News & Insights

Analysis of the Whistleblower Regulations Adopted by the SEC and Their Impact on Corporate Compliance Programs

SEC Enforcement Update

As part of the Dodd-Frank Wall Street Reform and Consumer Protection Act, which was signed into law on July 21, 2010, Congress adopted a whistleblower program that created increased incentives for individuals to report alleged violations of the securities laws, including the Foreign Corrupt Practices Act. The Dodd-Frank Act left significant questions regarding the scope of the whistleblower program for the rulemaking process of the Securities and Exchange Commission (SEC), including questions regarding the eligibility for an award, the type of information warranting an award, and the types of actions covered by the whistleblower provisions. In promulgating its rules, the SEC was called upon to balance, among other things, its interests in increased enforcement and in ensuring employees' continued use of internal compliance programs.

On November 3, 2010, the SEC adopted proposed rules implementing the whistleblower program. Following substantial public comments, and several statements by the SEC Staff, the Commission adopted final rules implementing the program on May 25, 2011, by a three to two vote.

This update provides details about the final rules adopted by the SEC, and provides practical considerations for companies subject to the new rules.

Statutory Background

The whistleblower provisions of the Dodd-Frank Act were codified in new Section 21F of the Securities Exchange Act of 1934 (15 U.S.C. 78a, et seq.). The statutory provisions provide for awards to individuals of 10 to 30 percent of monetary sanctions collected in enforcement actions resulting in monetary sanctions greater than $1,000,000. Only whistleblowers who provide “original information” are entitled to awards under the statute. § 21F(a)(3). Similar provisions were included for whistleblowers who report violations of the Commodity Exchange Act to the United States Commodity Futures Trading Commission. 

The whistleblower program is intended "to motivate those with inside knowledge to come forward and assist the Government to identify and prosecute persons who have violated the securities laws and recover money for victims of financial fraud." S. Rep. No. 176, 111th Cong., 2d Sess. 110-111 (2010). In a May 25, 2011, speech announcing the final rules, SEC Chairman Mary Schapiro recognized that "it is critical to be able to leverage the resources of people who may have first-hand information about potential violations" in order to protect "investors whose savings or retirement funds may hinge on [the Commission’s] ability to stop an ongoing fraud or obtain hidden evidence." Open Meeting: Chairman Schapiro Discusses the Whistleblower Program (2010) ("Schapiro Discussion on Final Rules"), available at

Policies Behind Final Rules

During the rulemaking process, the SEC announced several guiding principles:

  • To adopt "plain English" rules;
  • "[N]ot to discourage whistleblowers who work for companies that have robust compliance programs to first report the violation to appropriate company personnel, while at the same time preserving the whistleblower’s status as an original source of the information and eligibility for an award";
  • To exclude personnel "with established professional obligations" to report compliance violations;
  • To "maximize the submission of high-quality tips and to enhance the utility of the information."

SEC Release No. 34-63237, Proposed Rules for Implementing the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 ("Proposed Rules Announcement"), at pp. 2 5. 

Following the issuance of the proposed rules, the SEC received over 1,000 comments. SEC Release No. 34-64545, Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 ("Final Rules Announcement") at p. 4. Many of the comments related the eligibility of compliance and legal personnel for whistleblower bounties, the threshold for awards, the process for submitting information, and the protection for whistleblowers. Id. at pp. 6-7.

Moreover, public commenters emphasized the concern that the whistleblower program would be a "significant incentive… for would-be whistleblowers to circumvent well-established compliance processes… in favor of the chance to secure a significant monetary reward." Letter from James Moore, Executive Vice President, General Counsel and Corporate Compliance Officer, Huntsman Corporation to the SEC (Dec. 16, 2010) available at; see also Final Rules Announcement at p. 5.

In her speech announcing the rules, Chairman Schapiro summarized some of the key differences between the proposed rules and the final rules as follows:

  • The final rules expanded the ability of lawyers, auditors, and internal compliance personnel to act as whistleblowers;
  • The reporting procedures have been streamlined so that whistleblowers only need to fill out a single form (previously they had to fill out two);
  • Whistleblowers will be protected from retaliation even if their information relates only to a possible violation of the rules, regardless of whether it leads to a successful prosecution; and
  • Incentives for internal reporting have been increased:
    • The period of time in which a whistleblower can wait before approaching the SEC has been lengthened to 120 days;
    • The Commission will consider whether the whistleblower participated in or interfered with internal compliance processes in determining the amount of an award;
    • The Commission will give credit to a whistleblower whose company passes along information to the Commission even if the whistleblower does not. This permits individuals to received monetary awards even if they report through internal procedures;
  • In deciding the amount of awards, the Commission will consider the timeliness and quality of the whistleblower’s assistance.

See Schapiro Discussion on Final Rules.

The Commission stopped short of mandating that a potential whistleblower first participate in the employer’s compliance program in order to be eligible for an award. "Although many commenters argued that we should require whistleblowers to report possible violations internally either before or contemporaneously with reporting to us, we are not persuaded that such a requirement would achieve better overall enforcement of the federal securities laws" because, among other reasons, "while internal compliance programs are valuable, they are not substitutes for strong law enforcement." Final Rules Announcement at pp. 103-104. Moreover, "it is the whistleblower who is in the best position to know" whether to "pursue the route of internal compliance" or to report directly to the SEC. Schapiro Discussion on Final Rules.

The rules were adopted following a three to two vote that proceeded along party lines. The adoption was opposed by Commissioners Kathleen Casey and Troy Parades. Arielle Bikard, SEC Approves Whistleblower Rules; Some Concessions Made, Compliance Week, May 25, 2011 available at According to Casey, the rule “significantly underestimates the negative impact on the internal compliance programs” and, at the same time, “significantly overestimates our capacity to effectively triage and manage all the whistleblower complaints.” Id.

Final Rules

The following is a summary of the key rules adopted by the Commission.

1. Voluntary Submission of Information

Under the Dodd-Frank Act, only whistleblowers who provide information "voluntarily" are entitled to awards. § 21F(b)(1).

The SEC adopted Rule 21F-4(a)(1), which provides that information is not voluntary unless provided before "a request, inquiry, or demand… is directed to you or anyone representing you" by the Commission, the Public Company Accounting Oversight Board or any self-regulatory organization, Congress, or "any other authority of the federal government, or a state Attorney General or securities regulatory authority." Information will not be considered voluntary unless it is submitted "prior to receiving a request, inquiry, or demand" from a governmental agency of self-regulating board. Rule 21F-4(a)(2).

Unlike the proposed rule, the final rule treats a submission as voluntary even if the individual’s employer received an investigative request from the government or a self-regulatory board. The Commission explained that the "proposed rule might have the unintended result of deterring high-quality submissions… based on an overly-broad construction of the concept of voluntariness." Final Rules Announcement at p. 35.

Moreover, the Commission rejected a call for a rule that would render involuntary any information submitted by a whistleblower who was previously contacted for information during a company's internal investigation. The Commission concluded that, "simply being contacted [during an internal investigation], may not, without more, achieve the statutory purpose of getting high-quality, original information about securities violations directly into the hands of Commission staff." Final Rules Announcement at p. 34.

2. Original Information

Under the Dodd-Frank Act, only whistleblowers who provide "original information" are entitled to awards. The act itself defined this as information "derived from the independent knowledge or analysis of a whistleblower," "not known to the Commission from any other source," and not derived from "an allegation made in a judicial or administrative hearing, in a governmental report, hearing, audit, or investigation, or from the news media." § 21F(a)(3)(A)-(C). 

During the rulemaking process, the Commission emphasized that "original information must be based upon the whistleblower's independent knowledge or independent analysis, not already known to the Commission and not derived exclusively from certain public sources." SEC Proposes New Whistleblower Program Under Dodd-Frank (Nov. 3, 2010) available at

This understanding was incorporated into the SEC’s rules, which provide that original information must be:

  • Derived from the individual’s “independent knowledge or independent analysis”;
  • Not already known to the Commission from another source, unless the individual is the original source of the information; and
  • Not derived from an allegation made in a judicial, hearing, governmental investigation, or from the news, unless the proffering party is the source of the information.

Rule 21F-4(b)(1)(i)-(iii).

The Commission further clarified that "independent knowledge" must be "factual information in your possession that is not derived from publicly available sources." Rule 21F-4(b)(2)). The Commission did not limit the "independent knowledge" requirement in this rule to "direct, first-hand knowledge"—the knowledge is considered independent as long as it does not stem from publicly available sources. Final Rules Announcement at p. 47.

Moreover, the Rules clarify that “[i]ndependent analysis means your own analysis… from your examination and evaluation of information that may be publicly available, but which reveals information that is not generally known or available to the public.” Rule 21F-4(b)(3).

3. Compliance and Legal Personnel as Whistleblowers

The Dodd-Frank Act provided that employees of regulatory or governmental agencies such as the Department of Justice or Public Company Accounting Oversight Board are not entitled to whistleblower awards. § 21F(c)(2)(A). Moreover, by statute, whistleblowers who obtain the information during the course of an audit of the target company are not eligible. § 21F(c)(2)(C).

Questions were raised during the rulemaking process about whether certain compliance officers would qualify as whistleblowers under the new program. See Letter from Arent Fox LLP to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission (Oct. 25, 2010), available at (arguing that the SEC should not accept information from "representatives with fiduciary responsibilities… [including] compliance" officers). The Commission was sensitive to this concern and the Commission’s Chairman emphasized during a speech that those with "certain legal obligations, such as lawyers, auditors and internal compliance personnel," would not be eligible for awards. Open Meeting: Chairman Schapiro Discusses Proposed Whistleblower Program (2010), available at

As a result, "[t]he exclusions generally apply to narrow categories of individuals whose knowledge does not, in our view, constitute 'independent knowledge or analysis of a whistleblower.'" Final Rules Announcement at p. 53. The new rules provide that the Commission will not consider information to be derived from independent knowledge where it was obtained through a communication subject to the attorney-client privilege or as a result of legal representation of a client. Rule 21F-4(b)(4)(i)-(ii). Moreover, Rule 21F-4(b)(4)(iii)(A)-(D) excludes information obtained because the individual was:

  • A high-level company official who was informed of misconduct by someone raising allegations or through the entity’s internal compliance procedures;
  • An employee or contractor who has principal compliance or audit responsibilities;
  • A person employed “to conduct an inquiry or investigation into possible violations”; or
  • An employee of a public accounting firm who learned the information during the course of an engagement.

By prohibiting those who obtain their information through their role in managing a company's compliance and legal functions from acting as whistleblowers, the SEC sought to address "concern[] about creating incentives for company personnel to seek a personal financial benefit by 'front running' internal investigations and similar processes that are important components of effective company compliance programs." Final Rules Announcement at pp. 64-65.

On the other hand, the Commission worried about situations in which the "entity did not disclose the information to the Commission within a reasonable time or proceeded in bad faith." Final Rules Announcement at p. 65. Accordingly, the final rules allow whistleblower awards for such legal, compliance, and auditing personnel when:

  • The individual has "a reasonable basis to believe that disclosure of the information to the Commission is necessary to prevent the relevant entity from engaging in conduct that is likely to cause substantial injury to the financial interest or property of the entity or investors";
  • The individual has "a reasonable basis to believe that the relevant entity is engaging in conduct that will impede an investigation of the misconduct"; or
  • At least 120 days elapsed since the individual reported the information to the entity’s compliance personnel, or the compliance personnel were already aware of the information.

Rule 21F-4(b)(4)(v)(A)-(C).

4. Time Limit for Reporting Perceived Violations

As noted, one of the Commission's goals in crafting the whistleblower rules was to encourage potential whistleblowers to utilize corporate compliance programs. One way the Commission sought to accomplish this goal was to extend the amount of time a whistleblower has to submit information to the Commission.

The final version of Rule 21F-4(b)(7) provides that "[i]f you provide information to… an entity's internal whistleblower, legal, or compliance… and you, within 120 days, submit the same information to the Commission… the Commission will consider that you provided information as of the date of your original disclosure." A similar time period is provided in Rule 21F-4(b)(4)(vi), which permits otherwise prohibited classes of individuals from acting as whistleblowers where "120 days have elapsed since the individual reported the information to the entity or, in cases where the entity’s audit committee, chief legal officer, chief compliance officer."

The Commission indicated, however, that the 120-day rule is not “intend[ed] to suggest that an internal investigation should… be completed before an entity elects to self-report violations, or that 120 days is intended as an implicit ‘deadline’” for a company to complete such an investigation. Final Rules Announcement at p. 77. In the past, companies have self-reported violations at an early stage (i.e., before an investigation has been completed) and Staff has, in certain circumstances, agreed to wait until the investigation has been completed before deciding how it will conduct its own investigation. Ibid. The 120-day rule “is not intended to alter this practice.” Ibid.

5. Amount of Award

By the terms of the Dodd-Frank Act, a whistleblower is entitled to "not less than 10 percent" and "not more than 30 percent" of the "monetary sanctions" imposed in any related action. § 21F(b)(1)(A)-(B). Congress defined monetary sanctions to include "any monies, including penalties, disgorgement, and interest." § 21F(a)(4)(A). The rules mirror the statutory language in this respect. See Rule 21F-4(e). But Rule 21F-4(d) makes clear that the whistleblower will be entitled to an award if either one or several actions result in sanctions totaling over $1,000,000.

The Dodd-Frank Act afforded the SEC discretion over the amount of any award within the 10 to 30 percent range. § 21F(c)(1)(A).

Another way in which the Commission sought to increase participation with internal compliance programs was through consideration of participation in these programs in calculating whistleblower awards. "[T]hese provisions are designed to give whistleblowers appropriate incentives to report securities violations voluntarily to their corporate compliance programs and not to impair the effectiveness of these important programs." Final Rules Announcement at pp. 125-126.

Accordingly, the criteria set forth in Rule 21F-6 for determining the amount of the award include:

  • The significance of the information provided;
  • The assistance provided by the whistleblower;
  • Law enforcement interest; and
  • Participation in internal compliance systems.

Interference with compliance systems is a factor that can be used to reduce an award. Rule 21F-6(b)(3).

Under the new rules, claims for awards will be processed "[o]nce the time for filing any appeals of the Commission’s judicial or administrative action has expired, or where an appeal has been filed, after all appeals in the action have been concluded." Rule 21F-10(d). The award will be paid only "to the extent that a monetary sanction is collected in the Commission action or in a related action." Rule 21F-14(b).

6. Information Leading to Successful Enforcement

The statutory provisions provide for awards only when the whistleblower's original information leads to successful enforcement. Under the proposed rule, information would be considered as having led to successful enforcement if: (i) it caused the staff to commence an investigation into the relevant conduct and the information "significantly contributed" to the investigation’s success; or (ii) for investigations that were already under way, the information would not have otherwise been obtained and was essential to the success of the action. Final Rules Announcement at p. 93. Commenters felt these "standards were too high, ambiguous, or both." Ibid.

In lieu of these standards, the final rules authorize an award where the whistleblower provides "original information that was sufficiently specific, credible, and timely to cause the staff to commence an examination" or information regarding an existing investigation where "your submission significantly contributed to the success of the action." Rule 21F-4(c)(1)-(2).

In addition, in keeping with the Commission’s goals of encouraging internal compliance programs, the final rules deem information as leading to the success of an action even where the individual reports the information to his or company’s compliance program, and thereafter the entity reports that information leading to a successful enforcement action. See Rule 21F-4(c)(3). This subsection “incentivizes whistleblowers to report internally in appropriate circumstances by providing them a meaningful opportunity to increase their probability of receiving an award.” Final Rules Announcement at p. 102.

7. Related Actions

It is worth emphasizing that the type of "related actions" that may entitle a whistleblower to an award include both civil and criminal actions, and both judicial and administrative proceedings. Rule 21F-3(b)(1)(i)-(iv) specifies that a related action may be brought by the Attorney General of the United States, an appropriate regulatory agency, a self-regulatory organization, or a state attorney general in a criminal case.

8. Culpable Whistleblowers

To address concerns that culpable individuals would profit from their misconduct by becoming whistleblowers, the Commission adopted rules to prevent amnesty or undue rewards for individuals involved in the alleged violations.

Under Rule 21F-8(c)(3), an individual cannot receive an award if he or she is "convicted of a criminal violation that is related to the Commission action." Rule 21F-15 further notes that the rules "do not provide amnesty to individuals who provide information to the Commission." The Commission may still bring "an action against you based upon your own conduct." Ibid. And under Rule 21F-16, the SEC will reduce awards to the extent the whistleblower was liable for violations, or where the whistleblower’s conduct was a substantial component of the reported company's liability.

9. Foreign Officials as Whistleblowers

Of particular note for potential reporting of FCPA violations and companies operating internationally, the rules preclude foreign officials from receiving whistleblower awards. Under Rule 21F-8(c)(2), an individual is not eligible for an award if he is "a member, officer, or employee of a foreign government, any political subdivision, department, agency, or instrumentality of a foreign government, or any other foreign financial regulatory authority."

10. Confidentiality and Anti-Retaliation Provisions

Under the Dodd-Frank Act, the SEC may not disclose "any information, including information provided by a whistleblower to the Commission, which could reasonably be expected to reveal the identity of a whistleblower." § 21F(h)(2)(A). Congress also added anti-retaliation measures, including a private cause of action for alleged retaliation for disclosure of information. See § 21F(h)(1)(A)-(B). Under the statute, this cause of action carries potential relief of reinstatement, double back pay, litigation costs, and attorneys' fees. See § 21F(h)(1)(C)(i)-(iii).

The final rules largely reiterate the protections articulated in the statute. See Rule 21F-7. The rules seek to bolster the protection of the act by defining whistleblowers to include individuals who have "a reasonable belief that the information [they] are providing relates to a possible securities law violation" regardless of whether the individual "satisf[ies] the requirements, procedures and conditions to qualify for an award." Rule 21F-2(b)(i)-(iii) (emphasis added).

The first judicial opinion interpreting the Dodd-Frank Act's whistleblower provisions concerned the act's anti-retaliation provisions. See Egan v. Tradingscreen, Inc., 10-CV-08202-LBS, 2011 U.S. Dist. LEXIS 47713 (S.D.N.Y. May 4, 2011). In allowing a purported whistleblower to amend his action under the anti-retaliation provisions, the court held that the whistleblower did not have to personally provide information to the SEC in order to receive protection from retaliation as a whistleblower under the act. Rather, to warrant protection, it would be sufficient if the plaintiff could show that the information he provided to a law firm retained by the board of directors to perform an internal investigation had been communicated to the Commission.

The principle set forth in the Egan case is ostensibly reflected in Rule 21F-4(c)(3), which permits individuals who report information to an entity to quality as whistleblowers where "the entity later provided [the] information to the Commission, or provided results of an audit or investigation initiated in whole or in part in response to information you reported to the entity."

11. Mechanics of Reporting

Finally, the SEC adopted rules regarding the mechanics for reporting perceived violations. Rule 21F-9(a) requires a potential whistleblower to submit information regarding the alleged violation to the Commission either online at or by completing a Tip, Complaint or Referral ("TCR") form.

Whistleblowers wishing to submit information anonymously must submit a completed TCR to their attorney. See Rule 21F-9(c). The attorney is then required to submit the information to the Commission on the whistleblower's behalf. Id. An attorney making such a submissions is required to certify that he has verified the whistleblower’s identity, has reviewed the completed TCR and believes the information contained therein to be true, correct, and complete, has obtained consent to submit the TCR in certain circumstances, and will do so within seven days if requested by the Commission. Id.

Practical Considerations

In implementing the new rules, the Commission sought to assuage concerns that the new whistleblower provisions will create a race to the bank, whereby employees ignore company policies and go directly to the SEC in the hopes of obtaining a large award. As discussed above, the final rules have a number of provisions aimed at addressing these concerns. However, it remains to be seen whether the rules effectively address these concerns.

For now, companies should consider taking the following steps:

  • Continue to implement and enforce policies and procedures for preventing securities fraud and FCPA violations in the first instance;
  • Set forth well-defined procedures for reporting perceived problems internally and ensure those procedures are effectively communicated to employees;
  • Consider crafting internal incentives to encourage employees and would-be whistleblowers to follow internal procedures for reporting violations;
  • Thoroughly train those individuals responsible for investigating reported violations on how to resolve issues promptly and effectively; and
  • Train management about the potential consequences of any retaliation for reporting potential violations.
    Consider when to self-report the existence of an investigation, or the results of an investigation, into alleged securities and FCPA violations.

Sidley Austin LLP’s SEC Enforcement and White Collar Practices

Our national SEC Enforcement practice includes seasoned practitioners in all of our domestic offices, including a former Associate Director of the SEC’s Enforcement Division, a former Co-Head of Enforcement for the SEC’s New York regional office and a former Senior Trial Counsel from the SEC’s Los Angeles regional office. We mount effective responses to any kind of securities regulatory inquiry. Our adversarial skills cover the full spectrum of securities enforcement matters, from defending investigations to litigating unsettled cases in federal court or before administrative and regulatory tribunals.

Sidley’s White Collar group is recognized for its significant experience in all aspects of corporate criminal defense and enforcement-related litigation — from internal investigations, to representing clients in grand jury investigations, to managing parallel criminal and civil proceedings, to trial, to extraditions and counseling on foreign criminal investigations and to advising on voluntary disclosure and compliance issues.

The FCPA Practice of Sidley Austin LLP

Our FCPA practice, which involves over 80 of our attorneys, includes creating and implementing compliance programs for clients, counseling clients on compliance issues that arise from international sales and marketing activities, conducting internal investigations and defending clients in the course of SEC and DOJ proceedings. Our clients in this area include Fortune 100 and 500 companies in the pharmaceutical, healthcare, defense, aerospace, energy, transportation, advertising, telecommunications, insurance, food products and manufacturing industries, leading investment banks and other financial institutions.

To receive copies of Sidley updates via email, please click here.

This Sidley update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this without seeking advice from professional advisers.

Attorney Advertising - For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000. Prior results do not guarantee a similar outcome.