ALERT MEMORANDUM Regulations in the U.K. and the U.S.

July 13, 2021 If you have any questions concerning this memorandum, please reach out to Prior to the COVID-19 pandemic, were your regular firm contact or the following authors at the center of many of the world’s biggest headlines; Lux Leaks, the Panama Papers, and Cambridge LONDON Analytica to name but a few. The past 15 months have Jonathan Ke l ly +44 20 7614 2266 only increased the importance of effective [email protected] whistleblowing programs, as the crises and disruption James Brady +44 20 7614 2364 caused by the COVID-19 pandemic have provided a [email protected] fertile ground for fraud and misconduct. In many cases, Ti m Vo g e l +44 20 7614 2229 these risks have been heightened by working patterns [email protected] since the wave of global lockdowns started in 2020; businesses’ usual systems of supervision, which may WASHINGTON DC Nowell Bamberger have identified wrongdoing at an early , are likely +1 202 974 1752 to have been disrupted by the rapid switch to home [email protected] working, providing an opportunity for misconduct to NEW YORK evade detection. Unlike the aftermath of previous severe Jennifer Kennedy Park +1 212 225 2357 market shocks (such as the 2008 financial crisis), [email protected] whistleblower procedures are now an entrenched part of Pedro Brandão e Souza +1 212 225 4351 commercial life and their effective implementation is [email protected] expected by regulators. Aaron Haines In recent months there have been important developments in +1 212 225 2144 [email protected] whistleblowing in both the United States and the United Kingdom. The U.K.’s Financial Conduct Authority has increased its resources devoted to addressing whistleblower reports, and U.S. Congress has amended whistleblower laws to expand the protection available to whistleblowers. In this memorandum we review these recent developments and place them in the context of other whistleblowing laws on both sides of the Atlantic.

clearygottlieb.com © Cleary Gottlieb Steen & Hamilton LLP, 2021. All rights reserved. This memorandum was prepared as a service to clients and other friends of Cleary Gottlieb to report on recent developments that may be of interest to them. The information in it is therefore general, and should not be considered or relied on as legal advice. Throughout this memorandum, “Cleary Gottlieb” and the “firm” refer to Cleary Gottlieb Steen & Hamilton LLP and its affiliated entities in certain jurisdictions, and the term “” includes offices of those affiliated entities.

ALERT MEMORANDUM

Developments in the U.K. In 2016, the Financial Conduct Authority (the “FCA”) and the Prudential Regulation Authority (the “PRA”) The Public Interest Disclosure Act 1998 (“PIDA”) is introduced enhanced whistleblowing rules 2 as part of the principal legislation in the whistleblower area and the Senior Managers and Certification Regime (the protects whistleblowers from negative treatment or “SMCR”), which aimed to improve culture and unfair dismissal. PIDA makes it unlawful to dismiss governance in financial services. These rules require an employee if the reason for the dismissal is that the large banks, building societies and insurers to appoint employee has made a “protected disclosure”. It also a senior manager or director (preferably a shields employees and certain categories of worker non-executive director) as a “whistleblowers’ from detrimental treatment (e.g., victimization, champion”, responsible for overseeing the integrity, harassment or bullying) on the basis they have made independence and effectiveness of the firm’s a “protected disclosure”. A “protected disclosure” has whistleblowing policies and preparing an annual two components: report for the board. Other measures which firms 1. what was disclosed — the worker must disclose subject to the SMCR must take include: information which they reasonably believe shows 1. maintaining appropriate and effective wrongdoing that falls under at least one of the arrangements for the disclosure of “reportable following categories: i) the commission of a concerns” (w hich is widely defined and includes criminal offence, ii) non-compliance with a legal “protected disclosures” under PIDA, breaches of obligation (including regulatory requirements), the firm’s policies and procedures, breaches of the iii) a miscarriage of justice, iv) health and safety, FCA’s or PRA’s rules and behavior that may environmental damage or v) deliberate harm the reputation or financial wellbeing of the concealment of any of the above. firm); 2. who was the disclosure made to — the qualifying 2. ensuring whistleblowers are able to make disclosure must be made to an appropriate person disclosures confidentially or anonymously; or . PIDA encourages workers to make “internal” disclosures to their employer. 3. escalating reportable concerns where appropriate, Disclosures to third parties may also qualify as including to the FCA or PRA; “protected disclosures” but in more limited 4. maintaining whistleblowing policies and circumstances which vary according to the procedures; category of third party the disclosure is made to.1 Disclosures to the media for instance will only be 5. providing staff with appropriate protected in very narrow circumstances. regarding whistleblowing; and The definition of “worker” in PIDA is broader than in 6. ensuring that wording in settlement agreements other rights under English law, and does not deter staff from making a protected includes contractors, members of a limited liability disclosure. partnership, trainees and agency staff. The worker In addition to regulatory provisions that expressly must also reasonably believe the disclosure is in the address whistleblowing, a number of other public interest. Additionally, there is no financial cap regulations impose relevant obligations, such as FCA on compensation in whistleblower claims, nor a Principle 11 3 and PRA Fundamental Rule 74. These requirement for a minimum period of service. rules create an obligation to deal with regulators in an open and way and to disclose to the

1 A “protected disclosure” may for example be made to a 2 See the FCA Handbook (at Chapter SYSC 18) and the list of “prescribed persons” (available here), which PRA Rulebook (at 2A (Whistleblowing) of the General includes the National Crime Agency, the Serious Fraud Organisational Requirements Part of the PRA Rulebook , the Competition and Markets Authority, Her for CRR firms, and the Whistleblowing Part of the PRA Majesty’s Revenue & Customs and the Health and Safety Rulebook for Solvency II firms). Executive. 3 U.K. FCA Handbook, PRIN 2.1 The Principles 4 PRA Rulebook, Fundamental Rules

2

ALERT MEMORANDUM

regulators anything of which they would reasonably wrongdoing directly to the FCA, and remind them that expect notice, which would include relevant issues their confidentiality will be protected when doing so. raised by whistleblowers when appropriate. The FCA’s Mark Steward (Executive Director of Whistleblowing procedures may also be relevant to Enforcement and Market Oversight) has emphasized the FCA will listen to and support all whistleblowers criminal liability under the Bribery Act 2010 and the who “shine a light on serious misconduct”, 9 and the Criminal Finances Act 2017. Under the Bribery Act, a company may be criminally liable for failing to campaign highlights the tools the FCA will employ to achieve this end. For the first time, whistleblowers prevent bribery committed by an associated person. An accused company can provide a complete defense disclosing matters to the FCA will have a dedicated case manager, and they will be able to meet with the if it shows it had “adequate procedures” in place at FCA to discuss their concerns and receive optional the relevant time to prevent bribery. Guidance on the Bribery Act published by the Ministry of Justice5 regular updates throughout an investigation. The headcount on the FCA’s whistleblowing team has suggests that appropriate whistleblowing procedures will be an important element of a company’s been increased. The FCA’s website has been updated “adequate procedures”. to provide more comprehensive information for potential whistleblowers and its whistleblowing team A similar position prevails in relation to the Criminal is developing a confidential web form, increasing the Finances Act 2017, which imposes corporate criminal ways in which whistleblowers can make disclosures liability for failing to prevent the facilitation of tax to the regulator. In addition, the FCA has published offences. Guidance issued by H.M. Revenue and new materials for firms to share with employees, and Customs 6 suggests that a company may be unable to will use its events to highlight the campaign’s defend itself on the basis that it had “reasonable messages. The FCA has also produced a digital toolkit procedures” in place to prevent the tax facilitation for industry bodies, consumer groups and offences where those procedures did not adequately whistleblowing groups which details i) how the FCA address whistleblowing. protects whistleblowers’ identities, ii) when U.K. regulators do not reward whistleblowers individuals should step forward and contact the financially unlike their counterparts in the U.S. (with regulator and iii) what the FCA does with the the exception of the U.K.’s Competition and Markets information shared. Authority which provides up to £100,000 for The FCA’s campaign adds clarity and intent to their information relating to cartel activity). This approach expectations for whistleblowing procedures, and is appears unlikely to change. In 2014, the FCA and recognition of the valuable function which PRA published the findings of their research into the whistleblowers are perceived to perform, as is also impact of financial incentives on whistleblowing, evident from recent enforcement action. In 2018, the which firmly concluded that financial incentives for FCA and PRA imposed a joint £642,430 penalty on whistleblowers did not encourage whistleblowing or Barclay’s CEO Jes Staley, for his repeated attempts to significantly increase integrity and transparency in uncover the identity of an anonymous whistleblower, financial markets. 7 which the regulators found constituted a failure to act In March 2021, the FCA launched a new campaign with the due skill, care and diligence expected from a 10 (titled “In confidence, with confidence”8) whic h aims CEO . Mr Staley’s conduct also led to a $15m to encourage individuals to report potential

5 Ministry of Justice Guidance on The Bribery Act 2010, 8 https://www.fca.org.uk/news/press-releases/fca- March 2011 launches-campaign-encourage-individuals-report- 6 Government guidance for the corporate offences of wrongdoing failure to prevent the criminal facilitation of tax evasion, 1 9 Ibid September 2017 10 FCA Final Notice to James Edward Staley, 11 May 7 Financial Incentives for Whistleblowers – Note by the 2018 FCA and the PRA for the Treasury Select Committee, July 2014

3

ALERT MEMORANDUM

penalty being imposed on Barclays by the New York 2. the creation of new criminal offenses, for State Department of Financial Services. 11 subjecting a person to detriment as a consequence of being a whistleblower or being a close relative The FCA has also recently emphasized that of a whistleblower, and for failing to handle a non-financial misconduct (such as ) protected disclosure adequately; is a priority and part of its push to improve the culture in financial services, and that firms need to have 3. the repeal of PIDA; and appropriate whistleblowing procedures to address the 12 4. the constitution of an independent body with issue. Equally, recent speeches from the FCA’s powers to set, monitor and enforce standards for executive team have indicated that issues of whistleblowing, and to investigate complaints and inclusion are regulatory matters and that firms from whistleblowers. should “create the right environment in which people of all backgrounds can speak up”13. Although it is not clear which bill, if any, will succeed in passing into law, this is a clear indication of the Despite such messaging, there are indications that momentum for reform in this area of the law. companies in the U.K. still have some way to go in order to meet regulators’ expectations. In a recent The EU Whistleblower Directive 18 (the “Directive”) survey of whistleblowing cases in the financial sector, provides some context for the prospective reform of a third of employers ignored the whistleblower’s whistleblowing laws in the U.K. On 16 December concerns.14 2019 the Directive entered into force, with the aim of fortifying inconsistent and fragmented safeguards for On the horizon there is the prospect of changes to the whistleblowers across the EU. Member states have current whistleblowing legislation in the U.K., which until 17 December 2021 to implement the Directive was described in a 2019 report15 by the All Party into national law. The Directive is broader than PIDA Parliamentary Group for Whistleblowing16 as in some key respects, for example the Directive: “complicated, overly legalistic, cumbersome, obsolete and fragmented” and in need of radical 1. protects certain categories of person which PIDA overhaul. Three different draft bills are making their does not, such as volunteers, non-executive way through the U.K. Parliament, each proposing far directors, self-employed contractors and reaching changes to the current whistleblowing applicants; 17 laws The bills seek to achieve this in different ways 2. applies to almost any organization (i.e., private but some of the features which they propose include: businesses employing at least 50 employees and 1. extensions to the scope of those entitled to all public entities); whistleblower protection, and to the definition of 3. requires internal reporting channels are a “protected disclosure” (to include for example established that allow for disclosures to be made; reckless financial speculation, the gross waste or mismanagement of public funds and a serious 4. specifies time frames for implementing follow up misuse or abuse of authority); actions after receiving a whistleblowing report; and

11https://www.dfs.ny.gov/system/files/documents/2019/01 16 Established in 2018 to consider the adequacy of /ea181218_barclays.pdf whistleblower protection in the U.K. 12 Letter from Megan Butler (FCA Executive Director of 17 The Public Interest Disclosure (Protection) Bill was Supervision (Investment and Wholesale)) to the Chair of introduced by Dr Philippa Whitford MP, the Office of the the House of Commons Women and Equalities Whistleblower Bill was sponsored by Baroness Kramer Committee, 28 September 2018 (Co-Chair of the All Party Parliamentry Group for 13 Why diversity and inclusion are regulatory issues, Whistleblowing) and A Bill to Strengthen Whistleblowing Speech by Nikhil Rathi, CEO of the FCA, 17 March 2021 Protection has been drafted by the whistleblowing charity 14 Silence in the City 2, Protect, June 2020 Protect. 15 All Party Parliamentary Group Report on 18 Directive of the European Parliament and of the Council Whistleblowing, July 2019 on the protection of persons who report breaches of Union law, dated 23 October 2019

4

ALERT MEMORANDUM

5. reverses the burden of proof in court proceedings. 2006 Tax Relief and Health Care Act provides Where it is established that a whistleblower has monetary incentives to whistleblowers who inform suffered a detriment, it is presumed that the the IRS of those who fail to pay taxes owed.23 detriment was made in retaliation for the Depending on the qualities of the entity or person that whistleblower’s disclosure, and it is for the failed to pay their taxes, the whistleblower may employer to show the detrimental measure was receive up to 30% of the taxes and penalties owed. taken on “duly justified grounds”. The CFTC Whistleblower Program started in 2010 provides monetary incentives for whistleblowers who Following Brexit the U.K. is not obliged to implement the Directive into U.K. law, but it remains provide information regarding potential violations of the Commodity Exchange Act. 24 The law also relevant for those companies with European provides the CFTC whistleblower with a cause of operations, in particular where a consistent global whistleblowing policy is to be implemented across action if their employer retaliates against them. Similarly, the Criminal Antitrust Anti-Retaliation Act offices in different regions. of 2020, 25 the Occupational Safety Health Act of U.K. Statistics 197026 and, most recently in 2021, the Anti-Money 27 During the period 1 April 2019 to 31 March 2020: Laundering Act each provide retaliation protection for whistleblowers who provide information — the FCA received 1,153 whistleblower reports regarding violations of these laws. The (consisting of 2,983 separate allegations). The whistleblowers’ remedies include reinstatement to FCA took significant action to mitigate harm in their previous employment and back pay. 19 only eight of those cases ; Additionally, some courts have permitted — the PRA received 196 “protected disclosures”. whistleblowers to recover punitive damages under Two of those disclosures directly contributed to certain whistleblowing law s. 28 enforcement activity or other intervention, and a Significant in the modern development of further 13 disclosures were of significant value whistleblower protections in the U.S. is the Sarbanes and contributed to the discharge of regulatory Oxley Act of 2002. It provides protection to 20 activity ; employees of publicly traded companies who report — the Serious Fraud Office managed 128 company conduct that the employee believes violates whistleblowing disclosures, taking further action an SEC rule or regulation or a federal law prohibiting in relation to 121 of those21; and fraud. 29 The whistleblower may inform a federal regulatory or law enforcement agency, Congress, or — the Competition and Markets Authority received an employee with supervisory authority over the 16 disclosures. Ten of those cases led to further 30 22 whistleblower. The company may not “discharge, investigation or action. demote, suspend, threaten, harass or discriminate” against the whistleblower for providing the information. 31 The whistleblower may file a Developments in the U.S. complaint with the Secretary of Labor alleging such Various U.S. federal agencies have whistleblower retaliation. They must do this within 180 days of the programs. The IRS’s Whistleblower Office under the retaliation or within 180 days of learning of the

19 FCA Annual Report and Accounts 2019/20 26 29 U.S.C. §660(c) 20 The Prescribed Persons (Reports on Disclosures of 27 31 U.S.C. §5323(g) Information) Regulations 2017 28 See, e.g., McNett v. Hardin Cmty. Fed. Credit Union, Annual Report, June 2020 2006 WL 2473000 (N.D. Ohio Aug. 24, 2006); Worcester 21 SFO Annual Report on Whistleblowing Disclosures v. Springfield Terminal Ry. Co., 827 F.3d 179 (1st Cir. 2019-2020 2016). 22 CMA Whistleblowing Statistics: 2019 to 2020 29 18 U.S.C. §1514A(a) 23 26 U.S.C. §7623 30 18 U.S.C. §1514A(a)(1) 24 7 U.S.C. §26 31 18 U.S.C. §1514A(a) 25 15 U.S.C. §7a-3

5

ALERT MEMORANDUM

retaliation. 32 If the Secretary of Labor does not render two times the amount of back pay, litigation costs, and a final decision within 180 days of receiving the reasonable attorneys’ fees. 38 complaint, the whistleblower may bring an action in a Significantly, Dodd Frank introduced a financial federal district court. If the whistleblower wins their reward system for whistleblowers. A whistleblower is retaliation claim, they are entitled to “all relief eligible for an award when the SEC brings a judicial necessary to make the employee whole” including or administrative action that results in sanctions reinstatement, back pay, litigation costs, and exceeding $1,000,000. 39 The SEC has discretion in reasonable attorney fees. 33 A whistleblower’s rights determining the amount of the whistleblower’s aw ard. under the act cannot be waived by “any agreement, The Commission considers factors such as the policy form, or condition of employment.”34 significance of the information provided and the In 2010, Congress passed the Dodd-Frank Act. It degree of assistance by the whistleblower in setting amended the Securities Exchange Act of 1934 and the award. 40 The whistleblower must receive no less was intended to “promote the financial stability of the than 10%, but no more than 30%, of the monetary United States by improving accountability and sanctions imposed against the company. 41 Certain transparency in the financial system.”35 Dodd-Frank individuals are not eligible to receive a whistleblower provided “a new, robust whistleblower program award, including employees of a regulatory agency, designed to motivate people who know of securities the DOJ or law enforcement. Additionally, a law violation to tell the SEC.”36 whistleblower may not recover an award if they are convicted of a crime related to the judicial action or if Like Sarbanes Oxley, Dodd-Frank provides they obtained the information through an audit and its whistleblowers with protection against retaliation. disclosure would violate 18 U.S.C. 78j-1 (which However, to qualify for protection under Dodd-Frank, provides the process by which an auditor is to report a whistleblower must make their report directly to the illegal activity). SEC. The Supreme Court made this clear in its 2019 decision, Digital Realty Trust, Inc. v. Somers. 37 In that U.S. Statistics 42 case, a whistleblower alleged that they brought a — Over $562 million has been awarded to 106 retaliation claim against their employer under the whistleblowers and $2.7 billion in monetary Dodd-Frank Act. The Court found that the sanctions have been imposed as a result of whistleblower was not entitled to Dodd-Frank whistleblower reports since the program’s retaliation protections because they had reported the inception; alleged violation to the company’s senior management rather than the SEC. — In 2020, the SEC received over 6,900 whistleblower tips. This was a 31% increase from Dodd-Frank allows a whistleblower to bring a private 2018 (the second highest tip year) and a 130% right of action against their employer for retaliation as increase from the program’s first year, 2012. well. However, Dodd-Frank does not require administrative exhaustion like Sarbanes Oxley. — Tips have come from over 130 countries with the Instead, a whistleblower may bring their claim highest number of tips coming from Canada, the directly to federal district court. If they prevail in their U.K., and China. retaliation action, remedies include reinstatement,

32 18 U.S.C. §1514A(b) 39 15 U.S.C. §78u-6(a)(1) 33 18 U.S.C. §1514A(c) 40 15 U.S.C. §78u-6(c)(1)(B) 34 18 U.S.C. §1514A(e) 41 15 U.S.C. §78u-6(b)ba 35 Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767, 773 42 These statistics were obtained from the Whistleblower (2019) (quoting 124 Stat. 1376). Program 2020 Annual Report to Congress from the SEC. 36 Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767, 773 Pursuant to Section 924(d) of Dodd-Frank and Section (2019) (quoting S. Rep. No. 111-176, pp. 38 (2010)). 21F(g)(5) of the Exchange Act, the SEC is required to 37 Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767 prepare this report annually. The most recent report is for (2019) the 2020 fiscal year which covers the period 1 October 38 15 U.S.C. §78u-6(h)(1)(C) 2019 through 30 September 2020.

6

ALERT MEMORANDUM

— In 2020, $175 million was awarded to 39 Similar to other whistleblower programs, the AMLA individuals, which equaled 31% of total dollars provides retaliation protections for whistleblowers. ever awarded to whistleblowers under the An aggrieved whistleblower must first seek remedy program and 37% of the individuals ever to from the Secretary of Labor and may file an action receive awards. Approximately two-thirds of the with a district court if the Secretary of Labor does not awards in 2020 were at or near the statutory issue a final decision within 180 days. Available maximum of 30%.; remedies include reinstatement, two times the amount of back pay, and litigation costs. — The largest award since inception is $114 million in 2020. Conclusion – Looking to the Future SEC 2020 Amendments Recent developments in the U.K. and the U.S. suggest On 7 December 2020, the SEC made a number of the importance of whistleblowing in the enforcement amendments to the whistleblower program. These context has grown and is likely to continue do so. T h is included: is supported by an increase in the number of whistleblower reports in the U.S. and the U.K. over — a presumption of awarding the statutory the last decade, the implementation of legislation in maximum for whistleblowers who furnished the U.S. focusing on whistleblower protections and information resulting in awards of $5 million or awards, the prospect of the reform of whistleblower less; laws in the U.K., the expansion of whistleblower — allowing awards based on deferred prosecution programs and the growing size and frequency of agreements, non-prosecution agreements and awards made to whistleblowers in the U.S.. settlement agreements; and Companies with international operations must remain — a uniform definition of “whistleblower” as vigilant for whistleblowing regimes across the globe explained by the Supreme Court in Digital Realty, that may impact their activities, and design their specifically requiring that a whistleblower report whistleblower programs accordingly. Recent directly to the Commission. developments such as the EU Whistleblower Directive remain relevant in this regard. Firms should Anti-Money Laundering Act of 2020 be mindful that their whistleblowing procedures must Earlier this year, Congress passed the Anti-Money be agile and move in tandem with shifting regulatory Laundering Act (“AMLA”), which creates a financial expectations and the evolution of the . award program for whistleblowers who provided Companies will need to keep abreast of this information regarding potential money laundering developing area of law and regulation to ensure that activity. T h e AMLA amends the Bank Secrecy Act of they remain in international as well as domestic 1970 and among other changes, provides that if an compliance, and with the spirit as well as the letter of individual furnishes information that results in a DOJ the relevant rules. action that results in monetary sanctions of over $1 … million, the Department of the Treasury is to award the whistleblower an amount equal to no more than CLEARY GOTTLIEB 30% of the total sanctions imposed. The information must be original and the whistleblower may provide it to their employer, the Department of the Treasury or the Attorney General. In determining the amount of the award, the Department of the Treasury is to consider the significance of the information, the degree of assistance that the whistleblower provided and the interests of the Department of the Treasury in deterring future violations of anti-money laundering.

7