On June 23, 2021, the U.S. Securities and Exchange Commission (the “Commission”) entered an administrative order¹ (the “Order”) that, among other things, fined a broker-dealer (“BD”) $208,912 for alleged violations of Rule 21F-17(a), which relates to individuals reporting possible securities laws violations to the Commission (a.k.a., whistleblowers).

**KTS Practice Tip: While the Order was entered against a broker-dealer, Rule 21F-17(a) applies to all entities subject to the Commission’s jurisdiction (e.g., public companies, broker-dealers, and investment managers). Indeed, the Commission has previously sanctioned public companies and investment advisers for violations of Rule 21F-17(a).² This alert includes both a summary of the Order’s findings, and take-aways for legal and compliance practitioners who support firms that are subject to the Commission’s jurisdiction.

Summary of Order’s Relevant Facts

The Commission found that between April 2016 and July 2020, BD’s compliance manual contained a section entitled Communications with Regulators that stated in relevant part:

“Employees are also strictly prohibited from initiating contact with any Regulator without prior approval from the Legal or Compliance Department. This prohibition applies to any subject matter that might be discussed with a Regulator, including an individual’s registration status with FINRA. Any employee that violates this policy may be subject to disciplinary action by the Firm.”

Similar language was included in annual compliance training provided to BD’s employees in 2018 and 2019.³

 The Code of Conduct for BD’s parent company, to which BD’s employees were required to confirm compliance, stated that its section entitled Public Statements “should not be interpreted to restrict or interfere with any employee’s rights, free speech, or any whistleblower protections under applicable laws, regulations and requirements.”⁴

In July 2016, BD’s parent company conducted an internal review of applicable whistleblower and confidentiality provisions across its enterprise and added to its Code of Conduct a section entitled Prompt and Confidential Reporting of Illegal or Unethical Conduct that read:

“Nothing in this policy or any other Company policy or agreement is intended to prohibit you (with or without prior notice to the Company) from reporting to or participating in an investigation with a government agency or authority about a possible violation of law, or from making other disclosures protected by applicable whistleblower statutes.”⁵

Nonetheless, the Commission found that this language did not cure the offending Communications with Regulators section of the compliance manual because the introductory section of that compliance manual stated:

“There may be circumstances in which [the broker-dealer’s] policy or procedure may be more (or less) restrictive than [the parent company’s] policy or procedure. In all such circumstances, [broker-dealer] personnel should follow the more restrictive of the policies or procedures, absent explicit direction to the contrary.”⁶

On this basis, the Commission concluded that BD violated Rule 21F-17(a), even though the Commission acknowledged that it is “unaware of any specific instance in which” an employee of BD was “prevented from communicating with the Commission staff about potential securities laws violations” or any instance where BD disciplined or otherwise took action to enforce the restrictive provision or otherwise prevent communications with regulators.⁷

In reaching its determination, the Commission cited to the adopting release for Rule 21F-17(a),⁸ and explained that BD’s compliance manual was antithetical to the purpose of the rule, which is to: “encourage[e] individuals to report to the Commission.” Accordingly, the Commission concluded that BD had “willfully violated Rule 21F-17 of the Exchange Act, which prohibits any person from taking any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation.”⁹

Prior to the entry of the Order, upon being notified of Commission staff’s concerns, BD removed the offending paragraph from its manual, added the two passages quoted below to the manual, and issued a compliance alert to its employees highlighting the changes to the manual.

“…nothing in [the manual] prohibits or restricts any person in any way from reporting possible violations of law or regulation to any governmental agency or entity, or otherwise prevent anyone from participating, assisting, or testifying in any proceeding or investigation by any such agency or entity or from making other disclosures that are protected and/or permitted under law or regulation.”

“Nothing in this Manual, any agreement between GS and its employees, or any GS policy or program requires a person to obtain prior authorization from GS to make any such reports or disclosures to any governmental agency or entity or to notify GS that an individual intends to make or has made such reports or disclosures.”¹⁰

The Take-Aways

Since the effective date of Rule 21F-17 on August 12, 2011, prudent legal and compliance practitioners handling internal investigations and responses to regulatory examinations and investigations have been careful to modify so-called “Upjohn warnings” relating to the importance of maintaining the confidentiality of employee’s conversations with the firm’s counsel (so as to preserve the attorney-client privilege) to ensure nothing in the warning could be interpreted as a directive that the employee not communicate with the firm’s regulators if he or she felt personally compelled to do so.

The Order highlights the importance of continuing to be sensitive to whistleblower concerns in Upjohn warnings. It also illuminates additional areas of attention for legal and compliance practitioners seeking to balance a Commission-regulated firm’s need to ensure clear and coordinated responses to regulatory inquiries and its interest in avoiding inadvertent waiver of the firm’s attorney-client and work-product privilege protections, whilst also complying with both the letter and spirit (as articulated in the adopting release) of Rule 21F-17.

The Commission has consistently articulated the importance of its whistleblower program¹¹ to fulfilling the Commission’s mandates to protect investors, and maintain fair, orderly, and efficient markets.

In 2016, the Division of Examination (then-known-as the Office of Compliance Inspections and Examinations) issued a risk alert stating it would examine registered broker-dealers and investment advisers’ compliance manuals, codes of ethics, employment agreements, and severance agreements to determine whether provisions in those documents may raise concerns under Rule 21F-17.¹² While it has been nearly five years since the alert was published, the Order shows that firms must remain diligent in scrutinizing policies, procedures, contracts, and agreements to ensure compliance with the Commission’s whistleblower protections.

Registrants with the Commodity Futures Trading Commission (“CFTC”) and those regulated by state securities regulators should also take notice as the CFTC has a program similar to the Commission’s whistleblower program, and late last year NASAA¹³ released a model act that closely tracks the Commission’s and the CFTC’s whistleblowers’ protection rule.¹⁴ Prior to the NASAA model rule, two states’ securities regulators¹⁵ already had provisions to protect whistleblowers. Additional states are expected to adopt a version of the model rule.

If you have any questions about compliance with the Commission’s, CFTC’s, or states’ rules on whistleblower incentives or protections, or about any other regulatory or enforcement matters relating to investment advisers or broker-dealers, please don’t hesitate to contact us.

Footnotes