Since fall 2023, the Securities and Exchange Commission (“Commission” or “SEC”) has increased enforcement activity focused on advancing the SEC’s view that certain provisions of confidentiality agreements have the effect of impeding whistleblower reports in violation of Rule 21F-17.[1] The SEC’s approach has the potential to substantially expand the variety of agreements that the SEC has found violative of the whistleblower protection rules, making Rule 21F-17 an essential area of focus.
The SEC’s whistleblower rules were adopted in 2011 to fulfill a congressional mandate under the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.[2] The rules sought to encourage whistleblowers to report possible securities violations by, inter alia, providing financial incentives and confidentiality protections.[3] The financial incentives were determined by Congress to be a critical component in recognition that individuals take a meaningful risk by blowing the whistle.[4]
As part of the reforms, the Commission adopted Rule 21F-17, which provides in relevant part:
(a) No person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications.
Rule 21F-17 became effective on August 12, 2011.
The Commission brought the first enforcement action for a violation of Rule 21F-17 in 2015, based on a company’s use of a restrictive employee confidentiality agreement implemented in the course of conducting internal investigations into employee complaints concerning potentially illegal or unethical conduct.[5] Since that action, the Commission has instituted more than 20 additional enforcement actions charging violations of Rule 21F-17 against public issuers, registered investment advisers, broker-dealers, and private companies that have engaged in private securities offerings.[6]
Since 2015, the Commission has principally brought enforcement actions under Rule 21F-17 against entities alleged to have impeded the whistleblower protections through the inclusion of confidentiality provisions in separation, employment, and other related agreements. However, recently the Commission has expanded the scope of its application of the whistleblower rules to agreements with clients and consultants. This expansion marks an important shift in the Staff’s focus and a new avenue of liability risk for entities subject to SEC regulation.
This client alert examines representative SEC settlement orders, including the first-of-its-kind application of the whistleblower protection rules to a client agreement, and walks through the implications for market participants.
I. The Usual Case: Employment Agreements
Initially, Commission enforcement of the whistleblower rules targeted employment, separation, and severance agreements that expressly limited those persons’ rights to communicate with the SEC.[7] More recently, the Commission has focused on employment provisions that allegedly create impediments to participation in the whistleblower program by having employees forgo the statutorily provided financial incentives.
In particular, on September 9, 2024, the SEC announced settled charges finding violations of Rule 21F-17(a) against seven different public issuers with civil penalties ranging from $19,500 to $1,386,000.[8] In each action, the charges stemmed from agreements with current or former employees that included language limiting the employee’s ability to collect a monetary award from their participation in an investigation by a governmental agency. In one action against Acadia Healthcare, the Commission’s order highlighted language indicating that, while the employees did not “waive any right that cannot be waived under law, including the right to file an administrative charge or participate in an administrative investigation or proceeding,” the employees did “disclaim and waive any right to share or participate in any monetary award resulting from the prosecution of such charge or investigation or proceeding.”[9] In that action, the majority of the agreements expressly permitted participation in government whistleblower programs while also requiring employees to waive their right to a potential award thereunder.[10]
The Commission determined that the agreements, in combination with a separate agreement that required employees to waive their right to file a complaint with any federal government agency, together created impediments to participation in the whistleblower program by requiring employees to forgo possible financial awards.[11]
The Commission instituted similar charges against a.k.a. Brands Holding Corp., which entered into severance agreements disclaiming and waiving rights to receive monetary whistleblower awards,[12] and IDEX Corporation, requiring the same.[13] One additional action issued contemporaneously involving change-in-control agreements suggests the Commission may continue to expand the scope of agreements that could be the basis for alleging violations of the whistleblower rules.[14]
The Commission has entered orders finding that Rule 21F-17(a) violations extend to agreements entered into with contractors as well. AppFolio, Inc., a public company, entered into 68 separate consulting services agreements that prohibited contractors from voluntarily providing information to government agencies and required that contractors notify the company of any legally compelled disclosure of such information.[15] Of note, the Commission faulted provisions that permitted disclosure to the extent provided by law but required written notice to AppFolio of government orders and award offers “within 2 business days of receiving such order, but in any event sufficiently in advance of making any disclosure to permit [the company] to contest the order[.]”[16]
In light of the SEC’s recent spate of actions, market participants may wish to consider adding explicit and affirmative whistleblower protection language in employment agreements and other employment- and termination-related documents, as the Commission has acted assertively to find that general authorizations to follow any applicable law may be insufficient when used in combination with other confidentiality and non-disparagement clauses that have been interpreted to impede Rule 21F-17’s policy aims.[17]
a. Exemplary Remediation
In addition to considering whether to revise existing agreements, firms that find themselves involved in an SEC inquiry regarding their confidentiality agreements may wish to consider varying forms of proactive remediation. In fact, some recent SEC enforcement actions suggest that in some cases there could be meaningful benefits to such remediation. For example, in 2023, the Commission settled charges against CBRE, Inc. (“CBRE”), a subsidiary of publicly traded CBRE Group, Inc., for using an employee release that allegedly violated the SEC’s whistleblower protection rule.[18] According to the order, CBRE required its employees to sign a release in which employees attested that they had not filed a complaint against the Company with any federal agency as a condition of receiving separation pay.[19] The Commission found that CBRE’s employee separation agreement “impede[d] potential whistleblowers from reporting complaints to the Commission” and “undermine[d] the purpose of Section 21F and Rule 21F-17(a).”[20]
In its order, the Commission noted CBRE’s “extensive” remedial actions, including, after learning of the Commission’s investigation, revising all versions of its domestic releases and similar agreements for compliance with the whistleblower protection rule.[21] CBRE also commenced an audit of similar agreements worldwide, reviewing nearly 300 employment-related templates used by CBRE affiliates in more than 50 countries.[22] Additional remedial actions taken by CBRE included training members of compliance teams globally on the whistleblower rule and launching a mandatory “Standards of Business Conduct” recertification process by employees.[23] In light of CBRE’s exemplary remediation, the Commission ordered a civil penalty of $375,000.[24]
II. Expansion of Enforcement Targets
b. Client and Customer Agreements
The Commission made a substantial expansion of its enforcement of the whistleblower protections at the start of 2024. On January 16, 2024, the Commission announced settled charges against a dually registered investment adviser and broker-dealer, finding that certain confidentiality agreements impeded advisory clients’ and brokerage customers’ rights to report potential securities law violations to the SEC.[25] This first-of-its-kind application of the whistleblower rules to a regulated entity’s agreements with customers, as well as the substantial civil penalty issued of $18 million, signal a significant new development in the Commission’s application of its whistleblower provisions.
According to the SEC order, for more than three years, the registrant requested that certain advisory clients and brokerage customers (together, “Clients”) sign confidential release agreements if they had been issued a credit or settlement from the firm of more than $1,000.[26] More than 300 clients signed the agreements.[27] The release required the Clients to keep confidential the settlement, all underlying facts related to the settlement, and all information relating to the account at issue.[28] On the whole, the Commission was particularly concerned with the overall implication of the release provisions, which the Staff interpreted as a prohibition on Clients affirmatively reporting concerns to the Commission.[29]
Despite the registrant taking remedial measures to revise the release and add language affirmatively advising Clients that they were not prohibited from disclosing information to any governmental or regulatory authority, the order nevertheless imposed a considerable civil penalty of $18 million.[30]
On September 4, 2024, the Commission announced settled charges against broker-dealer Nationwide Planning Associates, Inc. and two affiliated investment advisers for impeding clients from voluntarily reporting information under the whistleblower rules through the use of confidentiality agreements in connection with compensatory payments to clients.[31] The agreements, which expressly limited a client’s ability to voluntarily report potential securities law violations to the Commission, notwithstanding the inclusion of a limited carve-out for responding to unsolicited inquiries from government agencies, “created the reasonable impression that signing clients were prohibited from affirmatively reporting” to the Commission through the whistleblower program.[32] The Commission found further fault with certain agreements that required clients to represent that they had not previously reported the underlying dispute which led to the compensatory payment and would “forever refrain” from such reporting.[33]
c. Privately Held Companies
While historically the SEC has sought to enforce this provision against SEC-registered entities, privately held companies with no SEC registration have recently become a SEC target. The SEC settled charges against Monolith Resources, LLC, a privately held technology company, for using employee separation agreements that violated the SEC’s whistleblower protection rules.[34] The Commission found that a separation agreement used by Monolith impermissibly raised impediments to former employees’ participation in the whistleblower program. The SEC’s order also noted that Monolith voluntarily revised the separation agreement to provide that “nothing in this Agreement shall bar or impede in any way your ability to seek or receive any monetary award or bounty from any governmental agency or regulatory or law enforcement authority in connection with protected ‘whistleblower’ activity.”[35]
III. The Implications for Industry
Following these SEC actions, market participants should consider reevaluating and potentially revising agreements that include language limiting a counterparty’s ability to participate in government investigations, including by collecting financial awards. Regulated entities should also consider adding affirmative and explicit whistleblower protection language in appropriate agreements, including those beginning and terminating an employment relationship, agreements pertaining to deferred and other compensation, and agreements with consultants, clients and customers. The Staff’s approach suggests general catchall authorizations to “follow any applicable law or rule” are unlikely to satisfy the Staff’s interpretations of what is required to advance the policy goals underlying the whistleblower protection rules.
Market participants may also wish to consider remedial actions like those highlighted in the actions above. Revising all releases and agreements and updating compliance programs and certifications to account for Rule 21F-17 were all viewed favorably by the Commission, particularly when undertaken in a timely manner soon after being contacted by the Staff.
The SEC will likely continue to scrutinize entities’ agreements containing confidentiality and non-disparagement provisions. Market participants should consider whether their agreements should be revised in light of the SEC’s interpretation of the whistleblower protection rules as demonstrated by their continued enforcement actions. Should you have any questions about the sweep or continued Staff efforts to enforce the whistleblower protection rules, please contact your regular Willkie attorney.
Click here to download this article.
[1] For more information regarding the SEC’s use of enforcement sweeps, see generally Adam Aderton & Melissa Taustine, SEC Enforcement Sweeps: Implications for Agency and Industry, The Review of Securities and Commodities Regulation (Apr. 12, 2023), https://www.willkie.com/-/media/files/publications/2023/aderton_taustine_rscr_pre-pub.pdf/ (pre-publication issue).
[2] See Implementation of the Whistleblower Provisions of Section 21F of the Securities Exchange Act of 1934 Adopting Release, Release No. 34-64545, at 197 (Aug. 12, 2011).
[3] Id.
[4] See The Restoring American Financial Stability Act of 2010, Committee on Banking, Housing, and Urban Affairs (Apr. 30, 2010).
[5] See In the Matter of KBR, Inc., Exchange Act Order No. 74619 (Apr. 1, 2015).
[6] Additional Rule 21F-17 actions to those cited and discussed infra include Exchange Act Order No. 78528 (Aug. 10, 2016), Exchange Act Order No. 78957 (Sept. 28, 2016), Exchange Act Order No. 79607 (Dec. 20, 2016), Exchange Act Order No. 79804 (Jan. 17, 2017), Exchange Act Order No. 79844 (Jan. 19, 2017), Exchange Act Order No. 96796 (Feb. 3, 2023).
[7] See, e.g., In the Matter of NeuStar, Inc., Exchange Act Order No. 79593 (Dec. 19, 2016) (Order finding violations of Rule 21F-17 where voluntary severance agreements with employees who were leaving the company included a non-disparagement clause that limited any communication with the Commission that “disparages, denigrates, maligns or impugns” the company).
[8] SEC Charges Seven Public Companies with Violations of Whistleblower Protection Rule, Exchange Act Release No. 2024-118 (Sept. 9, 2024), https://www.sec.gov/newsroom/press-releases/2024-118/.
[9] In the Matter of Acadia Healthcare Company, Inc., Exchange Act Order No. 100970 (Sept. 9, 2024), at ¶ 8.
[10] Id. at n.1.
[11] Id. at ¶ 10.
[12] In the Matter of a.k.a. Brands Holding Corp., Exchange Act Order No. 100969 (Sept. 9, 2024), at ¶¶ 6-8.
[13] In the Matter of IDEX Corporation, Exchange Act Order No. 100972 (Sept. 9, 2024), at ¶¶ 7-8.
[14] In the Matter of LSB Industries, Inc., Exchange Act Order No. 100973 (Sept. 9, 2024).
[15] In the Matter of AppFolio, Inc., Exchange Act Order No. 100971 (Sept. 9, 2024), at ¶ 8.
[16] Id.
[17] Exchange Act Order No. 98641 (Sept. 29, 2023).
[18] In the Matter of CBRE, Inc., Exchange Act Order No. 98429 (Sept. 19, 2023).
[19] Id. at ¶¶ 5-6.
[20] Id. at ¶ 7.
[21] In the Matter of CBRE, Inc., Exchange Act Release No. 98429 (Sept. 19, 2023).
[22] Order, supra note 18 at ¶ 10.A.
[23] Id. at ¶ 10.C-D.
[24] Id.
[25] Exchange Act Order No. 99344 (Jan. 16, 2024).
[26] Id. at ¶ 2.
[27] Id. at ¶ 6.
[28] Id. at ¶ 8.
[29] Id. at ¶ 8.
[30] Id. at ¶¶ 11-13.
[31] In the Matter of Nationwide Planning Associates, Inc., et al., Exchange Act Order No. 100908 (Sept. 4, 2024).
[32] Id. at ¶ 12.
[33] Id. at ¶ 2.
[34] In the Matter of Monolith Resources, LLC, Exchange Act Order No. 98322 (Sept. 8, 2023).
[35] Id. at ¶ 9.
