result of the legal representation of a client on whose behalf the
whistleblower's services, or the services of his or her employer or
firm had been retained, unless the disclosure had been authorized as
stated above. Neither of these exclusions applied where an attorney is
permitted to disclose otherwise privileged information; for example, if
the privilege has been waived or if the disclosure is permissible
pursuant to the Commission's attorney conduct rules \119\ or applicable
state statutes or bar rules governing the ethical behavior of
attorneys.\120\
---------------------------------------------------------------------------

    \119\ 17 CFR 205.3(d)(2). This Commission Rule permits attorneys
representing issuers of securities to reveal to the Commission
``confidential information related to the representation to the
extent the attorney reasonably believes necessary'' (1) to prevent
the issuer from committing a material violation that is likely to
cause substantial injury to the financial interest or property of
the issuer or investors; (2) to prevent the issuer, in a Commission
investigation or administrative proceeding, from committing perjury,
suborning perjury, or committing any act that is likely to
perpetrate a fraud upon the Commission; or (3) to rectify the
consequences of a material violation by the issuer that caused, or
may cause, substantial injury to the financial interest or property
of the issuer or investors in the furtherance of which the
attorney's services were used.
    \120\ E.g., California Evidence Code Sec.  956 (``There is no
privilege under this article if the services of the lawyer were
sought or obtained to enable or aid anyone to commit or plan to
commit a crime or plan to commit a crime or fraud.'').
---------------------------------------------------------------------------

    The proposed exclusions in 21F-4(b)(4)(i) and (ii) recognized the
prominent role that attorneys play in all aspects of practice before
the Commission and the special duties they owe to clients. We observed
that compliance with the Federal securities laws is promoted when
individuals, corporate officers, and others consult with counsel about
possible violations, and the attorney-client privilege furthers such
consultation.\121\ This important benefit could be undermined if the
whistleblower award program created monetary incentives for counsel to
disclose information about possible securities violations in violation
of their ethical duties to maintain client confidentiality.\122\
---------------------------------------------------------------------------

    \121\ See Upjohn Co. v. U.S., 449 U.S. 383, 389 (1981) (``[The
attorney-client privilege's] purpose is to encourage full and frank
communication between attorneys and their clients and thereby
promote broader public interests in the observance of law and
administration of justice.'').
    \122\ United States of America ex rel Fair Laboratory Practices
Associates v. Quest Diagnostics, Inc., 2011 WL 1330542 (S.D.N.Y.
Apr. 5, 2011) (emphasizing ``the great Federal interest in
preserving the sanctity of the attorney-client relationship,'' the
court dismissed a False Claims Act qui tam action brought by a
partnership where the suit was based on attorney-client privileged
information that one of the relator's partners, an attorney,
disclosed in violation of New York's attorney ethics laws).
---------------------------------------------------------------------------

    The proposed exceptions for information obtained through privileged
attorney-client communications and for information obtained in the
legal representation of others did not apply, however, where the
attorney is already permitted to disclose the substance of a
communication that would otherwise be privileged. This included, for
example, circumstances where the privilege has been waived, or where
disclosure of confidential information to the Commission without the
client's consent is permitted pursuant to either 17 CFR 205.3(d)(2) or
the applicable state bar ethical rules.\123\
---------------------------------------------------------------------------

    \123\ See Model Rules of Professional Conduct 1.6(b), 1.13(c).
Model Rule 1.6(b), variants of which have been adopted by nearly
every state in the country and the District of Columbia, permits the
disclosure of information relating to the representation of a
client, among other things, where the lawyer reasonably believes the
disclosure is necessary (1) to prevent reasonably certain death or
substantial bodily harm; (2) to prevent the client from committing a
crime or fraud that is reasonably certain to result in substantial
injury to the financial interests or property of another and in
furtherance of which the client has used or is using the lawyer's
services; and (3) to prevent, mitigate or rectify substantial injury
to the financial interests or property of another that is reasonably
certain to result or has resulted from the client's commission of a
crime or fraud in furtherance of which the client has used the
lawyer's services. See Model Rule 1.6(b)(1)-(3). Model Rule 1.13(c)
provides that where an attorney reports violations of law to the
highest authority within an organization, and ``despite the lawyer's
efforts * * * the highest authority that can act on behalf of the
organization insists upon or fails to address in a timely and
appropriate manner an action, or a refusal to act, that is clearly a
violation of law, and (2) the lawyer reasonably believes that the
violation is reasonably certain to result in substantial injury to
the organization,'' the lawyer may reveal information relating to
the representation., notwithstanding Rule 1.6, but only to the
extent ``the lawyer reasonably believes necessary to prevent
substantial injury to the organization.''
---------------------------------------------------------------------------

    The exclusions did not preclude an individual who has independent
knowledge of facts indicating possible securities violations from
becoming a whistleblower if that individual chooses to consult with an
attorney. Facts in the possession of such an individual do not become
privileged simply because he or she consulted with an attorney.
b. Comments Received
    The Commission received a number of comments related to the
exclusions set forth in Proposed Rules 21F-4(b)(4)(i) and (ii). Most
commenters were generally supportive of the exclusions for the reasons
that we identified in our proposing release.\124\ A few commenters,
however, asserted that the exclusions are unnecessary, and that instead
we should rely upon judicial decisions and state bar opinions to decide
on a case-by-case basis whether we could use information that would
otherwise be covered by the proposed exclusions.\125\
---------------------------------------------------------------------------

    \124\ See, e.g., letters from NSCP; Grohovsky Group.
    \125\ See, e.g., letters from TAF; Stuart D. Meissner, LLC.
---------------------------------------------------------------------------

    Many commenters who were generally supportive of the exclusions
suggested modifications.\126\ Several commenters recommended that the
exclusions expressly apply to all information coming from

communications subject to the attorney-client privilege, whether or not
the whistleblower was an attorney, because non-attorneys are often in
possession of information that is subject to the privilege.\127\ Other
commenters wanted us to modify the rules to ensure that we are not
receiving privileged information.\128\ For example, one commenter
requested that the rule explicitly state that we are not seeking
privileged information, and, that if such information is provided to
us, we will not argue that the privilege was waived.\129\ Other
commenters recommended that the rule should exclude all information
coming from communications with attorneys, even if the privilege had
been waived.\130\
---------------------------------------------------------------------------

    \126\ See, e.g., letters from M.J. O'Loughlin; joint letter from
Apache, Cardinal Health, Goodyear, HP, Merck, Microsoft, Proctor &
Gamble, TRW, United Technologies (``Apache Group''); Financial
Services Roundtable; and GE Group; Arent Fox LLP; CCMC.
    \127\ See letters from Apache Group; Financial Services
Roundtable; and GE Group.
    \128\ See, e.g., letters from Arent Fox LLP; CCMC.
    \129\ See letter from Apache Group.
    \130\ See letter from NACD. See also letter from Eric Dixon,
LLC.
---------------------------------------------------------------------------

    One commenter recommended that we narrow the scope of the
exclusions so that, if the privileged information relates to an
entity's wrong-doing and the entity does not appropriately handle the
information, a whistleblower will be eligible for an award if he
submits it to us.\131\
---------------------------------------------------------------------------

    \131\ Letter from the Institute of Internal Auditors.
---------------------------------------------------------------------------

c. Final Rule
    After reviewing the comments, we are adopting proposed Rules 21F-
4(b)(4)(i) and (ii) with several modifications.\132\
---------------------------------------------------------------------------

    \132\ In addition, we made several stylistic changes to Rules
21F-4(b)(4)(i) and (ii) that do not affect the substance of either
provision. We have replaced ``authorized'' with ``permitted'' in
stating that attorney-client privileged information, or information
learned from the legal representation of a client, may qualify as
independent knowledge if its disclosure ``would otherwise be
permitted by an attorney.'' See letter from M.J. O'Loughlin. We have
also moved the phrase ``If you obtained the information'' from
Proposed Rule 21F-4(b)(4) into both Rules 21F-4(b)(4)(i) and
(b)(4)(ii).
---------------------------------------------------------------------------

    First, we have modified the language to clarify that both
exclusions apply to non-attorneys. Thus, if an attorney in possession
of the information would be precluded from receiving an award based on
his or her submission of the information to us, a non-attorney who
learns this information through a confidential attorney-client
communication would be similarly disqualified. Correspondingly, if an
attorney could submit the information to us under the same
circumstances consistent with applicable state bar rules (e.g., based
on waiver of the privilege or a crime-fraud exception), then a non-
attorney would similarly be eligible for an award for disclosing the
information.
    Second, we have modified Rule 21F-4(b)(4)(ii) to clarify that it
applies to attorneys who work in-house for an entity and provide legal
services (e.g., attorneys in an entity's general counsel's office). The
proposing rule may have been unclear about whether in-house attorneys
would be covered by Rule 21F-4(b)(4)(ii) because language in the rule
stated that the individual's services, or the services of his or her
employer or firm, need to ``have been retained.'' Additional ambiguity
was created by proposed Rule 21F-(4)(b)(4)(iv), which would have
created a separate exclusion for individuals who have ``legal''
responsibilities for an entity. The changes to the final rule clarify
our intention that all attorneys--whether specifically retained or
working in-house--are eligible for awards only to the extent that their
disclosures to us are consistent with their ethical obligations and our
Rule 205.3.
    With regard to the comments that we ensure that whistleblowers are
not providing us with privileged information, we believe that Rules
21F-4(b)(4)(i) and (ii) sufficiently address this concern because these
rules make clear that we will not reward attorneys or others for
providing us with information that could not otherwise be provided to
us consistent with an attorney's ethical obligations and Rule
205.3.\133\ While some comments suggested expanding \134\ or narrowing
\135\ the exclusions in Rules 21F(B)(4)(i) and (ii), we believe that
the final rule strikes the right balance because these exclusions are
consistent with the public policy judgments that have been made as to
when the benefits of permitting disclosure are justified
notwithstanding any potential harm to the attorney-client relationship.
---------------------------------------------------------------------------

    \133\ We have, however, modified Form TCR to ask whether the
whistleblower's submission relates to an entity of which the
whistleblower is or was a ``counsel.'' See Form TCR, Item D5a. In
addition, we modified Item 8 on proposed form TCR to ask the
whistleblower to identify with particularity any information
submitted by the whistleblower that was obtained from an attorney or
in a communication where an attorney was present. These questions
will enhance the staff's ability to identify the risk of receiving
privileged information and provide an appropriate way to balance the
Commission's interest in receiving information with the policy goal
of protecting the privilege. In addition, knowing this information
may allow the staff to quickly segregate potentially privileged
information for more detailed review and consideration.
    \134\ See, e.g., letter from NACD (suggesting that Rule 21F-
4(b)(4)(i) exclude all information coming from communications with
attorneys, even if the privilege had been waived).
    \135\ See, e.g., letter from Institute of Internal Auditors
(suggesting the exclusion for information subject to the attorney-
client privilege should be conditioned on the company in question
having investigated and reported the violation in question, so that
if the entity does not appropriately handle the information, an
individual should be able to report the violation and participate in
any whistleblower award).
---------------------------------------------------------------------------

    Nor do we agree with the comments suggesting that the exclusions
are unnecessary because even if we receive attorney-client privileged
information we can thereafter rely upon judicial opinions and ethics
decisions to determine whether we can use it.\136\ In our view, the
exclusions send a clear, important signal to attorneys, clients, and
others that there will be no prospect of financial benefit for
submitting information in violation of an attorney's ethical
obligations.
---------------------------------------------------------------------------

    \136\ See letters from TAF; NSCP.
---------------------------------------------------------------------------

(b) Responsible Company Personnel, Compliance Processes, and
Independent Public Accountants
    As proposed, Rule 21F-4(b)(4)(iii) excluded independent public
accountants who obtained information through an engagement required
under the Federal securities laws in certain circumstances. Proposed
Rules 21F-4(b)(4)(iv) and (v) provided that certain responsible company
officials and others who learned information through or in relation to
a company's processes for identifying and addressing possible
violations of law would not be able to use that information as the
basis for a whistleblower submission, subject to certain exceptions set
forth in the rules. We have made substantial changes to the proposed
rules. As modified, we are adopting these provisions as Rules 21F-
4(b)(4)(iii) and (v).
(i) Proposed Rule 21F-4(b)(4)(iii)
a. Proposed Rule
    Proposed Rule 21F-4(b)(4)(iii) excluded from the definition of
``independent knowledge'' or ``independent analysis'' information that
was obtained through the performance of an engagement required under
the securities laws by an independent public accountant, if that
information related to a violation by the engagement client or the
client's directors, officers or other employees. This proposed
exclusion would have applied only if the information related to a
violation by the engagement client or the client's directors, officers
or other employees.
b. Comments Received
    We received many comments related to this rule. Several commenters
submitted substantially similar comments about the proposed rule.\137\
Generally these commenters recommended expanding the statutory

exclusion to disqualify submissions that identified violations in
connection with the firm's own conduct,\138\ as well as through the
performance of non-audit services for audit clients,\139\ and audit or
other services for non-public clients.\140\ These commenters cited to
duties of confidence and reporting requirements to which independent
public accountants are subject under state law and professional conduct
codes, the importance of candor in the audit relationship, and
practical problems associated with permitting employees of accounting
firms to become whistleblowers in some relationship contexts but not in
others.
---------------------------------------------------------------------------

    \137\ Letters from PwC; Ernst & Young; KPMG; the Center for
Audit Quality.
    \138\ Letters from PwC; Ernst & Young; KPMG.
    \139\ Letters from PwC; Deloitte & Touche, LLP (``Deloitte'');
KPMG.
    \140\ Letters from PwC; Deloitte; KPMG.
---------------------------------------------------------------------------

    One commenter urged that the exclusion for independent public
accountants should also extend to information obtained by internal
company personnel in connection with their role supporting an
independent public accountant conducting an audit required under the
securities laws.'' \141\
---------------------------------------------------------------------------

    \141\ Letter from ABA.
---------------------------------------------------------------------------

    One commenter similarly urged that the exclusion be extended to all
employees who provide information at the request of auditors (both
independent and internal) and observed that under the proposed rule
company accountants providing information at the request of external
auditors will still be considered to have ``independent knowledge and
`independent analysis.'' \142\
---------------------------------------------------------------------------

    \142\ Letter from NACD.
---------------------------------------------------------------------------

    Another commenter expressed the view that independent public
accountants (as well as attorneys) should be permitted to become
whistleblowers, but with certain limitations.\143\ This commenter
pointed out that a junior member of the team may not be able to effect
change within a client if the senior members are unwilling to oppose
management. According to this commenter, auditors and attorneys should
be required to report violations internally first, have the ability to
do so anonymously, and then be permitted to make a whistleblower
submission to the Commission 75 days after making an internal report
(but not later than 90 days after their report) if the entity does not
respond appropriately.
---------------------------------------------------------------------------

    \143\ Letter from DC Bar.
---------------------------------------------------------------------------

    One commenter was concerned about circumstances where an
independent public accounting firm might violate its duties to report
under Exchange Act Section 10A.\144\ This commenter argued that
proposed Rule 21F-4(b)(4)(iii) should be revised to permit
whistleblowing when information about illegal acts is not reported to
the Commission by the client or the public accounting firm within the
time periods specified in Section 10A.
---------------------------------------------------------------------------

    \144\ Letter from TAF.
---------------------------------------------------------------------------

    Finally, as noted above, a number of commenters strongly objected
in principle to all of our efforts to create exclusions from
independent knowledge that are not expressly set forth in Section 21F,
including those for independent public accountants.\145\
---------------------------------------------------------------------------

    \145\ Letters from NWC; NCCMP; Stewart D. Meissner, LLC; TAF.
---------------------------------------------------------------------------

(ii) Proposed Rules 21F-4(b)(4)(iv) and (v)
a. Proposed Rules
    Proposed Rule 21F-4(b)(4)(iv) excluded from the definitions of
``independent knowledge'' and ``independent analysis'' information
obtained by a person with legal, compliance, audit, supervisory, or
governance responsibilities for an entity if the information was
communicated to that person with the reasonable expectation that he or
she would take appropriate steps to cause the entity to respond to the
violation. Proposed Rule 21F-4(b)(4)(v) excluded information that was
otherwise obtained from or through an entity's legal, compliance,
audit, or similar functions or processes for identifying, reporting,
and addressing potential non-compliance with applicable law. Each rule
was subject to an exception that made the exclusion inapplicable if the
entity did not disclose the information to the Commission in a
reasonable time, or proceeded in bad faith.
    As we explained in our Proposing Release, the rationale for these
proposed exclusions was our interest in not implementing Section 21F in
a way that created incentives for responsible persons who are informed
of wrongdoing, or others who obtain information through an entity's
legal, audit, compliance, and similar functions, to circumvent or
undermine the proper operation of the entity's internal processes for
responding to violations of law. We were concerned about creating
incentives for company personnel to seek a personal financial benefit
by ``front running'' internal investigations and similar processes that
are important components of effective company compliance programs. On
the other hand, we proposed that these exclusions would no longer apply
if the entity did not disclose the information to the Commission within
a reasonable time or proceeded in bad faith, thereby making an
individual who knew this information eligible to become a whistleblower
based upon his or her ``independent knowledge'' of the violations.
b. Comments Received
    We received many comments expressing sharply different views on
these rules. Several commenters expressed strong opposition to the
proposed rules. Among other things, these commenters said that the
proposed rules would preclude submissions from large numbers of
individuals who were in the best position to know about misconduct at
companies; that such deference to internal compliance processes is not
warranted; that compliance and audit officials may be subject to
retaliation, in particular in cases where senior management is
implicated in wrongdoing; that the proposed rules were overly broad in
their potential application to all supervisors and all employees who
had any exposure to compliance and related processes even if the
employee had other sources of knowledge; and that the exceptions to the
proposed rules suffered from a lack of clarity that would make them
unworkable in practice and would strongly discourage potential
whistleblowers.\146\
---------------------------------------------------------------------------

    \146\ See letters from NWC; Stuart D. Meissner, LLC; Daniel J.
Hurson; TAF; POGO; and Mark Thomas.
---------------------------------------------------------------------------

    Other commenters generally supported these exclusions in concept,
but offered numerous and varied suggestions for expanding, clarifying,
or modifying the proposed rules. For example, some recommended
broadening the exclusions to encompass other categories of employees,
or clarifying that the proposed rules would cover specific functions,
including operations, finance, technology, credit, risk, and similar
internal control functions; product management or other personnel
responsible for independent valuations of positions at financial
services firms; persons who perform the designated functions at
subsidiaries or other units of an entity; persons involved in processes
relating to required officer certifications and management disclosures
under Sections 302, 404, and 906 of the Sarbanes-Oxley Act; and persons
performing or supporting an internal audit function, including those
individuals who may perform the functions of internal audit but whose
job titles and responsibilities may differ.\147\
---------------------------------------------------------------------------

    \147\ See letters from ABA; SIFMA; Davis Polk; NSCP; and NACD.

---------------------------------------------------------------------------

    Commenters also offered different views on the exceptions to the
proposed rules permitting use of the excluded information if the entity
failed to disclose the information to the Commission within a
reasonable time or acted in bad faith. A number of commenters argued
against the exceptions and in favor of an absolute preclusion of
persons in the designated categories from becoming whistleblowers.
These commenters generally took the view that the persons described in
Proposed Rules 21F-4(b)(4)(iv) and (v) should promote a culture of
compliance and should be required to utilize internal procedures and
systems to address and report instances of noncompliance in all
circumstances.\148\ Certain other commenters recommended that our rules
provide that persons who have a legal, compliance, or similar function
in a company would be ineligible for an award unless they have first
reported the information to an entity's chief legal officer, chief
compliance officer, or a member of the board of directors.\149\
---------------------------------------------------------------------------

    \148\ See letters from Davis Polk; Jones Day; National
Association of Criminal Defense Lawyers; Paul, Hastings, Janofsky &
Walker LLP (``Paul Hastings''); Financial Services Roundtable; Alcoa
Group; Michael Davis; Les M. Taeger; AT&T Inc.; Eric Dixon, LLC;
Valspar; joint letter from Joseph Murphy, Esq., Donna Boehme, Esq.,
Rebecca Walker, Esq. (``Murphy''); Ethisphere Institute.
    \149\ See joint letter from U.S. Chamber of Commerce, Americans
for Limited Government, Ryder Systems, Inc. Financial Services
Institute, Inc., Verizon, White & Case, LLP (``Chamber of Commerce
Group''); letters from AT&T National Association of Criminal
Defense Lawyers and Apache Group; see also letter from DC Bar
(suggesting that individuals in these categories be required to
report violations internally first and wait 75 days for the entity
to respond appropriately before they are eligible to become
whistleblowers).
---------------------------------------------------------------------------

    A number of commenters took issue with the ``reasonable time''
language in Proposed Rules 21F-4(b)(4)(iv) and (v) and suggested
alternative approaches for determining when persons described in the
rules might be permitted to make whistleblower submissions.\150\ Many
of these commenters argued that the ``reasonable time'' standard would,
in practice, require companies to disclose all allegations of
wrongdoing, regardless of considerations such as the materiality or
credibility of the allegations, or the results of the company's
investigation. Others pointed out that, because the standard lacked
clarity, it would be difficult for persons in these categories to
determine whether the company had disclosed the violation and whether
it had done so within a ``reasonable time.'' Some commenters
recommended that we define a ``reasonable time'' as some fixed period;
e.g., 90-180 days.\151\
---------------------------------------------------------------------------

    \150\ See letters from ABA (eliminate ``reasonable time''
standard and only permit use of information in the event of bad
faith); Society of Corporate Secretaries (same); DC Bar (require
individuals in these categories to report violations internally
first and wait 75 days for the entity to respond appropriately
before they are eligible to become whistleblowers.); Cleary Gottlieb
Steen & Hamilton LLP (replace ``reasonable time'' with ``reasonable
and appropriately substantiated basis for believing that the company
has failed to remediate the alleged problem or has acted in bad
faith''); Apache Group (permit compliance personnel to become
whistleblowers if company failed to investigate and remediate,
including consideration of whether to self-report, within a
reasonable time); Chamber of Commerce Group (permit personnel in
these categories to use information only after reporting internally,
and if company failed to disclose information concerning
substantiated violations in a reasonable time).
    \151\ See letters from Patrick Burns, NACD, John G. Connolly,
Auditing Standards Committee, Financial Services Roundtable.
---------------------------------------------------------------------------

    Finally, commenters from diverse perspectives shared the view that
aspects of the proposed rules were vague and open to subjective
interpretations. Some believed that the lack of clarity could have the
effect of discouraging potential whistleblowers because they would not
want to risk their livelihoods and reputations in the face of
uncertainty concerning whether they might be eligible for an
award.\152\ However, others suggested that vagueness would encourage
persons in the categories designated in the proposed rules to make
their own subjective determinations (for example, of whether a
``reasonable time'' had passed), and would therefore prove disruptive
to internal compliance mechanisms.\153\
---------------------------------------------------------------------------

    \152\ See letters from TAF, DC Bar, Daniel J. Hurson, Stuart D.
Meissner LLC.
    \153\ See letters from ABA, Financial Services Roundtable,
Society of Corporate Secretaries, Protiviti, Alcoa Group.
---------------------------------------------------------------------------

(iii) Final Rules 21F-4(b)(4)(iii) and (v)
    After considering the comments, we are adopting the proposed rules
with substantial modifications. These provisions have been combined and
are now set forth in Rules 21F-4(b)(4)(iii) and (v).
    As adopted, Rules 21F-4(b)(4)(iii)(A) through (C) address
responsible company personnel with compliance-related responsibilities.
Rule 21F-4(b)(4)(iii)(D) (in conjunction with Rule 21F-8(c)(4),
discussed below) addresses independent public accountants.\154\ Rule
21F-4(b)(4)(v) sets forth exceptions that apply to these exclusions.
These rules are discussed separately below.
---------------------------------------------------------------------------

    \154\ We are addressing independent public accountants through
the rules noted above instead of adopting proposed Rule 21F-
4(b)(4)(iii). Paragraph (D) of Rule 21F-4(b)(4)(iii), discussed
below, excludes from the definition of independent knowledge or
analysis information that an accountant learns because of his work
on an engagement required under the Federal securities laws unless
certain enumerated exceptions apply. Rule 21F-8(c)(4) makes a
whistleblower ineligible from being considered for an award if the
information is gained through an audit of financial statements
required under the securities laws and the submission is ``contrary
to the requirements of Section 10A * * * '' as provided for in
Section 21F(c)(2)(C) (15 U.S.C. 78u-6(c)(2)(C)). After considering
the competing views of commenters, we believe these provisions,
taken together, strike a balance between the statute's goal of
encouraging high quality submissions by whistleblowers and a policy
of preventing auditors from getting a windfall from performing their
duties.
---------------------------------------------------------------------------

a. Rules 21F-4(b)(4)(iii)(A) Through (C)
    As discussed above, we believe there are good policy reasons to
exclude information from consideration as ``independent knowledge'' or
``independent analysis'' in the hands of certain persons, and in
certain circumstances, where its use in a whistleblower submission
might undermine the proper operation of internal compliance systems. At
the same time, we do not think it serves the purposes of Section 21F to
apply this principle in a manner that creates expansive new exclusions
for broad categories of company personnel (e.g., any supervisor, or any
employee involved in control functions or in processes related to
required CEO and CFO certifications). Instead, we believe that the
better approach, and one consistent with Congressional intent, is to
adopt more tailored exclusions for ``core'' persons and processes
related to internal compliance mechanisms, and to enhance the
incentives for employees to report wrongdoing through their company's
established internal procedures.\155\
---------------------------------------------------------------------------

    \155\ With respect to enhanced incentives, as discussed below,
we are adopting a rule that creates additional opportunities for
employees to obtain whistleblower awards by reporting information
through a company's internal whistleblower, legal, or compliance
mechanisms before or at the same time that they file a whistleblower
submission with us. See Rule 21F-4(c).
---------------------------------------------------------------------------

    In addition, we agree with the commenters who stated that greater
clarity in these rules will assist both whistleblowers and companies.
For this reason, we have identified by title or function specific
categories of personnel to whom the rules apply.
    Thus, as adopted, Rules 21F-4(b)(4)(iii)(A) through (C) describe
three categories of persons whom we will not treat as having
``independent knowledge'' or ``independent analysis'' for purposes of a
whistleblower submission, unless one of the exceptions listed in
paragraph (b)(4)(vi) applies.\156\ The first category, set forth

in paragraph (A), is officers, directors, trustees, or partners of an
entity if they obtained the information because another person informed
them of allegations of misconduct, or they learned the information in
connection with the entity's processes for identifying, reporting, and
addressing potential non-compliance with law. The term ``officer'' is
defined in Rule 3b-2 under the Exchange Act,\157\ and means ``a
president, vice president, secretary, treasurer or principal financial
officer, and any person routinely performing corresponding functions
with respect to any organization whether incorporated or
unincorporated.'' For example, a managing member of a limited liability
company who performs these types of functions would ordinarily fall
within this rule.
---------------------------------------------------------------------------

    \156\ Rule 21F-4(b)(4)(iii) only applies to the extent that an
individual is not subject to any of the exclusions set forth in
Rules 21F-4(b)(4)(i) or (ii). Thus, for example, if a company
officer receives a report that is covered by attorney-client
privilege, paragraph (i) would govern use of the information for
purposes of our rules.
    \157\ 17 CFR 240.3b-2.
---------------------------------------------------------------------------

    This provision combines and modifies several concepts that were
previously included in Proposed Rules 21F-4(b)(4)(iv) and (v). As
noted, we have identified with greater specificity the persons who are
covered by the rule. Further, instead of making the exclusion
applicable when information is communicated to one of these persons
``with the reasonable expectation that [the recipient] would take steps
to cause the entity to respond appropriately to the violation,'' the
rule applies whenever one of the designated persons is ``informed * * *
of allegations of misconduct.'' Thus, when an officer or one of the
other designated persons receives a report of possible illegal conduct,
the rule applies without the recipient having to evaluate the
``expectations'' of the person who made the report.\158\ We have also
narrowed the scope of the proposed rule by removing non-officer
supervisors from the list of designated persons. We agree with those
commenters who stated that including all supervisors at any level would
create too sweeping an exclusion of persons who may be in a key
position to learn about misconduct, and that such an exclusion would
not further the purposes of Section 21F.\159\
---------------------------------------------------------------------------

    \158\ See letter from ABA (noting problem of requiring the
recipient of information to ascertain the ``reasonable expectation''
of the person who reported the information).
    \159\ See letter from TAF.
---------------------------------------------------------------------------

    Paragraph (A) does not preclude officers and the other designated
persons from obtaining an award for a whistleblower submission in all
circumstances. As noted, the rule applies when someone else informs a
person in the designated categories about allegations of misconduct, or
the designated individual learns the information in connection with the
entity's processes for identifying, reporting, and addressing potential
non-compliance with law.\160\ Examples include learning about a
violation because an employee reports misconduct to the designated
person, being informed of an allegation of misconduct that came into
the company's hotline, or learning of a report from the company's
auditors regarding a potential illegal act. Paragraph (A) is not
intended to establish a general bar against officers, directors, and
other designated persons becoming whistleblowers any time they observe
possible violations at a company or other entity. For example,
paragraph (A) does not prevent an officer from becoming eligible for a
whistleblower award if the officer discovers information indicating
that other members of senior management are engaged in a securities law
violation.
---------------------------------------------------------------------------

    \160\ The phrase ``in connection with the entity's processes for
identifying, reporting, and addressing potential non-compliance with
law'' requires that the officer, director, or other designated
individual learn the information through official responsibilities
that relate to such processes.
---------------------------------------------------------------------------

    The second category of persons that Rule 21F-4(b)(4)(iii) excludes
from the definitions of ``independent knowledge'' and ``independent
analysis,'' as set forth in paragraph (B), are employees whose
principal duties involve compliance or internal audit responsibilities,
as well as employees of outside firms that are retained to perform
compliance or internal audit work for an entity. For example, a
compliance officer is subject to the rule whether he or she learns
about possible violations in the course of a compliance review or
another employee reports the information to the compliance officer.
Unlike the proposed rule, the rule does not include a company's lawyers
in either of paragraphs (A) or (B), because lawyers are subject to
professional obligations in their dealings with clients, and these are
specifically addressed in Rules 21F-4(B)(4)(i) and (ii).\161\
---------------------------------------------------------------------------

    \161\ See letter from SIFMA.
---------------------------------------------------------------------------

    Paragraph (C) of Rule 21F-4(b)(4)(iii) excludes information learned
by employees or other persons associated with firms that are retained
to conduct an internal investigation or inquiry into possible
violations of law in circumstances (as noted above), where the
information is not already excluded under Rules 21F-4(b)(4)(i) or (ii).
b. Rule 21F-4(b)(4)(iii)(D)
    Paragraph (D) of Rule 21F-4(b)(4)(iii) excludes information that is
learned by employees of, or other persons associated with, a public
accounting firm through an audit or other engagement required under the
Federal securities laws, if that information relates to a violation by
the engagement client or the client's directors, officers, or other
employees. It only applies to those engagements which are not covered
by Rule 21F-8(c)(4).
    Similar to other provisions under Rule 21F-4(b)(4), we are adopting
this new paragraph based on our concern about creating incentives for
independent public accountants to seek a personal financial benefit by
``front running'' the firm's proper handling of information obtained
through engagements required under the Federal securities laws.
Examples include engagements for broker dealer annual audits pursuant
to Rule 17a-5 under the Exchange Act \162\ and compliance with the
custody rule by advisors.\163\
---------------------------------------------------------------------------

    \162\ See Sec.  240.17a-5.
    \163\ See Sec.  275.206(4)-2.
---------------------------------------------------------------------------

    Paragraph (D), however, does not limit an individual from making a
specific and credible submission alleging that the public accounting
firm violated the Federal securities laws or professional
standards.\164\ If a whistleblower makes such an allegation, and if
that submission leads to a successful action against the engagement
client, its officers, or employees, then the whistleblower can obtain
an award for that action as well. Moreover, this exclusion does not
apply whenever the facts and circumstances fall within the scope of
exceptions contained in Rule 21F-4(b)(4)(v).
---------------------------------------------------------------------------

    \164\ See infra discussion of Rule 21F-8(c)(4).
---------------------------------------------------------------------------

c. Rule 21F-4(b)(4)(v)
    Rule 21F-4(b)(4)(v) sets forth exceptions to the application of
Rule 21F-4(b)(4)(iii). If any one of these circumstances is present, a
person in one of the designated categories under Rule 21F-4(b)(4)(iii)
may be eligible for a whistleblower award using information that is
otherwise excluded to that individual by operation of Rule 21F-
4(b)(4)(iii).
    The first exception to the operation of Rule 21F-4(b)(4)(iii)
applies when the designated person has a reasonable basis to believe
that disclosure of the information to the Commission is necessary to
prevent the relevant entity from engaging in conduct that is likely to
cause substantial injury to the financial interest or property of the
entity or investors.\165\ For purposes of

Rule 21F-4(b)(4)(v), in order for a whistleblower to claim a reasonable
belief that disclosure of information to the Commission is necessary to
prevent the relevant entity from committing substantial harm, we expect
that in most cases the whistleblower will need to demonstrate that
responsible management or governance personnel at the entity were aware
of the imminent violation and were not taking steps to prevent it. In
short, the whistleblower must have a reasonable basis for believing
that the entity is about to engage in conduct that is likely to cause
substantial injury to the financial interests of the entity or
investors, and that notification to the Commission is necessary to
prevent the entity from engaging in that conduct. In such cases, we
believe it is in the public interest to accept whistleblower
submissions and to reward whistleblowers--whether they are officers,
directors, auditors, or similar responsible personnel--who give us
information that allows us to take enforcement action to prevent
substantial injury to the entity or to investors.
---------------------------------------------------------------------------

    \165\ This provision is similar to the standard that governs the
circumstances in which an attorney appearing and practicing before
the Commission in the representation of an issuer may reveal
confidential information related to the representation without the
issuer's consent. See 17 CFR 205.3(d). However, we have not included
a requirement of a ``material violation,'' as is found in the
attorney conduct rule. As most whistleblowers under this provision
will not be attorneys, we have decided not to require that they make
legal judgments about whether a material violation has occurred, but
simply consider whether they have a reasonable basis to believe that
a report to the Commission is necessary to prevent conduct that is
likely to cause substantial injury to the financial interest or
property of the entity or investors.
---------------------------------------------------------------------------

    The second exception to the operation of Rule 21F-4(b)(4)(iii)
applies when the designated person has a reasonable basis to believe
that the entity is engaging in conduct that will impede an
investigation of the misconduct. Our proposed rule included a similar
exception for the entity's ``bad faith,'' and the language, as adopted,
is intended to make this standard clearer. Thus, for example, an
officer or other individual covered by Rule 21F-4(b)(4)(iii) is not
subject to the exclusion of that paragraph if he or she has a
reasonable basis to believe that the entity is destroying documents,
improperly influencing witnesses, or engaging in other improper conduct
that may hinder our investigation.
    Finally, under the third exception to Rule 21F-4(b)(4)(iii), an
officer, director, auditor or one of the other designated persons can
become a whistleblower after at least 120 days have elapsed since the
whistleblower provided the information to the audit committee, chief
legal officer, or chief compliance officer (or their equivalents) of
the entity at which the violation occurred, or to his or her
supervisor, or since the whistleblower received the information, if he
or she received it under circumstances indicating that the entity's
audit committee, chief legal officer, chief compliance officer (or
their equivalents), or his or her supervisor was already aware of the
information. As noted above, many commenters criticized as too vague
and unpredictable our proposed rule that would have permitted one of
the designated persons to make a whistleblower submission if an entity
failed to disclose the information to the Commission within a
reasonable time. In response to these comments, we have instead adopted
an exception that will permit a person in one of the designated
categories to become a whistleblower after a fixed period.
    The 120-day period begins to run either from the date the
whistleblower informed other senior responsible persons at the entity,
or his or her supervisor, about the violations, or from the date the
whistleblower received the information, if the whistleblower was aware
that these other persons already knew of the violations. Thus, an
officer, director, or other designated person cannot receive a report
of misconduct, and keep silent about it while waiting for the 120-day
period to run, in order to become eligible for a whistleblower award.
    The inclusion of a fixed 120-day period is intended for the benefit
of potential whistleblowers, so that they will have a date certain
after which they will no longer be ineligible to make a submission
based upon the information in their possession. It is not intended to
suggest to entities that they have a 120-day ``grace period'' for
determining their response to the violations. Furthermore, when
considering whether and to what extent to grant leniency to entities
for cooperating in our investigations and related enforcement actions,
the promptness with which entities voluntarily self-report their
misconduct to the public, to regulatory agencies, and to self-
regulatory organizations is an important factor.\166\
---------------------------------------------------------------------------

    \166\ See Report of Investigation Pursuant to Section 21(a) of
the Securities Exchange Act of 1934 and Commission Statement on the
Relationship of Cooperation to Agency Enforcement Decisions, SEC
Rel. Nos. 34-44969 and AAER-1470 (Oct. 23, 2001) (http://www.sec.gov/litigation/investreport/34-44969.htm.)
---------------------------------------------------------------------------

    At the same time, it is important to note that this rule is not
intended to, and does not, create any new or special duties of
disclosure on entities to report violations or possible violations of
law to the Commission or to other authorities. The provisions of this
rule are solely designed to provide greater specificity to certain
types of potential whistleblowers about the circumstances in which
their submissions will or will not make them eligible to receive an
award.
    Nor do we intend to suggest that an internal investigation should
in all cases be completed before an entity elects to self-report
violations, or that 120 days is intended as an implicit ``deadline''
for such an investigation. Companies frequently elect to contact the
staff in the early stages of an internal investigation in order to
self-report violations that have been identified. Depending on the
facts and circumstances of the particular case, and in the exercise of
its discretion, the staff may receive such information and agree to
await further results of the internal investigation before deciding its
own investigative course. This rule is not intended to alter this
practice in the future.
(c) Rule 21F-4(b)(4)(iv)--Conviction for Violations of Law

a. Proposed Rule

    Proposed Rule 21F-4(b)(4)(iv) excluded from the definition of
``independent knowledge'' information that a whistleblower obtained by
a means or in a manner that violates applicable Federal or state
criminal law. We explained our preliminary view that a whistleblower
should not be rewarded for violating a Federal or state criminal law.
b. Comments Received
    Comments on this proposal were divided. Several commenters argued
that the proposal went too far in excluding information provided by
whistleblowers.\167\ One commenter explained that the exclusion would
raise difficult questions involving state or Federal criminal law,
including who would decide whether evidence was gathered in violation
of State or Federal criminal law and under what standard of
proof''.\168\
---------------------------------------------------------------------------

    \167\ See, e.g., letters from Stuart D. Meissner, LLC; False
Claims Act Legal Center; NWC; Kurt Schulzke; Patrick Burns.
    \168\ See letter from Stuart D. Meissner, LLC.
---------------------------------------------------------------------------

    Another commenter stated that the Government has historically been
permitted to use documents without concern for how a whistleblower
obtained them as long as the Government did not direct a whistleblower
to take documents \169\ and there is no reason to bar a whistleblower

from obtaining an award if the Government would be permitted to use
those documents.
---------------------------------------------------------------------------

    \169\ See letter from False Claims Act Legal Center. See also
letter from Patrick Burns.
---------------------------------------------------------------------------

    Several commenters were supportive of the exclusion.\170\ One, for
example, stated that, even if additional securities law violations
might be uncovered by illegal acts, the result would be to undermine
respect for the rule of law.\171\ Another commenter recommended that
the exclusion should go beyond domestic criminal law violations to
include, among other things, state and Federal civil law.\172\
---------------------------------------------------------------------------

    \170\ See, e.g., letters from the NSCP; the American Accounting
Association; GE Group. See also letter from Wanda Bond.
    \171\ See letter from the NSCP.
    \172\ See letter from Financial Services Roundtable.
---------------------------------------------------------------------------

    With respect to whether the exclusion should extend to violations
of foreign criminal law, comments were divided.\173\ One commenter
stated that, without such an exclusion, individuals might be encouraged
to break the laws of foreign countries by the prospect of a
whistleblower award.\174\ Other commenters urged the Commission not to
extend the exclusion to violations of foreign criminal laws. One
commenter, for example, argued that there may be situations in which a
violation of a foreign criminal law is not a violation of a U.S.
Federal or state law, and that in such situations a whistleblower
should be able to obtain an award.\175\
---------------------------------------------------------------------------

    \173\ Compare letters from Financial Services Roundtable,
American Accounting Association, National Society of Corporate
Responsibility, TRACE International, Inc. (supporting extending
exclusion to violations of foreign law); with letters from VOICES,
POGO, and Georg Merkl (opposing extending exclusion to violations of
foreign law).
    \174\ See letter from TRACE International, Inc. See also, e.g.,
letters from the American Accounting Association; Financial Services
Roundtable; NSCP.
    \175\ See letter from POGO. See also letters from VOICES and
Georg Merkl.
---------------------------------------------------------------------------

    In addition, commenters were sharply divided on whether we should
exclude information obtained in violation of a judicial or
administrative protective order.\176\ Commenters that supported the
exclusion expressed concern that trade secrets and other sensitive
information might be disclosed if we were to permit awards for
information provided in violation of judicial or administrative protect
orders.\177\ Other commenters expressed a general concern that
protective orders are often negotiated between the parties and entered
in private litigation as a way to protect proprietary information and
should not operate to shield from the Commission information related to
securities law violations.\178\
---------------------------------------------------------------------------

    \176\ Pursuant to Rule 21F-17(a), protective orders entered in
SRO proceedings may not be used to prohibit parties from providing
the Commission with information about a possible securities law
violation.
    \177\ See, e.g., letters from Alcoa Group; Financial Services
Roundtable; and GE Group.
    \178\ See, e.g., letters from VOICES; Georg Merkl; Patrick
Burns.
---------------------------------------------------------------------------

c. Final Rule
    After reviewing the comments, we have decided to adopt the proposed
rule, renumbered as Rule 21F-4(b)(4)(iv), but with a modification.
Under Rule 21F-4(b)(4)(iv), a whistleblower's information will be
excluded from the definition of ``independent knowledge'' if he or she
obtained the information by a means or in a manner that is determined
by a domestic court to violate applicable Federal or state criminal
law.\179\
---------------------------------------------------------------------------

    \179\ This exclusion is also supported by Section 21F(c)(2)(B)
of the Exchange Act.
---------------------------------------------------------------------------

    We continue to believe that this exclusion is consistent with the
intent of Congress that the whistleblower award program not be used to
encourage or reward individuals for obtaining information in violation
of Federal or state criminal law--even if the information might
otherwise assist our enforcement of the Federal securities laws.
Nonetheless, we have decided that the exclusion will only apply where a
domestic court determines that the whistleblower obtained the
information in violation of Federal or state criminal law.\180\ We
believe that Federal and state courts are better positioned than we are
to determine whether a whistleblower obtained the information in
violation of criminal law.
---------------------------------------------------------------------------

    \180\ If a criminal case is pending or known to be contemplated
against a whistleblower, we may defer decision on an award
application until the criminal matter is resolved.
---------------------------------------------------------------------------

    We have determined not to extend the exclusion to cover information
obtained in violation of domestic civil or foreign law, or judicial or
administrative protective orders. Commenters raise a number of
persuasive points supporting and opposing these additional exclusions.
With respect to foreign law, we recognize that other countries often
have legal codes that vary greatly from our own, and we are not in a
position to decide as a categorical rule when it is appropriate to deny
an award based on foreign law.\181\ With respect to material that may
have been obtained in violation of domestic civil law, we believe that,
on balance, these exclusions would sweep too broadly and be difficult
to apply consistently given the patchwork of state and municipal civil
laws that might be implicated.
---------------------------------------------------------------------------

    \181\ While the proposed rule does not extend the exclusion to
information obtained or disclosed in violation of foreign law, we
recognize that potential whistleblowers in foreign jurisdictions may
have obligations to comply with applicable foreign laws. For
instance, some foreign jurisdictions impose criminal penalties for
unlawfully obtaining certain information or for unlawfully
disclosing certain information to authorities outside their borders.
---------------------------------------------------------------------------

    Finally, we find persuasive the comments that protective orders are
frequently negotiated between parties to private litigation and are
generally intended to protect proprietary information against public
disclosure or improper use. It would be against public policy for
litigants to obtain a protective order, or to seek enforcement of such
an order, for the purpose of preventing the disclosure of information
regarding violations of law to a law enforcement agency. For this
reason, we have determined not to exclude whistleblowers who provide us
with information that an opposing party may contend comes within the
scope of a protective order.
(d) Rule 21F-4(b)(4)(vi)--Information Obtained From Excluded Persons
    Proposed Rule 21F-4(b)(4)(vii) excluded persons from making
whistleblower submissions based upon information they obtained from
other persons in whose hands the same information would be excluded as
``independent knowledge'' or ``independent analysis.'' We are adopting
the proposed rule with slight modifications to respond to comments and
to increase clarity. This provision is now set forth at Rule 21F-
4(b)(4)(v).
a. Proposed Rule
    The proposed rule provided that we would not treat a whistleblower
submission as derived from ``independent knowledge'' or ``independent
analysis'' if the whistleblower obtained the information on which the
submission was based from any of the individuals described in Proposed
Rules 21F-4(b)(4)(i) through (vi) (the other exclusion provisions).
b. Comments Received
    One commenter expressed the view that the proposed rule effectively
created a ``hearsay'' exception to the whistleblower provisions that
could produce unintended results.\182\ The commenter offered the
example of an employee who overhears a conversation in which a
compliance officer admits to participation in a Ponzi scheme. Under the
proposed rule, the commenter pointed out, the employee would be
ineligible to receive a whistleblower award.
---------------------------------------------------------------------------

    \182\ See letter from NWC.
---------------------------------------------------------------------------

c. Final Rule
    After considering the comments, we are adopting a modified version
of the

rule. As adopted, Rule 21F-4(b)(vi) provides that a submission will not
be deemed to be derived from ``independent knowledge'' or ``independent
analysis'' if the whistleblower obtained the information for the
submission from a person who is subject to this section unless the
information is not excluded from that person's use, or the
whistleblower is providing the Commission with information about
possible violations involving that person.
    We added the phrase ``unless the information is not excluded from
that person's use'' to the proposed rule in order to clarify that Rule
21F-4(b)(4)(vi) is intended to be purely derivative; i.e., if the
person from whom the information was obtained is free to use the
information in a submission (for example, pursuant to the exceptions
for officers, directors, auditors and others found in Rule 21F-
4(b)(4)(v)), then this rule does not bar use of the information. In
order to address the potential for the unintended consequence suggested
in the comment, we also added the proviso that this exclusion does not
apply if the whistleblower is providing information about violations
involving the person from whom the information was obtained.
    We expect that Rule 21F-4(b)(4)(vi) will work in tandem with the
other exclusions set forth in Rule 21F-4(b)(4) to preclude submissions
in a limited set of circumstances. Thus, for example, if an employee
only learns about possible violations because he or she is interviewed
in the course of a company internal investigation, Rule 21F-4(b)(4)(vi)
will not permit that employee to file a whistleblower submission
claiming the information as his or her ``independent knowledge'' or
``independent analysis''.\183\ Similarly, if a senior company officer,
after receiving a report concerning possible securities violations,
gives the information to his or her assistant, the assistant will not
be able to seek an award based on the information as long as the
officer is barred from doing so.
---------------------------------------------------------------------------

    \183\ This assumes that the employee learns the information in
the interview from an attorney or other person subject to Rules 21F-
4(b)(4)(i) or (ii), or from someone subject to Rule 21F-
4(b)(4)(iii)(C). Depending on all of the facts and circumstances,
the employee could also be directly excluded under Rule 21F-
4(b)(4)(i) if the interview is determined to be covered by the
attorney-client privilege.
---------------------------------------------------------------------------

6. Rule 21F-4(b)(5)--Original Source
    Proposed Rule 21F-4(b)(5) described how we would determine if a
whistleblower was the ``original source'' of information that we
received from another source. We are adopting the rule as proposed,
with a slight modification to maintain consistency with other rule
changes.
a. Proposed Rule
    The proposed rule provided that we would consider a whistleblower
to be the ``original source'' of the same information that we obtained
from another source if the information satisfied the definition of
original information and the other source obtained the information from
the whistleblower or the whistleblower's representative. If the
whistleblower claimed to be the ``original source'' of information
provided to us by any of the authorities set forth in Proposed Rule
21F-4(a) (relating to the ``voluntary'' submission of information),
then the whistleblower would be required to have ``voluntarily''
provided the information to the other authority within the meaning of
Proposed Rule 21F-4(a).
    The proposed rule also required that the whistleblower establish
his or her status as the original source of information to our
satisfaction. In the event that the whistleblower claimed to be the
original source of information provided to us by one of the authorities
set forth in the rule or by another entity (including the
whistleblower's employer), the proposed rule further stated that we
might seek assistance and confirmation of the whistleblower's status
from the other entity.
b. Comments Received
    The few comments we received on this proposed rule primarily sought
clarification on its application to particular circumstances.
    One commenter requested that we clarify the situation in which one
person makes a submission based upon information obtained from a second
person, and the second person (the original source of the information)
later submits the same information.\184\ Another commenter noted the
potential for inequity that may result if the person who makes the
first whistleblower submission is later displaced from award
eligibility because the second submitter (e.g., the first person's
supervisor) claims to be ``the original source'' of information
submitted by the first person. The commenter expressed concern that the
second submitter might obtain the award, to the exclusion of the first
person, even though the second person may have known about the
violations for an extended period, done nothing to stop them, and only
made a submission after learning about the first person's
submission.\185\
---------------------------------------------------------------------------

    \184\ See letter from SIFMA.
    \185\ See letter from TAF.
---------------------------------------------------------------------------

    Another commenter suggested we make clear that if an individual
reports misconduct through a company's internal compliance or other
reporting processes, and the company subsequently self-reports the
violations to the Commission, the individual will be eligible for an
award as the ``original source'' of the information reported by the
company.\186\
---------------------------------------------------------------------------

    \186\ See letter from Baron & Budd, P.C.
---------------------------------------------------------------------------

c. Final Rule
    After considering the comments, we are adopting Rule 21F-4(b)(5) as
proposed with a slight modification to conform to other rule changes.
Specifically, we are modifying the list of governmental and other
authorities set forth in the rule to conform to the revised list set
forth in Rule 21F-4(a) (see discussion above).
    In addition, we provide the following clarifications to address the
comments. As the language of our rule indicates, if B makes a
whistleblower submission based upon information obtained from A, and A
later makes his or her own submission of that information, then A will
be considered the ``original source'' of the information (assuming that
A establishes his or her status as the original source and that the
information otherwise qualifies as ``original information'').\187\
---------------------------------------------------------------------------

    \187\ This does not by itself mean that an award is due. The
submitter must still satisfy all of the other requirements of
Section 21F and of our rules, including that the information was
submitted voluntarily, it led to a successful Commission enforcement
action or related action, and the submitter is not ineligible for an
award.
---------------------------------------------------------------------------

    However, A's status as the ``original source'' of the information
does not exclude B from award eligibility. In this example, because B
obtained the facts underlying his or her submission from A, and those
facts were not derived from publicly available sources, B would also be
deemed to have submitted information derived from his or her
``independent knowledge.'' Thus, both submissions could qualify as
``original information;'' B's because he or she was first to bring the
Commission information derived from ``independent knowledge,'' and A's
because he or she was the ``original source'' of information that, as
of B's submission, was already known to the Commission.
    Further, by virtue of being first-in-time, B may have an advantage
over A. If B's submission were sufficiently specific, credible, and
timely that it caused us to open an investigation, and if a successful
enforcement action

resulted, then we would consider whether B's submission ``led to'' our
successful action under the lower standard set forth in Rule 21F-
4(c)(1). Correspondingly, if A made his or her submission after we were
already investigating the matter that B brought to us, then A's
information would be evaluated under Rule 21F-4(c)(2), and A would have
to meet the additional requirement that his or her information
``significantly contributed'' to the success of the action. In this
regard, we note that A would also be considered the ``original source''
of any additional information he or she provided that materially added
to our base of knowledge.\188\
---------------------------------------------------------------------------

    \188\ See Rule 21F-4(b)(6).
---------------------------------------------------------------------------

    An individual can also be the ``original source'' of information
that we receive from an entity, including, for example, other
government authorities, the whistleblower's employer, or other entities
to which the individual may report misconduct. For example, an
individual would be the original source of information provided to the
Commission by his or her employer if the individual reports possible
violations in the first instance through his or her employer's internal
whistleblower, legal, or compliance procedures for reporting
allegations of possible violations of law, the company later self-
reports the individual's information to the Commission, and the
individual thereafter files a whistleblower submission. In fact, as is
further described below, our final rules seek to enhance the incentives
for employees to utilize their company's internal reporting systems,
and we provide a clear alternate path for persons who do so to be
considered eligible for an award if the company later self-reports
violations to the Commission as result of the individual's internal
report.\189\
---------------------------------------------------------------------------

    \189\ See Rules 21F-4(b)(7) and 4(c).
---------------------------------------------------------------------------

7. Rule 21F-4(b)(6)--Original Source; Additional Information
a. Proposed Rule
    Proposed rule 21F-4(b)(6) addressed circumstances where we already
know some information about a matter from other sources at the time
that we receive a whistleblower submission related to the same matter.
In that case, the proposed rule provided that we would consider the
whistleblower to be an ``original source'' of any information he or she
provided that was derived from the whistleblower's independent
knowledge or independent analysis, and that materially added to the
information already in our possession. As our Proposing Release
explained, this standard was modeled after the definition of ``original
source'' that Congress included in the False Claims Act through recent
amendments.\190\
---------------------------------------------------------------------------

    \190\ 31 U.S.C. 3730(e)(4)(B), Public Law 111-148 Sec.
10104(h)(2), 124 Stat. 901 (Mar. 23. 2010).
---------------------------------------------------------------------------

b. Comments Received
    One commenter suggested that we clarify how we plan to address the
situation where one whistleblower provides original information that
leads to successful enforcement of an action, and a second
whistleblower provides additional information that ``materially aids''
the enforcement of the same case.\191\
---------------------------------------------------------------------------

    \191\ See letter from SIFMA.
---------------------------------------------------------------------------

c. Final Rule
    After considering the comments, we are adopting Rule 21F-4(b)(6) as
proposed. Accordingly, a whistleblower will be deemed to be an
``original of source'' of information he or she provides that
materially adds to the Commission's base of knowledge about a matter.
In cases where a second whistleblower voluntarily provides information
that materially adds to what we already know about the matter, and
assuming that all of the other requirements of our rules are satisfied,
we will assess whether the additional information provided by the
second whistleblower also led to successful enforcement of our action
pursuant to the standards described in Rule 21F-4(c). If so, and if, as
a result, we determine that the second whistleblower is also entitled
to an award, then we will determine an award allocation among
whistleblowers pursuant to the criteria set forth in Rule 21F-6.
8. 21F-4(b)(7): Original Source: Lookback
a. Proposed Rule
    Proposed Rule 21F-4(b)(7) provided that, if a whistleblower
reported the original information to other authorities or people
identified in Proposed Rules 21F-4(b)(4)(iv) and (v) (personnel
involved in compliance or similar functions, or who are informed about
possible violations with the expectation that they will take steps to
address them), and the whistleblower within 90 days submitted the same
information to the Commission, we would consider that the whistleblower
provided the information as of the date of his or her original
disclosure to one of these other authorities or people. In proposing
this rule in this manner, we were seeking to protect the ability of the
whistleblower to pursue internal or other channels to quickly address
the violation while ensuring that the Commission receives this critical
information in a timely fashion.
b. Comments Received
    The Commission received numerous comments suggesting that we extend
the lookback period or eliminate it altogether. Commenters suggested
that 90 days was not sufficient time for an internal compliance or
review program to conduct a sufficiently thorough investigation and
suggested extending the period to 120 days, 180 days, or a reasonable
period of time.\192\ Others, also calling for a longer lookback period
or none at all, suggested that the time limit would burden
whistleblowers seeking to complete their own investigations and
complicate the process.\193\ Some commenters suggested that the
Commission should coordinate with other authorities to determine timing
rather than burden a whistleblower with proving the timing.\194\
---------------------------------------------------------------------------

    \192\ See, e.g., letters from Association of Criminal Defense
Lawyers, AT&T, Business Roundable Institute for Corporate Ethics
(``Business Roundtable''), NSCP.
    \193\ See, e.g., letters from Georg Merkl, NWC.
    \194\ See e.g. letter from Storch, Amini & Munves PC.
---------------------------------------------------------------------------

c. Final Rule
    In response to the almost uniform view of commenters suggesting a
longer lookback period, we are modifying the proposed rule to extend
the lookback period to 120 days. Thus, a whistleblower who first
reports to an entity's internal whistleblower, legal, or compliance
procedures for reporting allegations of possible violations of law and
within 120 days reports to the Commission could be an eligible
whistleblower whose submission is measured as if it had been made at
the earlier internal reporting date. This means that even if, in the
interim, another whistleblower has made a submission that caused the
staff to begin an investigation into the same matter, the whistleblower
who had first reported internally will be considered the first
whistleblower who came to the Commission, assuming that his information
was sufficiently specific and credible to have caused the staff to
begin an investigation.\195\
---------------------------------------------------------------------------

    \195\ However, in that instance, the other whistleblower would
still be considered for an award if his information significantly
contributed to the success of our enforcement action. See Rule 21F-
4(c)(2).
---------------------------------------------------------------------------

    We are balancing priorities with the length and existence of this
lookback

period, each with the ultimate objective of identifying and remedying
violations of the Federal securities laws quickly. On the one hand, the
Commission's primary goal, consistent with the congressional intent
behind Section 21F, is to encourage the submission of high-quality
information to facilitate the effectiveness and efficiency of the
Commission's enforcement program. For this reason, we are not requiring
that a whistleblower utilize an available internal compliance program
prior to submission to the Commission, and we are not providing for a
lookback period as long as requested by some commenters. Because of our
strong law enforcement interest in receiving high quality information
about misconduct quickly we have chosen a lookback period shorter than
the 180 days or more that some commenters requested.
    On the other hand, compliance with the Federal securities laws is
promoted when companies have effective programs for identifying,
correcting, and self-reporting unlawful conduct by company officers or
employees. The objective of this provision is to support, not
undermine, the effective functioning of company compliance and related
systems by allowing employees to take their concerns about possible
violations to appropriate company officials first while still
preserving their rights under the Commission's whistleblower program.
This objective is also important because internal compliance and
reporting systems are essential sources of information for companies
about misconduct that may not be securities-related (e.g., employment
discrimination or harassment complaints), as well as for securities-
related complaints. We believe that the balance struck in the final
rule will promote the continued development and maintenance of robust
compliance programs. As we noted in our proposing release, we are not
seeking to undermine effective company processes for receiving reports
on possible violations including those that may be outside of our
enforcement interest, but are nonetheless important for companies to
address.
    The inclusion of this provision is designed for the benefit of
whistleblowers by providing a reasonable period of time to make their
decisions. As discussed elsewhere in this release, we are not requiring
potential whistleblowers to use internal compliance and reporting
procedures before they make a whistleblower submission to the
Commission. Among our concerns was the fact that, while many employers
have compliance processes that are well-documented, thorough, and
robust, and offer whistleblowers appropriate assurances of
confidentiality, others do not. Thus, there may well be instances where
internal disclosures could be inconsistent with effective investigation
or the protection of whistleblowers. Ultimately, we believe that
whistleblowers are in the best position to assess whether reporting
potential securities violations through their companies' internal
compliance and reporting systems would be effective.
    Nevertheless, as we noted in our proposing release, we expect that
in appropriate cases, consistent with the public interest and our
obligation to preserve the confidentiality of a whistleblower, our
staff will, upon receiving a whistleblower complaint, contact a
company, describe the nature of the allegations, and give the company
an opportunity to investigate the matter and report back. The company's
actions in these circumstances will be considered in accordance with
the Commission's Report of Investigation Pursuant to Section 21(a) of
the Securities Exchange Act of 1934 and Commission Statement on the
Relationship of Cooperation to Agency Enforcement Decisions.\196\ This
has been the approach of the Enforcement staff in the past, and the
Commission expects that it will continue in the future. Thus, in this
respect, we do not expect our receipt of whistleblower complaints to
minimize the importance of effective company processes for addressing
allegations of wrongful conduct.\197\
---------------------------------------------------------------------------

    \196\ Exchange Act Release No. 44969 (October 23, 2001).
    \197\ See Rule 21F-6. In addition, as discussed below, in order
to encourage whistleblowers to utilize internal reporting processes,
we expect to give credit in the calculation of award amounts to
whistleblowers who utilize established internal procedures for the
receipt and consideration of complaints about misconduct. And, in
determining whether to give a company the opportunity to investigate
and report back, we may consider a number of factors, including, but
not limited to, information we have concerning the nature of the
alleged conduct, the level at which the conduct allegedly occurred,
and the company's existing culture related to corporate governance.
We may also consider information we have about the company's
internal compliance programs, including what role, if any, internal
compliance had in bringing the information to management's or the
Commission's attention.
---------------------------------------------------------------------------

9. Rule 21F-4(c)--Information That Leads to Successful Enforcement
a. Proposed Rule
    As proposed, Rule 21-4(c) explained when we would consider original
information to have led to successful enforcement. The Proposed Rule
distinguished between information regarding conduct not under
investigation or examination and information regarding conduct already
under investigation or examination.
    For information regarding conduct not under investigation or
examination, the Proposed Rule established a two-part test for
determining whether the information led to successful enforcement.
First, the information must have caused the staff to commence an
investigation or examination, reopen an investigation that had been
closed, or to inquire into new and different conduct as part of an
existing examination or investigation. Second, the information must
have ``significantly contributed'' to the success of an enforcement
action filed by the Commission.
    For information regarding conduct under investigation or
examination, the Proposed Rule provided a significantly higher
standard. To establish that information led to successful enforcement,
a whistleblower would need to demonstrate that the information: (1)
would not have otherwise been obtained; and (2) was essential to the
success of the action.
b. Comments Received
    Although a few commenters approved of the standards in the Proposed
Rule,\198\ most stated that the standards were too high, ambiguous, or
both.\199\ Several commenters criticized the requirement that
information not only cause the staff to open an investigation or
examination but also that it ``significantly contributed'' to the
success of the action, noting that the ``significantly contributed''
element is not contained in the statute and is too high a
standard.\200\ Commenters also expressed concern that the standard
would create uncertainty over when awards would be granted, which in
turn would make potential whistleblowers less likely to come forward
with information.\201\ One commenter suggested that we should examine
whether the whistleblower has provided ``enough information to get the
Commission to open an investigation.'' \202\
    Commenters also criticized the proposed standard applicable when
there is already an examination or investigation underway, arguing that
it would be almost impossible for whistleblowers to show that
information

would not have otherwise been obtained and was essential to the success
of the action.\203\ One commenter expressed concern that the standards
could result in anomalous outcomes, providing an example where one
whistleblower provides a bare-boned tip that causes the staff to open
an investigation (but does not ``significantly contribute'' to the
success of the action), and another whistleblower provides a subsequent
tip that is a complete roadmap of the case after the investigation has
been opened (but the information is not ``essential'' to the success of
the action), yet neither would receive an award.\204\
---------------------------------------------------------------------------

    \198\ See Chris Barnard; American Accounting Association,
Auditing Standards Committee.
    \199\ See, e.g., TAF; VOICES.
    \200\ See letters from American Association for Justice;
Grohovsky Group; Cornell Securities Law Clinic; TAF; VOICES; NWC.
    \201\ Letters from TAF; VOICES.
    \202\ See letter from Grohovsky Group.
    \203\ Letter from VOICES (arguing that, particularly given our
funding issues, we should not condition awards on the theoretical
possibility that the staff could uncover the evidence).
    \204\ Letter from Grohovsky Group.
---------------------------------------------------------------------------

    As noted, we requested comment on whether our rules should require
whistleblowers to report violations of the securities laws through
their internal compliance and reporting systems before submitting the
information to us. Comments on this issue were sharply divided. Many
commenters strongly supported such a requirement. In particular,
commenters argued that we should require internal reporting because
doing so will:
    1. Allow companies to take appropriate actions to remedy improper
conduct at an early stage; \205\
---------------------------------------------------------------------------

    \205\ See letters from Lum; Chamber of Commerce Group.
---------------------------------------------------------------------------

    2. Allow companies to self-report; \206\
---------------------------------------------------------------------------

    \206\ See letter from Baker, Donaldson, Bearman, Caldewell &
Berkowitz (``Baker Donaldson'').
---------------------------------------------------------------------------

    3. Avoid undermining internal compliance programs and preserve
systems companies have installed designed to deter, indentify, and
correct violations; \207\
---------------------------------------------------------------------------

    \207\ See letters from Baker Donaldson; Chamber of Commerce
Group; Foster Wheeler; Apache Group; Alcoa Group; Allstate Group.
---------------------------------------------------------------------------

    4. Allow the whistleblower program to supplement, rather than
supersede the internal control requirements under the Sarbanes-Oxley
Act of 2002; \208\
---------------------------------------------------------------------------

    \208\ See letters from Arent Fox; Alcoa Group.
---------------------------------------------------------------------------

    5. Allow the Commission to preserve its scarce resources by relying
upon corporate internal compliance programs; \209\
---------------------------------------------------------------------------

    \209\ See letter from ALG.
---------------------------------------------------------------------------

    6. Promote a working relationship between the Commission and
companies; \210\
---------------------------------------------------------------------------

    \210\ Id.
---------------------------------------------------------------------------

    7. Allow compliance personnel to address conduct that does not yet
rise to the level of a violation or is not a violation (based on a
misunderstanding of fact or law); \211\
---------------------------------------------------------------------------

    \211\ See letters from Foster Wheeler; Apache Group.
---------------------------------------------------------------------------

    8. Increase the quality of tips the Commission receives; \212\ and
---------------------------------------------------------------------------

    \212\ See letter from Apache Group.
---------------------------------------------------------------------------

    9. Avoid internal investigations being compromised by unwillingness
on the part of whistleblowers to participate.\213\
---------------------------------------------------------------------------

    \213\ See letter from Apache Group.
---------------------------------------------------------------------------

    Many other commenters strongly opposed a requirement that
whistleblower report internally before reporting to the Commission.
Several commenters argued that doing so would:
    1. Prohibit whistleblowers from reporting fraud directly and
immediately to the Commission; \214\
---------------------------------------------------------------------------

    \214\ See letter from NWC.
---------------------------------------------------------------------------

    2. Be inconsistent with Congressional intent; \215\
---------------------------------------------------------------------------

    \215\ See letters from TAF; POGO. See also Letter from Senator
Charles Grassley (``requiring whistleblowers to first go through
internal compliance programs would be at odds with the law Congress
wrote'').
---------------------------------------------------------------------------

    3. Create unnecessary and improper hurdles for whistleblowers;
\216\
---------------------------------------------------------------------------

    \216\ See letter from TAF.
---------------------------------------------------------------------------

    4. Place whistleblowers at risk of retaliation; \217\
---------------------------------------------------------------------------

    \217\ See letters from TAF; Grohovsky Group; POGO.
---------------------------------------------------------------------------

    5. Result in whistleblowers deciding not to report misconduct;
\218\
---------------------------------------------------------------------------

    \218\ See letters from Grohovsky Group; POGO.
---------------------------------------------------------------------------

    6. Eliminate incentives for companies to improve their internal
compliance programs.\219\
---------------------------------------------------------------------------

    \219\ See letter from POGO.
---------------------------------------------------------------------------

    7. Contravene an employee's right to disclose information
anonymously and directly to the Commission;\220\ and
---------------------------------------------------------------------------

    \220\ See letters from NWC and Daniel J. Hurson.
---------------------------------------------------------------------------

    8. Be inconsistent with the DOJ and IRS whistleblower
programs.\221\
---------------------------------------------------------------------------

    \221\ See letters from TAF and NWC.
---------------------------------------------------------------------------

c. Final Rule
    After considering the comments, we have significantly modified Rule
21F-4(c). First, we are persuaded by those commenters who stated that
the standards in the Proposed Rule were too high. As such, we have
adopted standards that should be easier to satisfy--both for
information regarding conduct not under investigation or examination
and information regarding conduct already under investigation or
examination--in the Final Rule.
    Moreover, as further described below, internal compliance programs
are not substitutes for rigorous law enforcement. However, we believe
that internal compliance programs play an important role. While we are
not requiring whistleblowers to report misconduct internally before
reporting to us, we agree that the incentives to do so should be
strengthened. Accordingly, the Final Rule includes a provision for a
new standard applicable to a whistleblower who reports information
internally. The details of the final rule are discussed below.
    i. Rule 21F-4(c)(1): Standard for information concerning conduct
not under investigation or examination.
    We have decided to lower the standard applicable to information
that concerns conduct not under investigation or examination. As noted
above, the Proposed Rule required that the information must have
``significantly contributed'' to the success of the action. In the
Final Rule, we have deleted ``significantly contributed'' from the
standard. Under the Final Rule, information will be considered to have
led to successful enforcement when it is sufficiently specific,
credible, and timely to cause the staff to commence an examination,
open an investigation, reopen an investigation that the Commission had
closed, or to inquire concerning different conduct as part of a current
examination or investigation, and the Commission brings a successful
judicial or administrative action based in whole or in part on the
conduct identified in the original information.
    We do not anticipate a rigid, mechanical application of this
standard. As a general matter, in assessing whether information `led
to' a successful enforcement action, we will examine the relationship
between the information in a submission and the allegations in the
Commission's complaint filed in the civil action or order filed in the
administrative proceeding. Our inquiry will focus on whether the
submission identifies persons, entities, places, times and/or conduct
that correspond to those alleged by the Commission in the judicial or
administrative action. As part of this analysis, we may consider
whether, and the extent to which, the information included: (1)
Allegations that formed the basis for any of the Commission's claims in
the judicial or administrative action; (2) provisions of the securities
laws that the Commission alleged as having been violated in the
judicial or administrative action; (3) culpable persons or entities (as
well as offices, divisions, subsidiaries or other subparts of entities)
that the Commission named as defendants, respondents or uncharged
wrongdoers in the judicial or administrative action; or (4) investors
or a defined group of investors that the Commission named as victims or
injured parties in the judicial or administrative action.
    The Final Rule also states that the information submitted by the
whistleblower must be sufficiently ``specific, credible and timely'' to
cause

the Commission to commence an investigation or examination. This new
language is intended to describe generally the type of information that
would cause our staff to open an investigation or examination. While we
believe it is appropriate to adopt a lower standard in the Final Rule,
due to our limited resources and the high volume of tips that we
receive each year, high-quality tips--ones that are specific, credible
and timely--are most likely to lead to a successful enforcement action.
    ii. Rule 21F-4(c)(2): Standard for information concerning conduct
already under investigation or examination.
    We have also decided to lower the standard applicable for
information that concerns conduct already under investigation or
examination. We agree with the commenters who expressed concern that
the standard in the Proposed Rule--that the information would not have
otherwise been obtained and was essential to the success of the
action--in practice might be too difficult to satisfy. As a result, for
information concerning conduct already under investigation or
examination, we will find information to have led to successful
enforcement when the information ``significantly contributed'' to the
success of our action.
    While we continue to believe that the primary focus of the program
is to encourage the submission of information regarding conduct not
already known to us, we recognize that in some cases information
voluntarily provided by a whistleblower can play a vital role in
advancing an existing investigation. Thus, a whistleblower will be
eligible for an award in a matter already under investigation if his or
her information ``significantly contributes'' to our success. In
applying this standard, among other things, we will look at factors
such as whether the information allowed us to bring: (1) Our successful
action in significantly less time or with significantly fewer
resources; (2) additional successful claims; or (3) successful claims
against additional individuals or entities.
    At the same time, we do not want to reward a whistleblower who has
obstructed an ongoing investigation in an effort to obtain an award. In
this regard, absent extraordinary circumstances, we will not consider
information to have ``significantly contributed'' to the success of our
action if: (i) We or some other law enforcement agency has issued a
subpoena or other document request, inquiry or demand to an entity or
an individual other than the whistleblower; (ii) there is evidence that
the whistleblower was aware of the investigative request, inquiry, or
demand; and (iii) the whistleblower withheld or delayed providing
responsive documents prior to making the related submission to the
Commission. This approach is consistent with one of the principal goals
of the program: To incentivize whistleblowers to come forward early
with information of possible violations of the securities laws rather
than wait until they become aware of an investigation by the Commission
or other agency.\222\ Further, it would not be good policy for a person
to be rewarded for ``significantly contributing'' to the success of an
action when he has knowingly obstructed the investigation of the
misconduct.
---------------------------------------------------------------------------

    \222\ See S. Rep. No. 111-176 at 110 (2010) (``The Whistleblower
Program aims to motivate those with inside knowledge to come forward
and assist the Government to identify and prosecute persons who have
violated securities laws * * *.'').
---------------------------------------------------------------------------

    iii. Rule 21F-4(c)(3): Additional incentives to encourage reporting
through internal compliance programs.
    Paragraph (3) of Rule 21F-4(c) is a new provision that has been
added, in response to comments, to create a significant financial
incentive for whistleblowers to report possible violations to internal
compliance programs before, or at the same time, they report to us. The
final rule provides that if: (1) A whistleblower reports original
information through his or her employer's internal whistleblower, legal
or compliance procedures before or at the same time he or she reports
them to the Commission; (2) the employer provides the Commission with
the whistleblower's information or with the results of an investigation
initiated in response to the whistleblower's information; and (3) the
information provided by the employer to the Commission ``led to''
successful enforcement under the criteria of Rule 21F-4(c)(1) or (2)
discussed above, then the whistleblower will receive full credit for
the information provided by the employer as if the whistleblower had
provided the information to us.\223\ Thus, when the employer provided
information ``led to'' a successful enforcement action, the
whistleblower will be eligible for an award, even if the information
the whistleblower originally provided to the employer would not have
satisfied the ``led to'' requirements.
---------------------------------------------------------------------------

    \223\ Employees who report internally in this manner will have
anti-retaliation employment protection to the extent provided for by
Section 21F(h)(1)(A)(iii) of the Exchange Act, which incorporates
the broad anti-retaliation protections of Sarbanes-Oxley Section
806, see 18 U.S.C. 1514A(b)(2).
---------------------------------------------------------------------------

    To qualify for an award under this new provision, the rule requires
that a whistleblower must provide information ``through an entity's
internal whistleblower, legal or compliance procedures for reporting
allegations of possible violations of law.'' A report to a supervisor
will qualify under this standard if the entity's internal compliance
procedures require or permit reporting misconduct in the first instance
to supervisors. Furthermore, if an entity does not have established
internal procedures for reporting violations of law, we will consider
an employee who reports a possible violation to the entity's legal
counsel, senior management, or a director or trustee to have provided
the information through the appropriate ``internal whistleblower, legal
or compliance procedures.'' \224\
---------------------------------------------------------------------------

    \224\ To qualify for consideration under Rule 21F-4(c)(3), a
whistleblower must establish that he or she provided original
information through the appropriate ``internal whistleblower, legal
or compliance procedures.'' Accordingly, prospective whistleblowers
will be better able to support their claims under this provision if
they generate, obtain and retain contemporaneous documentation
(e.g., e-mails or other written records) demonstrating their
compliance with the requirements of the Rule, including documents
evidencing: (i) the substance of the information; (ii) the means by
which the information was provided; (iii) the recipients of the
information; and (iv) the date on which the information was
provided.
---------------------------------------------------------------------------

    Rule 21F-4(c)(3) incentivizes whistleblowers to report internally
in appropriate circumstances by providing them a meaningful opportunity
to increase their probability of receiving an award. In effect,
reporting internally provides a second potential path to an award. We
anticipate that not only individuals who were predisposed to report
internally prior to the enactment of the whistleblower award program,
but also some who would not have been inclined to report internally,
will respond to Rule 21F-4(c)(3)'s financial incentive by utilizing
internal reporting procedures. Put differently, the rule's financial
incentives should both mitigate any diversion from internal reporting
of individuals who would be predisposed to report internally in the
absence of the whistleblower program, and incentivize new individuals
who otherwise might never have reported internally to enter the pool of
potential internal whistleblowers. As a result, the provision should
increase the likelihood that individuals will report misconduct to
effective internal reporting programs, allowing such programs to
continue to play an important role in facilitating compliance with the
securities laws.
    Although many commenters argued that we should require
whistleblowers to report possible violations internally either before
or contemporaneously with reporting to us, we are not

persuaded that such a requirement would achieve better overall
enforcement of the Federal securities laws than the approach we are
adopting for several reasons. First, we believe that there are a
significant number of whistleblowers who would respond to the financial
incentive offered by the whistleblower program by reporting only to the
Commission, but who would not come forward either to the Commission or
to the entity if the financial incentive were coupled with a mandatory
internal reporting requirement.\225\ In those cases, the Commission
would not receive critical information about possible securities law
violations, and companies and investors would suffer harm as ongoing
violations remained undetected and unremedied.
---------------------------------------------------------------------------

    \225\ Specifically, the fear of retaliation and other forms of
harassment, as well as other social and psychological factors, can
have a chilling effect on certain whistleblowers who, absent a
mandatory internal reporting requirement, would respond to the
financial incentive offered by the whistleblower program by
providing the Commission with information about possible securities
law violations. See discussion in Part IV(A)(7) of the Economic
Analysis. A number of commenters who routinely work with
whistleblowers supported this assessment. See, e.g., letters from
Grohvosky (explaining that if potential whistleblowers were required
to report internally, many would remain silent); TAF (same).
---------------------------------------------------------------------------

    Second, our approach should encourage companies to continue to
strengthen their internal compliance programs in an effort to promote
internal reporting. Potential whistleblowers are more likely to respond
to Rule 21F-4(c)(3)'s financial incentive by reporting internally when
they believe that the company or entity has a good internal compliance
program--i.e., a compliance program that will take their information
seriously and not retaliate.\226\ We anticipate that companies will
recognize this, take steps to promote a corporate environment where
employees understand that internal reporting can have a constructive
result, and that the net effect of this will be enhanced corporate
compliance with the Federal securities laws.
---------------------------------------------------------------------------

    \226\ See generally Richard E. Moberly, Sarbanes-Oxley's
Structural Model To Encourage Corporate Whistleblowers, 2006 BYU L.
REV. 1107, 1144 (2006).
---------------------------------------------------------------------------

    Third, while internal compliance programs are valuable, they are
not substitutes for strong law enforcement. In some cases, law
enforcement interests will be better served if we know of potential
fraud before the entities or individuals involved learn of our
investigation. This is particularly true when there is a risk that an
entity or individual may try to hinder or impede our investigation by,
for example, destroying documents or tampering with witnesses.\227\
Similarly, there are circumstances where a whistleblower may have
legitimate reasons for not wanting to report the information
internally, for example, legitimate concerns about misconduct by the
company's management or within the internal compliance program, or a
reasonable basis to fear retaliation or personal harm.
---------------------------------------------------------------------------

    \227\ Similarly, we note that a requirement for mandatory
internal reporting before reporting to the Commission would result
in undesirable outcomes in the case of entities' with ineffective
internal compliance processes. In these cases, mandatory internal
pre-reporting would lead to unnecessary delays before the violation
can be addressed by the Commission, resulting in potentially
increased injuries to the company and investors.
---------------------------------------------------------------------------

    In addition, we do not believe that a general requirement on
whistleblowers to report possible violations through internal
compliance procedures would be consistent with the language of, or
legislative intent underlying, Section 21F. As evidenced by the text of
Section 21F, the broad objective of the whistleblower program is to
enhance the Commission's law enforcement operations by increasing the
financial incentives for reporting and lowering the costs and barriers
to potential whistleblowers, so that they are more inclined to provide
the Commission with timely, useful information that the Commission
might not otherwise have received.\228\ However, as discussed above, a
general requirement that employees report internally as a condition of
participating in the whistleblower program would impose a barrier that
in some cases would dissuade potential whistleblowers from providing
information to the Commission, contrary to the purpose of the
whistleblower provision.\229\ Moreover, a mandatory internal reporting
requirement would deviate from the operation of other established
Federal whistleblower award programs, and there is no indication in the
text or legislative history of Section 21F that Congress intended that
result.\230\
---------------------------------------------------------------------------

    \228\ The statute incentivizes whistleblowers to report possible
securities law violations to the Commission by offering them
financial awards, reducing the risks from employment retaliation,
and lowering the barriers through user-friendly procedures and
appellate redress. See Section 21F(b)-(c) of the Exchange Act (10-
30% awards); id. 21F(d) (whistleblower anonymity); id. 21F(e) (no
contractual obligations can be imposed on whistleblowers unless
provided for in a Commission rule or regulation); id. 21(f) (right
of appeal); id. 21F(h) (anti-retaliation protection and heightened
confidentiality requirements for whistleblower identifying
information). See also Section 922(d) of Dodd-Frank Act (mandating a
study of the ``whistleblower protections'' established in Section
21F of the Exchange Act).
    \229\ Similarly, an internal reporting requirement would appear
inconsistent with the provisions of Section 21F that are designed to
protect the identity of a whistleblower. See Section 21F(d)(2) &
(h)(2). Simply put, even where an entity may have implemented
generally effective procedures for anonymous reporting, there will
be situations where a whistleblower's tip might, by the nature of
the information it discloses, reveal the identity of the
whistleblower--e.g., situations where only a few people would have
assess to the information. The financial incentives approach that we
are adopting allows the whistleblower to access whether an internal
report might disclose his identity and, if so, whether he wishes to
report internally notwithstanding this possibility.
    \230\ We also considered suggestions by some commenters that we
should require internal reporting by employees of issuers that are
subject to Section 301 of the Sarbanes-Oxley Act of 2002 (``SOX'')
in order to harmonize Section 21F with the requirement of Section
301 that listed companies have audit committee procedures for the
receipt, retention, and treatment of complaints regarding
accounting, internal accounting control, and auditing matters,
including procedures for the submission of information anonymously.
See, e.g. letters from Business Roundtable; ABA; U.S. Chamber of
Commerce Group; Alcoa Group. In Section 301 of SOX, Congress
mandated that listed companies establish structural mechanisms to
facilitate internal whistleblowing by employees. In Section 21F,
however, Congress chose a wholly different model--one that provides
financial incentives for employees and others to report violations
directly to the Commission. See Richard E. Moberly, Sarbanes-Oxley's
Structural Model To Encourage Corporate Whistleblowers, 2006 BYU L.
REV. 1107, 1108 n.5 (2006); Geoffrey Christopher Rapp, Beyond
Protection: Invigorating Incentives for Sarbanes-Oxley Corporate and
Securities Fraud Whistleblowers, 87 B.U.L.Rev. 91 (2007). We do not
think it appropriate to limit the path opened by Section 21F by a
Commission-imposed requirement that employees of listed companies
also utilize internal audit committee or other complaint procedures.
Further, even if a company has anonymous complaint procedures
consistent with Section 301 of SOX, in some cases an anonymous
whistleblower's identity can be gleaned from the facts and
circumstances surrounding the whistleblower's complaint. In those
situations, requiring the whistleblower to report internally would
be in tension with the mandate of Section 21F that we protect
information that could reasonably be expected to reveal the identity
of a whistleblower. See Section 21F(h)(2) of the Exchange Act.
Finally, as discussed above, we believe that our approach will
incentivize individuals who were pre-disposed to report internally
to continue to do so, and thus will significantly mitigate the
concern of commenters that our rules will undermine internal
reporting processes established pursuant to Section 301.
---------------------------------------------------------------------------

    At the same time, we also do not agree with the comment that no
provisions should be made in our rule to encourage internal reporting
because whistleblowers would do so anyway.\231\ Although some evidence
suggests that many whistleblowers will continue to

report misconduct internally,\232\ we understand that the financial
incentives established by Section 21F could have the potential to
divert other whistleblowers away from reporting internally. If this
diversion were significant, it might impair the usefulness of internal
compliance programs, which can play an important role in achieving
compliance with the securities laws. Accordingly, we believe that it is
appropriate for us to provide significant financial incentives as part
of the whistleblower program to encourage employees and other insiders
to report violations internally, while still leaving the ultimate
decision whether to report internally to the whistleblower.
---------------------------------------------------------------------------

    \231\ See, e.g., letter from NWC (``NWC strongly urges that the
Commission rules be revised and * * * treat employees equally
whether they choose to make their disclosures internally,
externally, or both.''). But cf. Chamber of Commerce Group (``In the
absence of an affirmative restriction on external reporting when
effective internal compliance channels are available, or provision
of a significant incentive for using those internal channels,
employees will face an irresistible temptation to go to the SEC with
their report.'') (emphasis added).
    \232\ See letter from NWC. This comment included a study
indicating that roughly 90% of individuals who eventually filed qui
tam suits under the False Claims Act also reported the misconduct
internally, without any incentives for internal reporting. It is not
clear that data about whistleblower behavior under the False Claims
Act necessarily will be an accurate predictor of behavior under our
program. The barriers to participation as a False Claims Act
whistleblower are appreciably higher than in our program: for
example, to be eligible for an award under the False Claims Act, a
qui tam relator must file a Federal court complaint alleging fraud
with specificity as required by Rule 9(b) of the Federal Rules of
Civil Procedure, whereas under our program, a whistleblower only
needs to complete a Form TCR, sworn under penalty of perjury.
---------------------------------------------------------------------------

10. Rule 21F-4(d)--Action
    Proposed Rule 21F-4(d) defined the term ``action'' to mean a single
captioned judicial or administrative proceeding. We are revising the
proposed rule to permit consideration of multiple cases that arise out
of a common nucleus of operative facts as a single ``action.''
a. Proposed Rule
    For purposes of calculating whether monetary sanctions in a
Commission action exceed the $1,000,000 threshold required for an award
payment pursuant to Section 21F of the Exchange Act, as well as
determining the collected sanctions on which awards are based,\233\
proposed rule 21F-4(d) defined ``action'' to mean a single captioned
civil or administrative proceeding. Under the proposed rule, ``action''
included all defendants or respondents and all claims brought within
that proceeding without regard to which specific defendants or
respondents, or which specific claims, were included in the action as a
result of the information that the whistleblower provided.
---------------------------------------------------------------------------

    \233\ See Proposed Rule 21F-5.
---------------------------------------------------------------------------

    Also, the proposed rule meant that the Commission would not
aggregate sanctions that are imposed in separate judicial or
administrative actions for purposes of determining whether the
$1,000,000 threshold is satisfied, even if the actions arise out of a
single investigation. For example, if a whistleblower's submission
leads to two separate enforcement actions, each with total sanctions of
$600,000, then no whistleblower award would be authorized because no
single action will have obtained sanctions exceeding $1,000,000.
b. Comments Received
    Commenters offered competing views on the proposed interpretation
of ``action.'' A number of commenters supported our proposed
definition.\234\ Several commenters disagreed with the proposal, urging
that the Commission should aggregate multiple Commission actions
arising out of a whistleblower's submission for purposes of satisfying
the $1,000,000 threshold \235\ because to do otherwise was to put form
over substance and not fully reward whistleblowers for the information
they provided that led to successful actions.\236\
---------------------------------------------------------------------------

    \234\ See letters from Chris Barnard, Auditing Standards
Committee, and Institute of Internal Auditors.
    \235\ See, letters from VOICES, NWC, Stuart D. Meissner, LLC,
Georg Merkl, and Wanda Bond.
    \236\ See letter from the NWC.
---------------------------------------------------------------------------

    Two other commenters argued that our definition of ``action''
should be narrowed so that, in a case involving multiple counts, only
the counts resulting from the whistleblower's information are
considered.\237\ These commenters were concerned that, without this
limitation, the rules would encourage whistleblowers to report even
minor violations in the hope that they will be grouped with more
serious violations in a single action with the result that all of the
sanctions in the action together meet the covered action threshold.
---------------------------------------------------------------------------

    \237\ See letters from the NSCP and SIFMA.
---------------------------------------------------------------------------

c. Final Rule
    After reviewing the comments, we are adopting the rule with
substantial modifications. Notwithstanding the use of the singular term
``action'' in Section 21F, we agree with the commenters who urged that
Congress did not intend for a meritorious whistleblower to be denied
consideration for an award simply because we chose to bring separate
proceedings against respondents or defendants involved in the same or
closely related conduct.\238\
---------------------------------------------------------------------------

    \238\ As noted above, two commenters argued that we should
interpret ``action'' narrowly such that we would only pay an award
to a whistleblower for monetary sanctions related to specific counts
in an action that were based upon the whistleblower's information.
We decline to do so. First, we do not believe that such a narrow
interpretation is consistent with the purpose of the whistleblower
program, which is to encourage whistleblowers to provide the
Commission with information that leads to successful enforcement
actions. The proposed narrow interpretation of action would reduce
incentives for whistleblowers to provide the Commission with
information because (i) it would create uncertainty regarding how
monetary sanctions may be assigned to specific counts and (ii) it
would not reward whistleblowers who provide the Commission with
information regarding lesser misconduct (although misconduct
sufficient to cause the Commission to open an investigation) but
which led the Commission to uncover much more significant
misconduct. Second, we do not believe that such a narrow
interpretation of action is practical. In contested actions, courts
often do not assign monetary sanctions against a single defendant on
a per count basis, and neither do Commission settlements. As such,
we would have no reasonable basis to assign specific amounts to
various counts in an action.
---------------------------------------------------------------------------

    Accordingly, as adopted, Rule 21F-4(d) defines the term ``action''
generally to mean a single captioned judicial or administrative
proceeding brought by the Commission. However, the rule also identifies
two exceptions to this general definition. First, an ``action'' will
constitute two or more Commission proceedings arising from the same
nucleus of operative facts for purposes of making an award under Rule
21F-10. Second, for purposes making payments under Rule 21F-14 on a
Commission action for which we have already made an award, we will
treat as part of that same action any subsequent Commission proceeding
that, individually, results in a monetary sanction of $1,000,000 or
less, and that arises out of the same nucleus of operative facts.
    The same-nucleus-of-operative-facts test is a well-established
legal standard that is satisfied where two proceedings, although
brought separately, share such a close factual basis that the
proceedings might logically have been brought together in one
proceeding.\239\ In exercising our discretion and deciding whether two
or more proceedings arise from the same nucleus of operative

facts, we intend to apply a flexible approach and will consider a
number of factors, including whether the separate proceedings involve
the same or similar: (1) Parties (whether named as defendants/
respondents or simply named within the complaint or order); (2) factual
allegations; (3) alleged violations of the Federal securities laws; or
(4) transactions or occurrences.\240\
---------------------------------------------------------------------------

    \239\ See, e.g., Harper v. AutoAlliance Intern., Inc., 392 F.3d
195, 209 (6th Cir. 2004) (``Claims form part of the same case or
controversy [for purposes of supplemental jurisdiction] when they
`derive from a common nucleus of operative facts.''') (quoting
Ahearn v. Charter Township of Bloomfield, 100 F.3d 451, 454-55 (6th
Cir. 1996)). To determine whether two or more proceedings involve
the same nucleus of operative facts, courts look at ``factors such
as `whether the facts are related in time, space, origin or
motivation,' `whether they form a convenient trial unit,' and
whether treating them as a unit `conforms to the parties'
expectations.''' In re Iannochino, 242 F.3d 36, 46 (1st Cir. 2001)
(quoting Restatement (Second) of Judgments Sec.  24 (1982))
(internal quotation marks omitted). See also Airframe Systems, Inc.
v. Raytheon Co., 601 F.3d 9, 15 (1st Cir. 2010). Put another way,
``as long as the new complaint grows out of the same transaction or
series of connected transactions as the old complaint, the causes of
action are considered to be identical.'' Kale v. Combined Ins. Co.,
924 F.2d 1161, 1166 (1st Cir. 1991) (internal quotation marks and
citations omitted).
    \240\ An administrative or judicial proceeding brought by the
Commission will be treated as part of only one covered action.
---------------------------------------------------------------------------

    Paragraph (d)(1) allows us to treat together as a covered action
for purposes of making an award under Rule 21F-10, two or more
administrative or judicial proceedings brought by the Commission if
those proceedings arise from the same nucleus of operative facts. So,
for example, if we bring multiple proceedings during the course of an
investigation, and these proceedings involve the same nucleus of
operative facts but none yields a monetary sanction in excess of
$1,000,000, we may nonetheless issue a Notice of Covered Action and
treat these proceedings as one covered action for purposes of making an
award under Rule 21F-10. Thus, if a qualified whistleblower provided us
with original information that led to the successful enforcement of any
one of the proceedings, we will make an award to that whistleblower for
10 to 30 percent of the total monetary sanctions collected in those
proceedings.
    Similarly, we will treat together a proceeding that yielded a
monetary sanction of $1,000,000 or less with a Commission proceeding
that alone would qualify as a covered action if the two proceedings
involve the same nucleus of operative facts. Here again, we believe
this is consistent with Congress's intent that qualified whistleblowers
who provide us with original information that leads to enforcement
proceedings yielding monetary sanctions in excess of $1,000,000 should
receive an award payout that fully reflects the monetary sanctions
collected.
    Paragraph (d)(1) also authorizes us to treat as a covered action
under Rule 21F-10 two or more Commission proceedings that otherwise
might individually qualify as covered actions where these proceedings
involve the same nucleus of operative facts. We believe that treating
these proceedings together under the Rule 21F-10 procedures as one
covered action, rather than processing them as separate covered
actions, will help make the awards procedures more efficient and user-
friendly, thereby further encouraging whistleblowers to come forward.
    Finally, paragraph (d)(2) provides that, for purposes of
determining the payment on an award pursuant to Rule 21F-14, we will
deem as part of the Commission action upon which the award was based
any subsequent Commission proceeding that, individually, results in a
monetary sanction of $1,000,000 or less, and that arises out of the
same nucleus of operative facts.\241\ For example, if we make a
whistleblower award for a covered action brought against an entity, but
thereafter bring a separate proceeding against the officer who was
responsible for the entity's conduct in which we do not recover in
excess of $1,000,000, we may in our discretion determine to treat the
second proceeding as part of the previous covered action and provide a
payment based on the total of the two proceedings.
---------------------------------------------------------------------------

    \241\ If a subsequent Commission proceeding arises from the same
nucleus of operative facts as two covered actions for which we have
already made awards, we will treat the subsequent proceeding as part
of the covered action to which it bears the closest relationship.