SEC brings whistleblower enforcement actions against seven companies

The SEC announced the settlement of enforcement actions against seven companies, stemming from the use of employment and related agreements that allegedly violated Dodd-Frank whistleblower protection rules. Two of the agreements were consulting agreements, demonstrating that whistleblower protection for all persons, not just employees, is a priority for the SEC's Enforcement Division.

The SEC continues to scrutinize provisions in employment agreements, separation agreements and other similar documents that, according to the SEC, discourage individuals from reporting possible securities law violations. On September 9, 2024, the SEC announced seven settled enforcement actions stemming from alleged violations of the whistleblower protection rule. In all cases, the SEC alleged the employee or consultant's waiver of their right to seek a monetary award from a governmental agency was a violation of whistleblower protections, notwithstanding explicit provisions in the relevant agreements stating that the employee or consultant was not prohibited from filing a claim or charge with a government agency or engage in certain other protected activities. Further, in two of the cases, the SEC alleged that confidentiality clauses in the companies' consulting agreements violated whistleblower protections by limiting permitted disclosure to only that required by law or court order, thereby prohibiting voluntary disclosure. The SEC's actions were the first time the agency has alleged a consulting agreement violated the whistleblower protection rule.

Whistleblower protection rule

Rule 21F-17 of the Securities Exchange Act of 1934 prohibits a company from interfering with a person's right to report possible securities law violations to the SEC. The rule states: "no person may take action to impede an individual from communicating directly with the [SEC] staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement … with respect to such communications."

Previous SEC enforcement cases

The SEC has been pursuing enforcement cases on whistleblower protection violations since 2015. In 2023, the SEC settled actions against four companies (one of which was a private company) alleging that the following provisions in employment and separation agreements violated whistleblower protections or otherwise impeded whistleblowing activity:

• notification clauses requiring former employees to notify the company of any request from an administrative agency relating to a report or a complaint;
• separation agreements that, although explicitly permitting employees to file claims or charges with government agencies and participate in government investigations, prohibited employees from receiving any form of financial award for such participation;
• separation agreements and releases requiring an employee's representation that they had not filed any complaints with any governmental agency; and
• employment agreements that permit disclosure of confidential information to governmental agencies only if required by law or court order, thereby prohibiting voluntary whistleblowing (previous client updates available here and here).

Latest SEC enforcement actions

On September 9, 2024, the SEC announced seven settled enforcement actions against companies stemming from alleged violations of the whistleblower protection rule in employment, separation and consulting agreements, with the companies agreeing to pay more than $3 million combined in civil penalties.

Requiring a person to waive their right to a monetary award (still) undermines the purpose of the rule

In all seven of the cases, the companies used various agreements that required employees to waive their right to recover a monetary award for participating in an investigation by a governmental agency. The SEC determined that these provisions impeded potential disclosure by whistleblowers, notwithstanding explicit override provisions in the relevant agreements stating that nothing in the agreement should be interpreted as limiting the employee's ability to file a claim or charge with a government agency. As in the 2023 enforcement actions, the SEC determined that the prohibitions on monetary awards undermine the purpose of the rule by restricting access to financial incentives designed to encourage communication with the SEC about possible securities law violations.

Confidentiality provisions in consulting agreements also under scrutiny

In addition, the SEC also determined that confidentiality provisions contained in two companies' consulting agreements violated whistleblower protections. These confidentiality provisions permitted disclosure of confidential information by consultants to governmental agencies and regulators only to the extent legally compelled by court order or required by law, and also required the consultant to give prior notice to the company before disclosure. The SEC alleged that these provisions prohibited voluntary whistleblowing and other voluntary disclosure and impeded or discouraged participation in investigations. This marks the first instance of the SEC scrutinizing such provisions in consulting agreements.

Key takeaways

These recent enforcement actions continue to reinforce observations made in previous client updates that the SEC's Enforcement Division is skeptical of any restrictions that impede a person's right to file a whistleblower claim (even when the SEC acknowledges that it is unaware of any instances in which the company took action to enforce these provisions or in which the affected employee declined to speak with the SEC). Further, these recent actions also demonstrate that the SEC's focus on whistleblower protections extends beyond a company's employees to its consultants, clients and other third-party agreements.

Companies should continue to regularly review and update their form agreements and policies to address and protect whistleblower rights in light of evolving SEC guidance on this issue (and the guidance released by the Office of the Whistleblower), and consider the following:

• Confidentiality provisions should include a whistleblower carveout for affirmative voluntary disclosure of potential violations of federal law or regulations to governmental agencies (not just pursuant to court order or as required by law), and without a requirement to notify the company.
• Do not limit an employee's ability to seek a monetary award under a whistleblower program.
• Employee representations that they have not filed any complaints or charges against the company with a governmental agency should contain a clear exception for protected whistleblower activity (or be omitted altogether).
• Consider other provisions that could be seen as chilling whistleblower activity (such as non-disparagement and cooperation provisions), including provisions in any forms of release or other exhibits attached to the agreement, and ensure that each has an express reference to a carveout for such activity.
• Consider not just employment and severance agreements, but also consulting, client and other third-party agreements; incentive award agreements (and their attached releases); and employee handbooks and company policies.
  • Consulting agreements may be particularly fraught, as the in-house legal personnel who review consulting agreements are often not the same individuals as those who review employment-related agreements and may thus not be aware of the rule and its implications.

Lastly, companies reviewing their form agreements and policies for compliance with the whistleblower protection rule should be aware of other federal and state agencies bringing enforcement actions for violations of existing whistleblower provisions (such as the CFTC) or introducing their own new whistleblower programs, including the DOJ pilot program launched on August 1, 2024 (client updates here and here) and the new pilot program in the Southern District of New York announced on January 10, 2024 (client update here). In addition, companies should be mindful that several other government agencies have also recently focused on agreements containing overly broad confidentiality provisions in contravention to other laws, including the FTC (overly broad confidentiality provisions can serve as functional noncompetes) and the NLRB (overly broad confidentiality provisions may violate an employee's labor rights).

If you have any questions regarding the matters covered in this publication, please reach out to any of the lawyers listed below or your usual Davis Polk contact.

This communication, which we believe may be of interest to our clients and friends of the firm, is for general information only. It is not a full analysis of the matters presented and should not be relied upon as legal advice. This may be considered attorney advertising in some jurisdictions. Please refer to the firm's privacy notice for further details.