On May 25, 2011, by a three-to-two vote of its commissioners, the Securities and Exchange Commission (the “Commission”) adopted final rules implement­ing the whistleblower provisions of Section 21F of the Securities Exchange Act of 1934 (as amended, the “Exchange Act”). Section 21F was added to the securities laws by Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”) to create monetary incentives and job protections for securities whistleblowers who provide the Commission with original information leading to a successful enforcement action resulting in monetary sanctions in excess of $1,000,000. The final rules will become effective on August 12, 2011. The full text of the adopting release and the final rules is available here.

Public companies have already seen—and should continue to expect—increased whistleblower activity in response to the new legislation and rules. Thus, public companies and other entities regulated under the securities laws should not delay gaining an understanding of, and preparing to deal with, Section 21F of the Dodd-Frank Act and the final rules promulgated thereunder.

Part I of this e-alert summarizes the key components of the whistleblower rules adopted by the Commission. Part II discus­ses the tension between these rules and internal corporate compliance mechanisms. Part III describes certain practical implications that these rules have for public companies and other entities subject to the securities laws. Among other things (and as explained further in Part III below), because of the structure of the rules, they create new incentives for the early involvement of attorneys (whether outside or in-house) when potential whistleblower issues arise.

I. Summary of Final Whistleblower Rules

A. Award Provisions

The whistleblower rules adopted by the Commission generally track Section 21F, although they provide a number of other refinements to the require­ments for being eligible for receiv­ing a bounty. Rule 21F‑2(a) defines a “whistleblower” as an individual (corporations and other entities are not eligible) who “alone or jointly with others” provides the Commission “with information pursuant to the procedures set forth in [Rule 21F‑9(a)], and the information relates to a possible violation of the federal securities laws (including any rules or regula­tions thereunder) that has occurred, is ongoing, or is about to occur.”

Certain categories of individuals are excluded from eligibility for a whistleblower award pursuant to Rule 21F‑8(c), including: (1) employees of the Commission, the Department of Justice, other regulatory or law enforcement agencies, self-regulatory organizations, and the Public Company Accounting Oversight Board (“PCAOB”); (2) members, officers or employees of foreign governments (including state, provincial, and local) or any foreign financial regulatory authority; (3) a person who is convicted of a criminal violation that is related to the Commission action; and (4) a person who obtained the information through an audit of a company’s financial statements, where making a whistleblower submission would be contrary to requirements of Section 10A of the Exchange Act.

Rule 21F-3(a) provides that—subject to the exclusions above and certain other requirements—the Commission will pay an award to one or more whistleblowers who:

(1) Voluntarily provide the Commission

(2) With original information

(3) That leads to the successful enforcement by the Commission of a federal court or administrative action

(4) In which the Commission obtains monetary sanctions totaling more than $1,000,000.

(Emphasis added.)¹

Where all of the conditions to an award are met (and none of the exclusions are applicable), Section 21F requires the Commission to award the whistleblowers between 10 and 30 percent of the amounts actually recovered. Each of the highlighted terms above are discussed further below.

First Requirement – Voluntary Reporting. Rule 21F-4(a) states that, to provide information “voluntarily,” the whistleblower must submit the information to the Commission or certain “other authorities” before he or she (or anyone representing the whistleblower) receives any request that relates to the subject of the whistleblower’s submission from the Commission (in any context), from the PCAOB or a self-regulatory organization (but only in connection with an investigation, examination or inspection by such entity), or from the Congress, any other federal government authority, a state attorney general or state securities regulator (but only in connection with an investigation by any such govern­mental body).²

Although the proposed rules had provided that a request from the Commission (or one of the other authorities) to an employer was deemed to be directed to all of the employ­ees who possess the requested information, the final rules eliminat­ed this concept. The final rules thus allow a whistleblower to be a person who learned of an inquiry by the Commis­sion (or one of the other authorities) as a result of a government agency’s request for documents addressed to the person’s employer, as long as a request for information was not made directly to him or her (or his or her representatives).³

In addition, the rules provide that a submission to the Commission will be considered “voluntarily” made if that information was provided voluntarily by the whistle­blow­er to another authority prior to the whistleblower’s receipt of a request, inquiry, or demand from the Commission. Thus, if a person voluntarily provided information regarding a Foreign Corrupt Practices violation to the Department of Justice (and that department referred the matter to the Commission, which then subpoenaed the whistleblower), the person who originally provided information voluntarily to the Department of Justice could still qualify as a whistleblower under the rules. On the other hand, an individual who first provided information to the Department of Justice in response to a subpoena and who then provides the same information to the Commission would not similarly be deemed to have provided information “voluntarily.”

Lastly, Rule 21F-4(a)(3) provides that a submission of information regarding a possible securities law violation will not be considered “voluntarily” made if the person making the submission was under an obligation to provide the information in question to the Commission, and that obligation arose from existing legal or contractual duties that are owed to the Commission or one of the other authorities or that arise out of a judicial or administrative order. The proposed rule had applied this exclusion more broadly (i.e., in any case where the whistleblower was obligated to report the violation to one of the other authorities); however, in adopting the final rule, the Commission concluded that this broader exclusion was potentially vague and overbroad, and might have the unintended consequence of deterring some whistleblowers.

Second Requirement – Original Information. Rule 21F-4(b)(1) defines “original infor­mation” as information derived from the whistleblower’s “independent knowledge” or “independent analysis” that is not otherwise known to the Commission from another source. “Independent knowledge” is defined as factual information in the whistle­blow­er’s possession that is not derived from publicly available sources. There is no require­ment that the whistleblower have direct, first-hand knowledge of the alleged violations, and the “independent knowledge” may be gleaned from the whistleblower’s experiences, communications, and observations (including—subject to certain exceptions discussed below—information imparted by third parties). “Independent analysis” means the whistleblower’s own analysis (whether done alone or with others) which reveals information that is not generally known or available to the public.

However, the final rule also specifies various types of information or analysis that are excluded from “independent knowledge” or “independent analysis”:

• In order to protect the attorney-client relationship, Rules 21F-4(b)(4)(i) and (ii) provide that information obtained through a communica­tion protected by attorney-client privilege or obtained in connection with legal representa­tion of a client is not “independent informa­tion” or “indepen­dent analysis.” Thus, attorneys—whether outside or in-house—will not be able to claim whistleblower status. The sole exception to these two rules exists where disclosure to the Commission (without client consent) would be permitted under Exchange Act Rule 205.3(d)(2) (adopted in connection with the Sarbanes-Oxley Act of 2002)⁴ or applicable state bar ethical rules.
• Clauses (A) and (B) of Rule 21F-4(b)(4)(iii) exclude any information obtained because (1) the recipient was “an officer, director, trustee, or partner” of an entity and either (x) another person informed the recipient of allegations of misconduct or (y) the recipient learned the information in connection with the entity’s compliance processes, or (2) the recipient was an employee whose principal duties involve compliance or internal audit (or was employed by a firm engaged to perform those functions).
• Clause (C) of Rule 21F-4(b)(4)(iii) excludes information learned by a person employed by, or associated with, a firm that is retained to conduct an internal investigation into a possible violation of the securities laws.
• Clause (D) of Rule 21F-4(b)(4)(iii) excludes information gained by an employee of a public accounting firm (or any other person associated with such a firm) through the performance of an engagement required under the federal securities law relating to the engagement client or the engagement client’s directors, officers or employees. However, the exclusion relating to public accounting firms would not apply to information that an employee or associated person learned through an engagement that is not required by the federal securities laws (e.g., an engagement on tax matters), nor would it exclude information learned by an accounting firm employee about a violation of the securities laws by another employee of the accounting firm.
• Rule 21F‑4(b)(4)(iv) excludes any information that was found by a U.S. court to have been obtained in a manner that violates applicable state or federal criminal law.
• Finally, Rule 21F-4(b)(4)(vi) excludes any information “obtained from a person who is subject to this section,” subject to certain limited exceptions. In other words, if an attorney conducting an internal investigation were to interview an employee of a public company and, in the course of that interview, reveal information to that employee that the attorney obtained in connection with an attorney-client communication, the employee who received the information could not then be a whistleblower for purposes of an award based on that information.

In addition to the foregoing, Rule 21F-4(b)(4)(v) creates a series of exceptions to the exclusions in clause (iii) of Rule 21F‑4(b)(4) (but not to the exclusions in the other clauses of the rule). In order to encourage reporting by potential whistleblowers, a person that would not otherwise be deemed to have “original informa­tion” pursuant to Rule 21F-4(b)(iii) may satisfy the “original information” requirement if: (a) the person reasonably believes that disclosure to the Commission is necessary to prevent the relevant entity from engaging in conduct that is likely to cause “substantial injury to the financial interest or property of the entity or investors”; (b) the person reasonably believes that the relevant entity is about to impede an investigation (e.g., by destroying documents); or (c) at least 120 days have elapsed since either (i) the person provided the information to the relevant entity’s audit committee, chief legal officer, chief compliance officer (or their equivalents), or his or her supervisor, or (ii) if the provider of the information to the Commission received it from another person under circumstances indicating that the entity’s audit committee, chief legal officer, chief compliance officer (or their equi­va­lents), or such other person’s supervisor was already aware of the information, the date the provider received it.

Third Requirement – Successful Enforcement. Rule 21F‑4(c) defines three circum­stances that constitute “information leading to successful enforcement”:

• first, the whistleblower submitted “information [that was] sufficiently specific, credible, and timely to cause the staff to commence an examination, open an investigation, reopen an investigation that the Commission had closed, or to inquire concerning different conduct as part of a current examination or investigation,” and the Commission later brought a successful action based on conduct that was the subject of the information submitted; or
• second, the whistleblower submitted “information about conduct that was already under examination or investigation by the Commission, the Congress, any other authority of the federal government, a state Attorney General or securities regulatory authority, any self-regulatory organization, or the PCAOB,” and such submission “significantly contributed” to the success of the action; or
• third, the whistleblower provided information through an entity’s internal compliance processes and that entity later provided that information to the Commission or provided the results of an audit or investigation initiated in response to the whistleblower’s information, and the information submitted by the entity to the Commission satisfied either one of the two preceding standards.

The language adopted in the first two paragraphs of the final rule quoted above sets significantly lower hurdles for whistleblower information than was originally proposed. The Commission had proposed that, where it had not yet commenced an investigation, the information needed to have “significantly contributed” to the success of the action and, where it had already commenced an investigation, the information needed to have been “essential” to the success of the action. These changes thus suggest an intent on the part of the Commission to broaden considerably the pool of whistleblowers eligible for a financial award. The third category is entirely new to the final rule and, as described below in Part II, was adopted to create a further incentive to internal compliance reporting.

Fourth Requirement – Monetary Sanctions. The action must generally be a single civil or administrative proceeding that results in monetary sanctions (including penalties, disgorgement and interest) ordered to be paid exceeding $1,000,000. However, the Commission will treat multiple actions as a single action if they arise out of the “same nucleus of operative facts.

B. Anti-Retaliation Provisions

The final whistleblower rules—like those proposed—provide only limited guidance relating to the anti-retaliation provisions. Rule 21F‑2(b)(1) defines a whistleblower for purposes of the anti-retaliation provisions as an individual who “(i) … possess[es] a reasonable belief that the information [the individual is] providing relates to a possible securities law violation (or, where applicable, to a possible violation of the provisions set forth in 18 U.S.C. 1514A(a)) that has occurred, is ongoing, or is about to occur, and; (ii) … provide[s] that information in a manner described in Section 21F(h)(1)(A) of the Exchange Act.” Under the proposed rules, there was no separate definition of whistleblower for anti-retaliation purposes.⁵

If a person meets the definition of a whistleblower set forth above for purposes of the anti-retaliation provisions, the rules clarify that he or she will be entitled to the anti-retaliation protections of Section 21F regardless of whether the whistleblower satisfies the additional requirements for an award. Thus, an employee claiming the benefit of the anti-retaliation provisions of Section 21F(h) does not have to be correct about the existence of a securities violation, does not have to provide information that meets the standard of “original information,” and does not have to provide the information in a manner that meets the “voluntary” standard. Section 21F broadly prohibits many types of adverse employment and other actions against a whistleblower for any lawful act done in providing information to the Commission, in initiating, testifying or assisting in an investigation or judicial or administrative action or in making certain disclosures that are required or protected under the Sarbanes-Oxley Act.

II. Tensions between the Whistleblower Program and Effective Internal Reporting Mechanisms

Starting prior to the publishing of the proposed rules and continuing until the adoption of the final rules, a major topic of debate has been the inherent tension between the congressional mandate in the Dodd-Frank Act regarding whistle­blower awards and protections and other governmental policies in favor of robust and effective internal compliance mechanisms. The adoption of the final rules has not ended the debate. Indeed, one of the commissioners expressed serious reservations that the balance struck by the Commission undervalues internal compliance mechanisms.

The conflict between the whistleblower program and effective internal compliance mechanisms is that the existence of the whistleblower program creates incentives for employees to avoid internal compliance mechanisms entirely and simply report matters directly to the Commission. Although the Commission acknowledged the conflict, it was unwilling to adopt a final rule—as many had suggested—that required internal reporting before an employee could seek to be a whistleblower entitled to a reward. The Commission explained: “while internal compliance programs are valuable, they are not substitutes for strong law enforcement. In some cases, law enforcement interests will be better served if we know of potential fraud before the entities or individuals involved learn of our investigation.” The Commission also thought that requiring reporting through internal compliance processes would, in some cases, “dissuade potential whistleblowers from providing information to the Commission.”

Nevertheless, the Commission was open to tinkering around the margins of the rule in an effort to create better incentives to report internally first. For example:

• In order to create an incentive for an employee to utilize its employer’s internal compliance processes Rule 21F-4(b)(7) provides that any disclosure of whistleblower information to the Commission will relate back to (and be deemed to be made as of) an earlier disclosure of the same information to Congress, to the other authorities or to an entity’s internal whistleblower, legal or compliance mechanisms, as long as the disclosure to the Commission occurs no later than 120 days after that earlier disclosure (the proposed rule had permitted this relation-back only for 90 days). Because a whistleblower is permitted to keep a “place in line” during this 120-day period, an employee may be willing to consider reporting potential violations internally in the first instance.
• As noted above in Part I, the Commission added a third category of “information leading to a successful enforcement action” for information provided by a whistleblower to an entity if that entity subsequently provides that information (or information generated from the whistleblower information) to the Commission. This provision is notable because it is expressly intended to give the whistleblower credit for any information developed by the entity after being given the whistleblower’s information. Thus, if a whistleblower provides information to the audit committee of his or her employer regarding a possible fraud by a senior executive, and the audit committee hires an outside law firm to do a thorough investigation, and the investigation concludes that the executive in fact violated the law, and the audit committee provides the audit committee report to the Commission, the whistleblower would get credit (for purposes of the award provisions) for all of the information ferreted out by the law firm (at least to the extent the Commission did not already have that information).
• Lastly, the final rules expressly provide that a whistleblower’s participation in an entity’s internal compliance and reporting systems is a factor that can increase the amount of an award, and provide further that a whistleblower’s interference with internal compliance and reporting is a factor that can decrease the amount of an award.

III. Practical Advice under the Final Whistleblower Rules

Section 21F and the final rules raise potentially significant issues for public companies and other entities subject to the securities laws.

Timing. Public companies and other entities subject to the securities laws will need to try to complete internal investigations more quickly. As noted above, if an employee discovers a potential securities law violation and the employee chooses to report that violation internally to legal, internal audit, or compliance personnel, that whistleblower can maintain “first in line” status only if the employee then makes a whistleblower report to the Commission within 120 days after making the internal report. Therefore, a company that receives a whistleblower report from an employee will have to assume that the employee will want to “monetize” the information by reporting that matter to the Commission within 120 days and plan any internal investigation accordingly. Even if there is no employee who provided a tip, Section 21F and the final rules create new pressures to complete the investigation quickly. As noted above, the rules allow personnel in internal audit and compliance functions (and persons who learned about the possible violations from such compliance personnel) to report possible securities violations to the Commission and claim an award if the employer does not report such information itself within the 120-day window period.

If the investigation finds a violation (or if a securities law violation is a strong possibility), the company will have to consider self-reporting to the Commission within that same 120-day period so as to report the violation to the Commission before the whistleblower (or, if that is not possible, so as to minimize the lag between the whistleblower’s and the company’s own reports to the Commission). The Commission staff has indicated that it will consider the lapse of time between the whistleblower report and the entity’s self-report in granting credit for cooperation.

Loss of Incentives to Proceed Internally. Although the final rules, as noted above, give an employee an opportunity to report potential violations internally while retaining a “first in line” position for an award (and include some additional incentives for an employee to report internally first), it is not clear that employees will necessarily perceive that the advan­tages of internal reporting outweigh the potential disadvantages. Companies should reevaluate their current compliance policies and procedures, employee manuals and other employee materials to ensure that employees understand the existing mechanisms for internal reporting and appreciate the value placed on reporting matters internally.⁶

Involve Attorneys Early. As noted above, the rules defining “independent knowledge” and “independent analysis” create exclusions for information learned by various officers and employees with compliance functions as well as audit personnel, but then provide that an officer or employee or auditor so excluded can be a whistle­blow­er for award purposes if such person reasonably believes that disclosure of such information “is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors,” if spoliation has occurred or is about to occur, or if at least 120 days have elapsed since the information was provided to the relevant entity’s audit committee, chief legal officer, chief compliance officer, or the provider’s supervisor. The rules similarly create an exclu­sion from “independent knowledge” and “independent analysis” for information learned by attorneys subject to the attorney-client privilege or that was obtained in connection with rendering legal services to a client, but then provides an exception to the attorney-related exclusion that is considerably narrower than the one available for compliance personnel or auditors.⁷ Because an employee who learns about a possible securities law violation from a compliance officer or auditor will be subject to the Rule 21F‑4(b)(4)(iii) exclusion (and its exceptions) under the terms of Rule 21F‑4(b)(4)(vi), but an employee who learns about a possible securities law violation from an attorney will be subject to Rule 21F‑4(b)(4)(i) and/or (ii) (and their narrower exceptions), the final whistleblower rules create a strong preference for involving attorneys at early stages of examining a possible securities law violation. This should minimize the number of officers and employees who could potentially claim the right to be a whistleblower 120 days after the possible violation was discovered and reported internally.

Issues for Dealmaking. Rule 21F‑17(a) prohibits the enforcement of a confidentiality agreement when it impedes a would-be whistleblower and, in doing so, raises troubling issues for public companies in the M&A context. Because the whistleblower rules appear to override obligations to maintain due diligence information in confidence, they may cause the target in an acquisition to withhold information on sensitive topics or to limit and delay disclosure of possible securities law violations to the acquirer in a way that minimizes the possibility of a whistleblower report by members of the M&A working group. In addition, a would-be acquirer may have contractual liabilities to the target for disclosure of information by the acquirer’s employee in a whistleblower report if the disclosure violates a confidentiality agreement. Companies should consider limiting the size of the due diligence team that reviews sensitive information and/or using attorneys in certain sensitive areas.

Risks of Employment Disputes. Public companies and other entities subject to the securities laws should monitor grievances that might result in whistleblower complaints and take prompt action. Human resources personnel should communicate with the company’s legal department regarding any such grievances. As noted above, Section 21F(h) and the final rules include broad anti-retaliation protection for employees that may make it difficult to terminate an employee in the midst of an investigation.

Sarbanes-Oxley Certifications. If a public company’s CEO and CFO receive a Sarbanes-Oxley sub-certification that indicates a concern about financial reporting or material misstatements or omissions in disclosure documents, the company should be alert to a possible whistleblower claim. Likewise, if an employee refuses to provide a sub-certification in advance of a filing with the Commission, the company should consider whether the employee may be holding back information for a whistleblower report.

Disclosure of Whistleblower Reports in Public Filings. Although disclosure of whistleblower reports is not required by the rules, in determining whether disclosure should be made, a company will want to consider the materiality of the investigation, based on, among other things, the stage of the investigation, the materiality of the allegations, the reliability of the information and any offering or corporate action then being considered.

* * * * *

 1. Rule 21F-3(b) extends the scope of actions on which an award will be paid (assuming there is also a successful action by the Commission) to amounts collected in “related actions” by certain other governmental or quasi-governmental entities as well.

2. The rules define these “other authorities” as the PCAOB, a self-regulatory organization, Congress, any other federal government authority, a state attorney general, and/or a state securities regulator.

3. The Commission’s adopting release explained that “a rule that prohibited a whistleblower from acting ‘voluntarily’ any time the whistleblower became aware of an investigation or other inquiry covered by the rule is overly inclusive because the subject of the inquiry may not be clear to potential whistle­blow­ers with valuable information or these potential whistleblowers may not be known to the Commission.” However, the Commission also cautioned that individuals who make whistleblower submis­sions after a request for information has been directed to the relevant employer or issuer will likely have an uphill climb to establish that the information provided “significantly contributed” to a successful enforcement action. As explained further with respect to “Step Three – Successful Enforcement,” asserting whistleblower status for purposes of an award after an investigation has already been commenced is subject to a higher burden of proof than would be applicable if no investigation had yet been started by the Commission or one of the other authorities.

4. That rule provides:

“An attorney appearing and practicing before the Commission in the representation of an issuer may reveal to the Commission, without the issuer’s consent, confidential information related to the representation to the extent the attorney reasonably believes necessary: (i) To prevent the issuer from committing a material violation that is likely to cause substantial injury to the financial interest or property of the issuer or investors; (ii) To prevent the issuer, in a Commission investigation or administrative proceeding from committing perjury, proscribed in 18 U.S.C. 1621; suborning perjury, proscribed in 18 U.S.C. 1622; or committing any act proscribed in 18 U.S.C. 1001 that is likely to perpetrate a fraud upon the Commission; or (iii) To rectify the consequences of a material violation by the issuer that caused, or may cause, substantial injury to the financial interest or property of the issuer or investors in the furtherance of which the attorney’s services were used.”

5. The Commission made this modification in an attempt to resolve an apparent ambiguity in the text of the Dodd-Frank Act. Section 21F(h)(1)(A) of the 1934 Act provides anti-retaliation protection because of any lawful act done by a whistleblower “(i) in providing information to the Commission …; (ii) in initiating, testifying in, or assisting in any investigation or judicial or administrative action of the Commission; or (iii) in making disclosures that are required or protected under the Sarbanes-Oxley Act of 2002 …, the Securities Exchange Act of 1934 …, section 1513(e) of title 18, United States Code, and any other law, rule, or regulation subject to the jurisdiction of the Commission.” Although the first two of those categories plainly contemplate that the purported whistleblower would have provided information to the Commission, the third does not. Notwith­stand­ing this omission in clause (iii) of Section 21F(h)(1)(A), some litigants had argued that reporting to the Commission was a prerequisite to anti-retaliation protection for all whistleblower actions based on the definition of “whistleblower” in the Dodd-Frank Act (which defined a whistleblower as a person who, among other things, provided information to the Commission). In adding a separate definition of “whistleblower” for pur­poses of the anti-retaliation provisions, the Commission has seemingly rejected this interpretation and has sided with those (including the district court in Egan v. TradingScreen, Inc., No. 10 Civ. 8202 (LBS) (S.D.N.Y. filed Oct. 29, 2010)) who have concluded that reporting a tip to the Commission should not be required for someone providing information pursuant to clause (iii) of Section 21F(h)(1)(A).

6. At the same time, companies must be careful to ensure that, whatever the steps taken to encourage internal reporting, those steps do not run afoul of Rule 21F-17(a).

7. The exceptions relating to attorneys under Exchange Act Rule 205.3(d)(2) require, in addition to the requirements under Rule 21F-4(b)(4)(v), the existence of a “material” violation. More importantly, the attorney-related exception also does not provide for (as Rule 21F‑4(b)(4)(v) does) potential whistleblower status once 120 days have elapsed after the initial disclosure to the relevant entity’s audit committee, chief legal officer, chief compliance officer or their equivalents.