A lot of commentators, including many law firms, have recently issued dire warnings concerning the final whistleblower rules adopted by the SEC on May 25 pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act. Some of the more extreme observations have expressed fears that companies’ internal compliance programs will be undermined and have recommended top-to-bottom revamping of internal compliance systems. Believing that at least some of this commentary may be overblown, we thought it might be appropriate to take a deep breath and examine what is real and what is hype.

First, it is important to remember what has not changed: the new rules still permit and indeed encourage both privately held and publicly traded companies to continue doing what most have been doing for years: (1) actively encouraging all employees to report potential compliance violations to the company, either by directly reporting any concerns to supervisors, legal, compliance or audit personnel, or by using confidential hotline, website or ombudsmen mechanisms; (2) assuring all employees who step forward that they will not be terminated or otherwise discriminated or retaliated against for raising good faith compliance concerns; (3) examining, in a responsible and appropriate way, all reported potential compliance issues; and (4) taking reasonable corrective measures, including changing business practices and systems, imposing discipline, and when appropriate, reporting the issue to regulators. While it would have been better, as we and others previously stated (see our prior memo here), for the SEC to have fully respected those programs by requiring whistleblowers to first make an internal report, this does not mean that corporate compliance regimes have become obsolete. In fact, they have become even more important.

(more…)