CFTC Finalizes Whistleblower Bounty Program

On August 4, 2011, the Commodity Futures Trading Commission (CFTC or Commission) voted 4-1 to adopt final regulations implementing the whistleblower incentives and protections set forth in Section 748 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank). See 76 Fed. Reg. 53172 (Aug. 25, 2011) (to be codified at 17 C.F.R. Part 165). The CFTC’s whistleblower program generally obligates the CFTC to pay a bounty to whistleblowers who provide information leading to the assessment of monetary sanctions against those found to have violated the Commodity Exchange Act (CEA). The reach of the whistleblower provisions is quite broad — they apply to “any individual” (not just employees of companies) and to information regarding any possible violation of the CEA. Dodd-Frank Section 748 also creates strong, new anti-retaliation protections for individuals who provide information to the CFTC.

The Commission’s final whistleblower rules respond to public comments it received on its December 6, 2010 proposal. Many public comment letters raised concerns that the proposed rules encouraged potential whistleblowers to provide information directly to the CFTC and thereby discouraged those same individuals from invoking firms’ long-established internal reporting and compliance systems. To avoid a potential negative impact on companies’ internal processes, a number of commenters suggested that whistleblowers should be required to utilize a firm’s internal reporting systems to be eligible for an award. The CFTC declined to adopt this suggestion; instead, it added incentives to encourage internal reporting as part of the whistleblower process. In addition, the CFTC adopted changes to its final regulations to promote harmonization with the Securities and Exchange Commission’s (SEC) final regulations and whistleblower program. The CFTC’s final whistleblower rules will go into effect on October 24, 2011.

This memorandum summarizes the main features of the final rules and, in the course of outlining the rule mechanics, notes key differences between the CFTC and SEC whistleblower programs.

How do individuals become eligible for whistleblower awards?

First, the whistleblower’s submission to the CFTC must be “voluntary.” Information is submitted “voluntarily” if it is provided before the whistleblower or anyone representing the whistleblower (such as an attorney) receives a related request, inquiry or demand from the CFTC, Congress, any federal or state authority, the Department of Justice (DOJ), a registered entity, a registered futures association or other self-regulatory organization (SRO). Unlike the SEC, the CFTC will disqualify a whistleblower’s submission if the information is covered by an official request to the whistleblower’s employer, unless the employer fails to respond to the request in a timely manner. Under both the CFTC and SEC programs, a whistleblower’s submission is not considered voluntary if the individual is required to provide the information under a pre-existing legal or contractual duty to the agency or certain other regulatory or law enforcement authorities. See Final Rule 165.2(o).

Second, the whistleblower’s submission must consist of “original information” about a possible CEA violation. “Original information” is information submitted to the CFTC after July 21, 2010 (the date of Dodd-Frank’s enactment) that is derived from the whistleblower’s independent knowledge or independent analysis and is not known to the Commission from any other source, unless the CFTC receives the information from a source that itself originally received the information from the whistleblower. See Final Rule 165.2(k). The CFTC’s final rules clarify the distinction between independent knowledge and independent analysis: independent knowledge is information that does not come from publicly available sources (e.g. corporate filings and the media); on the other hand, a whistleblower’s independent analysis can be based on publicly available sources as long as the analysis reveals information that is not generally known to the public. See Final Rules 165.2(g) & 165.2(h).

Third, the whistleblower’s original information must “lead to the successful enforcement” of a judicial or administrative action brought by the CFTC that results in “monetary sanctions” exceeding $1 million, or must lead to the successful enforcement of a related action brought by certain other regulatory or law enforcement authorities. The CFTC has explained that information that “leads to successful enforcement” is expected “because of its high quality, reliability, and specificity [to] ha[ve] a meaningful nexus to the Commission’s ability to successfully complete its investigation, and to either obtain a settlement or prevail in a litigated proceeding.” 76 Fed. Reg. at 53177. For purposes of determining whether the $1 million threshold is met in a successful Commission action, the CFTC modified its final rules to indicate that it will aggregate amounts ordered to be paid in separately captioned judicial or administrative actions that “arise out of the same nucleus of operative facts.” See Final Rule 165.2(a). The CFTC observed that this aggregation approach “will make whistleblower awards available in more cases.” 76 Fed. Reg. at 53173.

Finally, the whistleblower must comply with stated procedures for submitting information. A whistleblower must submit a completed Tip, Complaint or Referral form (Form TCR) online, by mail or by fax. See Final Rule 165.3. Form TCR includes a declaration under penalty of perjury that the information contained therein is true and correct to the best of the whistleblower’s knowledge and belief. See Final Rule 165.3.

Can an individual be eligible for an award based on original information that it reports internally within an entity and the entity later provides to the CFTC?

Yes. An individual may be eligible for a whistleblower award based on original information it reported through an entity’s internal whistleblower, legal or compliance procedures and that the entity later provided to the CFTC. To be eligible, the whistleblower also must submit the original information to the CFTC within 120 days of its internal report and cannot fall into any of the exclusions set forth in the responses to the next two questions. An eligible whistleblower also will receive credit not only for the information it reported internally, but for all the information the entity reported to the CFTC that was developed in response to the whistleblower’s internal report and that leads to a successful enforcement action. See Final Rule 165.2(i).

What types of information are excluded from award eligibility?

The CFTC’s final rules contain exclusions from “original information” for certain types of information, including sensitive confidential information. Specifically, exclusions apply to information obtained: a) through an attorney-client privileged communication; b) in connection with the legal representation of a client; c) by an officer, director, trustee or partner of an entity, if another person informed that person of allegations of misconduct or that person learned the information in connection with the entity’s processes for identifying, reporting and addressing possible violations of law; d) by an employee whose “principal duties involve compliance or internal audit responsibilities”; or e) in a manner determined by a federal court to violate applicable federal or state criminal law. See Final Rule 165.2(g)(2)-(6). Unlike the SEC’s rules, the CFTC’s rules do not exclude information obtained by employees of public accounting firms, which means that external auditors of companies regulated by the CFTC may report original information to the CFTC and qualify for an award. The CFTC reasoned that an exclusion for employees of public accounting firms is necessary under the SEC’s program, but not the CFTC’s, because the SEC’s statute requires this exclusion and external auditors have an existing obligation to report violations to the SEC under the Securities Exchange Act of 1934. See 76 Fed. Reg. at 53177.

According to the Commission, certain exclusions from award eligibility — particularly those related to information from internal compliance personnel — are meant to “promote the goal of ensuring that the persons most responsible for an entity’s conduct and compliance with the law are not incentivized to promote their own self-interest at the expense of the entity’s ability to detect, address and self-report violations.” See id. Nonetheless, the Commission’s rules include carve-outs from the exclusions, meaning that even some highly sensitive compliance-related information can still become the subject of a whistleblower tip. For example, information obtained through attorney-client privilege or in connection with the legal representation of a client would be permitted as “original information” if disclosure is authorized by applicable federal or state attorney conduct rules. Information from persons with internal compliance and audit responsibilities and others with access to an entity’s internal compliance and reporting processes (see exclusions c and d above) would be permitted as “original information” if such persons have a “reasonable basis to believe” that: 1) reporting the information to the Commission is necessary to prevent conduct likely to cause substantial injury; 2) the entity is engaging in conduct that will impede an investigation of the misconduct; or 3) at least 120 days have elapsed since the person reported the information internally. See Final Rule 165.2(g)(1), (2), & (7).

What types of individuals are excluded from award eligibility?

The Commission’s final rules also identify individuals who are categorically ineligible for a whistleblower award. Excluded are: a) persons who are, or were at the time they acquired the original information, a member, officer or employee of the CFTC, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Board of Directors of the Federal Deposit Insurance Corporation, the Director of the Office of Thrift Supervision, the National Credit Union Administration Board, the SEC, the DOJ, a registered entity, a registered futures association, another SRO, a foreign regulatory authority, or a law enforcement organization; b) persons who are convicted of a criminal violation related to the underlying judicial or administration action brought by the CFTC or a related action; c) persons who submit information that is based on facts underlying a CFTC action already submitted by another whistleblower; or d) persons who knowingly and willfully make any false, fictitious or fraudulent representations or statements to the Commission or another authority in connection with a related action. See Final Rule 165.6. In contrast to the SEC program, the CFTC’s final rules do not exclude foreign government officials (though foreign regulatory officials are excluded) or external auditors whose submission would be contrary to the securities laws.

Individuals with potential civil liability or criminal liability for CEA violations they report to the CFTC are still eligible for whistleblower awards. However, if a whistleblower is convicted of a criminal violation related to the judicial or administrative action, they are not eligible for an award. See 76 Fed. Reg. at 53191. The CFTC has emphasized, moreover, that whistleblowers are not immune from prosecution and any leniency for culpable whistleblowers will be assessed in accordance with the CFTC’s stated policy regarding cooperation by individuals. See 76 Fed. Reg. at 53191. In order to prevent culpable whistleblowers from profiting as a result of their own misconduct, the final rules provide that monetary sanctions assessed against the whistleblower or any entity whose liability is based substantially on conduct that the whistleblower directed, planned or initiated will not count for purposes of determining whether the $1 million statutory threshold has been met, or for purposes of calculating the amount of any bounty. See Final Rule 165.17.

How does the CFTC determine the amount of whistleblower awards?

In cases where one or more whistleblowers meet the eligibility requirements for receiving a bounty, the CFTC is required to award bounties that, in the aggregate, amount to between 10 percent and 30 percent of the monetary sanctions collected in the judicial or administrative action brought by the CFTC or a related action. See Final Rule 165.8. Subject to this requirement, the amount of any bounty is within the CFTC’s discretion.

Under the final rules, the CFTC will consider four factors that can increase the amount of a bounty: a) the significance of the information provided by the whistleblower; b) the degree of assistance provided by the whistleblower; c) the CFTC’s programmatic interest in deterring violations of the CEA by making awards to whistleblowers who provide information that led to successful enforcement of a CFTC action or related action; and d) the whistleblower’s participation in internal compliance systems. The CFTC also will consider three factors that can reduce the amount of a bounty: a) a whistleblower’s culpability or involvement in matters associated with the CFTC’s action or related actions; b) unreasonable delay in the whistleblower’s reporting of the violation; and c) interference with internal compliance and reporting systems, including by preventing or delaying detection of a violation, or hindering an entity’s effort to detect, investigate or remediate violations. See Final Rule 165.9. These considerations are not intended to be all-inclusive or to require a specific determination in any particular case.

In addition, the CFTC will consider “the potential adverse incentives from oversized awards” in determining the amount of a whistleblower bounty. The CFTC added this criterion in response to concerns raised in a comment letter from Sen. Carl Levin warning that “excessive monetary incentives may lead to misreporting causing investigative waste.” See 76 Fed. Reg. at 53189. By contrast, the SEC declined to include a consideration against excessive awards in its final rules.

Can a whistleblower appeal a CFTC award determination?

Yes. A person claiming whistleblower status may appeal any Commission final award determination, including whether an award is issued, to whom the award is issued or the amount of an award to an appropriate U.S. Circuit Court of Appeals. See CEA § 23(f); Final Rule 165.13. The SEC program, on the other hand, does not allow whistleblowers to appeal award amounts that fall within the statutory range. A person challenging a final award determination — whether under the CFTC or SEC program — must bring the appeal within 30 days after the agency’s final order of determination. The CFTC issues such final orders in response to putative whistleblowers’ applications for bounties, which they must submit within 90 days of the CFTC’s publication of a “Notice of Covered Action” for enforcement actions meeting the $1 million statutory threshold. See Final Rule 165.7.

What sorts of protections are available to whistleblowers?

Whistleblowers receive two primary types of protections. First, the CFTC must keep a whistleblower’s identity confidential unless and until the identity is required to be disclosed to a defendant or respondent in a government proceeding. However, the CFTC may share whistleblower information with the DOJ, appropriate state or federal agencies or departments, state attorneys general in connection with criminal investigations, registered entities, registered futures associations, other SROs and foreign futures authorities. See Final Rule 165.4.

Second, whistleblowers are entitled to bring a private cause of action against their employers for retaliation against whistleblower activities. The CFTC interprets “retaliation” as encompassing any form of discrimination against a whistleblower — including discharge, demotion, suspension, threats and harassment — because of the whistleblower’s lawful act in providing information to the CFTC or assisting the CFTC in any related investigation or enforcement action. See Appendix A to Part 165. This anti-retaliation protection is available even if a whistleblower does not satisfy all of the conditions to qualify for an award under the Commission’s whistleblower program. However, the whistleblower must “possess a reasonable belief” that the whistleblower’s information relates to a possible CEA violation that has occurred, is ongoing or is about to occur, and must provide the CFTC with the information in accordance with stated procedures. See Final Rule 165.2(p)(2).

Although the SEC’s anti-retaliation protections are generally consistent with those of the CFTC as outlined above, there are some notable differences. For one, the CFTC’s anti-retaliation protections cannot be invoked by federal government employees, whereas the SEC’s protections could be. Additionally, the statute of limitations for bringing a retaliation claim under the CFTC program is shorter — two years from the date of alleged retaliation compared to the SEC’s six years from the date of alleged retaliation (or three years from when the material facts of the claim where known or should have been known). The CFTC expressly has declined to exercise enforcement authority over retaliation claims, noting that the CFTC’s statutory whistleblower provision “clearly states that only an individual who alleges retaliation in violation of being a whistleblower may bring such a cause of action.” See 76 Fed. Reg. at 53182. In contrast, although its statutory provision is nearly identical, the SEC has asserted that, by virtue of the anti-retaliation provision in its governing statute, the SEC has the authority to bring its own enforcement actions against employers for retaliation.

How does the CFTC’s whistleblower program interplay with company internal compliance and reporting programs?

The CFTC has expressed the view that effective internal compliance and reporting systems promote compliance with the CEA and, accordingly, has stated its intention to support such programs. Certain commenters (and the one CFTC commissioner who dissented from the adoption of the final rules) urged the Commission to require internal reporting as a condition for award eligibility. The proponents of mandatory internal reporting explained that, absent such a requirement, whistleblowers likely would go directly to the CFTC with information regarding misconduct, thereby weakening companies’ internal compliance functions. In particular, commenters were concerned that the CFTC’s proposed whistleblower rules would result in slower identification, investigation and potential remediation by employers of alleged violations and an increase in costs for firms ultimately referred to the CFTC for investigation (as compared to the costs of an internal investigation).

The Commission declined to adopt mandatory internal reporting, stating that such a requirement could prevent or deter whistleblowers from making legitimate complaints out of fear of reprisal from their employer. If whistleblowers were dissuaded from bringing violations to the attention of the Commission, then the Commission reasoned that it would not be in a position to bring actions against certain violators of the CEA and, as a result, victims would be deprived of restitution, and market participants and the public would be deprived of the benefits associated with enforcement of the CEA. See 76 Fed. Reg. at 53196.

Rather than mandate internal reporting in its final rules, the CFTC has offered incentives for whistleblowers to report possible violations to internal compliance personnel prior to or at the same time they report the information to the CFTC. The CFTC believes the incentives will “strik[e] an appropriate balance between the interests of maintaining strong internal reporting functions and the interests of the Commission’s whistleblower program.” See id. at 53194. Although not affirmatively encouraging internal reporting, the first “incentive” blunts the incentive that a whistleblower would otherwise have to race to the CFTC without reporting an issue internally; it gives a whistleblower credit for blowing the whistle as of the date of the whistleblower’s internal report — essentially holding the whistleblower’s place in line with the CFTC — as long as the whistleblower provides the information to the CFTC within 120 days after the internal report is made. See Final Rule 165.2(l)(2). The second incentive provides a whistleblower who reports internally within an entity with credit for all the information that the entity gathers in response to the whistleblower’s report and later submits to the agency, even if the information the whistleblower originally reported would not have been sufficient on its own to lead to a successful enforcement action. See Final Rule 165.2(i)(30. Finally, the CFTC’s final rules state that the Commission will consider the whistleblower’s decision to report internally as a potentially positive factor in the Commission’s award determination. See Final Rule 165.9(b)(4).

The final rules attempt to “strike an appropriate balance” and therefore do not remove all incentive to report directly to the CFTC and eschew internal compliance procedures. 76 Fed. Reg. at 53194. Moreover, the award eligibility of certain company personnel — including those “most responsible for an entity’s conduct and compliance with the law” (see 76 Fed. Reg. at 53177) — if certain exceptions are met (see discussion above) creates real incentives for such individuals to attempt to position themselves as whistleblowers even in the midst of an internal investigation. This self-interested behavior could be potentially disruptive to the process of evaluating, investigating and addressing compliance issues.

Can an individual be eligible for a whistleblower award based on information submitted to the CFTC before the final rules go into effect?

Yes. Whistleblowers that submit original information after the date of enactment of the Dodd-Frank Act (July 21, 2010) but before the final rules become effective (October 24, 2010) will be eligible for an award, provided that the whistleblower complies with the Commission procedures within 120 days of the rules’ effective date. See Final Rule 165.3(2)(d).