December 16, 2019
On November 15, 2019, the SEC’s Office of the Whistleblower (“OWB”) issued its annual report for fiscal year 2019. The report contains some important details for public and private companies, investment advisers and broker-dealers. Although OWB is limited by statute in the amount of information it can provide about whistleblowers and the enforcement actions on which whistleblower awards are based, the report nevertheless provides a useful look at the priorities of the SEC’s Division of Enforcement, the types of potential violations that whistleblowers have been reporting to the SEC, and characteristics of the whistleblowers themselves. This information, along with related developments that we discuss below, should inform how entities anticipate and respond to the continuing proliferation of whistleblower activity discussed in the report.
Based on the number of whistleblower tips and the quantity and dollar amounts of the reported awards, the whistleblower program remains vigorous, even though the total award amount paid in fiscal 2019 was significantly below that of fiscal 2018. In fiscal 2019, the SEC received 5,212 whistleblower tips – slightly below the 5,282 received in fiscal 2018 – viewed against the total of over 33,000 tips provided to the agency since the program began.1 More importantly, however, the number of tips in recent years has grown dramatically, increasing by approximately 74 percent since fiscal year 2012,2 reflecting the continued effectiveness of the sizeable financial incentives that the program offers to individuals who report possible wrongdoing to the SEC.
In terms of dollar amounts, whistleblower awards in fiscal 2019 totaled approximately $60 million, paid to eight individuals whose whistleblower tips either led to the opening of an investigation or otherwise “significantly contributed” to a successful SEC enforcement action.3 This compares to the over $168 million that the Commission awarded to 13 individuals in fiscal 2018.4 (Overall, the SEC has awarded approximately $387 million to 67 individuals in connection with 55 enforcement actions since the program was established.5) The disparity between the 2018 and 2019 award figures may be attributable in part to the 35-day federal government shutdown in December 2018 and January 2019, which brought the SEC to a near standstill, as well as a decrease in the quality of the whistleblower tips that the agency received. (We examine the largest awards in further detail below.)
The SEC’s whistleblower program is a creation of the 2010 Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”). Section 922 of Dodd-Frank amended the Securities Exchange Act of 1934 (“Exchange A also added protections for whistleblowers against retaliation by their employers for reporting misconduct to the SEC.7 The SEC established OWB, which exists within the Division of Enforcement, to administer and carry out the goals of the whistleblower program.
Under the implementing SEC rules, the agency will deem a tip to qualify for an award if: (1) it caused the SEC staff to initiate an examination, open or reopen an investigation, or expand the scope of an existing investigation to include additional conduct, and resulted in a successful action; or (2) it involved conduct that was already under investigation and “significantly contributed” to the success of the SEC’s action.8 Significantly, in order to encourage employees to utilize a firm’s internal processes for reporting misconduct, the rules also permit whistleblowers to qualify for an award where they initially report misconduct internally, provided that they also report it to the SEC within 120 days of doing so, and the entity either shares with the SEC the whistleblower’s tip or the results of an audit or investigation resulting from that information.9
The amount of an award is at the SEC’s discretion, but can be no less than 10 percent, and no more than 30 percent, of the monetary sanctions (including penalties, disgorgement and prejudgment interest) collected in the related enforcement action.10 In determining the size of the award, Section 21F requires the SEC to consider: (1) the “significance of the information provided” to the success of the judicial or administrative action; (2) the “degree of assistance provided” by the whistleblower and the whistleblower’s counsel in the relevant action; (3) the SEC’s “programmatic interest” in deterring violations of the securities laws by making whistleblower awards; and (4) other factors prescribed by SEC rule (including, among other considerations, whether the whistleblower reported internally first and assisted in any internal investigation).11 The statute also disqualifies certain categories of whistleblowers, such as those employed by a regulatory or law enforcement agency or convicted of a crime related to the enforcement action. from receiving awards.12
The SEC has been considering proposed rule changes that would, among other things, allow the agency to reduce the size of awards of $30 million or more, as calculated under Section 21F’s current percentage scheme.13 The proposals have proven highly controversial within and outside of the Commission. The agency cancelled a scheduled October 2019 meeting to discuss the proposed amendments, and appears to be reconsidering them in light of the backlash that they have engendered.14
The SEC paid some notably large awards to whistleblowers during fiscal 2019. (Although the SEC is bound by Section 21F’s requirement that the agency not disclose information that could reveal a whistleblower’s identity,15 in some cases, the whistleblowers’ counsel provided information to the press that sets forth a fuller picture of the circumstances surrounding the award than the minimal detail in the OWB report.) These included:
Apart from the numbers, the OWB report provides some revealing qualitative detail about the profile of whistleblowers and those they alleged to have engaged in misconduct, as well as the nature of their tips. A significant majority of whistleblowers who have received awards to date – approximately 69 percent – were current or former insiders of the entity about which they provided information to the SEC.25 Of those recipients, approximately 85 percent first blew the whistle internally to their supervisors, compliance personnel, or through internal reporting mechanisms, or understood that relevant personnel within the company knew of the violations, before they reported the information to the SEC.26 Fiscal 2019 was consistent with this pattern, with seven of the eight award recipients having reported their concerns internally.27 In the enforcement cases that have resulted in awards since the program’s inception, approximately 40 percent of the defendants and respondents were individuals, and roughly 33 percent were registered entities such as broker-dealers and investment advisers. Unregistered entities made up approximately 26 percent of the defendants and respondents.28
The most common categories of allegations made by whistleblowers in fiscal 2019, in approximate percentages, were corporate disclosures and financials (21 percent), offering fraud (13 percent), and manipulation (10 percent), followed by crypto currency (6 percent), insider trading (4 percent), trading and pricing (4 percent), FCPA (4 percent) and unregistered offerings (3 percent).29 With the exception of crypto currency tips, this breakdown has been broadly consistent since the whistleblower program began.30
Geographically, whistleblower tips in fiscal 2019 originated from every U.S. state and the District of Columbia, with California, Pennsylvania, New York, Texas, Florida, New Jersey, Arizona, Ohio and Illinois providing the largest numbers.31 The SEC has also attracted significant numbers of tips from outside the U.S., with individuals in 123 countries having reported to the SEC since the whistleblower program's inception, and the globalization of the program appears to have accelerated. In fiscal 2019 alone, the SEC received tips from whistleblowers in 70 countries, with the highest numbers coming from Canada, Germany, the United Kingdom, China, Australia, India, Russia and South Africa.32
As noted, Dodd-Frank included substantial protections for whistleblowers against retaliation by their employers, and the OWB report devotes significant attention to this issue.33 Since the Supreme Court’s 2018 ruling in Digital Realty Trust, Inc. v. Somers,34 to be eligible for Section 21F’s anti-retaliation provisions, a whistleblower must report misconduct to the Commission directly. Prior to that decision, there had been a split among the circuits as to whether internal whistleblowing within the company was enough to trigger those protections.35 Digital Realty determined that it is not. Hence, the SEC at present will only pursue enforcement action against entities that retaliate where the whistleblower conveyed his or her tip to the SEC.36 Congress, however, appears poised to counteract Digital Realty. Two bills – the Whistleblower Programs Improvement Act,37 which was introduced in the Senate with bi-partisan support in September of this year, and the Whistleblower Protection Reform Act of 2019, which the House of Representatives passed in July with a 410-12 majority38 – would explicitly extend anti-retaliation protection to internal whistleblowers.
To date, the SEC has brought three anti-retaliation enforcement actions under Section 21F(h)(1) (all of which pre-dated the Digital Realty decision), against: an Oklahoma oil and gas company that fired a whistleblower who raised concerns internally about the company’s process for calculating oil and gas reserves because of the “internal strife” he created;39 a Nevada corporation that denied advancement opportunities to and terminated a whistleblower who had previously received consistently positive job evaluations after he raised concerns internally and to the SEC about misleading financial reporting resulting from the company’s use of a cost accounting model;40 and a New York-based investment adviser that carried out a series of retaliatory measures against a supervising trader who reported prohibited principal trades to the SEC, including removing him from day-to-day trading and supervisory responsibilities, subjecting him to investigation, directing him to work offsite, encouraging him to leave the firm with severance, denying access to the firm’s trading and account systems, forcing him to engage in onerous clerical tasks, and falsely accusing him of violating a confidentiality agreement.41 Although the SEC did not file any anti-retaliation enforcement actions in fiscal 2018 or 2019, OWB affirmed in its report that “[r]etaliation protection remains a key tenet of the whistleblower program.”42
The SEC rules also forbid employers and others to discourage individuals from blowing the whistle to the SEC, whether through the use of confidentiality agreements or otherwise, and SEC Enforcement has been especially vigilant against firms that have used such tactics. Exchange Act Rule 21F-17 provides that no person may “take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement … with respect to such communications.”43 Indeed, so seriously does the SEC take unfettered access to whistleblower tips that Rule 21F-17 allows the SEC staff to communicate directly with a whistleblower who initiates contact with the agency without seeking the consent of counsel representing the whistleblower’s employer or principal.44
The SEC has brought 12 enforcement actions against entities under Rule 21F-17, involving a variety of impediments to communication between whistleblowers and the agency.45 In the first of those cases, the SEC brought settled charges against a Texas-based global technology and engineering company for violating the Rule by requiring witnesses in internal investigations interviews to sign confidentiality agreements with language providing that they could face discipline or be fired if they discussed the matters under investigation with outside parties without the prior approval of the company’s legal department.46 Significantly, the SEC charged the company even though there was no indication that any employee was actually prevented from communicating directly with the SEC staff or that the company took any action to enforce the confidentiality agreement or otherwise prevented employees from engaging in the communications that the agreements purported to forbid.
In a case involving the fraudulent offer and sale of oil and gas investments, the SEC charged the company and its president with violating Rule 21F-17(a) by threatening to fire employees who spoke with the SEC.47 The SEC subsequently charged two companies with violating the Rule by adopting severance agreements with language that precluded employees from seeking whistleblower awards.48 In 2017, the agency charged a Seattle-based financial services company under Rule 21F-17 for, among other things, allegedly attempting to determine the identity of a whistleblower and suggesting that an employee suspected of being the whistleblower was not entitled to indemnification for legal fees in the SEC’s investigation.49 Last month (in a charge brought after the close of the fiscal year), the SEC for the first time applied Rule 21F-17 outside the employment context, filing an amended complaint in an offering fraud case against an online auction portal and its CEO. The SEC alleges that the defendants violated the Rule by conditioning the return of investor money in their settlement agreements upon the investors’ agreement not to report potential securities law violations to law enforcement, including the SEC.50
In addition to the enforcement actions, the SEC’s Office of Compliance Inspections and Examinations (“OCIE”), which routinely refers matters to and collaborates with the Division of Enforcement, issued a Risk Alert in 2016 announcing its focus on provisions in compliance manuals, codes of ethics, and employment and severance agreements that may run afoul of Rule 21F-17.51 The OWB report confirms that this issue remains on the SEC’s radar, noting that OWB “continues to work with investigative staff to identify and investigate practices in the use of confidentiality and other kinds of agreements, or engagement in other practices, to report potential wrongdoing to the Commission.”52
The large majority of whistleblowers who have first reported internally suggests that Digital Realty has not prompted employees to go directly to the SEC in the numbers that were feared after the decision. Internal reporting provides a valuable benefit to firms faced with allegations of securities law violations by allowing them to investigate and address possible wrongdoing at an early stage. It also minimizes the information gap that arises where employees report misconduct to the SEC without informing the company of their concerns, leaving the company in the dark as to what the SEC may know (a particular risk given that Rule 21F-17 allows the SEC to contact whistleblowers without the knowledge of company counsel). These considerations are especially significant for registered investment advisers and broker-dealers, who are exposed not only to the risk of SEC investigations, but also to OCIE examinations that can result from whistleblower tips.
The provisions in the SEC rules that incentivize employees to report internally have no doubt been helpful in this regard. That said, as long as Digital Realty remains the law, there will exist at least partially competing incentives to report directly to the SEC under that ruling and internally under the rules. Companies, investment advisers and broker-dealers therefore should ensure that their internal reporting processes are clear and effective enough to inspire the confidence of employees that their concerns will be addressed fairly, expeditiously and confidentially, and where appropriate, reported to the SEC. Concrete steps toward these objectives include anonymous hotlines for employees to report potential wrongdoing, assigning attorneys to review incoming tips to evaluate their significance, policies and procedures ensuring that allegations are investigated promptly and thoroughly, and regular training on and review of the foregoing.
In light of OWB’s continuing focus on retaliation, firms should continue to be especially cautious about taking any action that could be construed as penalizing an employee for reporting to the SEC. Compliance and legal departments should remain alert to this issue through the adoption and regular review of policies and procedures prohibiting retaliation and protecting whistleblower confidentiality, regular training, and monitoring of the firm’s response to possible or actual whistleblowing. Firms should also recognize that retaliation need not be as egregious as that in the SEC’s enforcement actions to date. Any adverse measure that results in a whistleblower being treated differently from other employees will invite scrutiny from the SEC staff.
The language in the OWB report and the numerous cases that the SEC has brought to enforce Rule 21F-17 make plain that SEC Enforcement will continue to be closely focused on this issue. The SEC’s filed actions also make clear that in Enforcement’s view, practices that run afoul of the Rule are not limited to contractual provisions that bar whistleblowers from reporting to the SEC or collecting awards. Rather, any practice that might be expected to dissuade employees or others from communicating with the SEC – such as veiled or implicit threats, attempts to learn the identity of a whistleblower or requests that employees notify the employer before contacting the SEC – risks drawing the attention of SEC Enforcement. Again, specific and unequivocal policies and procedures, training, and ongoing monitoring are essential in this area.
The surge of whistleblower complaints from a broad range of developed and developing countries abroad in recent years poses a significant compliance challenge to firms operating globally, both substantively and logistically. This is especially so for private equity firms, who face the prospect of whistleblowers not only within the firm itself, but also in the portfolio companies in which they invest. Given their increased exposure to whistleblowers outside the U.S., entities must maintain robust compliance programs and internal controls over financial reporting wherever they operate, particularly given that issuer disclosure and FCPA violations remain significant categories of whistleblower tips.
2. See id.
3. OWB Report, supra note 1, at 1, 9, 22.
5. OWB Report, supra note 1, at 1.
6. See Dodd-Frank Act, Pub. L. No. 111-203, 124 Stat. 1376, § 922 (2010), 15 U.S.C. § 78u-6. The statute defines “original information” to include information that is “derived from the independent knowledge or analysis of a whistleblower,” is not known to the SEC “from any other source, unless the whistleblower is the original source of the information,” and is not “exclusively derived” from an allegation in a judicial or administrative proceeding, government report, hearing, audit or investigation, or from the news media, unless the whistleblower is the source of the information. Id. § 78u-6(a)(3). It does not include information learned through a communication covered by the attorney-client privilege or in connection with the whistleblower’s legal representation of a client (subject to limited exceptions). 240 CFR § 21F-4(b)(4). “Original information” also excludes information provided by an entity’s officer, director, trustee or partner who learned it from another person or through the entity’s internal whistleblowing process (again, subject to limited exceptions), compliance or internal audit personnel (same), anyone working for a firm retained to investigate possible illegal conduct, or accountants who obtained the information in the course of an audit, or in a manner that violates a federal or state criminal law. Id.
7. Id. § 78u-6(h)(1).
8. 240 CFR § 21F-4(c)(1) and (2).
9. Id. § 21F-4(c)(3).
10. Id. § 78u-6(b)(1) and (c)(1)(A).
11. Id. § 78u-6(c)(1)(B); see also 240 CFR § 21-F-6(a) and (b) (setting forth additional factors governing an increase or decrease, respectively, of an award).
12. Section 21F does not permit awards to: (i) employees of an “appropriate regulatory agency,” including the SEC, the DOJ, a self-regulatory organization such as the New York Stock Exchange or FINRA, the Public Company Accounting Oversight Board or a law enforcement agency; (ii) anyone convicted of a criminal violation related to the enforcement action for which the whistleblower would otherwise receive an award; (iii) any whistleblower who gained the information through an audit of financial statements; or (iv) a whistleblower who fails to follow the SEC’s requirements as to form of the whistleblower submission. 15 U.S.C. § 21F(c)(2).
15. 15 U.S.C. § 78u-6(h)(2).
17. OWB Report, supra note 1, at 10.
19. OWB Report, supra note 1, at 10.
20. Rule 21F-4(c) provides that the SEC will consider a whistleblower to be an “original source” of information, as is required to qualify for an award, if the whistleblower:
reported original information through an entity’s internal whistleblower, legal, or compliance procedures for reporting allegations of possible violations of law before or at the same time you reported them to the Commission; the entity later provided your information to the Commission, or provided results of an audit or investigation initiated in whole or in part in response to information you reported to the entity; and the information the entity provided to the Commission [was specific, credible and timely enough to cause the SEC staff to initiate or expand an investigation or “significantly contributed” to the success of an action].
CFR § 240.21F-4(c).
21. OWB Report, supra note 1, at 10.
23. OWB Report, supra note 1, at 10-11.
24. Id. at 11.
25. Id. at 18.
27. Id. at 2.
28. Id. at 18.
29. Id. at 23, 31.
30. Id. at 24.
31. Id. at 24, 32.
32. Id. at 24, 33.
33. Section 21F provides that no employer may “discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against a whistleblower in the terms and conditions of employment because of any lawful act done by the whistleblower” in (i) providing information to the SEC, (ii) “initiating, testifying in, or assisting in any investigation or judicial or administrative action” of the SEC based upon that information, (iii) making disclosures that are required or protected under the Sarbanes-Oxley Act of 2002, the Exchange Act, 18 U.S.C. § 1513(e) [relating to the commission or a criminal offense], or any other statute or rule subject to the SEC’s jurisdiction. 15 U.S.C. § 78u-6(h)(A). Aggrieved whistleblowers can bring suit in federal court and, if successful, obtain reinstatement, two times the amount of back pay with interest, and costs and attorney fees. Id. § 78u-6(h)(1) (B) and (C).
34. 138 S. Ct. 767. The SEC is considering rule amendments proposed in June 2018 that would clarify the requirements for Dodd-Frank anti-retaliation protections following Digital Realty, including revising the definition of “whistleblower” in Section 21F to accord with the Supreme Court’s ruling. OWB Report, supra note 1, at 2, 21.
35. Id. at 776.
36. Although Section 806 of the Sarbanes-Oxley Act of 2002 (“SOX”) provides a cause of action to whistleblowers at public companies who are retaliated against for reporting internally, 18 U.S.C. § 1514A(a)(1)(C), the incentives for employees to rely solely on the SOX scheme are significantly less than those under Dodd-Frank, since there is no whistleblower award available under SOX, the potential recovery includes only one time back pay (as opposed to two times back pay under Dodd-Frank) employees are required to exhaust administrative remedies before filing suit in federal court, and Section 806 imposes a far shorter statute of limitations (180 days as opposed to at least three years under Dodd-Frank). See id. § 1514A(b), (c), and (d).
42. OWB Report, supra note 1, at 21.
43. 240 CFR § 21F-17(a).
44. Id. § 21F-17(b).
45. OWB Report, supra note 1, at 20-21 (including 11 actions as of the date of the annual report plus the subsequently-filed Collector’s Coffee case, infra note 50); see also “SEC Enforcement Actions” here (collecting enforcement actions based on actions to impede reporting).
48. Matter of Health Net, Inc., File No. 17396, Exch. Act Rel. No. 78590 (Aug. 16, 2016), available here; Matter of BlueLinx Holdings Inc., No. 3-17371, Exch. Act Rel. No. 78528 (Aug. 10, 2016), available here.
52. OWB Report, supra note 1, at 21.