How to blow the whistle

Cynthia Cooper of WorldCom, Sherron Watkins of Enron and Alayne Fleischmann of J.P. Morgan: they all blew the whistle on fraud.

Fleischmann—a Canadian—was fired. Her former employer, J.P. Morgan, later paid the U.S. government US$13 billion to settle charges that it misled investors about the quality of mortgage-backed securities. Fleischmann told Financial News that her advice to other potential whistleblowers is to avoid employment at unethical firms in the first place.

Probably easier said than done.

But the OSC’s new whistleblower program, launched in July 2016, aims to deter unethical behaviour by encouraging whistleblowing. Maureen Jensen, the OSC’s chair and CEO, says she expects the program to uncover misconduct in the multi-million dollar range, with tips about insider trading, market manipulation, and accounting and disclosure violations.

Such complex cases involve sophisticated players, says Kelly Gorman, chief of the whistleblower office, and are difficult to detect without an insider offering secrets.

That’s where you come in.

Through the program, the OSC encourages you to report misconduct by submitting award-eligible information (see rule no. 2, below) either internally or to the commission. If eligible, you’ll receive compensation up to $5 million (conditions apply) after the appeal process is complete.

But blowing the whistle can be a stressful, high-stakes endeavour. If you decide to go forward, know the rules.

1. Honour your internal reporting obligations

“The whistleblower policy shouldn’t be looked at in isolation from the other reporting obligations financial advisors have,” says Caitlin Sainsbury, a partner at Borden Ladner Gervais in Toronto.

“Most companies with good compliance programs have a whistleblower policy,” adds Danielle Royal, a partner at Stikeman Elliott in Toronto, because of anti-retaliation amendments to the Criminal Code in 2004. At that time, “a lot of companies ensured they had a whistleblower policy in place and understood their obligations.”

And the OSC’s program provides incentive to report internally: doing so may increase your award amount.

If, after you report internally, your firm subsequently reports to the OSC, you, too, must report to the OSC within 120 days to be reward-eligible. If someone submits the same information to the commission while you’re waiting for your firm’s response, the timing of your internal report will be used to determine who submitted first.

What if you have information and don’t report? “The whistleblower policy itself doesn’t create any additional reporting obligations,” says Royal.

But, says Sainsbury, “there’s certainly potential exposure” to disciplinary action from your self-regulatory organization if you fail to comply with its reporting obligations.

2. Ensure your information meets the program’s criteria

To be eligible for a reward, your information must:

• be original;
• be submitted voluntarily (i.e., before you’re asked for it);
• be high quality (i.e., contain sufficiently timely, specific and credible facts); and
• result in an enforcement action of $1 million or more that’s upheld on appeal.

Gorman says “original” means the information leads to a new investigation or significantly furthers an existing one.

More specifically, the policy defines “original” as information obtained independently from your work, through your social interactions or from your critical analysis of publicly available information.

Excluded from the policy: information subject to solicitor-client privilege or obtained “in a manner that violates applicable criminal law.”

Ready to be a whistle blower?

Blow* if your information is:

• timely, specific and credible — as assessed by legal counsel;
• voluntarily provided;
• new to the commission;
• detailed in documents in your possession or control, if possible.

*Those ineligible for awards include directors, officers, CCOs, in-house counsel, auditors and other investigators (exceptions apply).

Don’t blow if your information is:

• false, misleading or speculative;
• public knowledge;
• privileged;**
• from a hearing, audit or investigation;**
• obtained through a criminal offence (e.g., you stole corporate records);
• not related to a securities violation.

**except where disclosure is necessary to prevent great losses to an entity or investors. Consult legal counsel to determine as much.

Royal says the typical employee probably can’t assess whether information is under solicitor-client privilege, or if it meets the program’s criteria.

“There are [many] individual questions the [whistleblower] would want advice on before they included documentation,” she says. For instance, a whistleblower and employer might disagree on who was entitled to have access to certain information and whether it was properly understood.

Sainsbury agrees: “Obtain legal advice about what kinds of things you have in your possession that you could take to the commission without running into any issues” (see “Ready to be a whistleblower?” below, and “Finding evidence,” above).

3. Consult a lawyer

You’ll want legal counsel if you’re involved in the misconduct or want to make an anonymous report.

But before receiving a reward, you must disclose your identity, which may also be revealed during prosecution, as per the policy.

“You’re naïve to think you’re going to stay anonymous,” says Royal. (That contrasts with the U.S. regime. Attorney Bill Singer says, “It’s technically a felony—a criminal event—if somebody at the SEC or the [U.S.] Department of Justice were to unveil the identity of a whistleblower.”)

If you’re a whistleblower who’s part of the misconduct, “move quickly,” says Royal, because the commission won’t look kindly on delay, and the reward size depends on how early you report. (Keep in mind the OSC won’t offer you immunity.)

Sainsbury says anti-retaliation provisions protect whistleblowers from civil exposure. “The Securities Act has been amended to say that a provision in an agreement, including confidentiality and employment agreements, that prevents you from providing information to the commission is void.”

But you might have other exposure.

Royal recalls a case in which the alleged wrongdoer claimed defamation, adding a layer of complexity and increased legal costs to the case. Referring to high-quality information, she says, “This goes back to what [you] are disclosing, and do [you] really know what’s going on?”

SEC whistleblower stats

Certainly, the U.S. regime appears to be more encouraging for whistleblowers to come forward.

In terms of awards, the OSC caps a whistleblower award at 15% of total monetary sanctions, up to a maximum of $5 million when the commission collects at least $10 million. The SEC awards a maximum of 30%, with no limit. There are also strong whistleblower protections in the U.S., where it’s a crime for a DoJ or SEC official to disclose a whistleblower’s identity.

Below are SEC stats from the program’s inception in August 2011 to fiscal year 2015.

• Number of tips received 14,116
• Number of whistleblower awards 22
• Reward total $54 million

Source: 2015 annual report to Congress on the Dodd-Frank whistleblower program

Assume you do. Do you need a lawyer to report internally?

Singer highlights a practical problem. After reporting internally, the whistleblower unexpectedly finds herself stonewalled or threatened with job loss and defamation suits. Or she’s pressured to keep quiet with promotions or other perks. Cue Tom Cruise in The Firm.

What’s a whistleblower to do at this point? Report to the commission? Says Royal, “You see that tension in the policy where there can be internal reporting but also reporting to the OSC.”

So, having legal counsel is wise, all sources agree.

4. Complete and submit the OSC’s online whistleblower form

The form asks you to:

• name individuals and entities involved in the misconduct;
• describe, date and quantify the misconduct;
• explain how and when you learned about the misconduct;
• provide supporting documents, if any; and
• disclose various personal details (e.g., your communication with other regulators, your role in the conduct, your relationship with wrongdoers).

To submit anonymously, you must print the form, complete and sign it, and give it to your lawyer. Your lawyer will then submit a new form that doesn’t identify you (online or via post, along with supporting documents).

Now the hard part: waiting.

The policy concedes years may lapse between submitting the form and receiving an award. The whistleblower office website says, “You may not hear from us for a significant period of time or at all.”

Best follow Fleischmann’s advice.

Finding evidence

Setting out on a document hunt is dangerous, says Danielle Royal, a partner at Stikeman Elliott in Toronto, and the outcome is unpredictable.

The commission doesn’t expect you to obtain documents not in your possession or control, but do record details of what you’ve seen and, if possible, the location of documents.

Bill Singer, an American securities lawyer whose successful representation of a whistleblower in 2015 resulted in a reward of $1.5 million, says even if you can’t legally obtain incriminating documents, details can help secure a subpoena.

“The size of an award may depend on whether you can point to a meeting that took place on a specific day at a specific location per your notes. Before you blow the whistle, make sure you’ve documented as many facts as you can in terms of dates, participants, meetings, and the names of memoranda and subject lines of email.”

To maintain anonymity, don’t leave a so-called vapour trail: emails, instant messages, or internet searches like “how to report insider trading to the OSC.”

Says Singer: “Don’t store any notes and materials on your corporate server. Don’t send emails discussing any aspect of what you’re doing […] because they’ll be archived and easily mined.”