A Refresh on Obligations to Report Wrongdoing, and Why You
In-house counsel, compliance officers and internal auditors are under various legal obligations to report wrongdoing, and it is worth refreshing your recollection of the relevant statutes and some details about those duties.
First, though, take a moment to consider and appreciate why you have been given the job of safeguarding the public interest. Your role puts you in the middle of the action in our capitalist arena, and your work directly supports the ethical foundation on which it was built. That is empowering. If the obligation to report potential criminal acts feels like a heavy responsibility, remember that the flip side of responsibility is trust. You have been entrusted with doing the right thing if and when needed, and you have the confidence of lawmakers, government agencies, the judiciary, and the public. They have clarified through various laws their ask and made it your task. Let’s review some of the key ones.
1. Section 307 of the Sarbanes-Oxley Act is the basis for 17 CFR Part 205, which emphasizes "up-the-ladder" reporting requirements for lawyers employed by Issuers. In-house counsel is required to report evidence of a material violation of securities law, breach of fiduciary duty or similar has occurred, is, or is about to occur to their General Counsel or CEO, and if an appropriate response is not provided within a reasonable time, make the report to the audit committee or full board of directors.
2. Rule 10b-5 of the Securities Exchange Act of 1934 prohibits securities fraud. To briefly summarize, Rule 10b-5 makes it unlawful to: (a) employ any device, scheme, or artifice to defraud, (b) make any untrue statement of a material fact or omit to state a material fact necessary to make the statements made not misleading, or (c) engage in any act, practice, or course of business which operates or would operate as a fraud or deceit. The Rule also requires lawyers to be aware of their role in preventing and not participating in fraudulent activities related to securities transactions. Upon encountering fraud or deceit, in-house counsel has an obligation to report this internally and possibly externally.
3. Insider Trading and Securities Fraud Enforcement Act of 1988 requires in-house counsel at issuers to report knowledge of insider trading. It also expanded the scope of civil penalties to control persons who fail to take adequate steps to prevent insider trading. Compliance teams must ensure that proper policies and procedures are in place for handling material non-public information and to prevent insider trading.
4. Whistleblower Provisions of the Dodd-Frank Wall Street Reform and Consumer Protection Act. Dodd-Frank enhances whistleblower protections and rewards, encouraging employees to report securities violations to the Securities and Exchange Commission (SEC). The Whistleblower Hotline has been a critical component of the SEC's efforts to encourage and protect whistleblowers reporting securities violations. In 2023, the SEC received 18,000 tips, nearly a 50% increase from the previous year. Almost $600 million in awards were granted, including a record single award of nearly $279 million, the highest in the program’s history. Under the applicable rules, employees whose primary job responsibilities involve compliance or internal audit functions are excluded from the program unless a narrow exception is met. In-house counsel also would need to consider complex attorney-client privilege issues. But none of us got into Compliance for the money, and the Hotline is available if your company’s internal controls and processes fail.
5. The Foreign Corrupt Practices Act (FCPA) and UK Bribery Act 2010 do not impose an obligation on in-house counsel or compliance officers to report suspected violations. Of course, you should report any concerns internally and help lead the discussion about whether to self-report to the enforcement authorities, especially if the violation is significant.
6. The Bank Secrecy Act and Anti-Money Laundering (AML) Regulations primarily target financial institutions, although AML regulations can affect issuers. In-house counsel must ensure their employer complies with AML laws and report any suspicious transactions that may indicate money laundering activities. This duty includes situations in which in-house counsel suspects their employer is engaging in violations of AML regulations.
7. The Model Rules of Professional Conduct of the American Bar Association, Rule 8.3(a), imposes an ethical duty on lawyers to report misconduct to regulatory authorities if it involves a violation that raises substantial questions about a lawyer’s honesty, trustworthiness, or fitness to practice law.
Beyond specific statutes, in-house counsel and compliance officers have a general duty under corporate governance principles to report significant legal issues or violations internally to the CLO or CEO and if necessary to their company’s board of directors or appropriate board committee. The laws discussed above also anticipate and support that employees will report any suspected wrongdoing through internal channels before going to an enforcement agency. The compliance team must ensure that employees know this, have confidence that their report will be handled earnestly and without delay, and feel protected from any potential retaliation.
Be sure to familiarize yourself with reporting obligations required under laws and regulations applicable in your jurisdiction or region and in your industry. Finally, before making a report of possible illegal activity to enforcement authorities, it is advisable to seek advice from external counsel.
General Counsel