SEC Proposes Rules for New Whistleblower Program

The sweeping reforms of the Dodd‑Frank Wall Street Reform and Consumer Protection Act include the creation of a whistleblower program that will affect every public company. On November 3, 2010, the SEC issued proposed rules for implementing this program,[1] inviting the public to submit comments by December 17.[2] Because the proposed rules provide insights into the SEC's plans for administering its whistleblower program, companies should be aware of their key provisions and should consider submitting comments.

This Commentary is intended to highlight provisions of the proposed rules that may have the most significant impacts on public companies and on which companies may wish to submit comments to the SEC.


Section 922 of Dodd-Frank adds Section 21F to the Securities Exchange Act of 1934, creating financial incentives designed to "motivate those with inside knowledge to come forward and assist the Government" in prosecuting securities law violations.[3] A person who "voluntarily" provides the SEC with "original information" that leads to a successful enforcement action by the Commission will be entitled to collect between 10 percent and 30 percent of any monetary sanctions imposed that exceed $1 million. Section 21F also prohibits an employer from discharging or retaliating against a whistleblower, and it provides remedies including reinstatement, double back pay, and attorneys' fees in cases of proven retaliation.

These provisions present challenges to public companies that have spent considerable effort and resources on strengthening their internal compliance and reporting systems in response to the Sarbanes‑Oxley Act. With the SEC imposing ever-larger civil penalties in enforcement actions, the whistleblower provisions provide powerful incentives to employees to bypass or completely ignore internal compliance procedures. The SEC's commentary to the proposed rules acknowledges the tension between robust internal compliance programs, which provide companies an opportunity to investigate, correct, and self-report wrongdoing, and a statutory scheme encouraging employees to bypass these programs. The rules themselves, however, do not resolve that tension.

"Whistleblower" Definition

Dodd-Frank defines "whistleblower" as a person who provides information to the SEC "relating to a violation of the securities laws." The proposed rules expand this definition to encompass persons who provide information "relating to a potential violation of the securities laws" (emphasis added). In its comments to the proposed rules, the SEC acknowledges expanding the statutory definition but rationalizes that this is the only way to protect the privacy of informants (by not requiring the SEC to determine at the outset whether actual violations have occurred) and to fortify the anti-retaliation provisions of the statute (so that companies are not tempted to retaliate against whistleblowers whose tips do not result in proven violations). This expansion of the statutory language is debatable, and it is sure to engender comment; in fact, the SEC has specifically requested comment on whether it should promulgate rules to limit or narrow the anti-retaliation protections for frivolous or bad-faith whistleblowers. For now, however, the proposed rules underscore the SEC's intention to extend broad protections to a wide category of persons.

Requirement to Submit Information under Penalty of Perjury

On the other hand, the proposed rules do address one of the greatest concerns raised by Dodd-Frank—that it will encourage the proliferation of false claims of corporate wrongdoing—by a requirement that whistleblowers submit their information to the SEC in a written statement signed under penalty of perjury. Where a whistleblower wishes to remain anonymous, he or she must be represented by an attorney, who must sign a separate certification that he or she has verified the whistleblower's identity, reviewed the whistleblower's statement for completeness and accuracy, and will retain the whistleblower's original signed statement.

Limitations on Information Reportable by Whistleblowers

The statute provides that whistleblowers may be rewarded only for "voluntarily" providing "original information" to the SEC. The proposed rules prohibit certain activities that would interfere with internal compliance processes by restrictively defining what reporting is "voluntary" and what information is "original." Thus, reporting is not considered "voluntary" if it is provided by a person who is under a legal or contractual duty to report it to the SEC or certain other authorities. To be considered "original," information must be derived from independent knowledge or analysis, and it cannot be derived from, inter alia, publicly available information, attorney-client privileged communications, or other compliance-related functions.

These provisions provide some protections for compliance-related activities and seek to prevent individuals who learn information in the course of internal compliance from "front-running" an internal investigation by reporting information learned therein to the SEC ahead of the company's self-reporting. The limitations related to information learned in the course of compliance activities do not apply, however, where the company does not disclose the information to the SEC "within a reasonable time" or "proceed[s] in bad faith." Unfortunately, these terms are undefined, which will give rise to uncertainty and litigation.

Unresolved Tensions with Internal Compliance Programs

The above limitations do not fully address the potential of the whistleblower provisions to undermine internal compliance efforts. The only nod to this problem in the proposed rules is a provision that would permit an employee to retain her status as a whistleblower even if she initially reports suspected misconduct internally, as long as she also reports the same information to the SEC within 90 days of the internal report. The rules also suggest that the SEC will "consider" higher percentage awards to persons who first report problems internally.

These provisions seem ineffectual, however, because 90 days may well be an insufficient amount of time for a company to resolve an internal investigation of the reported conduct, and because the rules do little to encourage, much less require, employees to utilize internal reporting systems that companies have established in good faith. Whistleblowers will still be motivated to go directly to the SEC rather than report internally, because an effective internal response might resolve the problem in a way that persuades the SEC not to pursue an enforcement action: a good result for both the company and the SEC, even though a disappointment to the whistleblower.

The predictable—and regrettable—result of encouraging external reporting is that companies will lose the opportunity to uncover, resolve, and self-report misconduct. They will also lose the potential credit for self-reporting misconduct that they would otherwise receive under existing SEC and Department of Justice policies.[4]

Another difficult feature of the proposed rules is explained in a footnote to the SEC's release: an employee can qualify as a whistleblower even if she reports to the SEC only after she has been questioned by the company's internal investigators, as long as her information was "original" to her. In other words, an employee who initially decides to sit on information about misconduct can still receive a whistleblower's bounty by going to the SEC after learning that her employer had begun an internal investigation, as long as she reports her information before the company self-reports. The SEC's rationale for this feature of the proposed rules is that "because there is no assurance that an employer will ultimately disclose" the potential violations in issue, the employee should still be rewarded for coming forward.

The SEC's comments to the proposed rules acknowledge the tension between whistleblower bounties and effective internal compliance procedures, but they justify a proposed approach favoring external reporting by noting that "while many employers have compliance processes that are well-documented, thorough and robust … others lack such established procedures and protections." The SEC also states that it "expects" that "in appropriate cases, consistent with the public interest and [its] obligation to protect the confidentiality of a whistleblower," it will contact the company, describe the allegations it has received, and give the company an opportunity to investigate and report back before it launches its own investigation. This "expectation" is hardly reassuring, however, given that it is abundantly hedged and is not reflected in the rules themselves.

It seems unnecessary and counterproductive to marginalize the compliance efforts of all public companies because some companies have poor compliance programs. It would seem to be a better approach to require whistleblowers in companies whose internal processes are "well-documented" and "robust" to report internally first. Under the revised rules, these individuals could retain their status as providers of original information while permitting the company to investigate and self-report as necessary.


Among its 45 requests for comments, the SEC noted that it is seeking "recommendations on structures, processes, and incentives that we should consider implementing in order to strike the right balance between the Commission's need for a strong and effective whistleblower awards program, and the importance of preserving robust corporate structures for self-policing and self-reporting." Companies should consider submitting comments to the SEC regarding the value of the strong internal reporting and compliance programs that have been created in recent years, and the potential adverse impacts that the proposed rules could have on those programs. As the SEC has long recognized, its enforcement efforts are enhanced, and not diminished, by robust internal compliance efforts. While the proposed whistleblower rules contain some commendable provisions that will help companies recognize, remedy, and report misconduct, more could be done in this regard, while remaining faithful to Congress's intent in enacting the whistleblower provisions.

[1] SEC Press Release, SEC Proposes New Whistleblower Program Under Dodd-Frank Act, November 3, 2010, available at

[2] General instructions for submission of public comments are available on the SEC web site at

[3] S. Rep. No. 111-176 at 110 (2010).

[4] Securities and Exchange Commission, Division of Enforcement, Enforcement Manual, § 6.1.2 (2010); United States Attorney Manual, Principles of Federal Prosecution of Business Organizations, § 9-28.800 (2008).