Filing Requirements Under the Corporate Transparency Act: Stealth Beneficial Owners

The Corporate Transparency Act (“CTA”) requires most entities to file with the Financial Crimes Enforcement Network (“FinCEN,” a Bureau of the U.S. Department of the Treasury) Beneficial Ownership Information (“BOI”) about the individual persons who own and/or control the entities, unless an entity is exempt under the CTA from the filing requirement. There are civil and criminal penalties for failing to comply with this requirement.

A key issue: WHO are the Beneficial Owners?

FinCEN has issued a series of Frequently Asked Questions along with responses providing guidance on the issue of who the beneficial owners are.

Question A-1, issued on March 24, 2023, states that “[BOI] refers to identifying information about the individuals who directly or indirectly own or control a company.”

Question A-2, issued on Sept. 18, 2023: Why do companies have to report beneficial ownership information to the U.S Department of the Treasury? defines the CTA as “…part of the U.S. government’s efforts to make it harder for bad actors to hide or benefit from their ill-gotten gains through shell companies or other opaque ownership structures.”

Question D-1, updated April 18, 2024: Who is a beneficial owner of a reporting company? states that “A beneficial owner is an individual who either directly or indirectly (i) exercises substantial control over a reporting company” and, in referring to Question D-2 (What is substantial control?), “owns or controls at least 25 percent of a reporting company’s ownership interests.”

Question D-1 goes on to note that beneficial owners must be individuals, i.e., natural persons. This guidance is extended by Question D-2 on Substantial Control, where control includes the power of an individual who is an “important decision-maker.” Question D-3 (What are important decisions?) identifies “important decisions” with a pictorial chart of subject matters that FinCEN considers important, such as the type of business, the design of necessary financings, and the structure of the entity. Question D-4 explores ownership interests (again with a pictorial) including equity interests, profit interests, convertible securities, options, or “any other instrument, contract, arrangement, understanding, relationship, or mechanism used to establish ownership.”

Who, in FinCEN’s view, has “substantial control”?

Question D-2 lists four categories of those who have substantial control:

  1. A senior officer, including both executive officers and anyone “who performs a similar function;”
  2. An individual with “authority to appoint or remove certain officers or directors;”
  3. An individual who is an important decision-maker; or
  4. An individual with “any other form of substantial control.”

“Silent partners” and/or other undisclosed principals, including some who may be using the reporting company for nefarious purposes, might be discussed here, but that is not the intended subject of this writing. Rather, this piece is intended to warn businesspersons and their advisers of potential “stealth beneficial owners” – those whose status as beneficial owners is not immediately obvious.

First, consider the typical limited liability company Operating Agreement for an LLC with enough members and distribution of ownership interests so that no member owns over 25% of the LLC’s equity. If the LLC is manager-managed, then the manager(s) is/are Beneficial Owners, but the other members are not. But what if the Operating Agreement requires a majority or super-majority vote to approve certain transactions? Assuming that those transactions are “important” (as discussed in Question D-3), then possessing a potential veto power makes EACH member a beneficial owner. Such contractual limitations on executive power necessarily raise the issue of “beneficial ownership” in corporations, in limited liability companies, and even in limited partnerships where the Limited Partners have power to constrain the general partner (who clearly is a beneficial owner).

Second, consider the very recent amendments to the Delaware General Corporation Law (“DGCL”) in response to the Delaware Chancery Court’s holding in West Palm Beach Firefighters’ Pension Fund v. Moelis & Co (“Moelis”) Feb. 23, 2024. In Moelis, the CEO had a contract with the Company that materially limited the power of the Board of Directors to act in a significant number of matters. Vice Chancellor Travis Laster issued a 133-page opinion finding the agreement was invalid, as it violated the Delaware Law that placed management and governance responsibilities in the Board. Because such arrangements are frequently used in venture capital arrangements as part of raising capital for new enterprises, the Delaware Legislature and the State’s Governor enacted amendments to the DGCL that expressly authorize such contracts. In the Moelis situation itself, Ken Moelis was a major owner and CEO so he would have had to be disclosed as a Beneficial Owner if Moelis & Co. had not been exempt from the filing requirements of the CTA because it is a registered investment bank.

But what of a start-up venture entity where a wealthy venture investor owns a 10% interest in the entity, but has a stockholder agreement that gives him substantial governance rights including the ability to veto or even overrule board decisions? Is that venture investor not a “beneficial owner”? Somewhat even more Baroque, what about the private equity fund controlled by a dominant investor, say William Ackman or Nelson Peltz? If that fund invests in the same start-up entity and holds a 10% interest, but also has a stockholder agreement giving the fund substantial governance rights, isn’t the controlling owner of the fund a “beneficial owner” of the start-up?

Finally, consider financing with a “bankruptcy remote entity” where the Board of that entity includes a contingent director chosen by the finance source. The contingent director does not participate in any part of the governance of the entity unless the entity finds itself in financial distress. The organizational documents of the entity provide that at that point, the contingent director can veto any decision to file for bankruptcy protection. At that point, the contingent director apparently becomes a “beneficial owner” of the entity, with the CTA filing requirements applicable. A more interesting question is whether the contingency arrangement in the organizational documents makes the contingent director a “beneficial owner” from the inception of the financing. Further, with respect to bankruptcy, key questions remain unanswered, such as whether the trustee in a Chapter 7 bankruptcy proceeding or a liquidating trustee in a Chapter 11 bankruptcy proceeding has a reporting obligation under the CTA.

This piece is not intended to identify all the situations that may give rise to “Stealth Beneficial Owners.” Rather, its intent is to raise awareness of the complexities involved in answering the initial question – WHO is a “beneficial owner”?

DOJ Implements New Whistleblower Reward Program

Companies who submit healthcare claims to private payors, provide financial services to customers, interact with domestic or foreign public officials, or otherwise operate in highly regulated industries should take note that the Department of Justice (DOJ) has taken another significant step in its ongoing effort to encourage new whistleblowers with information about potential corporate criminal malfeasance to report that information to the government. On August 1, 2024, the DOJ announced its long awaited Corporate Whistleblower Awards Program. The program seeks to fill “gaps” in existing whistleblower programs by providing awards of up to 30% of forfeited proceeds for reporting criminal conduct that is not otherwise covered by an existing system for awarding whistleblowers. The silver lining for companies is that the program incentivizes the whistleblowers to cooperate with the company’s internal compliance function. DOJ also provides for a presumptive declination of criminal charges for companies that self-report to DOJ within 120 days of the time the issue is first raised internally by the whistleblower, providing strong incentives for companies to investigate issues quickly.

The program represents the DOJ’s latest effort to increase the number of voluntary self-disclosures of corporate criminal activity. In January 2023, the DOJ announced its revised Corporate Enforcement and Voluntary Self Disclosure Policy, which sought to expand the incentives for companies to voluntarily self-disclose misconduct, cooperate with DOJ investigations, and take prompt and full remedial measures. The policy’s primary incentive was the prospect of a presumed declination for companies who followed its mandates.

As we discussed in a previous post, efforts to increase voluntary self-disclosures continued in April 2024 when the DOJ launched a Pilot Program on Voluntary Self Disclosures for Individuals. That initiative expanded the scope of potential whistleblowers by including those complicit in wrongdoing, granting them eligibility for immunity from prosecution in return for reporting the activity. In substance, that structure incentivized both individual wrongdoers and the corporations for whom they worked to be the first to report criminal activity. By pitting the would-be whistleblowers and the companies against each other, the DOJ effectively constructed a prisoners’ dilemma where the government stood to benefit regardless of which party acted first.

The program is a different verse from the same hymnal. It offers a different (but more traditional) incentive for whistleblowers – the opportunity for financial reward – while maintaining the goal of increasing the number of voluntary self-disclosures. The program seeks to achieve that objective by motivating those who are aware of misconduct, but perhaps are otherwise unable to qualify for a bounty under the current framework or otherwise uninterested in reporting the activity without a personal benefit.

The Basic Framework

Under the program, eligible individuals who voluntarily provide original information to the government in certain areas of focus and cooperate with the resulting investigation stand to receive 30% of any criminal or civil forfeitures over $1 million in accordance with a defined payment priority. The program lays out a basic structure for determining whether an individual is entitled to an award, but also affords the DOJ substantial discretion in deciding whether to make such awards, and in what amount. The key elements are:

  • Areas of focus – The program identifies four subject matter areas: 1) violations by financial institutions, their insiders and agents involving money laundering, fraud, and fraud against or non-compliance with regulators; 2) foreign corruption and bribery and violations of money laundering statutes; 3) domestic corruption violations including bribes and kickbacks paid to domestic public officials; and 4) healthcare offenses involving private or non-public healthcare benefit programs and fraud against patients, investors or other non-governmental entities in the healthcare industry, or other violations of federal law not covered by the federal False Claims Act (FCA).
  • Eligible individuals – The program excludes several categories of individuals, including those eligible to report under other whistleblower programs and those who “meaningfully participated” in the criminal activity reported (although those who played a “minimal role” can still participate).
  • “Original information” – Essentially, independent non-public knowledge or analysis in the individual’s possession is considered “original” information. Notably, information can be deemed “original” if it “materially adds to the information that the Department already possesses.” Information that the individual has already reported through the company’s internal whistleblower, legal or compliance procedures can still be deemed “original,” provided the individual also reports that information to the government within 120 days of reporting internally. Privileged information is not considered “original” unless the crime, fraud or other exception to state attorney conduct rules apply.
  • “Voluntary” submission – The information must be reported before the DOJ or any federal law enforcement or civil enforcement agency initiates any inquiry relating to the subject matter.
  • “Cooperation” – Individuals who report must also cooperate fully with the DOJ’s investigation, including by participating in interviews, testifying before a grand jury or at trial, producing documents and, if requested, working in a “proactive manner” with federal law enforcement. This could include clandestine activities to gather evidence, such as recording phone calls or wearing a wire.
  • Criteria for determining amount of award – The program lists several factors that could militate in favor of increasing or decreasing the whistleblower’s financial award. Increases may be justified by the significance of the information provided, by the nature and extent of assistance provided, and, notably, by participation in internal compliance programs. Decreases may be appropriate where the reporting individual was a minimal participant in the underlying activity, or where the individual unreasonably delayed reporting, interfered with the company’s internal compliance and reporting systems, or had management or oversight responsibilities over the offices or personnel involved in the conduct.
  • Payment priority – When the victim is an individual, he or she must first be compensated “to the fullest extent possible” before a whistleblower can recover. When the victim is a corporate entity or government agency, the whistleblower jumps the line and is compensated first.
  • Relationship to the Corporate Enforcement and Voluntary Self Disclosure Policy – While the program incentivizes whistleblower reports to the DOJ, a simultaneous amendment to the self-disclosure policy provides that “if a whistleblower makes both an internal report to a company and a whistleblower submission” to the DOJ, companies who self-report that conduct within 120 days of the internal report “will still qualify for a presumption of a declination[.]” This amendment underscores the DOJ’s focus on increasing self-disclosures, inasmuch as it effectively removes the need for them to be truly “voluntary.” A company that receives a complaint through its whistleblower program may still be eligible under the self-disclosure policy even if the individual has already reported the conduct to the DOJ, but it has a limited time to investigate and decide whether to self-report the conduct.

Key Takeaways

Reading the tea leaves, we see several potentially significant takeaways for companies evaluating the program’s likely impact.

  1. As a starting point, companies should evaluate whether and to what extent their operations create new reporting opportunities under the program, and thus necessitate action. That process should involve answering the following questions:
    • Does the company operate in one of the areas of focus? If so, the program creates new opportunities and incentives for whistleblowers, and the company must assess whether it is prepared to address an increase in reports and to recognize that a reporter may have already disclosed information to the DOJ.
    • Is the company publicly traded? If so, the company is already subject to the Sarbanes-Oxley Act (SOX), which should mean that systems are already in place to receive, investigate and determine whether to take action, including potentially making a voluntary self-disclosure. The program provides an opportunity to reassess the efficacy of those systems but should not necessarily require the creation of new ones. Note that even those companies with existing whistleblower programs should consider the need to expand those systems to cover new areas of focus. For example, a company with a SOX whistleblower policy should consider the need to expand its scope to cover domestic corruption violations, which may not otherwise be covered.
    • Does the company submit claims to government payors? If so, it is already subject to the FCA and should already have a system in place to analyze internal compliance concerns. If that system focuses on or prioritizes issues regarding government payors, the company should expand its focus to include claims and conduct regarding private payors, which may now be subject to whistleblower bounties under the program.
  2. For privately held companies operating in the areas of focus that are not subject to the FCA, the program necessitates a thorough and candid assessment of the risk the program creates. Depending on the extent of that danger, companies should consider the following measures:
    • Create, or enhance as necessary, internal reporting mechanisms to receive and evaluate whistleblower reports.
    • Publicize the company’s expectation that employees should promptly report concerns internally about potential violations of law or company policy, making clear that no retaliation will result from reports made in good faith.
    • Design a process for investigating whistleblower reports based on their nature and seriousness. Establish criteria for identifying those that can be investigated by HR, those that require the involvement of in-house counsel, and those that must be handled by outside counsel. If there is any possibility of criminal exposure, ensure an appropriate investigation is conducted and concluded in time to allow the company to determine whether to self-report in the 120-window for a presumptive declination.
  3. All companies should have in place a system for quickly and accurately evaluating whether to voluntarily self-disclose violations. This process is a multi-factor calculus that considers a range of factors, including primarily the merits of the underlying information and the amount of financial loss or gain that resulted. While decision-making in this context varies by situation, one essential element remains constant: the need for accurate information regarding the nature, scope and effect of the underlying conduct.

Only time will tell exactly how the program will impact the number and nature of whistleblower reports. But companies can take practical steps now to gauge whether and to what extent they are likely to be affected and begin installing the measures necessary to minimize the risk that might otherwise result.

Listen to this post 

DOJ Launches Corporate Whistleblower Awards Pilot Program

The Department of Justice (“DOJ”) released its Corporate Whistleblower Awards Pilot Program on August 1, 2024. This initiative, which is expected to last three years, aims to enhance corporate crime detection, expand enforcement and prosecution efforts, and encourage reporting by incentivizing whistleblowers with the potential of significant payouts. Going forward, companies should pay close attention to DOJ’s  statements  and  guidance  and assess their existing compliance program to ensure that they are encouraging internal reporting and have procedures in place to quickly investigate, remediate, and potentially disclose misconduct.

For years, the Securities and Exchange Commission, Commodity Futures Trading Commission, and the Financial Crimes Enforcement Network have maintained whistleblower programs. When announcing the DOJ’s Pilot Program last March, Deputy Attorney General Lisa Monaco said these programs, while successful, do not address “the full range of corporate and financial misconduct” that DOJ prosecutes. Monaco emphasized that DOJ’s new program aims to fill the gaps in the existing patchwork. The Pilot Program goes into effect immediately.

Impacting the Pilot Program is DOJ’s recent  amendment  to its Corporate Enforcement and Voluntary Self-Disclosure (“VSD”) Policy. Under the amendment, a company that receives an internal report of misconduct from a whistleblower and reports that misconduct to DOJ within 120 days is eligible for a presumption in favor of declining prosecution. To be eligible for the presumption, the company must also cooperate fully and commit to remediation of the wrongdoing. Along with the whistleblower awards program, this amendment provides DOJ with more tools to encourage companies to strengthen internal reporting systems and to incentivize voluntary self-disclosure of corporate crimes and misconduct.

Foreign and domestic companies should reassess anti-corruption, trade compliance, and other compliance programs and should consider revising existing programs as needed to encourage internal reporting of concerns regarding potential non-compliance with company policies and applicable laws.

Covered Violations 

To qualify for an award, the information provided by a whistleblower must be related to one of the following types of criminal conduct:

  • Violations by financial institutions, their insiders, or agents, including schemes involving money laundering, anti-money laundering compliance violations, registering of money transmitting businesses, fraud statutes, and fraud against or non-compliance with financial institution regulators.
  • Foreign corruption and bribery violations under the Foreign Corrupt Practices Act, the Foreign Extortion Prevention Act, or money laundering statutes.
  • Violations related to the payment of bribes or kickbacks to domestic (U.S.) public officials.
  • Federal health care offenses not covered by the False Claims Act, including federal health care offenses and related crimes involving private or other nonpublic health care benefit programs and health care fraud schemes involving private insurance plans.

Eligibility and Rewards 

  • Whistleblowers may be eligible for an award under the Pilot Program if, alone or jointly with other individuals, the whistleblower provides DOJ with original information, in writing, which leads to criminal or civil forfeiture exceeding $1 million in connection with a successful prosecution, criminal resolution, or civil forfeiture action. The whistleblower must cooperate fully with DOJ’s investigation.
  • Whistleblowers must provide truthful, original, non-public information about corporate misconduct to qualify for potential compensation under the program.
  • Whistleblowers may report suspected misconduct internally before reporting to DOJ but are not required to do so in order to be eligible under the pilot program. If the whistleblower reports the alleged misconduct internally through company reporting channels, they must subsequently report it to DOJ within 120 days. A whistleblower may therefore choose to go directly to DOJ without first reporting through internal channels.
  • Information will not be considered original if it was obtained through communications subject to attorney-client privilege, or if the whistleblower’s principal duties include compliance or audit responsibilities. Whistleblowers who work for third-party firms conducting or supporting internal investigations will also not be eligible for any rewards.
  • Whistleblowers that would be eligible for an award through another U.S. whistleblower, False Claims Act qui tam, or similar program will not be eligible for an award under the Pilot Program if they report the same misconduct. However, DOJ encourages whistleblowers to submit information to multiple programs to allow DOJ and other agencies to decide which program is best suited to address the alleged misconduct.

Whistleblowers are eligible for an award even if they initially report information through their employer’s internal reporting procedures. However, the whistleblower must also report the same information to DOJ within 120 days of making an internal report. Whistleblowers may receive up to 30 percent of the first $100 million in net proceeds forfeited, and up to 5 percent of net proceeds between $100 million and $500 million. There is no award on net proceeds forfeited above $500 million. The maximum potential award is set at $35 million. The payment of any award is subject to DOJ’s discretion. DOJ will take into consideration, among other things, the significance of the information provided and the whistleblower’s cooperation and level of assistance. A whistleblower’s level of culpability, unreasonable delay in reporting, and interference with internal compliance and reporting systems may decrease award amounts. A whistleblower is not eligible for payment if they meaningfully participated in the misconduct or criminal activity. DOJ may, however, determine that a whistleblower is eligible if he or she played a minimal role and any misconduct was “sufficiently limited” in scope.

VSD Policy Amendment 

The VSD Policy amendment provides that, where a whistleblower makes both an internal report and a report to DOJ, a company may qualify for a presumption of declination under the VSD Policy even if the whistleblower reports the misconduct to DOJ before the company does. The company, however, must report the conduct to DOJ within 120 days of receiving the internal report  and  before DOJ contacts the company about the misconduct. Thus, the “declination window” may be shorter than 120 days, as DOJ could reach out before then. The amended VSD Policy and the Pilot Program effectively require companies to swiftly investigate and disclose misconduct to avoid steep penalties and prosecution.

What Companies Can Do Now 

The Pilot Program will be administered by the Criminal Division’s Money Laundering and Asset Recovery Section (“MLARS”). MLARS has taken a leading role in prosecuting foreign corruption and other international crimes in recent years but will likely expand its role into domestic corruption and national security issues as a result of its mandate here. MLARS will certainly place increased focus on the seizure and forfeiture of money.

Companies can take proactive steps to mitigate risk by re-evaluating their voluntary self-disclosure decision making and to improve existing compliance policies and procedures.

A few steps companies can take include:

  1. Clear Policies and Procedures: 
    • Establish clear guidelines and encourage employees to report misconduct.
    • Communicate these policies to all employees through training sessions, handbooks, and regular reminders.
  2. Anonymous Reporting Channels: 
    • Provide confidential or anonymous reporting channels (such as hotlines or online platforms).
  3. Non-Retaliation Assurance: 
    • Assure employees that they will not face retaliation for reporting.
    • Implement strong anti-retaliation policies and enforce them consistently.
  4. Leadership Support: 
    • Leadership should actively promote a culture of integrity and transparency.
  5. Incentives and Recognition: 
    • Consider offering incentives for early reporting or successful outcomes.
    • Recognize and appreciate employees who report misconduct.
  6. Training and Awareness: 
    • Regularly train employees on recognizing red flags and reporting procedures.
    • Foster awareness about the importance of reporting for the company’s well-being.
  7. Testing of Internal Controls: 
  • Ensure that existing compliance policies and procedures are working and are accurately identifying risks and detecting potential misconduct.
  1. Voluntary Disclosure: 
  • Review and strengthen internal investigation policies and procedures.
  • Conduct thorough, timely investigations into alleged misconduct.
  • Companies have 120 days or less to review internal complaints and reports of misconduct and to disclose to DOJ to qualify for declination under the amended VSD Policy.

The DOJ’s New Corporate Whistleblower Awards Pilot Program: A Victory for Wall Street – A Setback for Accountability

On August 1, 2024, the U.S Department of Justice announced the rules governing its new corporate whistleblower program. Unfortunately for whistleblowers, the Justice Department based its new program on proposals long advocated by the U.S. Chamber of Commerce and Wall Street special interests.

These Wall Street-friendly features contain most of the major elements of a long dreamed of “wish list” sought by the very companies that have been successfully prosecuted as a result of whistleblower disclosures. This wish list includes: making the payment of awards discretionary, capping the amount of awards, blocking the best informants from coverage, pushing whistleblowers into internal compliance programs instead of having them report directly to the government, and placing a major caveat on the right to file anonymous claims.

In adopting this Wall Street wish-list, the Justice Department ignored the empirical data demonstrating that programs which reject these proposals, such as the Dodd-Frank Act, have proven to be the most successful fraud-detection whistleblower laws.

New Program Announced

Deputy Attorney General (DAG) Lisa Monaco first announced the DOJ’s decision to establish  a new whistleblower award program during her keynote remarks at the American Bar Association’s 39th National Institute on White Collar Crime on March 7. She recognized the importance of paying monetary awards to whistleblowers and how such programs have created massive opportunities to pursue major fraud prosecutions:

Ever since Dodd-Frank created whistleblower programs at the SEC and the CFTC, those agencies have received thousands of tips, paid out many hundreds of millions of dollars, and disgorged billions in ill-gotten gains from corporate bad actors.”

“These programs have proven indispensable — but they resemble a patchwork quilt that doesn’t cover the whole bed. They simply don’t address the full range of corporate and financial misconduct that the Department prosecutes.

“So, we are filling these gaps.”

Monaco detailed that the Pilot Program would use existing statutory authorities under the little-used Asset Forfeiture Whistleblower Award Law, 28 U.S.C. § 524, as a basis for paying whistleblower awards. This law, in existence since 1984, was, for years, ignored by the DOJ. For example, in FY 2023, the United States obtained $3.4 billion from asset forfeitures but only used $13 million to compensate whistleblowers or informants. All whistleblower payments were made by the Drug Enforcement Authority ($12 million) or the FBI ($1 million)).

The failure to pay whistleblowers from the Fund has contributed to the Fund’s massive balance. As of the end of FY 2023, the Fund had $8.5 billion in assets. The Justice Department’s annual Asset Forfeiture Fund report confirmed that whistleblower-initiated cases were a major driving force in adding billions to the Fund. The report identified income from the Danske Bank money laundering case as the largest contributor to increasing the Fund’s assets. As Danske Bank itself admitted, that scandal, and the resulting enforcement actions were initiated by a whistleblower report, and the DOJ admitted that $1.2 billion was deposited into the Fund from that case.

Significantly, Congress entrusted the Justice Department to establish rules for paying whistleblowers or other informants. Unlike other whistleblower award laws such as the False Claims or Dodd-Frank Acts, Congress did not establish mandatory guidelines limiting the ability of the Department to compensate whistleblowers. Instead, the Justice Department could establish progressive and pro-whistleblower regulations to fully achieve the goals behind establishing the Fund. As explained by the Justice Department, the Fund is supposed to be “an essential component of the Department’s efforts to combat the most sophisticated criminal actors and organizations – including terrorist financiers, cyber criminals, fraudsters, human traffickers, and transnational drug cartels.”

Thus, whistleblower advocates were optimistic when the DAG announced the DOJ’s intent to use its authority under the Asset Forfeiture Fund to build a new corporate whistleblower program. Not only had the DAG acknowledged the success of the Dodd-Frank model for incentivizing informants, but the DOJ also clearly understood the international nature of many of the crimes resulting in asset forfeiture (including the DOJ’s acknowledgment that the Fund was created to combat “transnational drug cartels,” “human traffickers” and “terrorist financiers”). Advocates hoped that the Justice Department would incorporate policies outlined in the United States Strategy on Countering Corruption into the new program. Under this Strategy, the United States pledged to act in “solidarity” with whistleblowers and bolster human rights defenders, investigative journalists, and other key players in the worldwide fight against corruption.

After the DAG’s announcement,, the Justice Department engaged in “listening sessions” to “gather information” so they could “design a thoughtful, well-informed program.” Numerous whistleblower experts met with the Justice Department team crafting the new program and provided input. Additionally, written guidance was provided by leading whistleblower law firmsa former SEC Commissioner with expertise on the Dodd-Frank whistleblower law, and all the major whistleblower advocacy groups, including 23 international anti-corruption organizations, the National Whistleblower Center, Transparency International (USA), The Anti-Fraud Coalition (TAF), and the Government Accountability Project. These persons and groups endorsed a framework modeled on the Dodd-Frank Act consistent with the legal structure explained in the paper “Why Whistleblowing Works: A New Look at the Economic Theory of Crime.” 

The groundwork was set for the creation of a highly effective, transnational anti-corruption whistleblower program, that was designed to close gaps in existing laws, and use the billions in assets sitting in the Asset Forfeiture Fund to incentivize reporting and ensure that whistleblowers were properly compensated.

What Happened? The DOJ Adopts Proposals Advocated by Anti-Whistleblower Corporate Lobbyists

For years, the U.S. Chamber of Commerce and numerous corporations (many of which have pleaded guilty to committing frauds) have lobbied against highly successful qui tam whistleblower award laws. They actively lobbied to water-down both the Dodd-Frank and False Claims Act. Given the unquestionable effectiveness of these qui tam laws, the Chamber and its numerous members that were found to have committed frauds promoted tactics that would impede the ability of whistleblowers to use the laws or obtain compensation.

In December 2010, the Chamber urged the SEC to implement proposed rules that would have crippled the Dodd-Frank Act, but the SEC rejected those proposals. In 2013, the Chamber issued a comprehensive report, entitled “Fixing the False Claims Act,” which likewise urged Congress to enact legislation that would cripple the False Claims Act. Congress ignored these proposals.

However, the Justice Department adopted the main proposals advocated by the Chamber, all of which have been discredited by empirical evidenceBy following the lead of the Chamber of Commerce, Justice ignored guidelines Congress incorporated into the leading whistleblower award laws, and instead yielded to the lobbying power of Wall Street.

MANDATORY AWARDS

All of the successful whistleblower award laws require the government to pay qualified whistleblowers a mandatory award if they adhere to the criteria established by law or regulation. The mandatory nature of the award laws is the single most important feature of every successful whistleblower qui tam law. The most successful whistleblower laws in the United States require the payment of an award, not less than 10% and not more than 30% of the monies collected by the United States. Thus, whistleblowers are not compensated by taxpayer funds, but instead monies obtained from the fraudsters they report are used to pay the awards.

What did Justice Do?

Although the Justice Department had the discretion to follow the precedent under Dodd-Frank, False Claims, and AML laws, it ignored these precedents and created a discretionary program. In other words, the Justice Department can deny a fully qualified whistleblower, for any reason or no reason. There is no appeal. The Justice Department’s written regulations are clear: “The Department’s Award Determination is entirely discretionary, and neither appealable nor subject to judicial review.”

A whistleblower whose information results in hundreds of millions of dollars in recoveries, but who suffers tremendous retaliation, simply has no right to an award.

Not surprisingly, all discretionary whistleblower award laws have failed. Why should a whistleblower risk everything if the government has no obligation whatsoever to live up to its end of the bargain?

LIMITS ON AWARD AMOUNTS

The successful whistleblower award laws have no caps on the amount of an award. Awards are based on the quality of information provided, the cooperation a whistleblower provides to the government, the risks or sacrifices of the whistleblower, and the size of the frauds or crimes the whistleblower uncovers and reports. All awards are tied to the amount of actual recovery collected from the fraudster.

The Chamber of Commerce has tried, for years, to cap or limit the amount of an award. They fully understand that the handful of very large awards drives thousands of whistleblowers to come forward. Large awards publicize the programs, send a message that the government will honor its commitments, and incentivizes well-paid and high-level executives to become whistleblowers. Thus, capping the amount of an award is the number one goal of the corporate lobbyists attempting to weaken or undermine whistleblower rights.

In 2018 the SEC instituted a rulemaking proceeding which would have limited the amount of awards paid to whistleblowers in large cases. The initial proposal was approved in a 3-2 vote (all of the SEC Commissioners more supportive of Wall Street interests voted for limiting the size of awards). The proposal was debated internally within the SEC for two years, and leading whistleblower experts and advocates provided empirical evidence that large awards were a cornerstone to the program, incentivized some of the most important whistleblowers, and had a deterrent effect on wrongdoing.

Based on the objective evidence the Commission, 5-0, withdrew the proposal and rejected a rule that would have limited awards in large cases.

What did Justice Do?

Breaking with 35-years of Congressional legislation and ignoring the empirical evidence concerning the importance of large awards, the Justice Department, in an unprecedented move, decided to cap the amount of awards. This was the most significant victory Wall Street, and the Chamber of Commerce obtained, and it sets a terrible precedent.

Incredibly, the Justice Department instituted a rule that was even more regressive than the proposal made by the Chamber of Commerce. In its report Fixing the False Claims Act, the Chamber advocated changing the False Claims Act’s mandatory minimum 15% award, to a sliding scale that would create a “Graduated Reduction” in a whistleblower’s award. The amount of awards would be slowly reduced, and ultimately whistleblowers would only obtain “1 to 3 percent of amounts recovered above $100 million.”

The Justice Department took an even more extreme position. They adopted the Chamber’s recommendation to gradually reduce the size of an award, but instead of permitting tiny awards in large cases, they decided to zero these awards out, and pay nothing. Under the DOJ criteria, a whistleblower would not be entitled to any compensation based on recoveries that topped $500 million and would be subjected to a 5% cap on recoveries above $100 million. These caps need to be understood in the context of the right of the DOJ to reduce or deny awards at will. The DOJ capped the maximum amount of awards, yet established no minimum award, and provided itself with authority to pay no awards to fully qualified whistleblowers. The Chamber of Commerce never went this far in its proposal to undermine the False Claims Act.

CRIMINAL CULPABILITY

All the existing award laws have addressed the issue of the potential criminal culpability of the whistleblower. The original False Claims Act fully recognized this issue when it was signed into law by President Abraham Lincoln on March 2, 1863. The Senate sponsors of the bill explicitly called for participants in the frauds to step forward and use the law to assist the government in detecting these types of crimes. The Senate sponsor of the original False Claims Act recognized that it “takes a rogue to catch a rogue” and the primary intent of the award laws was to induce persons involved in the criminal conspiracy to turn on their fellow conspirators.

Thus, all successful whistleblower award laws permit participants in the frauds to turn in their co-conspirators and collect an award. This aspect of the law is perhaps the most important tool in incentivizing highly placed whistleblowers to step forward. In the context of asset forfeiture, there are no better sources of who the bad actors are who are hiding their assets than the bankers who opened their accounts. All of the laws prohibit persons convicted of the crime they are reporting from collecting an award. But likewise, all of the laws encourage participants, such as international bankers, to step forward.

What did Justice Do?

The Chamber of Commerce and its corporate allies have long advocated against the primary goal of the qui tam laws, i.e. to induce conspirators to turn on their co-conspirators. The fact that “trusted” persons sitting around a corporate board when the company is discussing paying a bribe sends chills within corporate America. In 2010,, the Chamber of Commerce made its position on this issue perfectly clear: “Exclude culpable individuals from award eligibility . . . corporate employees should not be rewarded if they engage in, perpetuate, or fail to take action to stop internal wrongdoing. Individuals who participated in wrongdoing should be excluded from award eligibility.”

Although Congress has continuously rejected such a broad disqualification, and the SEC explicitly rejected this proposal submitted by the Chamber and numerous corporate allies, the Justice Department has now adopted the essence of this position. Under the DOJ’s rules, the vast majority of participants in any fraud are now blocked from obtaining an award.

The DOJ regulation bars anyone who “meaningfully participated” in the fraud. This would cover the overwhelming majority of the best sources of information, and would give comfort to corporate insiders knowing that their co-conspirators could not obtain an award if they turned them in. The only exception would be for those who had a “minimal role,” i.e. those who would have the least valuable information, such as a secretary who may have mailed a letter related to the fraud. The regulation states: “An individual is not eligible for payment if they meaningfully participated in the criminal activity, including by directing, planning, initiating, or knowingly profiting from that criminal activity” (emphasis in original).

CONFIDENTIAL REPORTING

Dodd-Frank and the new AML whistleblower award law permits confidential and anonymous filing.

What did Justice Do?

Although the Justice Department permits anonymous filings, the regulations require that an anonymous whistleblower be identified whenever the Justice Department requests it. The regulation states: “The Department reserves the right to require information regarding your identity at any time the Department, in its sole discretion, deems it necessary to the prosecution of a case or to meet the Department’s legal obligations, policies, or procedures.”

Thus, DOJ can waive confidentiality and anonymity at-will, unbound by the legal restraints contained in Dodd-Frank and the AML whistleblower laws.

INTERNAL REPORTING

The DOJ’s new program strongly encourages whistleblowers to make internal reports to the very companies they suspect are violating the law. Similarly, the program provides companies who “self-report,” even after whistleblowers disclose violations of law to the government, major benefits and radical reductions in the amount of fines and penalties.

According to the DOJ factsheet:

“DOJ recognizes the value of companies’ internal compliance programs and has designed the pilot program to encourage employees to report misconduct internally before submitting information to DOJ.” (emphasis added).

This focus on encouraging whistleblowers to report to their companies ignored the fact that the very companies that benefit from these internal reports have lobbied and successfully fought in court to strip whistleblowers of protection against retaliation. In other words, the DOJ is encouraging employees to engage in a behavior that is not protected under federal law, and can result in their being fired and harassed, without legal protections.

All whistleblower laws protect employees who report to the government. But the following laws do not:

  • Commodity Exchange Act: No protection for internal disclosures.
  • Security Exchange Act/Foreign Corrupt Practices Act: No protection for internal disclosures.
  • Federal Obstruction of Justice Whistleblower Law: No protection for internal disclosures.
  • Anti-Money Laundering and Sanctions Whistleblower Law: No protection for internal disclosures for any employees who work for FDIC insured institutions or credit unions.
  • Asset Forfeiture Whistleblower Award (Fund): No protection for internal disclosures.

A recent study published in SSRN demonstrated that 92% of all corporate whistleblower retaliation cases arise from employees who make internal disclosure, while only 5% of retaliation cases arise from employees who report to the government, but avoid internal compliance programs.

It is extremely troubling that the DOJ would encourage whistleblowers to engage in behaviors that are not protected under federal law, will result in many of them losing the ability to report confidentially, and that the empirical evidence demonstrates is the most dangerous method for an employee to report concerns.

Moreover, the DOJ ignored the fact that Wall Street, led by the Chamber of Commerce, strongly argued that internal reporting should not be protected under the Dodd-Frank Act. The Chamber succeeded in having the Supreme Court overturn an SEC regulation that protected internal whistleblower disclosures from protection under law and resulted in stripping employees who reported to corporate counsel, corporate boards, corporate audit committees, or corporate compliance programs from all protections against retaliation under Dodd-Frank.

Options for Whistleblowers

The DOJ’s Corporate Whistleblower Awards Pilot Program represents a colossal lost opportunity to use a Fund created by Congress to combat major financial crimes to incentivize and compensate whistleblowers and otherwise encourage human rights defenders to assist in reporting domestic and international corruption. The Fund has billions of dollars that could have been creatively, aggressively and effectively utilized to fill loopholes in current laws and implement the important recommendations of the United States Strategy on Countering Corruption.

However, existing whistleblower award laws, that do not share the defects of the DOJ Pilot Program, can still be used by whistleblowers. Given the broad scope of these laws, much of the negative impact of the Justice Department’s regulations can be mitigated. Dodd-Frank can be used to report foreign bribery by most corporations worldwide; the Anti-money laundering laws can be used to hold banks and financial exchanges accountable, and to report violations of U.S. sanctions; the IRS program can be used to report tax evasion and permits awards for IRS investigations related to asset forfeiture; and finally, the Commodity Exchange Act can be used to report foreign corruption in the international commodities markets.

Employees who report directly to federal law enforcement authorities are also fully protected under the federal obstruction of justice laws. Under the obstruction law passed as part of the Sarbanes-Oxley corporate reform law, employers who fire employees for reporting to federal law enforcement are subjected to fines and up to ten years in prison.

These numerous (and highly effective) laws do not contain the problems that undermine whistleblower rights under the DOJ Pilot Program, and they should be used whenever available.

Conclusion

The Justice Department adopted proposals long sought after by Wall Street special interests and the Chamber of Commerce and created a program that delivered on the corporate wish-list for undercutting the effectiveness of whistleblower award programs. By making the program discretionary, capping the amount of awards, blocking the best informants from coverage, and placing a major caveat on the right to file anonymous claims, the Justice Department’s program runs counter to the significant amount of empirical evidence concerning the specific policies and procedures necessary to operate a successful program. Worse still, it creates a dangerous precedent for future whistleblower laws.

To understand just how terrible discretionary programs with compensation caps are and why Congress has repeatedly rejected them since 1986, one need only look at older and discredited award programs.

For example, between 1989 and 2010, the SEC had a discretionary award program covering whistleblowers who disclosed insider trading. The SEC Inspector General reviewed that program and found that it was a total failure and was unable to stop frauds like the ENRON scandal or frauds associated with the 2008 financial collapse.

The Inspector General described the program and its operation over its eleven years of existence as follows:

“All bounty determinations, including whether, to whom, or in what amount to make payments, are within the sole discretion of the SEC.”

“Since the inception of the SEC bounty program in 1989, the SEC has paid a total of $159,537 to five claimants.”

Thus, in July 2010, Congress repealed this discredited law and passed Dodd-Frank, which has mandatory award laws, no caps, and no discretion to deny qualified whistleblowers compensation.

The old IRS law and the False Claims Act of 1943 had similar problems, and both laws were amended to make the payment of awards mandatory, eliminate all caps, and end the discretion of government agencies to deny awards. All of the modern award laws also permit whistleblowers to challenge any denial in court.

The Justice Department had the discretion to create a highly effective program based on the Dodd-Frank Act. They dropped the ball. Now Congress needs to fix the mess Justice created.

In the meantime, whistleblowers should continue to use the highly effective award laws: the False Claims Act, the Dodd-Frank Act, the AML Whistleblower Improvement Act and the Foreign Corrupt Practices Act. Whistleblowers should also take advantage of the strong protections offered under the federal obstruction of justice statutes by reporting concerns directly to law enforcement.

The Justice Department did get one thing right. As part of its pilot program, Justice ruled that whistleblowers who are covered under the existing highly effective whistleblower laws cannot obtain any awards under the pilot program. Intentionally or not, this was the best advice Justice could give to whistleblowers: Make sure you use the existing laws and not rely on the pilot program.

Top Competition Enforcers in the US, EU, and UK Release Joint Statement on AI Competition – AI: The Washington Report


On July 23, the top competition enforcers at the US Federal Trade Commission (FTC) and Department of Justice (DOJ), the UK Competition and Markets Authority (CMA), and the European Commission (EC) released a Joint Statement on Competition in Generative AI Foundation Models and AI products. The statement outlines risks in the AI ecosystem and shared principles for protecting and fostering competition.

While the statement does not lay out specific enforcement actions, the statement’s release suggests that the top competition enforcers in all three jurisdictions are focusing on AI’s effects on competition in general and competition within the AI ecosystem—and are likely to take concrete action in the near future.

A Shared Focus on AI

The competition enforcers did not just discover AI. In recent years, the top competition enforcers in the US, UK, and EU have all been examining both the effects AI may have on competition in various sectors as well as competition within the AI ecosystem. In September 2023, the CMA released a report on AI Foundation Models, which described the “significant impact” that AI technologies may have on competition and consumers, followed by an updated April 2024 report on AI. In June 2024, French competition authorities released a report on Generative AI, which focused on competition issues related to AI. At its January 2024 Tech Summit, the FTC examined the “real-world impacts of AI on consumers and competition.”

AI as a Technological Inflection Point

In the new joint statement, the top enforcers described the recent evolution of AI technologies, including foundational models and generative AI, as “a technological inflection point.” As “one of the most significant technological developments of the past couple decades,” AI has the potential to increase innovation and economic growth and benefit the lives of citizens around the world.

But with any technological inflection point, which may create “new means of competing” and catalyze innovation and growth, the enforcers must act “to ensure the public reaps the full benefits” of the AI evolution. The enforcers are concerned that several risks, described below, could undermine competition in the AI ecosystem. According to the enforcers, they are “committed to using our available powers to address any such risks before they become entrenched or irreversible harms.”

Risks to Competition in the AI Ecosystem

The top enforcers highlight three main risks to competition in the AI ecosystem.

  1. Concentrated control of key inputs – Because AI technologies rely on a few specific “critical ingredients,” including specialized chips and technical expertise, a number of firms may be “in a position to exploit existing or emerging bottlenecks across the AI stack and to have outside influence over the future development of these tools.” This concentration may stifle competition, disrupt innovation, or be exploited by certain firms.
  2. Entrenching or extending market power in AI-related markets – The recent advancements in AI technologies come “at a time when large incumbent digital firms already enjoy strong accumulated advantages.” The regulators are concerned that these firms, due to their power, may have “the ability to protect against AI-driven disruption, or harness it to their particular advantage,” potentially to extend or strengthen their positions.
  3. Arrangements involving key players could amplify risks – While arrangements between firms, including investments and partnerships, related to the development of AI may not necessarily harm competition, major firms may use these partnerships and investments to “undermine or coopt competitive threats and steer market outcomes” to their advantage.

Beyond these three main risks, the statement also acknowledges that other competition and consumer risks are also associated with AI. Algorithms may “allow competitors to share competitively sensitive information” and engage in price discrimination and fixing. Consumers may be harmed, too, by AI. As the CMA, DOJ, and the FTC have consumer protection authority, these authorities will “also be vigilant of any consumer protection threats that may derive from the use and application of AI.”

Sovereign Jurisdictions but Shared Concerns

While the enforcers share areas of concern, the joint statement recognizes that the EU, UK, and US’s “legal powers and jurisdictions contexts differ, and ultimately, our decisions will always remain sovereign and independent.” Nonetheless, the competition enforcers assert that “if the risks described [in the statement] materialize, they will likely do so in a way that does not respect international boundaries,” making it necessary for the different jurisdictions to “share an understanding of the issues” and be “committed to using our respective powers where appropriate.”

Three Unifying Principles

With the goal of acting together, the enforcers outline three shared principles that will “serve to enable competition and foster innovation.”

  1. Fair Dealing – Firms that engage in fair dealing will make the AI ecosystem as a whole better off. Exclusionary tactics often “discourage investments and innovation” and undermine competition.
  2. Interoperability – Interoperability, the ability of different systems to communicate and work together seamlessly, will increase competition and innovation around AI. The enforcers note that “any claims that interoperability requires sacrifice to privacy and security will be closely scrutinized.”
  3. Choice – Everyone in the AI ecosystem, from businesses to consumers, will benefit from having “choices among the diverse products and business models resulting from a competitive process.” Regulators may scrutinize three activities in particular: (1) company lock-in mechanisms that could limit choices for companies and individuals, (2) partnerships between incumbents and newcomers that could “sidestep merger enforcement” or provide “incumbents undue influence or control in ways that undermine competition,” and (3) for content creators, “choice among buyers,” which could be used to limit the “free flow of information in the marketplace of ideas.”

Conclusion: Potential Future Activity

While the statement does not address specific enforcement tools and actions the enforcers may take, the statement’s release suggests that the enforcers may all be gearing up to take action related to AI competition in the near future. Interested stakeholders, especially international ones, should closely track potential activity from these enforcers. We will continue to closely monitor and analyze activity by the DOJ and FTC on AI competition issues.

Triggers That Require Reporting Companies to File Updated Beneficial Ownership Interest Reports

On January 1, 2024, Congress enacted the Corporate Transparency Act (the “CTA”) as part of the Anti-Money Laundering Act of 2020 and its annual National Defense Authorization Act. Every entity that meets the definition of a “reporting company” under the CTA and does not qualify for an exemption must file a beneficial ownership information report (a “BOI Report”) with the US Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”). Reporting companies include any entity that is created by the filing of a document with a secretary of state or any similar office under the law of a state or Indian tribe (this includes corporations, LLCs, and limited partnerships).

In most circumstances, a reporting company only has to file an initial BOI Report to comply with the CTA’s reporting requirements. However, when the required information reported by an individual or reporting company changes after a BOI Report has been filed or when either discovers that the reported information is inaccurate, the individual or reporting company must update or correct the reporting information.

Deadline: If an updated BOI Report is required, the reporting company has 30 calendar days after the change to file an updated report.

What triggers an updated BOI Report? There is no materiality threshold as to what warrants an updated report. According to FinCEN, any change to the required information about the reporting company or its beneficial owners in its BOI Report triggers a responsibility to file an updated BOI Report.

Some examples that trigger an updated BOI Report:

  • Any change to the information reported for the reporting company, such as registering a new DBA, new principal place of business, or change in legal name.
  • A change in the beneficial owners exercising substantial control over the reporting company, such as a new CEO, a sale (whether as a result of a new equity issuance or transfer of equity) that changes who meets the ownership interest threshold of 25%, or the death of a beneficial owner listed in the BOI Report.
  • Any change to any listed beneficial owner’s name, address, or unique identifying number provided in a BOI report.
  • Any other change to existing ownership information that was previously listed in the BOI Report.

Below is a reminder of the information report on the BOI report:

  • (1) For a reporting company, any change to the following information triggers an updated report:
    • Full legal name;
    • Any trade or “doing business as” name;
    • A complete current address (cannot be a post office box);
    • The state, territory, possession, tribal or foreign jurisdiction of formation; and
      TIN.
  • (2) For the beneficial owners and company applicants, any change to the following information triggers an updated report:
    • Full legal name of the individual;
    • Date of the birth of the individual;
    • A complete current address;
    • A unique identifying number and the issuing jurisdiction from one of the following non-expired documents; and
    • An image of the document.

It is important to note that if a beneficial owner or company applicant has a FinCEN ID and any change is made to the required information for either individual, then such individuals are responsible for updating their information with FinCEN directly. This is not the responsibility of the reporting company

Struck by CrowdStrike Outage? Your Business Loss Could Be Covered

Over the last week, organizations around the globe have struggled to bring operations back online following a botched software update from cybersecurity company CrowdStrike. As the dust settles, affected organizations should consider whether they are insured against losses or claims arising from the outage. The Wall Street Journal has already reported that insurers are bracing for claims arising from the outage and that according to one cyber insurance broker “[t]he insurance world was expecting to cover situations like this.” A cyber analytics firm has estimated that insured losses following the outage could reach $1.5 billion.

Your cyber insurance policy may cover losses resulting from the CrowdStrike outage. These policies often include “business interruption” or “contingent business interruption” insurance that protects against disruptions from a covered loss. Business interruption insurance covers losses from disruptions to your own operations. This insurance may cover losses if the outage affected your own computer systems. Contingent business interruption insurance, on the other hand, covers your losses when another entity’s operations are disrupted. This coverage could apply if the outage affected a supplier or cloud service provider that your organization relies on.

Cyber policies often vary in the precise risks they cover. Evaluating potential coverage requires comparing your losses to the policy’s coverage. Cyber policies also include limitations and exclusions on coverage. For example, many cyber policies contain a “waiting period” that requires affected systems to be disrupted for a certain period before the policy provides coverage. These waiting periods can be as short as one hour or as long as several days.

Other commercial insurance policies could also provide coverage depending on the loss or claim and the policy endorsements and exclusions. For example, your organization may have procured liability insurance that protects against third-party claims or litigation. This insurance could protect you from claims made by customers or other businesses related to the outage.

If your operations have been impacted by the CrowdStrike outage, there are a few steps you can take now to maximize your potential insurance recovery.

First, read your policies to determine the available coverage. As you review your policies, pay careful attention to policy limits, endorsements, and exclusions. A policy endorsement may significantly expand policy coverage, even though it is located long after the relevant policy section. Keep in mind that courts generally interpret coverage provisions in a policy generously in favor of an insured and interpret exclusions or limitations narrowly against an insurance company.

Second, track your losses. The outage likely cost your organization lost profits or extra expenses. Common business interruption losses may also include overtime expenses to remedy the outage, expenses to hire third-party consultants or technicians, and penalties arising from the outage’s disruption to your operations. Whatever the nature of your loss, tracking and documenting your loss now will help you secure a full insurance recovery later.

Third, carefully review and comply with your policy’s notice requirements. If you have experienced a loss or a claim, you should immediately notify your insurer. Even if you are only aware of a potential claim, your policy may require you to provide notice to your insurer of the events that could ultimately lead to a claim or loss. Some notice requirements in cyber policies can be quite short. After providing notice, you may receive a coverage response or “reservation of rights” from your insurer. Be cautious in taking any unfavorable response at face value. Particularly in cases of widespread loss, an insurer’s initial coverage evaluation may not accurately reflect the available coverage.

If you are unsure of your policy’s notice obligations or available coverage, or if you suspect your insurer is not affording your organization the coverage that you purchased, coverage counsel can assist your organization in securing coverage. Above all, don’t hesitate to secure the coverage to which you are entitled.

Listen to this post

Relying on Noncompete Clauses May Not Be the Best Defense of Proprietary Data When Employees Depart

Much of the value of many companies often is wrapped up with and measured by their intellectual property (IP) portfolios. Some forms of IP, such as patents, are known by the public. Others derive their value from being hidden from the public. Many companies, for example, have gigabytes of data or “know-how” that may be worth millions, but only to the extent that they remain secret. This article discusses some ways to keep business information confidential when an employee who has had access to that information leaves the company.

Many companies traditionally turned to employment agreements, specifically noncompete clauses, to protect proprietary competitive information. The legality of noncompetes is in question following the Federal Trade Commission’s (FTC’s) ban on them, which is being challenged in court by the U.S. Chamber of Commerce, causing confusion and concerns about protecting information via noncompete agreements. As covered in Wilson Elser’s prior articles* on this subject, the timeline of the FTC rule in question was as follows:

  • The FTC promulgated new rules to take effect in September 2024 banning all noncompete agreements.
  • The U.S. Supreme Court overturned the 40-year-old method of reviewing agency rules (Chevron Deference), throwing all agency rules, including the FTC’s rule on noncompetes, into question.
  • The District Court for the Northern District of Texas preliminarily enjoined the FTC from enforcing its new rule banning noncompetes.

After this flurry of activity, noncompetes are, for now, not banned. But do they offer an effective solution for businesses seeking to protect their proprietary information?

Noncompete Clauses Are Not Always Effective
Vortexa, Inc. v. Cacioppo, a June 2024 case from the District Court for the Southern District of New York, illustrates the limitations of noncompete clauses in employment agreements. That case presents the familiar fact pattern of an employee leaving and going to work for a competitor. With some evidence of the employee’s access to proprietary competitive information in hand (but no evidence of actual misappropriation), the former employer sought a preliminary injunction to prevent the employee from working for the competitor for one year, the term stated in the noncompete clause in the employee’s contract with the former employer. The contract also included common non-disclosure and confidentiality clauses.

Absent evidence of actual misappropriation, the plaintiff employer relied on the “Inevitable Disclosure” doctrine, which assumes that a departing employee will inevitably disclose confidential information when they go work for a competitor. The court refused to apply this doctrine, explaining that inevitable disclosure may substitute for actual evidence of misappropriation only when the information is a trade secret. Here, none of the information about which the former employer was concerned was a trade secret.

The proprietary information that the former employee had was pricing data, marketing strategies and “intricacies of the business.” These types of information do not, in and of themselves, constitute trade secrets. In addition, the information was not afforded trade secret treatment because (1) some of it was ascertainable by the competitor without reference to the first employer’s information; (2) the companies sell different products; (3) some of the information was developed without the expenditure of a good deal of money and effort; (4) some of the information was provided to clients without a non-disclosure agreement; (5) some of the information was shared on company-wide collaboration channels; and (6) “google drive log records show that [the former employee] opened and viewed these documents, which underlines the lack of security protecting this purportedly confidential information.”

Most of these reasons for the information not being accorded trade secret status cannot be changed by any action of the employer. For example, if information can be generated by means independent of the first employer, that information cannot be protected by trade secret law and nothing the first employer can do will change that after the fact. However, any business seeking to protect its valuable competitive information can change the way that it secures, protects and manages access to its competitive information, and this may be enough to ensure that its information is protected by trade secret law.

What Businesses Should Do to Protect Their Proprietary Competitive Information
Generally, proprietary competitive information can be protected as a trade secret by operation of law or via contract. In many cases, the “boots and suspenders” approach is best – the information should be protected both by contract and by meeting the requirements for protection under trade secret law. As described, a contract alone is sometimes ineffective, so information that derives its value from not being generally known to the public should also be treated in such a manner that the courts would see it as being a trade secret.

Specifically, for something to qualify for trade secret protection under federal and state statues and common law, it must be securely kept and carefully protected from disclosure. Some easy ways to protect information are to (1) restrict access to folders on a company’s internal computer systems, (2) physically lock rooms that contain hard copies and (3) have computers lock automatically when not accessed for set time periods. Protecting information via noncompete, confidentiality and non-disclosure contractual obligations is another way to ensure that information remains secret, such that it is protected under trade secret law. Internal policies on how information may be shared with third parties, such as clients, also are helpful evidence of trade secret treatment. In addition, the business may consider maintaining records on the time, effort and monetary expenditures required to develop proprietary information, which should allow the business to demonstrate that making such information freely available to a competitor is fundamentally unfair.

In some cases, information protected as a trade secret may be the most valuable IP that a company owns. But the value can easily be lost if the company does not properly secure the information. Different scenarios call for different methods of security, and a good rule of thumb to protect information from disclosure by a departing employee is to protect this information both by contract and as a trade secret.

The first step for any business is to think through their overall data protection strategy and consult with experienced intellectual property counsel to put appropriate protections in place.

Federal Agencies Have Placed a Heightened Priority on Whistleblowers and Speedy Cooperation

As new areas of the law emerge, driven in part by technology and the free flow of information, federal agencies are becoming more aggressive with a tried and true carrot-and-stick approach to law and regulatory enforcement.

In a recent PLI panel on government enforcement priorities in May 2024, Brent Wible, Chief Counselor, Office of the Assistant Attorney General, Department of Justice (DOJ or Department); Daniel Gitner, Chief of the Criminal Division, US Attorney’s Office for the Southern District of New York (SDNY or the Office); and Antonia Apps, Director of the New York Regional Office of the Securities and Exchange Commission (SEC or Commission) shared their thoughts, priorities and practices in 2024 enforcement and beyond.

All of the government lawyers stressed that the DOJ and enforcement agencies are open and are actively encouraging whistleblowers with new incentives and programs. To that end, Mr. Gitner from the SDNY stated very directly that corporations need to understand that there is a “need for speed” in corporate self-disclosures. Otherwise, whistleblowers will be closing the door to the benefits of corporate self-disclosures. Put differently, enforcement agencies do not want a corporation to complete lengthy internal investigations before reporting.

A uniform theme and stance taken by all is that whistleblowers are valuable, and bounties will be paid in cash or in deferred prosecution agreements or possibly both. Whistleblowers must be protected. Internal and external whistleblowers should be encouraged.
This article focuses on three whistleblower initiatives—(i) the SEC’s Whistleblower Program, (ii) the SDNY Whistleblower Pilot Program and (iii) DOJ’s Pilot Whistleblower Program for voluntary self-disclosure—and how those programs may impact a corporation’s response to whistleblowers, internal investigations, and disclosures.

SEC 21F WHISTLEBLOWER PROGRAM

Since its inception more than a decade ago, the SEC’s Whistleblower Program is widely viewed as successfully incentivizing whistleblower reports of violations of the securities laws. In its 2023 fiscal year, the SEC received more than 18,000 tips from whistleblowers and issued the most awards to whistleblowers ever in one year, totaling nearly US$600 million. That year, the Commission also issued its largest ever award of US$279 million to a single whistleblower.1

What is the SEC’s Whistleblower Program?

Section 21F of the Securities Exchange Act of 1934, codified as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act, requires the SEC to pay awards to whistleblowers who provide information to the SEC about violations of federal securities laws.2 Accordingly, the SEC has issued a series of rulemakings implementing Section 21F to create its whistleblower program. To qualify as a whistleblower, an individual must voluntarily provide the SEC with original information in writing about a possible violation of federal securities law that has occurred, is ongoing, or is about to occur.3 To qualify for an award, this information must lead to a successful enforcement action with monetary sanctions totaling more than US$1 million.4

“Original” information means that it cannot be found in publicly available sources and is not already known by the Commission, but is instead the product of the whistleblower’s independent knowledge or analysis.5 A submission is “voluntary” if the whistleblower provides it to the SEC before receiving a regulatory request or demand for information relating to the same subject matter. Therefore, a submission of information that is made in response to a request, inquiry, or demand by the SEC, the Public Company Accounting Oversight Board, a self-regulatory organization (such as the Financial Industry Regulatory Authority), or a separate federal or state governmental body does not qualify as a voluntary submission.6 Additionally, a submission that is required under a legal or contractual duty to the Commission is not considered voluntary and is thus ineligible for an award.7

The SEC’s whistleblower rules also include anti-retaliation protections intended to ensure that the incentives provided to whistleblowers for reporting are not outweighed by a fear of reprisal from their employer. Under Rule 21F-17, companies are prohibited from interfering with or impeding a whistleblower’s communications to the SEC about a possible violation of the securities laws, including through enforcement or threatened enforcement of a confidentiality agreement that may be read to prevent whistleblower communications with the SEC.8

The SEC is taking violations of Rule 21F-17 seriously and has increased enforcement activity in this area over the last two years. The Commission brought a number of actions, with significant civil penalties, focused on corporate agreements containing confidentiality language that, according to the SEC, does not provide an express exception for whistleblower communications. The enforcement actions extend to different types of companies, including publicly traded companies, privately held companies, broker-dealers and investment advisers, and to a variety of forms of agreements with employees and customers alike.9

For example, a gaming company paid US$35 million to settle claims that it had violated the whistleblower protection rule by requiring former employees to execute separation agreements that obligated them to notify the company of any request for information received from the Commission, in addition to compliance failures regarding workplace complaints.10 In January 2024, the SEC settled the largest ever standalone Rule 21F-17 case, imposing US$18 million in civil penalties against a dually registered investment adviser and broker dealer for allegedly requiring clients to sign a confidential release agreement—without expressly allowing for direct communications to regulators regarding potential securities law violations—in order to receive certain credit or settlement payments.11 In another case involving US$10 million in civil penalties, the Commission charged a registered investment adviser with a standalone violation of Rule 21F-17 based on employment agreements that contained a confidentiality clause prohibiting external disclosure of confidential company information, without a carve-out for voluntary communications with the SEC concerning possible violations of the securities laws.12 As recently stated by the co-chief of the SEC Enforcement Division’s Asset Management Unit, “Investors, whether retail or otherwise, must be free to report complaints to the SEC without any interference. Those drafting or using confidentiality agreements need to ensure that they do not include provisions that impede potential whistleblowers.”13

SDNY WHISTLEBLOWER PILOT PROGRAM

In February 2024, the SDNY launched a whistleblower pilot program. The purpose of the program is to encourage early and voluntary self-disclosure of criminal conduct by individual participants.14 The program is applicable to disclosures of conduct committed by public or private companies, exchanges, financial institutions, investment advisers, or investment funds involving fraud or corporate control failure or affecting market integrity, or criminal conduct involving state or local bribery or fraud relating to federal, state, or local funds.15 In exchange for a qualifying self-disclosure, the Office will enter into a non-prosecution agreement with the whistleblower.16

Given that a non-prosecution agreement is promised, the SDNY has identified factors to determine whether a whistleblower qualifies for a discretionary non prosecution agreement. The most salient include: whether and to what extent the misconduct is unknown to either SDNY or the DOJ; whether the information is disclosed voluntarily to SDNY and not in response to an inquiry or obligation to report misconduct; whether the whistleblower provides substantial assistance in the investigation and prosecution of culpable individuals, and in the investigation and prosecution of the disclosed conduct; whether the whistleblower truthfully and completely discloses all criminal conduct they participated in and are aware of; whether the whistleblower is a chief executive officer or chief financial officer of a public or private company, who is not eligible for the pilot program; and the adequacy of noncriminal sanctions, such as remedies imposed by civil regulators.

Mr. Gitner said the defense bar is coming around to a non-prosecution carrot for individuals involved in wrongdoing within the corporation. Mr. Gitner said that SDNY seeks early discussions, and the pilot program seems to be driving toward that goal.

DOJ PILOT PROGRAM ON VOLUNTARY SELF-DISCLOSURES FOR INDIVIDUALS

In March 2024, the DOJ announced an upcoming program to reward whistleblowers who report corporate crimes. The new program seeks to bolster existing whistleblower programs established by the SEC (discussed above), the Commodities Future Trading Commission (CFTC), the Internal Revenue Service, and the Financial Crimes Enforcement Network.17 Accordingly, the program will offer rewards to whistleblowers who provide information on misconduct that is not under the jurisdiction of those agencies. In particular, the Department is interested in criminal abuses of the US financial system, foreign corruption cases outside of the SEC’s jurisdiction, and domestic corruption cases. In order to qualify, an individual must provide original, nonpublic, and truthful information that assists the Department in uncovering “significant corporate or financial misconduct” and is previously unknown to the agency.18 Like the SEC and CFTC, the Department does not plan to provide awards for information that is submitted under a preexisting duty or in response to an inquiry.19 Access to the program is only available where existing programs or qui tam actions do not exist. Additionally, the whistleblower in this program cannot be involved in the criminal activity itself. After compensation to victims, the whistleblower will receive a portion of the resulting forfeiture as a reward.20

Interestingly, however, it appears the Department may be moving away from offering monetary awards to whistleblowers. In April 2024, the Department introduced a pilot program that tracks with the SDNY and offers mandatory non prosecution agreements to individuals who provide information on corporate misconduct.21 Under the program, an individual must voluntarily self-disclose original information to the Criminal Division about criminal misconduct that is not previously known to the Department. The information must be “truthful and complete,” meaning it must include all known information relating to the misconduct, including the individual’s own culpability. In particular, the Department seeks information on violations by financial institutions; violations related to market integrity committed by financial institutions, investment advisers, investment funds, or public or private companies; foreign corruption and bribery violations by public or private companies; violations relating to health care fraud or illegal health care kickbacks; fraud or deception against the United States in connection with federally funded contracting; and bribery or kickbacks to domestic public officials by public or private companies. The whistleblower also cannot be a chief executive officer, chief financial officer, or those equivalents of a public or private company; or an elected or appointed foreign government or domestic government official; nor can the whistleblower have a previous felony conviction or a conviction of any kind involving fraud or dishonesty. Irrespective of this program, the Department still has the discretion of offering a non-prosecutorial agreement to individuals who may not meet the above criteria in full, subject to Justice Manual and Criminal Division procedures.22

TAKEAWAYS

The takeaways here for corporate in-house legal departments are:

  • Federal agencies are incentivizing whistleblowers with cash and non-prosecution agreements. It is clear that wrongdoers and witnesses now more than ever have several whistleblower programs from which to choose. As a result, corporations must become more vigilant at detecting wrongdoing and effectively utilizing internal reporting systems. Careful consideration of an early self-disclosure to the appropriate agency may also be warranted. Internal investigations will take a heightened priority to aid the c-suite and board on disclosure decisions.
  • Not only is protecting whistleblowers a priority but encouraging whistleblowers through heightened compliance programs, updated hotlines or other internal reporting programs should be considered. You may also wish to consider offering financial incentives for timely reporting to the corporation’s internal reporting program. All of which will benefit the company in any government disclosure.
  • The enforcement risk for companies under the SEC’s whistleblower rules is real and potentially significant, including with respect to day-to-day business activities (such as entering into client or employee confidentiality agreements) that may not otherwise be recognized as creating regulatory exposure. Companies may wish to revisit their standard contracts and compliance materials to ensure that any confidentiality provisions align with Rule 21F-17.

We acknowledge the contributions to this publication from our summer associate Minu Nagashunmugam.

https://www.sec.gov/newsroom/enforcement-results-fy23.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 2.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 2.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 3.

5https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 28.

The SEC’s Office of the Whistleblower has stated that violations of Rule 21F-17 may be triggered by “internal policies, procedures, and guidance, such as codes of conduct, compliance manuals, training materials, and other such documents.” SEC, Whistleblower Protections (last updated July 1, 2024) https://www.sec.gov/enforcement-litigation/whistleblower-program/whistleblower-protections#anti-retaliation.

10 https://news.bloomberglaw.com/securities-law/sec-biggest-whistleblower-penalty-signals-broad-protection-focus?context=search&index=11

11 In re JP Morgan Sec. LLC, File No. 3-21829 (Jan. 16, 2024), https://www.sec.gov/files/litigation/admin/2024/34-99344.pdf.

12 In re D.E. Shaw & Co., L.P., File No. 3-21775 (Sept. 29, 2023), https://www.sec.gov/files/litigation/admin/2013/34-70396.pdf.

13 SEC Press Release (Jan. 16, 2024), https://www.sec.gov/newsroom/press-releases/2024-7.

14 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

15 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

16 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

17 https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-speech-american

18 https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-keynote-remarks-american-bar-associations

19 https://www.justice.gov/criminal/media/1347991/dl?inline

20https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-keynote-remarks-american-bar-associations

21https://www.justice.gov/criminal/media/1347991/dl?inline

22 https://www.justice.gov/criminal/media/1347991/dl?inline

Listen to this post

FinCEN Publishes Updated FAQs

Entities terminated in 2024 are required to file Corporate Transparency Act beneficial ownership information reports, as are administratively dissolved entities.

The Financial Crimes Enforcement Network (“FinCEN”) recently published updates to its list of Frequently Asked Questions (“FAQs”) to assist entities in complying with the beneficial ownership reporting requirements of the Corporate Transparency Act (“CTA”).

Principal among these updates was FinCEN’s clarifying requirement that business entities terminated in the year 2024 (whether existing prior to 2024 or formed in 2024) are required to file beneficial ownership information reports (BOIR) under the CTA.

This filing requirement also expressly includes BOIR filings for administratively dissolved entities.

Each of these concepts were the subject of debate as to their applicability under the CTA prior to this FAQ release, with some conjecture that terminating an entity’s existence prior to its BOIR filing deadline would alleviate the need to make a BOIR filing – a position now refuted by FinCEN.

As Polsinelli has consistently advised, the obligation to file under the CTA has accrued for all entities in existence in 2024, only the deadline for filing the BOIR has not yet arrived. Entities are advised to file their BOIR prior to consummating their termination process.

The July 8 FAQs also included clarification on beneficial owner disclosure scenarios involving an entity fully or partially owned by an Indian Tribe.

FinCEN expects to publish further guidance in the future. The updated FAQs can be accessed here.

* * * * *

Several of the updates bear special note:

1. FAQ C. 12. – Reporting Company Status

Do beneficial ownership information reporting requirements apply to companies created or registered before the Corporate Transparency Act was enacted (January 1, 2021)?

FinCEN stated “Yes.” Beneficial ownership information reporting requirements apply to all companies that qualify as “reporting companies”, regardless of when they were created or registered. Companies are not required to report beneficial ownership information to FinCEN if they are exempt or ceased to exist (i.e., are formally terminated with the Secretary of State) as legal entities before January 1, 2024.

2. FAQ C. 13. – Reporting Company Status

Is a company required to report its beneficial ownership information to FinCEN if the company ceased to exist before reporting requirements went into effect on January 1, 2024?

A company is not required to report its beneficial ownership information to FinCEN if it ceased to exist as a legal entity (i.e., was formally terminated with the Secretary of State) before January 1, 2024. This means that the entity entirely completed the process of formally and irrevocably dissolving (i.e., was formally terminated with the Secretary of State). A company that ceased to exist as a legal entity before the beneficial ownership information reporting requirements became effective January 1, 2024, was never subject to the reporting requirements and thus is not required to report its beneficial ownership information to FinCEN.

Although state or Tribal law may vary, a company typically completes the process of formally and irrevocably dissolving by, for example, filing dissolution paperwork with its jurisdiction of creation or registration, receiving written confirmation of dissolution, paying related taxes or fees, ceasing to conduct any business, and winding up its affairs (e.g., fully liquidating itself and closing all bank accounts).

If a reporting company continued to exist as a legal entity for any period of time on or after January 1, 2024 (i.e., did not entirely complete the process of formally and irrevocably dissolving (i.e., terminating) before January 1, 2024), then it is required to report its beneficial ownership information to FinCEN, even if the company had wound up its affairs and ceased conducting business before January 1, 2024.

Similarly, if a reporting company was created or registered on or after January 1, 2024, and subsequently ceased to exist, then it is required to report its beneficial ownership information to FinCEN—even if it ceased to exist before its initial beneficial ownership information report was due.

A company that is administratively dissolved or suspended—because, for example, it failed to pay a filing fee or comply with certain jurisdictional requirements—generally does not cease to exist as a legal entity unless the dissolution or suspension becomes permanent. Until the dissolution becomes permanent, such a company is required to report its beneficial ownership information to FinCEN.

3. FAQ C. 14. – Reporting Company Status

If a reporting company created or registered in 2024 or later winds up its affairs and ceases to exist before its initial BOI report is due to FinCEN, is the company still required to submit that initial report?

FinCEN stated “Yes.” Reporting companies created or registered in 2024 must report their beneficial ownership information to FinCEN within 90 days of receiving actual or public notice of creation or registration. Reporting companies created or registered in 2025 or later must report their beneficial ownership information to FinCEN within 30 days of receiving actual or public notice of creation or registration. These obligations remain applicable to reporting companies that cease to exist as legal entities—meaning wound up their affairs, ceased conducting business, and entirely completed the process of formally and irrevocably dissolving—before their initial beneficial ownership reports are due.

It bears note that, if a reporting company files an initial beneficial ownership information report and then ceases to exist, then there is no requirement for the reporting company to file an additional report with FinCEN noting that the company has ceased to exist.

4. FAQ D. 17. – Beneficial Owner

Who should an entity fully or partially owned by an Indian Tribe report as its beneficial owner(s)?

An Indian Tribe is not an individual, and thus should not be reported as an entity’s beneficial owner, even if it exercises substantial control over an entity or owns or controls 25 percent or more of the entity’s ownership interests. However, entities in which Tribes have ownership interests may still have to report one or more individuals as beneficial owners in certain circumstances.

Entity Is a Tribal Governmental Authority. An entity is not a reporting company—and thus does not need to report beneficial ownership information at all—if it is a “governmental authority,” meaning an entity that is (1) established under the laws of the United States, an Indian Tribe, a State, or a political subdivision of a State, or under an interstate compact between two or more States, and that (2) exercises governmental authority on behalf of the United States or any such Indian Tribe, State, or political subdivision. This category includes tribally chartered corporations and state-chartered Tribal entities if those corporations or entities exercise governmental authority on a Tribe’s behalf.

Entity’s Ownership Interests Are Controlled or Wholly Owned by a Tribal Governmental Authority. A subsidiary of a Tribal governmental authority is likewise exempt from BOI reporting requirements if its ownership interests are entirely controlled or wholly owned by the Tribal governmental authority.

Entity Is Partially Owned by a Tribe (and Is Not Exempt). A non-exempt entity partially owned by an Indian Tribe should report as beneficial owners all individuals exercising substantial control over it, including individuals who are exercising substantial control on behalf of an Indian Tribe or its governmental authority. The entity should also report any individuals who directly or indirectly own or control at least 25 percent or more of the ownership interests of the reporting company. (However, if any of these individuals own or control these ownership interests exclusively through an exempt entity or a combination of exempt entities, then the reporting company may report the name(s) of the exempt entity or entities in lieu of the individual beneficial owner.)