IMPLICATIONS OF THE SEC’S WHISTLEBLOWER RULES
FOR ATTORNEYS, THEIR PROFESSIONAL RESPONSIBILITIES,
AND THE ATTORNEY-CLIENT PRIVILEGE
Brian T. Sumner
In August 2011, the SEC’s final rule implementing the whistleblower award provisions
(Sections 922–24) of the Dodd-Frank Wall Street Reform and Consumer Protection Act became
effective.1 Prior to the issuance of the Final Rule, there had been considerable commentary about
the extent to which lawyers would be able to blow the whistle on their clients.2 Notwithstanding
the adoption of the Final Rule, there remains some confusion regarding the implications of the
inclusion of lawyers in the SEC’s new whistleblower program for attorneys’ professional
responsibilities and the attorney-client privilege.
In short, the Final Rule permits lawyers to blow the whistle on their clients under two sets
of circumstances, depending on whether the information falls within the classic definition of a
client confidence or arises in connection with an internal investigation, where the contours of the
privilege and confidentiality can be grayer. The Chief of the SEC’s Office of the Whistleblower
has said that Final Rule recognize that in “certain narrow circumstances, [the SEC] need[s]
[attorneys and audit and compliance personnel] to report wrongdoing.”3 The Final Rule also
permits the SEC to communicate directly with persons blowing the whistle on their employer
without contacting the company’s counsel.
Under the Final Rule, the circumstances under which the foregoing can take place are
limited, and, as a practical matter, will not likely result in a flood of lawyers blowing the whistle
on their clients. But, because the Final Rule risks intruding into areas historically protected by
the attorney-client privilege and the broader shield covering client confidences, companies and
their counsel need to be vigilant in understanding the nature of attorneys’ confidentiality
obligations and how those duties fit into the SEC’s new whistleblower regime, and to think about
their engagement of outside consultants through a framework similar to that which companies
are adopting to handle potential whistleblowers.
Circumstances Under Which Lawyers Can Blow the Whistle on Their Clients
Under the Final Rule, whether a lawyer can blow the whistle on a client depends on the
nature of the information at issue. The Final Rule prescribes different standards for information
1
See Securities Whistleblower Incentives and Protections, Exchange Act Release No. 64,545, 76 FED. REG.
34,300 (June 13, 2011) (codified at 17 C.F.R. pts. 240, 249) (the “Final Rule”).
2
See, e.g., Letter from Charles E. Grassley, U.S. Senate, to Mary L. Schapiro, Sec. & Exch. Comm’n (May
10, 2011), available at http://www.sec.gov/comments/s7-33-10/s73310-310.pdf; Letter from Stephen N.
Zack, President, Am. Bar Ass’n, to Mary L. Schapiro, Sec. & Exch. Comm’n (May 20, 2011), available at
http://www.sec.gov/comments/s7-33-10/s73310-315.pdf.
3
Yin Wilczek, “SEC Whistleblower Office to Monitor Bounty Program for ‘Unintended’ Effects,” BNA
Daily Report for Executives (Aug. 12, 2011).
1
subject to the attorney-client privilege or obtained in connection with a legal representation, on
the one hand, and information obtained pursuant to inquiries and investigations by counsel, on
the other.
First, information that is obtained “through a communication that was subject to the
attorney-client privilege” or “in connection with the legal representation of a client on whose
behalf [the whistleblower] or [the whistleblower’s] employer or firm [is] providing services, and
[the whistleblower] seek[s] to use the information to make a whistleblower submission for [his or
her] own benefit” is not “original information”—and is therefore ineligible for a whistleblower
award—unless disclosure “would otherwise be permitted by an attorney pursuant to
Section 205.3(d)(2) of this chapter, the applicable state attorney conduct rules, or otherwise.”4
The Commission stated that the limited exceptions to the exclusion of privileged information
“send a clear, important signal to attorneys, clients, and others that there will be no prospect of
financial benefit for submitting information in violation of an attorney’s ethical obligations.”5
The circumstances under which lawyers may disclose client confidences are narrow
under state bar ethics rules: most jurisdictions have adopted a variation of the crime-fraud
exception found in ABA Model Rule of Professional Conduct 1.6. The issue with the Final
Rule’s exception to the exclusion of privileged information and client confidences arises in
connection with the SEC’s standards of conduct for attorneys, which are codified at 17 C.F.R.
§ 205 and govern attorneys appearing and practicing before the Commission on behalf of an
issuer, and the tension between Part 205 and state ethics rules.6 Specifically, Section 205(d)(2)
states that an attorney may reveal client confidences to the Commission “to the extent the
attorney reasonably believes necessary” under the following circumstances:
(i) To prevent the issuer from committing a material
violation that is likely to cause substantial injury to the
financial interest or property of the issuer or investors;
(ii) To prevent the issuer, in a Commission investigation or
administrative proceeding, from committing perjury, . . .
suborning perjury, . . . or committing any act proscribed in
18 U.S.C. § 1001 [prohibiting, among other things, false
statements to government officials] that is likely to
perpetrate a fraud upon the Commission; or
(iii) To rectify the consequences of a material violation by
the issuer that caused, or may cause, substantial injury to
the financial interest or property of the issuer or investors in
furtherance of which the attorney’s services were used.
4
See 17 C.F.R. §§ 240.21F-4(b)(4)(i)–(ii).
5
Final Rule at 34,315.
6
See Howard W. Goldstein, “Attorneys and Whistleblowing,” BUS. CRIMES BULLETIN (July 2011).
2
The foregoing standard differs from many states’ ethics rules. Part 205 recognizes as much and
provides that where state rules conflict the SEC’s rules, Part 205 will control.7 This conflict puts
attorneys in a difficult spot. Disclosure and a whistleblower award may be permitted under the
SEC’s rules, but not under state bar rules. Attorneys who know the same information about an
issuer client but practice law in different jurisdictions, and lawyers with multijurisdictional
practices, might be subject to differing ethics rules relating to the disclosure of client
confidences, and the status of the SEC’s rules vis-à-vis their state ethics obligations might be
entirely unclear. Moreover, companies will be unclear about their various lawyers’ professional
obligations with respect to their confidences.
The tension between Part 205 and state ethical obligations, however, has existed since
Part 205 was adopted in 2003 pursuant to the Sarbanes-Oxley Act, and no court has since
determined whether Part 205 preempts state ethical obligations. The whistleblower rules do not
change that. Rather, they create a financial incentive for attorneys to blow the whistle, should
one of the exceptions under Part 205 or state professional responsibility rules be available to
them. Some commentators have expressed the concern that, in light of the potential monetary
payoff, attorneys will actively seek out an exception under Part 205 in order to be able to blow
the whistle on a client. For some time and without financial incentives, however, attorneys have
provided information about their clients to the Commission consistent with relevant professional
regulations. Given the potential consequences under state law, however, most commentators do
not expect significantly more attorneys to provide such information to the SEC merely because
of the whistleblower award program.
Second, only to the extent not covered by the exclusions for attorney-client privileged
communications and information obtained in connection with a legal representation discussed
above,8 information “obtained . . . because [the whistleblower was]: . . . [e]mployed by or
otherwise associated with a firm retained to conduct an inquiry or investigation into possible
violations of law” is not “original information”—and is therefore ineligible for a whistleblower
award—unless one of three exceptions applies. Those exceptions are as follows:
(A) [The whistleblower has] a reasonable basis to believe
that disclosure of the information to the Commission is
necessary to prevent the relevant entity from engaging in
conduct that is likely to cause substantial injury to the
financial interest or property of the entity or investors;
7
See 17 C.F.R. § 205.1. If a state’s rules permit more disclosures than Part 205, however, the state’s rules
will govern. See Implementation of Standards of Professional Conduct for Attorneys, Exchange Act
Release No. 47,276, Part II “Section 205.1 Purpose and Scope” (Jan. 29, 2003).
8
See Final Rule at 34,317 n.156 (“Rule 21F-4(b)(iii) only applies to the extent that an individual is not
subject to any of the exclusions set forth in Rules 21F-4(b)(i) or (ii). Thus, for example, if a company
officer receives a report that is covered by attorney-client privilege, paragraph (i) would govern use of the
information for purposes of our rules.”) and 34,318 (“Paragraph (C) of Rule 21F-4(b)(4)(iii) excludes
information learned by employees or other persons associated with firms that are retained to conduct an
internal investigation or inquiry into possible violations of law in circumstances (as noted above), where
the information is not already excluded under Rules 21F-4(b)(4)(i) or (ii).”)
3
(B) [The whistleblower has] a reasonable basis to believe
that the relevant entity is engaging in conduct that will
impede an investigation of the misconduct;9 or
(C)
At least 120 days have elapsed since [the
whistleblower] provided the information to the relevant
entity’s audit committee, chief legal officer, chief
compliance officer (or their equivalents), or [the
whistleblower’s] supervisor, or since [the whistleblower]
received the information, if [the whistleblower] received it
under circumstances indicating that the entity’s audit
committee, chief legal officer, chief compliance officer (or
their equivalents), or [the whistleblower’s] supervisor was
already aware of the information.10
The Commission acknowledged in its adopting release that “most whistleblowers under
this provision will not be attorneys,”11 but the foregoing exceptions to the exclusion nevertheless
present several issues for counsel:

First, unlike exception (i), above, in the SEC’s lawyer conduct rules,12 no
“material” violation of the federal securities laws is required to permit
someone to disclose information obtained in connection with an internal
investigation or similar work under exception (A), above.13 Creating a
different standard was a deliberate choice by the Commission.14

Second, notwithstanding the Final Rule’s statement to the contrary,15 the 120day period effectively puts a stopwatch on all internal investigations of
allegations reported in-house. The Final Rule states that companies
“frequently elect to contact the staff in the early stages of an internal
investigation in order to self-report violations that have been identified” but
neglect to acknowledge that most companies would prefer to determine the
full scope of the violations (including whether they are material) before
deciding whether to self-report, and, if the company elects to self-report, how
best to approach the SEC Staff.
9
This exception is designed to capture such conduct as document destruction and improper influencing of
witnesses. See Final Rule at 34,319.
10
17 C.F.R. § 240.21F-4(b)(4)(v)(A)–(C).
11
Final Rule at 34,319 n.165.
12
17 C.F.R. § 205(d)(2)(i).
13
17 C.F.R. § 240.21F-b(4)(v)(A).
14
See Final Rule at 34,318–19 n.165.
15
See Final Rule at 34,319.
4

Third, the 120-day clock starts when the whistleblower provides the
information to any number of specified people, including his or her immediate
supervisor, or when the whistleblower received the information, if he or she
received it under circumstances indicating that any number of specified
people, including the whistleblower’s immediate supervisor, was already
aware of the information.16 Depending on the whistleblower’s position and the
size of the company, the whistleblower’s immediate supervisor may be a
junior manager far removed from the members of the audit committee, the
chief legal officer, and the chief compliance officer and the various
compliance issues with which those persons work on a regular basis.
The Commission’s acknowledgement that attorneys will not commonly fall within the exclusion
for information obtained in connection with an inquiry or investigation into possible violations of
law reflects the importance the Commission has placed on preserving client confidences. It is
difficult to imagine circumstances under which information obtained by a lawyer who was
retained to conduct an internal investigation would not be covered by the attorney-client
privilege or considered information obtained in connection with a legal representation. An
example of information that would fall within the exclusion is information obtained by a nonlawyer (e.g., compliance consultant) retained by a company to conduct such an investigation
(without the involvement of counsel).
SEC Staff Communications with Whistleblowers
The Final Rule authorizes the SEC Staff to communicate directly with directors, officers,
members, agents, and employees of entities that have counsel, provided that individual “initiated
communication with the Commission relating to a possible securities law violation,” without
obtaining the consent of the entity’s counsel.17 This would appear to depart from long-standing
ethics rules governing communications with represented persons.
ABA Model Rule 4.2 prohibits lawyers from communicating about the subject of a
representation with a person the lawyer knows to be represented by another lawyer in the matter,
unless the lawyer has the consent of the other lawyer or is authorized to do so by law or a court
order. The Commission has taken the view that Section 21F of the Exchange Act authorizes the
Commission to communicate with whistleblowers without the consent of corporate counsel
because Section 21F “evinces a Congressional purpose to facilitate the disclosure of information
to the Commission relating to possible securities law violations and to preserve the
confidentiality of those who do so.”18
Putting aside whether the Commission is correct in its interpretation of the scope of its
legal authority under Section 21F, as a practical matter, no in-house or outside counsel would be
pleased with an investigation progressing to advanced stages without counsel ever hearing of it.
In particular, the Commission’s approach under the Final Rule risks situations where current
16
Final Rule at 34,319.
17
17 C.F.R. § 240.21F-17(b).
18
Final Rule at 34,351.
5
employees have been de facto deputized by the SEC Staff, where a company is unable to have a
meaningful dialogue with the Staff about the facts because the whistleblower has provided a onesided story to the SEC Staff for months (if not years), and where privileged documents are turned
over to the Staff by the whistleblower.19 Unfortunately, this is not an entirely foreign concept for
companies subject to government investigations, which have involved confidential informants,
particularly in criminal investigations, for some time.
Considerations for Companies and Their Counsel
Although the protection of the attorney-client privilege is generally strong under the Final
Rule, there remain risks to the privilege and to other confidential client information. Companies
and their counsel should consider the following:

Given the tension between relevant state confidentiality obligations and the
Commission’s attorney conduct rules, companies with operations in multiple
jurisdictions or with lawyers licensed in multiple jurisdictions should
understand the various competing professional obligations of their attorneys.

Because the standard for whistleblower-award eligibility is lower for
information obtained in connection with internal investigations and similar
engagements than for information protected under the attorney-client
privilege, companies should ensure that all non-attorney professionals (e.g.,
forensic accountants, compliance consultants, and strategic/crisis media
relations personnel) that are retained in connection with an inquiry or
investigation into possible violations of law are retained by counsel pursuant
to a Kovel20 letter or similar arrangement, in order to protect communications
with such professionals to the extent legally possible.

Companies should put into place reporting mechanisms for internal inquiries
and investigations, so attorneys and non-attorneys alike who are retained in
connection with such matters can report irregularities and concerns internally
and have confidence that the company or responsible counsel will review and
resolve any issues. In short, companies should treat each person working on
an internal investigation as a potential whistleblower and adopt policies and
procedures similar to those that companies have in place for more traditional
whistleblowers.

Companies should have clear escalation lines for internal whistleblower
complaints. Because the 120-day period can begin as early as the time when
the whistleblower informs his or her immediate supervisor of a potential
19
The Final Rule states that it does not authorize the Staff to depart from the Commission’s existing
procedures for handling potential attorney-client privileged information that comes into the Staff’s
possession, see Final Rule at 34,352, but the mere fact of a protected direct line of communication between
employee-whistleblowers and the Staff increases the chance that a company will be in a dispute with the
Staff at a later time about whether particular documents are privileged.
20
United States v. Kovel, 296 F.2d 918 (2d Cir. 1961).
6
violation, it will be critically important for all levels of supervisors to be
aware of and comfortable with their escalation paths for such information. For
companies with great geographic and organizational diversity, this will be
particularly challenging.

Companies should be prepared to make substantial progress on any internal
investigations within 120 days of receiving information about possible
violations of law. To that end, companies should have in-house legal staff
with training and capacity to get such investigations off the ground early,
including identifying the relevant individuals and preserving and collecting
their electronic data.

Because the SEC Staff will not hesitate to communicate directly with
whistleblowers without first consulting counsel of the whistleblower’s
employer, companies should ensure that would-be whistleblowers are aware
of their internal reporting options and that companies promote a culture where
internal reports are encouraged.
7