Two recent Dodd-Frank whistleblower awards suggest that the program is becoming the kind of “game changer” for law enforcement that many had predicted. The program, which took effect in August 2011, mandates the payment of bounties to persons who voluntarily provide information leading to a successful securities enforcement action in which more than $1 million is recovered. Informants are entitled to receive between 10 and 30 percent of the amounts recovered, with the precise amount to be determined by the SEC.

In September 2014, the SEC awarded $30 million to a non-U.S. resident who enabled authorities to stop a fraudulent scheme that would otherwise have remained undiscovered. The award was the largest yet paid under the program and dramatically illustrated the magnitude of financial incentives available to whistleblowers.

A few weeks earlier, the SEC awarded $300,000 to a compliance/internal audit professional for providing information that had been in the course of his or her duties. Although the amount was small in comparison to the $30 million award, it was no less significant, providing a sharp reminder of the risks of what can happen when a company fails to respond promptly to internal reports of potential wrongdoing.

$30 million award
According to the SEC’s Enforcement Director, the $30 million award was paid to an individual who had provided the SEC with information concerning an “ongoing fraud that would have been very difficult to detect.” Only 14 awards have been made to date, the next largest being a $14 million award in 2013.

The award might well have been much larger had the whistleblower acted more promptly. According to the SEC, the award was reduced from the maximum level because the whistleblower had failed to come forward earlier, purportedly because of uncertainty as to whether the SEC would take action in the matter. The SEC dismissed this rationale out of hand, calling the delay “unreasonable” in light of the fact that investors had “continued to suffer significant monetary injury that otherwise might have been avoided.” It is unclear how long the whistleblower had delayed or how much the award had been reduced as a result. 

Although little is known about the specific facts of the matter (since the SEC routinely withholds the names of both the whistleblower and the company involved), the SEC disclosed that the whistleblower resides outside the United States.  Notably, about 10 percent of the tips received under the program originate from sources outside the United States. More than 700 reports have been received from non-U.S. sources since the program came into effect in 2011, with the largest number of reports from the United Kingdom, Canada, China, Russia, India, Ireland, Australia, and Germany.

Compliance/Internal Audit Professional
In August 2014, the SEC made its first Dodd-Frank whistleblower award to a compliance/internal audit professional.

Ordinarily, an award will not be given under the program for information obtained by a person acting in a compliance or internal audit function. However, this rule does not apply if 120 days have elapsed since the information was provided to certain specified persons, including the company’s audit committee, its chief legal officer, or its chief compliance officer. As noted by the Chief of the SEC’s Whistleblower Office, such persons “often are privy to the very kinds of specific, timely, and credible information that can prevent an imminent fraud or stop an ongoing one. These individuals may be eligible for an SEC whistleblower award if their companies fail to take appropriate, timely action on information they first reported internally.”

Under the whistleblower program, compliance and internal audit personnel may also qualify for awards without regard to the 120-day waiting period where there is a “reasonable basis to believe” that disclosure is necessary to prevent substantial injury to the company or its investors, or that the company is engaged in conduct that will impede an investigation of the misconduct.  

The award, which was approximately $300,000, was 20 percent of the amounts recovered through the related enforcement action—less than the maximum of 30 percent permitted under the program. No explanation was provided for this determination. Regardless of size, the award highlights the need for companies to take prompt action in response to reports made through its internal reporting system or otherwise, as well as to other indications of wrongdoing. 

What Can Companies Do?
Companies whose conduct is subject to the federal securities laws may face law enforcement inquiries and other action resulting from a Dodd-Frank whistleblower’s tip. This can happen whether the tip is accurate or, alternatively, results from an unfortunate misunderstanding.

Although a company is unlikely to foresee a specific whistleblower tip, companies can take steps in advance to best position themselves to respond to such events.

1. Have a plan already in place to respond to indications of wrongdoing. A company cannot plan in advance for any particular problem to arise, but some advance planning can save critical time in the event the company learns information about a potential legal violation. For example, it is a virtual certainty that emails will need to be reviewed to evaluate the matter, and someone should have a solid grasp of how the company stores electronic data, how the email of a particular custodian can be quickly collected, and how long data is retained on the company’s systems. In addition, many circumstances may benefit from the assistance of outside counsel, and identifying potential counsel in advance of a crisis may save valuable time.
2. Train company personnel to be aware of and to comply with the legal and regulatory restrictions that may apply to their actions on behalf of the company. Revisit and reaffirm codes of conduct and other key policies.
3. Be sure that personnel know of—and know how to use—the company’s internal reporting system. A whistleblower is not required to report a matter internally before taking it to the SEC, but some personnel may prefer to try to resolve an issue internally, by making a report on the company hotline or speaking with a supervisor or other senior officer.
4. Be sure that supervisory personnel are trained to recognize and respond appropriately to employee concerns of potential wrongdoing. Handling a potential whistleblower’s concerns properly at the outset may facilitate a resolution that does not involve federal authorities. 
5. Be aware that almost anyone can be a Dodd-Frank whistleblower. The recent $30 million award highlights the fact that persons outside the United States can qualify—as can, for example, competitors, consultants, joint venture partners, shareholders, estranged spouses, and many others.
6. Stay focused on the 120-day clock. Once 120 days have elapsed after potential wrongdoing is reported internally, a range of persons who would otherwise be ineligible for an award suddenly become eligible. This applies not only to compliance and internal audit personnel, but also a company’s senior officers and directors.
7. Evaluate early on whether to self-report and consider that a whistleblower may report first.  Most companies are not required to advise the authorities of potential legal violations, but there may be advantages in doing so under certain circumstances. Bear in mind, however, that authorities only give credit for information that they do not already know—so if a whistleblower reports wrongdoing to them first, that benefit is lost to the company.

Given the length of time ordinarily required for the SEC or other law enforcement agencies to bring a law enforcement investigation to closure, these cases may be only the first of many Dodd-Frank whistleblower awards in the pipeline.