SEC must pay an award if the rules' requirements are met, with the SEC only having discretion on the range of the award between 10 and 30 percent.
Editor: On what date will the rules become formally effective?
Hsu: The rules become effective August 12, 2011. However, whistleblowers who come forward after July 21, 2010, the date of enactment of Dodd-Frank, and before the effective date are still eligible.
Editor: What have been the major criticisms of these new rules?
Hsu: The business community has raised several objections to the new rules. First, there is a concern that there will be too many frivolous claims aimed purely at obtaining a substantial bounty. For the minimum sanction of $1 million, a whistleblower may earn a 10 to 30 percent bounty, resulting in an award of $100,000 and higher. Some violations may result in amounts much bigger in magnitude, such as violations of the FCPA. If the lure of these financial awards results in lots of frivolous claims, the SEC and companies will be wasting a lot of time and resources dealing with them.
Another major criticism leveled by the business community is that the rules do not require employees to first report problems internally. Consequently, employees may be tempted to by-pass the normal internal procedures for reporting and go directly to the SEC. There is a real risk that this will undermine corporate compliance programs. In addition, there is concern that a whistleblower may delay reporting a violation in hopes that the violation will escalate, thereby increasing the related monetary sanctions and any potential whistleblower award.
On the other side of the coin, whistleblower advocates have criticized the new rules for being overly complex and creating too many hurdles for whistleblowers to earn awards.
Editor: The two Republican commissioners who voted against the proposal had several objections, one of which related to the fact that a whistleblower could still bypass a company's good faith efforts to investigate violations. Do you consider this argument to have merit?
Kaufer: There is concern whether the internal reporting incentives contained in these rules are strong enough to deter an employee from bypassing, and thereby undermining, internal compliance programs. A whistleblower is eligible to receive a bounty on a tip to the SEC even after having been contacted pursuant to an internal investigation. Bypassing internal compliance programs may substantially reduce a company's ability to identify wrongdoing, to collect information and, possibly, to remediate fraud or other misconduct.
Engaging in a private process to remediate problems may be more efficient than the government's process, especially if you consider the high volume of expected complaints and the fact that the SEC has many other responsibilities. It's possible that misconduct and fraud may grow worse due to potentially slower response time from the SEC.
Many companies implemented or enhanced existing compliance programs following the adoption of Sarbanes-Oxley and continue to make these systems more robust. These compliance systems provide a host of benefits for companies. Boards and senior executives have come to rely on these systems as an early detection system for wrongful conduct enabling the company to respond to problems before misconduct festers and exposes the company to significant liability.
Compliance systems serve to educate employees about the law, which takes on greater significance for international companies subject to complex and overlapping laws and regulations. What makes compliance programs effective is the expectation that employees will report misconduct through internal processes so that the company may timely correct the problems. If employees bypass these internal processes and go directly to the SEC, the effectiveness of these internal mechanisms will be undermined.
Editor: Do the SEC rules do enough to incentivize employees to use internal compliance systems?
Kaufer: The rules offer some incentives for whistleblowers to report internally, but they may not be strong enough to deter employees from reporting directly to the Commission. First, a whistleblower who reports internally will be eligible for an award if the company subsequently self-reports to the SEC and the company's report leads to a successful enforcement action. So long as the whistleblower reports the information he provided internally to the SEC within 120 days of the internal report, the whistleblower will receive full credit for all information provided by the employer as if the whistleblower had provided the information to the SEC. This is designed to put a whistleblower who uses internal procedures in at least the same position as one who goes directly to the SEC. Also, because the whistleblower gets credit for all of the information reported by the company, the whistleblower may get a larger award.
Another incentive is that in determining the amount of an award between the minimum of 10 percent and the maximum of 30 percent, the SEC will consider, among other things, the extent to which the whistleblower participated in the internal compliance system. The SEC noted that it added this incentive to dissuade employees from reporting solely to the SEC, and to express its recognition of the important investor protection role that corporate compliance programs can serve.
A third incentive is that an employee who first reports internally will be treated as if she had reported to the SEC at the time the internal report is made so long as the whistleblower reports to the SEC within 120 days of the internal report. This allows whistleblowers to preserve their "place in line" at the SEC without having to worry that some other whistleblower will go to the SEC before they do.
It remains to be seen whether these incentives will be sufficient to motivate employees to report internally. Even a minimum award of 10 percent could be an enticing sum for an employee. Also, a whistleblower may decide to bypass internal reporting procedures so the company doesn't get credit for self-reporting to the SEC, thereby exposing the company to greater monetary sanctions that would increase the size of the whistleblower's award.
Editor: Is the provision for disqualifying certain categories of personnel, such as compliance and audit personnel, as whistleblowers sufficiently broad?
Hsu: The rules exclude certain logical categories of individuals from whistleblower eligibility. For example, they exclude officers and directors of a company where they obtain the information because another person informed them of allegations of misconduct or where they learned of the allegations in connection with the company's internal compliance process. The rules also exclude individuals whose principal duties are compliance and internal audit. There may, however, be certain personnel who do not fall within one of the exclusions but do learn the information through the company's internal compliance program. For example, if an employee, pursuant to a company's compliance procedures, reports a possible violation to her supervisor, unless the supervisor is an officer or her duties principally relate to compliance or internal audit, the supervisor would be eligible to go to the SEC as a whistleblower. The employee would still be considered first in line with the SEC so long as the employee also reported the possible violation to the SEC within 120 days of the internal report. But if the employee fails to make that timely report with the SEC, and the supervisor does file a report with the SEC, the supervisor would ultimately get credit for providing the information. There will likely be other scenarios that may pose problems under the new rules.
Editor: Do the anti-retaliation provisions unduly inhibit the ability of an employer to fire or discipline an employee for reasons other than the alleged reason given by the employee?
Hsu: Several commenters on the proposed rules had requested that the SEC expressly provide that the anti-retaliation provisions would not apply where a company takes an action against an employee based on factors independent of the employee's whistleblower activities, such as engaging in culpable conduct or not following the company's internal compliance reporting requirements. The SEC, however, declined to include this in the final rules, stating instead that there is well-established case law for making these determinations, which are very fact intensive.
Companies will definitely want to tread lightly if taking a disciplinary action against an employee whistleblower and make sure that they appropriately document the grounds for such action. Companies should also make sure their HR personnel are fully briefed on these new rules.
Editor: Do you think the whistleblower provision even requires the bounty incentive? Isn't it enough that an employee reporting securities violations simply be commended by management?
Hsu: I think that at most companies and in most situations, a bounty incentive is not needed. Most companies do have strong ethical cultures and encourage and recognize employees for reporting violations. This motivates employees to be loyal to their employers and report violations as soon as they suspect or become aware of them. However, we all know that there are some rogue organizations out there where management either does not care, or knowingly disregards, the securities laws. In these situations, internal reporting won't accomplish anything and certainly won't be commended by management.
Editor: Are there incentives for an employee to withhold making a timely report of a potential violation to management to build up the bounty?
Kaufer: Because the awards are based on a percentage of the monetary sanctions from a successful enforcement action, an employee may find it financially advantageous to delay reporting a potential violation to allow the violations to grow in size and scope in order to increase the resulting sanctions, thus maximizing the potential award. Delaying may also increase the amount and quality of evidence that supports the claim, thereby increasing the likelihood of a successful proceeding. On the other hand, delay in reporting a violation and interference by the whistleblower with the company's internal compliance system are factors that the SEC will consider in determining the size of an award within the 10 to 30 percent range. And, employees who delay reporting are at risk that another whistleblower could come forward first, possibly eliminating the employee's opportunity for an award.
Editor: While employees may continue to go directly to the SEC and bypass company procedures, do you see this avenue of reporting being utilized very often, where an employee feels he will not receive a fair hearing by company management?
Kaufer: Certainly, fear of retaliation is a significant factor in any employee's decision whether and how to report a violation; however, the employee also needs to feel confident that the company wants to hear the complaint, particularly when it involves higher-ranking employees. Convincing an employee that she will be protected from retaliation involves more than good systems - it requires constant reinforcement of corporate commitment at every level within the organization. Companies that maintain meaningful internal avenues for raising concerns and that can substantiate a good record of effective management response and resolution, may earn the confidence of their employees, which should enhance the likelihood of more internal reporting. Companies have an incentive to respond quickly and effectively to internal reports of potential violations. A company may receive favorable treatment if it self-reports violations to the SEC. If a whistleblower reports to the SEC before the company self-reports, the company may lose benefits that it otherwise might have gained by self-reporting.
There are many ways a company can enhance its culture of compliance, including robust employee training programs at all levels and training managers and supervisors about how to respond to reports of violations. It's not uncommon for retaliation allegations to arise when a lower-level supervisor terminates an employee, not knowing that the termination is impermissible under the law.
Companies should ensure that the ability to report internally is easy and accessible. A company might include ethics and reporting of violations as positive performance measures in employee evaluations. Exit interviews as well as performance reviews can be used effectively to learn whether the employee knows of any unethical conduct. Also, it's critical to eliminate any basis for a potential whistleblower to fear that there will be any retaliation internally.
Finally, an employee who engaged in misconduct may feel hesitant about reporting the violation internally, fearing he may be categorized with other more egregious violators. The employee who may be liable still may be eligible for the whistleblower award and may thereby feel more protected in going directly to the SEC.
Editor: Left out of this whole equation is the ability of the employer to answer the employee's complaint to the SEC. It only hears one side.
Kaufer: There were a host of comments to the SEC favoring a requirement that employees be required to report internally initially, or at least require concurrent reporting. Additional comments requested that the Commission be required to notify an affected company of a whistleblower's allegations and to give the company credit if it took remedial action. The SEC declined to adopt any of these positions, and instead left it to the discretion of the SEC staff whether to contact a company upon receipt of a whistleblower complaint. While an SEC inquiry or investigation ultimately may provide a company with an opportunity to respond fully to the allegations, the concern principally is one of response time. Timely alerting the company to the whistleblower allegations enables a company to respond and remediate promptly.
Editor: Is the SEC staffing up sufficiently to handle all these complaints?
Kaufer: Sean McKessy has been appointed to oversee the new Whistleblower Office in the Division of Enforcement. The Commission has stated that this office will consolidate existing resources to administer the whistleblower provisions. Staffing is a concern because of the anticipated increase in tips. At one point, the SEC was anticipating as many as 30,000 tips a year under the new program. Editor: Sean McKessy, chief of the SEC's new whistleblower office, stated that the agency's ability to separate credible tips will be enhanced by requirements that potential whistleblowers identify themselves as seeking a possible award, and provide a sworn statement, under penalty of perjury, that the information is true. Do you think his argument has merit?
Kaufer: It is possible that a sworn statement may have some filtering effect, but simply requiring a sworn statement may not serve to ensure high-quality tips, even if provided in good faith. To that point individuals who provide information that relates to just a possible violation of the federal securities laws may be eligible for an award if that information leads to a successful enforcement action. The SEC's May 25 release provided that a possible violation need not be "material," "probable," or even "likely." This feature may have a negative impact on the quality of the tip. The rules do allow that the tipster may remain anonymous as long as she is reporting through an attorney. To be fair, the Commission has indicated that there has been an increase in high-quality tips since the passage of Dodd-Frank.
Published July 1, 2011.
