The Dodd-Frank Wall Street Reform and Consumer Protection Act, enacted by Congress in 2010, brought significant changes to financial regulation in the U.S. Among these changes was the establishment of the Office of the Whistleblower within the Securities and Exchange Commission (SEC). The Office of the Whistleblower is responsible for, among other things, administering a bounty program that permits individual whistleblowers who meet certain requirements to receive awards for information they submit to the SEC regarding securities law violations.

During its first year, the Office of the Whistleblower received more than 3,000 tips, complaints and referrals (TCRs) from whistleblowers in all 50 states, the District of Columbia, Puerto Rico and 49 countries outside the U.S. More than one-third of the TCRs reported by whistleblowers related to issuer disclosures, with almost 20 percent categorized as corporate disclosures and financials and more than 15 percent categorized as offering fraud.

It is not surprising, as noted by the SEC's Office of the Inspector General in its Jan. 18 “Evaluation of the SEC's Whistleblower Program,” that “the primary demographic for prospective whistleblowers include middle management personnel, controllers, finance department personnel, and other employees who are involved in international transactions.” It is surprising, however, that the majority of whistleblowers were employees who reported their concerns to management, but were ignored.

In fact, the relevant provisions of Dodd-Frank provide incentives for companies to establish internal compliance systems and to work with employee-whistleblowers to address illegal conduct. For example, employees who report potential wrongdoing internally first are deemed to have reported to the SEC on the date they reported it internally. This preserves their place in line in terms of when information was provided to the SEC, and it allows the company to investigate and collect additional evidence for 120 days before the employee brings the information to the SEC. Moreover, one of the considerations the Office of the Whistleblower undertakes when determining the percentage award to recommend is whether the whistleblower cooperated with the company's internal compliance system.

By encouraging employees to report potential violations internally, a company can fully assess the allegations; conduct an internal investigation, if appropriate; and present its findings to the SEC at the same time the employee presents his or her concerns to the SEC. As a result, any subsequent investigation by the staff will likely be more focused, and the company may earn credit for its cooperation.

To date, one TCR has resulted in an award to a whistleblower. The whistleblower has been identified as a bookkeeper of the company she reported as engaging in a multi-million dollar Ponzi scheme. Following a successful enforcement action, the SEC awarded the whistleblower 30 percent of the recovery, the maximum allowed under the law.

The fact that the SEC has paid only one award under the new regulations, however, is likely not a good indication of the quality of the information the Office of the Whistleblower has received or will receive. First, not every TCR results in an award, even if it results in successful enforcement. Under the regulations, a whistleblower is only entitled to an award if he or she voluntarily provides the SEC with original information that leads to the successful enforcement by the SEC of a federal court or administrative action in which the SEC obtains monetary sanctions totaling more than $1 million. Second, the time from the TCR to collection of any eventual judgment is generally more than two years, nearly as long as the time the Office of the Whistleblower has been in operation.

In recent public statements, Stephen Cohen, an associate director in the Division of Enforcement in D.C., recently explained that TCRs from whistleblowers make investigations more efficient and more effective. Because the whistleblower usually is from inside the organization, his or her TCR helps to pinpoint the illegal conduct and potentially narrow the SEC's investigation into the conduct.

The SEC's whistleblower program is just getting started, and we should expect an increase in activity as the program develops. Given that the majority of TCRs are initiated by employees, the time has come for corporations that do not have internal compliance systems to develop them. And for companies that already have compliance systems, this is a good time to review them and ensure that there are appropriate policies and procedures for fully addressing employees' reports of potential wrongdoing or violations.