Responding to an SEC Investigation Triggered by a Whistleblower.

Companies that reasonably anticipate an SEC enforcement investigation must preserve relevant electronic and physical evidence. They must also implement governance measures and controls to protect the company’s interests and ensure compliance. These measures should include:

• Establish clear authority for handling the investigation.
• Clearly delineate roles for decision-making, reporting, and execution.
• Define the scope of the investigation and identify responsible parties.
• Designate individuals responsible for implementing remediation measures.
• Establish anti-retaliation controls, including the requirement for all employment actions involving a whistleblower to undergo documented review prior to implementation.
• Establish a secure and internal communication channel that protects privileged information.
• Establish a team to manage communications with the SEC and other federal authorities.

2. Conduct an Internal Investigation to Gather Relevant Facts

The same measures required to guard against retaliation also necessitate gathering relevant facts about potential whistleblower allegations. This includes identifying any potential issues, including criminal conduct that may warrant a referral to the Department of Justice.

3. Develop a Response Strategy and Coordinate with Federal Authorities

With relevant information in hand, the investigation team can develop a response strategy and coordinate with the SEC and other federal authorities as necessary.

The same issues that commonly generate tips will drive the SEC’s inquiry:

• Market manipulation
• Offering fraud
• Financial reporting fraud
• Insider trading
• Foreign Corrupt Practices Act violations

When coordinating with federal authorities, companies must avoid any actions that could jeopardize future litigation.

Whistleblowers’ awards can be delayed for years.

Whistleblowers receive awards after enforcement is concluded; therefore, a whistleblower-triggered investigation is driven by the tip itself rather than the whistleblower’s continued involvement.

There are no SEC rules governing the duration of an enforcement investigation.

How do we preserve evidence and investigate without losing privilege?

1. Identify Relevant Participants, Transactions, and Other Nonpublic Records

If not already known, the company’s investigation team should work with its outside counsel to identify relevant participants, transactions, and other nonpublic records. The more specifically the company can map the whistleblower’s allegations and identify pertinent and discoverable information, the more effectively it can develop a targeted preservation strategy.

2. Suspend Automated Deletion and Other Routine Data Management

When implementing legal holds, companies need to make sure that they suspend routine deletion across applicable messaging, email, device, and cloud storage systems. When establishing legal holds, they must ensure that they do not expand employees’ authorized system access, if the intent is to preserve but not otherwise disclose the records in question.

When employees’ devices are in scope for data collection, companies need to consider various aspects of the collection process. These include employees’ consent to use company-owned or company-connected devices for employment purposes, applicable privacy laws and regulations, and other relevant company policies.

3. Conduct Privileged Investigations That Document (and Do Not Compromise) Confidential Information

When conducting privileged investigations, it is not sufficient for outside counsel to be involved. There should be other factors present as well. While privileged investigations are very beneficial, they are not a foolproof solution.

For example, even in a privileged communication, the underlying facts discussed will still be discoverable. So, companies need to be very careful about what they say and when they say it.

With respect to interviews, company counsel should explain that interview privilege belongs to the company, and that company counsel will determine whether to waive that privilege. While it is not strictly required by law to have a Company Counsel-approved interview script, it is strongly recommended.

4. Establish Effective Controls to Prevent Retaliation

With this information in hand, the investigation team should be able to implement effective controls to prevent retaliation against the whistleblower. Once the investigation team has established an anti-retaliation protocol and can demonstrate compliance with it to the SEC, the company may then need to take remedial action against the whistleblower.

5. Coordinate with the SEC and Other Federal Authorities

When engaging with the SEC and other federal authorities during a whistleblower-triggered investigation, the company will need to develop a comprehensive strategy for preserving its interests. This will involve taking various steps, including:

• Working closely with outside counsel, when applicable
• Working with an experienced external compliance firm, when applicable
• Responding to the SEC’s civil subpoenas and Requests for Information (RFIs)
• Developing a cohesive and strategic approach for engagement with the SEC’s Division of Enforcement
• Ensuring that communications with the SEC (and other federal authorities, if necessary) are conducted through the appropriate channels and protocols
• Documenting all communication and interactions with the SEC (and other federal authorities, if necessary)
• Documenting all internal response and remediation measures related to the SEC’s inquiry

Does a Whistleblower Tip Mean the SEC Will Bring Charges?

A whistleblower tip is just one of several ways the SEC can identify targets for scrutiny. The SEC receives thousands of tips annually, and while some prove highly significant, many are found to be unsubstantiated. Nevertheless, the SEC will take closer notice of tips that are:

• Specific in nature (i.e., they go beyond providing the SEC with just generalized information and identify specific transactions, records, and individuals that are relevant to the inquiry in question)
• Credible on their face (i.e., they contain information that seems to point to evidence, even if the information is not definitively proven at the tip stage)
• Timely, especially with respect to alleged violations that are ongoing or that present the risk of imminent harm to investors or the US market
• Accompanied by corroborating documentation (i.e., emails, text messages, internal company documents, and any other records that the SEC could use to validate the whistleblower’s claims)

Along with these factors, the SEC takes the alleged risks of investor harm and market-integrity disruption into consideration when determining which types of tips and concerns it prioritizes. With this in mind, an SEC enforcement inquiry based on a whistleblower’s tip may lead to charges, but it certainly does not establish that charges will follow.

While a whistleblower’s allegation may raise a red flag, it does not establish that any securities laws were violated. As with all federal enforcement matters, the burden of proving a violation in court will fall on the government, and the government will need to support its case with specific and relevant evidence. Thus, even when the SEC initiates an investigation based on a whistleblower’s tip, the SEC must still carry out a full investigation before deciding whether to pursue an enforcement action.

Generally speaking, the SEC’s enforcement investigations are divided into two phases: informal investigations (or inquiries) and formal investigations. During a formal investigation, the SEC’s Division of Enforcement staff has received a formal investigation order from the SEC Commission that authorizes the staff to use subpoenas to compel the production of documents and to compel individuals to testify. All formal investigations involve establishing a formal record of the SEC’s decisions and findings, and the proceedings themselves will remain nonpublic unless (or until) the SEC Commission orders otherwise.

Finally, the SEC can initiate a whistleblower-triggered investigation, conclude that no enforcement action is warranted, and then close the investigation without making any recommendation to the SEC Commission. Of course, the individual SEC investigators will have no authority to pursue an enforcement action independently; this requires the SEC Commission’s approval.

Spodek Law Group, led by managing partner Todd Spodek, defends clients in federal criminal and white collar matters.

How should we respond to SEC requests and subpoenas?

1. Informal Requests for Documents, Information, and Interviews

In an informal inquiry, the SEC’s staff typically asks for documents, information, and interviews on a voluntary basis. While this does not require the company to produce responsive documents or records, it may make sense for companies to cooperate to establish that they are taking the inquiry seriously.

2. Subpoenas

A subpoena is a compulsory civil process that may compel the production of records or require a witness to testify at a sworn deposition or hearing. Subpoena recipients may attempt to negotiate the scope and timing of their production, but they must document their agreement with the SEC staff to ensure that they will not face enforcement actions for failure to comply with the subpoena in full.

Once the SEC’s staff has determined that enforcement action is warranted, they will present their case to the SEC Commission, and the Commission will then decide whether to initiate a civil enforcement proceeding.

Before making its recommendation to the SEC Commission, the Division of Enforcement staff will typically send the target(s) of the investigation a Wells notice. In order to respond, the SEC allows an additional period of time in which recipients may present evidence, legal arguments, and mitigating circumstances to avoid prosecution.

3. Enforcement Action and Referral for Criminal Prosecution

While whistleblower-triggered investigations often result in civil enforcement action, there are cases in which a referral to the Department of Justice (DOJ) is appropriate. The SEC may make referrals if the allegations contain evidence of a felony offense, and the SEC may make a referral if it thinks the referral will facilitate a targeted enforcement action.

All enforcement action proceedings are public, and companies will need to implement reputation management measures as a result.

4. Civil or Administrative Enforcement Proceedings

Whether through an informal inquiry or a formal investigation, there are five key aspects of SEC investigations that all companies need to consider:

• Truthfulness: 18 U.S.C. § 1001 makes it unlawful to knowingly make any materially false statement or representation to a federal investigator. It also makes it unlawful to knowingly conceal or falsely represent any fact or material information that is capable of influencing an agency’s action. Thus, when responding to SEC requests, it is critical that company employees ensure that their statements are true and complete to the best of their knowledge.
• Data Security: At all times, the company must take steps to ensure that its data security practices are up-to-date and compliant with all applicable privacy laws and regulations.
• Compliance Obligations: When facing an SEC enforcement action, companies must ensure that they are also taking steps to comply with all other applicable laws and regulations. This includes other federal securities laws, as well as the Sarbanes-Oxley Act and the Dodd-Frank Act, as well as any other federal law that might apply given the company’s operations.
• Privilege: To protect itself against the risks of unnecessary exposure during the SEC’s investigation, companies must ensure that they are handling all privilege-protected documents and communications appropriately.
• Confidentiality: Even though SEC investigations are generally confidential, the SEC may share information with other authorities when appropriate under statutory confidentiality provisions. In light of this, it is critical that companies do not share nonpublic investigative information with their auditors, financial advisors, or any third parties without first obtaining the appropriate authorization.

Can we discipline a whistleblower without creating retaliation liability?

1. What is the scope of whistleblower retaliation?

What counts as retaliation can depend on how it was brought to light.

• Under Sarbanes-Oxley, retaliatory acts include “discrimination and other adverse employment actions.” The primary investigative authority for administrative whistleblower retaliation complaints is the Occupational Safety and Health Administration (OSHA) within the Department of Labor (DOL), and, under most circumstances, retaliation plaintiffs may not sue their employers in federal district court directly.
• Under Dodd-Frank, retaliation plaintiffs can sue directly in federal district court, and the statutory protections go to anyone who “provides, collects, or attempts to provide or collect information concerning “violation of any provision of the federal securities laws or any other Federal law, or provision thereof, which relates to the securities, commodity, banking, or insurance industry.”

The Supreme Court rejected the SEC’s interpretation of Dodd-Frank in Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018). In that decision, the Supreme Court acknowledged the broad statutory language of Dodd-Frank’s whistleblower anti-retaliation protections, and but it held that “any individual who is to be protected by the statute’s anti-retaliation remedies must satisfy its whistleblower definition as a matter of law.” As a result, Digital Realty affirmed that, under Dodd-Frank, a plaintiff must report a violation to the SEC before it has a right to statutory whistleblower protections and remedies.

2. What is the SEC’s role in enforcing Dodd-Frank’s protections against whistleblower retaliation?

The SEC has authority to enforce Dodd-Frank’s prohibition against retaliation. Specifically, Section 21F(h)(2) of the Securities Exchange Act of 1934, “Any person who, after or while making a submission to the Commission under section 21F(a), is discharged, demoted, suspended, threatened, harassed, or discriminated against in the employment of that person” will have a statutory private right of action. The SEC also has an independent right of enforcement.

SEC enforcement staff have the authority to issue subpoenas in retaliation investigations as well. Additionally, when conducting these investigations, the SEC may request access to corporate records such as personnel records and company policies.

When enforcing Dodd-Frank’s protections, the SEC may also assess retaliation under Rule 21F-17, 17 C.F.R. § 240.21F-17(a). Under Rule 21F-17, “No person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation . .. or to make a false or misleading statement to the Commission staff about any person or entity or the possibility or extent of a securities law violation. No person may impede or unreasonably delay an individual from communicating with the Commission staff by: (i) Implementing or enforcing a confidentiality agreement; (ii) Threatening or attempting to enforce a confidentiality agreement; or (iii) Taking any other action aimed at preventing the individual from communicating directly with the Commission staff about possible securities law violations.”

With respect to confidentiality agreements, it is important to note that nothing in Dodd-Frank’s whistleblower program (and nothing in any other law or regulation) requires companies to not require its employees or other individuals to sign confidentiality agreements. It does, however, mean that these agreements cannot lawfully prohibit individuals from communicating directly with the SEC.

3. What types of actions or statements can constitute whistleblower retaliation?

The types of employment actions and statements that can constitute whistleblower retaliation are subject to context-specific inquiry. For example, the SEC has the authority to issue subpoenas in retaliation investigations as well, and SEC enforcement staff have previously used this authority to investigate corporate employers for threats of defamation, threats of firing, forced severance agreements, and imposed gag orders in the wake of whistleblower filings. Similarly, retaliation plaintiffs in various whistleblower retaliation cases have been able to survive termination motions for various actions including termination, demotion, suspension, threats, and harassment.

As a result, whistleblowers must be handled with extreme care.

Can companies discipline whistleblowers without creating retaliation liability? The simple answer is yes. Retaliation claims will not be based on the mere fact that a whistleblower was disciplined. Rather, these claims rely on evidence showing that a whistleblower was disciplined specifically and only because of their whistleblower activities, not due to legitimate, nonretaliatory reasons. As long as companies have documented evidence supporting the existence of nonretaliatory reasons for their disciplinary actions, these actions should generally not run afoul of federal whistleblower anti-retaliation statutes.

Who else must be notified when allegations reach the company?

1. Senior Management and Board Members, Other Company Stakeholders, and Other Affected Parties

Allegations that implicate senior management or board members raise unique considerations regarding governance, internal controls, and the protection of the company’s interests. When such allegations come to light, it may make sense to implement oversight by independent directors, an audit committee (or other special board committee), and/or external advisors.

2. Other Auditors or Third-Party Advisors

Listed companies’ audit committees have a duty to establish and maintain procedures under Exchange Act Rule 10A-3 that receive, investigate, and process complaints relating to accounting, internal accounting controls, or auditing matters. These procedures are required to be “confidential, anonymous, and appropriately confidential with respect to accounting, internal accounting controls, auditing matters, and compliance,” and they must allow anyone who makes an “accounting, internal accounting controls, or auditing matter submission” to do so “confidentially and/or anonymously.” Along with these requirements, PCAOB AS 2405 also requires listed companies to ensure that their audit committees are notified of all illegal acts unless these acts are clearly inconsequential.

3. Insurance Carriers

When companies are facing potential financial exposure, it will be important to promptly check for any applicable insurance coverage. For example, directors and officers liability insurance, or D&O coverage, may cover some (and not all) of the costs of responding to the SEC’s inquiry. The availability of such coverage will depend on the applicable policy and its specific terms and conditions.

When engaging with insurance carriers, companies must ensure that they do not waive their rights to coverage. Some D&O insurance policies, for example, require companies to send notice to their insurance carriers within a specific window. Companies must also consider the potential implications of making premature disclosures to their insurance carriers.

4. Investors, Third Parties, and the Public

Allegations against publicly traded companies trigger affirmative disclosure requirements under SEC rules and applicable securities laws when the allegations relate to issues that are material to investors. When such obligations exist, companies must timely and accurately disclose the nature of the allegations to the public, and this disclosure must be made in compliance with any applicable regulations.

5. The U.S. Department of Justice and Other Federal Authorities

In some cases, the SEC may make referrals to the DOJ or other appropriate federal authorities based on evidence gathered during an investigation. However, companies are required to proactively make such referrals when appropriate as well. For example, under the federal securities laws, any government enforcement action must involve U.S. Department of Justice (DOJ) prosecutors at the U.S. Department of Justice (or its regional offices).

6. SEC Whistleblower Program Office

In certain situations, it may make sense to affirmatively notify the SEC’s Whistleblower Program Office of a whistleblower’s identity and the existence of a whistleblower’s submission. For example, if the whistleblower had previously reported the issue to the company internally, doing so will allow the SEC to consider the whistleblower’s prior internal reporting when determining the extent of any award that the whistleblower may be eligible to receive.

Contact a Federal Criminal Defense Attorney

Nothing here is legal advice, and the details of your case matter. Todd Spodek and Spodek Law Group take federal criminal and white collar cases nationwide, from offices in New York, Brooklyn, Queens and Los Angeles. You can reach the firm at 212-300-5196.