Category: Criminal Law

The Five Largest SEC Whistleblower Awards from the First Half of 2024

In the first half of 2024, the SEC Whistleblower Program awarded over $18 million to whistleblowers who aided in the agency’s enforcement efforts. Below are the top five awards from the first half of 2024.

Since its inception in 2010, the Securities and Exchange Commission (SEC) Whistleblower Program has made significant strides, granting over $1.9 billion in whistleblower awards. In the first half of 2024, over $18 million was awarded to individuals who voluntarily provided original information that led to a successful enforcement action, a testament to the program’s effectiveness.

Under the SEC Whistleblower Program, qualified whistleblowers can receive 10-30% of the funds collected from a successful enforcement action based on their tip. The SEC does not disclose identifying information about award recipients, ensuring their protection and the program’s integrity.

Following are the top five whistleblower awards of the first half 2024:

1. $3.6 Million

On June 17, the SEC granted two claimants a total of $3.6 million, with the first receiving $2,400,000 and the second receiving $1,200,000.

The SEC acknowledged the significant contribution of the first Claimant whose disclosure “caused the staff to open the investigation” and “provided ongoing assistance by participating in interviews and providing documents, which saved Commission resources by helping the staff obtain information in an efficient manner.”

Claimant Two “provided information that caused the staff to inquire concerning different conduct as part of a current investigation” and “provided ongoing assistance by participating in interviews and providing documents, which helped to expedite the staff’s investigation,” according to the award order.

The award document noted that Claimant Two received a reduced reward for reporting information to the commission months after the staff had opened its investigation. Furthermore, it was noted that Claimant One provided a higher level of assistance than Claimant Two and that Claimant One’s information ultimately formed the basis of more charges in the Covered Action.

2. $3.4 Million.

On May 31, the SEC granted a payment of $3.4 million to a single Claimant. Five others filed for an award for the Covered Action but were denied.

According to the SEC, “Claimant voluntarily provided original information that significantly contributed to the success of the Covered Action,” underscoring whistleblowers’ crucial role in enforcing securities regulations.
“Enforcement staff opened the Covered Action investigation based on a referral from staff in the Division of Examinations, and not because of information submitted by any of the claimants.” the agency states.

However, it notes that the whistleblower “met with Enforcement staff” and “provided new, helpful information that substantially advanced the investigation.

The SEC further explains that the awarded whistleblower suffered hardship as a result of blowing the whistle and that there were “high law enforcement interests in this matter.”

Two of the Claimants were denied because they did not have personal knowledge of the investigation’s opening. One Claimant was denied because their tip was primarily publicly available information, and another was denied because their information did not lead to the success of the Covered Action.

3. $2.5 MILLION

On June 20, the SEC awarded $2.5 million to Joint Claimants.

According to the SEC, “the record demonstrates that Joint Claimants voluntarily provided original information to the Commission that led to the successful enforcement of the Covered Action.”

The Joint Claimants “alerted Commission staff to the conduct, prompting an examination to be commenced that resulted in a referral to staff in the Division of Enforcement and the opening of an investigation,” the SEC explains in the award order.

They also “provided significant additional information and assistance during the course of the examination and investigation, including communicating with Commission staff multiple times, which helped to save staff time and resources.”

4. $2.4 Million

On April 3, the SEC granted two claimants a combined award of $2,400,000. The first Claimant received $2 million, and the second received $400,000.

According to the SEC, “Claimant 1 qualifies as a whistleblower and Claimant 1 voluntarily provided original information to the Commission that caused Enforcement staff to open an investigation that led to the successful enforcement of the Covered Action.”

However, in 2022, Claimant 2 was originally denied as the SEC claimed that their disclosure was made by a general counsel on behalf of an entity owned by Claimant 2 and not on behalf of Claimant 2 as an individual.

Following the SEC’s 2022 denial, the Claimant filed a petition for review of their denial in the Court of Appeals for the Fifth Circuit. The SEC then sought a remand in the case and requested further information from the Claimant.

The Claimant provided “a new declaration from the entity’s general counsel that expressly states that the general counsel represented Claimant 2 in Claimant 2’s personal capacity throughout the process of providing information regarding the Company to the SEC.”

The SEC thus determined that Claimant 2 did qualify as a whistleblower and had “voluntarily provided original information to the Commission that significantly contributed to the success of the Covered Action.”

This marked the first time the SEC awarded a whistleblower who appealed an award denial before a federal appeals court.

5. $2.4 Million

On April 25, an individual Claimant was awarded $2.4 million after voluntarily providing original information to the Commission.

According to the SEC, “after internally reporting concerns, Claimant submitted a tip to the Commission that prompted the opening of the investigation and thereafter provided continuing assistance to the staff.”

Brooke Burkhart and Avery Hudson also contributed to this article.

Copyright Kohn, Kohn & Colapinto, LLP 2024. All Rights Reserved.
For more on Whistleblowers, visit the NLR Criminal Law Business Crimes section

Digging for Trouble: The Double-Edged Sword of Decisions to Report Misconduct

On May 10, 2024, Romy Andrianarisoa, former Chief of Staff to the President of Madagascar, was convicted for soliciting bribes from Gemfields Group Ltd (Gemfields), a UK-based mining company specializing in rubies and emeralds. Andrianarisoa, along with her associate Philippe Tabuteau, was charged after requesting significant sums of money and a five percent equity stake in a mining venture in exchange for facilitating exclusive mining rights in Madagascar.

The investigation, spearheaded by the UK’s National Crime Agency (NCA), began when Gemfields reported their suspicions of corruption. Using covert surveillance, the NCA recorded Andrianarisoa and Tabuteau requesting 250,000 Swiss Francs (approximately £215,000) and a five percent equity stake, potentially worth around £4 million, as payments for their services. Gemfields supported the investigation and prosecution throughout.

During the investigation, six covertly recorded audio clips were released, suggesting Andrianarisoa had significant influence over Madagascar’s leadership and her expectation of substantial financial rewards. The arrests in August 2023 and subsequent trial at Southwark Crown Court culminated in prison sentences of three and a half years for Andrianarisoa and two years and three months for Tabuteau.

Comment

Gemfields has, quite rightly, been praised for reporting this conduct to the NCA and supporting their investigation and prosecution. In doing so, they made a strong ethical decision and went above and beyond their legal obligations: there is no legal requirement on Gemfields to report solicitations of this kind.

Such a decision will also have been difficult. Reporting misconduct and supporting the investigation is likely to have exposed Gemfields to significant risk and costs:

  • First, in order to meet their obligations as prosecutors, put together the best case, and comply with disclosure requirements, the NCA likely required Gemfields employees to attend interviews and provide documents. These activities require significant legal support and can be very costly both in time and money.
  • Secondly, such disclosures and interviews might identify unrelated matters of interest to the NCA. It is not uncommon in these cases for corporates reporting misconduct to become the subject of unrelated allegations of misconduct and separate investigations themselves.
  • Furthermore, to the extent that Gemfields supported the covert surveillance aspects of the NCA’s investigation, there may have been significant safety risks to both the employees participating, and unrelated employees in Madagascar. Such risks can be extremely difficult to mitigate.
  • Finally, the willingness to publicly and voluntarily report Andrianarisoa is likely to have created a chilling effect on Gemfields’ ability to do legitimate business in Madagascar and elsewhere. Potential partners may be dissuaded from working with Gemfields for fear of being dragged into similar investigations whether warranted or not.

Organisations in these situations face difficult decisions. Many will, quite rightly, want to be good corporate citizens, but in doing so, must recognise the potential costs and risks to their business and, ultimately, their obligations to shareholders and owners. In circumstances where there is no obligation to report, the safest option may be to walk away and carefully record the decision to do so. No doubt, Gemfields carefully considered these risks prior to reporting Andrianarisoa’s misconduct.

Businesses facing similar challenges should:

  • Ensure they understand their legal obligations. Generally, there is no obligation to report a crime. However, particularly for companies and firms operating in the financial services or other regulated sectors, this is not universally the case.
  • Carefully consider the risks and benefits associated with any decision to report another’s misconduct, including not only financial costs, but time and safety costs too.
  • Develop a compliance programme that assists and educates teams on how to correctly identify misconduct, escalate appropriately, and decide whether to report.
© 2024 Bracewell LLP
For more news on Reporting Global Misconduct, visit the NLR Criminal Law & Business Crimes section.

Federal Agencies Have Placed a Heightened Priority on Whistleblowers and Speedy Cooperation

As new areas of the law emerge, driven in part by technology and the free flow of information, federal agencies are becoming more aggressive with a tried and true carrot-and-stick approach to law and regulatory enforcement.

In a recent PLI panel on government enforcement priorities in May 2024, Brent Wible, Chief Counselor, Office of the Assistant Attorney General, Department of Justice (DOJ or Department); Daniel Gitner, Chief of the Criminal Division, US Attorney’s Office for the Southern District of New York (SDNY or the Office); and Antonia Apps, Director of the New York Regional Office of the Securities and Exchange Commission (SEC or Commission) shared their thoughts, priorities and practices in 2024 enforcement and beyond.

All of the government lawyers stressed that the DOJ and enforcement agencies are open and are actively encouraging whistleblowers with new incentives and programs. To that end, Mr. Gitner from the SDNY stated very directly that corporations need to understand that there is a “need for speed” in corporate self-disclosures. Otherwise, whistleblowers will be closing the door to the benefits of corporate self-disclosures. Put differently, enforcement agencies do not want a corporation to complete lengthy internal investigations before reporting.

A uniform theme and stance taken by all is that whistleblowers are valuable, and bounties will be paid in cash or in deferred prosecution agreements or possibly both. Whistleblowers must be protected. Internal and external whistleblowers should be encouraged.
This article focuses on three whistleblower initiatives—(i) the SEC’s Whistleblower Program, (ii) the SDNY Whistleblower Pilot Program and (iii) DOJ’s Pilot Whistleblower Program for voluntary self-disclosure—and how those programs may impact a corporation’s response to whistleblowers, internal investigations, and disclosures.

SEC 21F WHISTLEBLOWER PROGRAM

Since its inception more than a decade ago, the SEC’s Whistleblower Program is widely viewed as successfully incentivizing whistleblower reports of violations of the securities laws. In its 2023 fiscal year, the SEC received more than 18,000 tips from whistleblowers and issued the most awards to whistleblowers ever in one year, totaling nearly US$600 million. That year, the Commission also issued its largest ever award of US$279 million to a single whistleblower.1

What is the SEC’s Whistleblower Program?

Section 21F of the Securities Exchange Act of 1934, codified as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act, requires the SEC to pay awards to whistleblowers who provide information to the SEC about violations of federal securities laws.2 Accordingly, the SEC has issued a series of rulemakings implementing Section 21F to create its whistleblower program. To qualify as a whistleblower, an individual must voluntarily provide the SEC with original information in writing about a possible violation of federal securities law that has occurred, is ongoing, or is about to occur.3 To qualify for an award, this information must lead to a successful enforcement action with monetary sanctions totaling more than US$1 million.4

“Original” information means that it cannot be found in publicly available sources and is not already known by the Commission, but is instead the product of the whistleblower’s independent knowledge or analysis.5 A submission is “voluntary” if the whistleblower provides it to the SEC before receiving a regulatory request or demand for information relating to the same subject matter. Therefore, a submission of information that is made in response to a request, inquiry, or demand by the SEC, the Public Company Accounting Oversight Board, a self-regulatory organization (such as the Financial Industry Regulatory Authority), or a separate federal or state governmental body does not qualify as a voluntary submission.6 Additionally, a submission that is required under a legal or contractual duty to the Commission is not considered voluntary and is thus ineligible for an award.7

The SEC’s whistleblower rules also include anti-retaliation protections intended to ensure that the incentives provided to whistleblowers for reporting are not outweighed by a fear of reprisal from their employer. Under Rule 21F-17, companies are prohibited from interfering with or impeding a whistleblower’s communications to the SEC about a possible violation of the securities laws, including through enforcement or threatened enforcement of a confidentiality agreement that may be read to prevent whistleblower communications with the SEC.8

The SEC is taking violations of Rule 21F-17 seriously and has increased enforcement activity in this area over the last two years. The Commission brought a number of actions, with significant civil penalties, focused on corporate agreements containing confidentiality language that, according to the SEC, does not provide an express exception for whistleblower communications. The enforcement actions extend to different types of companies, including publicly traded companies, privately held companies, broker-dealers and investment advisers, and to a variety of forms of agreements with employees and customers alike.9

For example, a gaming company paid US$35 million to settle claims that it had violated the whistleblower protection rule by requiring former employees to execute separation agreements that obligated them to notify the company of any request for information received from the Commission, in addition to compliance failures regarding workplace complaints.10 In January 2024, the SEC settled the largest ever standalone Rule 21F-17 case, imposing US$18 million in civil penalties against a dually registered investment adviser and broker dealer for allegedly requiring clients to sign a confidential release agreement—without expressly allowing for direct communications to regulators regarding potential securities law violations—in order to receive certain credit or settlement payments.11 In another case involving US$10 million in civil penalties, the Commission charged a registered investment adviser with a standalone violation of Rule 21F-17 based on employment agreements that contained a confidentiality clause prohibiting external disclosure of confidential company information, without a carve-out for voluntary communications with the SEC concerning possible violations of the securities laws.12 As recently stated by the co-chief of the SEC Enforcement Division’s Asset Management Unit, “Investors, whether retail or otherwise, must be free to report complaints to the SEC without any interference. Those drafting or using confidentiality agreements need to ensure that they do not include provisions that impede potential whistleblowers.”13

SDNY WHISTLEBLOWER PILOT PROGRAM

In February 2024, the SDNY launched a whistleblower pilot program. The purpose of the program is to encourage early and voluntary self-disclosure of criminal conduct by individual participants.14 The program is applicable to disclosures of conduct committed by public or private companies, exchanges, financial institutions, investment advisers, or investment funds involving fraud or corporate control failure or affecting market integrity, or criminal conduct involving state or local bribery or fraud relating to federal, state, or local funds.15 In exchange for a qualifying self-disclosure, the Office will enter into a non-prosecution agreement with the whistleblower.16

Given that a non-prosecution agreement is promised, the SDNY has identified factors to determine whether a whistleblower qualifies for a discretionary non prosecution agreement. The most salient include: whether and to what extent the misconduct is unknown to either SDNY or the DOJ; whether the information is disclosed voluntarily to SDNY and not in response to an inquiry or obligation to report misconduct; whether the whistleblower provides substantial assistance in the investigation and prosecution of culpable individuals, and in the investigation and prosecution of the disclosed conduct; whether the whistleblower truthfully and completely discloses all criminal conduct they participated in and are aware of; whether the whistleblower is a chief executive officer or chief financial officer of a public or private company, who is not eligible for the pilot program; and the adequacy of noncriminal sanctions, such as remedies imposed by civil regulators.

Mr. Gitner said the defense bar is coming around to a non-prosecution carrot for individuals involved in wrongdoing within the corporation. Mr. Gitner said that SDNY seeks early discussions, and the pilot program seems to be driving toward that goal.

DOJ PILOT PROGRAM ON VOLUNTARY SELF-DISCLOSURES FOR INDIVIDUALS

In March 2024, the DOJ announced an upcoming program to reward whistleblowers who report corporate crimes. The new program seeks to bolster existing whistleblower programs established by the SEC (discussed above), the Commodities Future Trading Commission (CFTC), the Internal Revenue Service, and the Financial Crimes Enforcement Network.17 Accordingly, the program will offer rewards to whistleblowers who provide information on misconduct that is not under the jurisdiction of those agencies. In particular, the Department is interested in criminal abuses of the US financial system, foreign corruption cases outside of the SEC’s jurisdiction, and domestic corruption cases. In order to qualify, an individual must provide original, nonpublic, and truthful information that assists the Department in uncovering “significant corporate or financial misconduct” and is previously unknown to the agency.18 Like the SEC and CFTC, the Department does not plan to provide awards for information that is submitted under a preexisting duty or in response to an inquiry.19 Access to the program is only available where existing programs or qui tam actions do not exist. Additionally, the whistleblower in this program cannot be involved in the criminal activity itself. After compensation to victims, the whistleblower will receive a portion of the resulting forfeiture as a reward.20

Interestingly, however, it appears the Department may be moving away from offering monetary awards to whistleblowers. In April 2024, the Department introduced a pilot program that tracks with the SDNY and offers mandatory non prosecution agreements to individuals who provide information on corporate misconduct.21 Under the program, an individual must voluntarily self-disclose original information to the Criminal Division about criminal misconduct that is not previously known to the Department. The information must be “truthful and complete,” meaning it must include all known information relating to the misconduct, including the individual’s own culpability. In particular, the Department seeks information on violations by financial institutions; violations related to market integrity committed by financial institutions, investment advisers, investment funds, or public or private companies; foreign corruption and bribery violations by public or private companies; violations relating to health care fraud or illegal health care kickbacks; fraud or deception against the United States in connection with federally funded contracting; and bribery or kickbacks to domestic public officials by public or private companies. The whistleblower also cannot be a chief executive officer, chief financial officer, or those equivalents of a public or private company; or an elected or appointed foreign government or domestic government official; nor can the whistleblower have a previous felony conviction or a conviction of any kind involving fraud or dishonesty. Irrespective of this program, the Department still has the discretion of offering a non-prosecutorial agreement to individuals who may not meet the above criteria in full, subject to Justice Manual and Criminal Division procedures.22

TAKEAWAYS

The takeaways here for corporate in-house legal departments are:

  • Federal agencies are incentivizing whistleblowers with cash and non-prosecution agreements. It is clear that wrongdoers and witnesses now more than ever have several whistleblower programs from which to choose. As a result, corporations must become more vigilant at detecting wrongdoing and effectively utilizing internal reporting systems. Careful consideration of an early self-disclosure to the appropriate agency may also be warranted. Internal investigations will take a heightened priority to aid the c-suite and board on disclosure decisions.
  • Not only is protecting whistleblowers a priority but encouraging whistleblowers through heightened compliance programs, updated hotlines or other internal reporting programs should be considered. You may also wish to consider offering financial incentives for timely reporting to the corporation’s internal reporting program. All of which will benefit the company in any government disclosure.
  • The enforcement risk for companies under the SEC’s whistleblower rules is real and potentially significant, including with respect to day-to-day business activities (such as entering into client or employee confidentiality agreements) that may not otherwise be recognized as creating regulatory exposure. Companies may wish to revisit their standard contracts and compliance materials to ensure that any confidentiality provisions align with Rule 21F-17.

We acknowledge the contributions to this publication from our summer associate Minu Nagashunmugam.

1 https://www.sec.gov/newsroom/enforcement-results-fy23.

2 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 2.

3 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 2.

4 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 3.

5https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

6 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

7 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 5.

8 https://www.sec.gov/about/offices/owb/reg-21f.pdf, p. 28.

9 The SEC’s Office of the Whistleblower has stated that violations of Rule 21F-17 may be triggered by “internal policies, procedures, and guidance, such as codes of conduct, compliance manuals, training materials, and other such documents.” SEC, Whistleblower Protections (last updated July 1, 2024) https://www.sec.gov/enforcement-litigation/whistleblower-program/whistleblower-protections#anti-retaliation.

10 https://news.bloomberglaw.com/securities-law/sec-biggest-whistleblower-penalty-signals-broad-protection-focus?context=search&index=11

11 In re JP Morgan Sec. LLC, File No. 3-21829 (Jan. 16, 2024), https://www.sec.gov/files/litigation/admin/2024/34-99344.pdf.

12 In re D.E. Shaw & Co., L.P., File No. 3-21775 (Sept. 29, 2023), https://www.sec.gov/files/litigation/admin/2013/34-70396.pdf.

13 SEC Press Release (Jan. 16, 2024), https://www.sec.gov/newsroom/press-releases/2024-7.

14 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

15 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

16 https://www.justice.gov/d9/2024-05/sdny_wb_policy_effective_2-13-24.pdf

17 https://www.justice.gov/opa/speech/acting-assistant-attorney-general-nicole-m-argentieri-delivers-keynote-speech-american

18 https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-keynote-remarks-american-bar-associations

19 https://www.justice.gov/criminal/media/1347991/dl?inline

20https://www.justice.gov/opa/speech/deputy-attorney-general-lisa-monaco-delivers-keynote-remarks-american-bar-associations

21https://www.justice.gov/criminal/media/1347991/dl?inline

22 https://www.justice.gov/criminal/media/1347991/dl?inline

Listen to this post

Copyright 2024 K & L Gates
For more on Whistleblowers, visit the NLR Criminal Law Business Crimes section

Petition for Certiorari Filed in Supreme Court in False Claims Act Case Seeking Review of Whether “Willful” Under the Anti-Kickback Statute Requires Knowledge that the Conduct is Unlawful

The Supreme Court now has the opportunity to define “willfulness” under the federal criminal Anti-Kickback Statute (AKS). In a declined qui tam case filed against McKesson Corporation, a pharmaceutical wholesaler, the relator, Adam Hart, a former McKesson employee, filed a petition for certiorari seeking Supreme Court review of a Second Circuit decision that upheld the dismissal of relator’s complaint asserting claims under the civil False Claims Act (FCA) premised on alleged violations of the AKS. U.S. ex rel. Hart v. McKesson Corp., 96 F.4th 145 (2d Cir. 2024). A violation of the AKS requires as the scienter element that the defendant “knowingly and willfully” offered or paid remuneration to induce the recipient of the renumeration to purchase goods or items for which payment may be made under a federal health care program. 42 U.S.C. § 1320a-7b(b)(2). The Second Circuit held that a defendant does not act “willfully” within the meaning of the AKS unless that defendant “act[s] knowing that his conduct is unlawful.” United States ex rel. Hart, 96 F.4th at 154.

The AKS is enforced both as a criminal statute and, as in this case, is frequently used by the government or relators as a predicate violation to support an alleged violation of the civil FCA. Since 2010, Congress has specified that a claim that includes items or services “resulting from” an AKS violation is a false or fraudulent claim under the FCA. 42 U.S.C. § 1320a-7b(g). Though the evidentiary standard in criminal and civil cases differs, the government or relator in civil cases must adequately plead the “knowingly and willfully” scienter element of the AKS.

Hart alleged in his Second Amended Complaint that McKesson offered physician oncology practices two valuable business tools, the Margin Analyzer and the Regimen Profiler, to induce those practices to purchase oncology pharmaceuticals from McKesson. Hart alleged that these business tools were prohibited remuneration, and that McKesson acted “knowingly and willfully” in offering these two tools to its customers in violation of the AKS. Hart’s basis for alleging “willfulness” included: (1) alleged document destruction during the litigation; (2) Hart informed his supervisor during compliance training about the potential AKS violation, yet McKesson continued to provide these tools, worth about $150,000, to medical practices free of charge in exchange for commitments to purchase drugs from McKesson; and (3) Hart’s discussions with other employees that McKesson was inappropriately exploiting the business tools.

After the government declined to intervene, the District Court dismissed the FCA claims in a Second Amended Complaint (after dismissing the prior complaint as well) by ruling that Hart failed to plausibly allege sufficient facts to suggest McKesson acted “willfully”. The Second Circuit upheld the dismissal and agreed that a defendant acts “willfully” under the AKS only if the defendant knows “that its conduct is, in some way, unlawful.”

The Second Circuit rejected the relator’s proposed approach, a looser standard that would meet the “willfully” standard of the scienter element if (a) the company provided something of value in connection with the sale of pharmaceuticals reimbursed by the government, and (b) knew, even through general compliance training, that it is illegal to provide things of value to induce sales. Hart filed a petition for a writ of certiorari, presenting the question: “[t]o act ‘willfully’ within the meaning of the [AKS], must a defendant know that its conduct violates the law?”

There is no dispute, under the law, that a defendant does not need “specific intent” to violate the AKS. 42 U.S.C. § 1320a-7b(h). However, the petition raises questions about how certain sister Circuits interpret “willfully” when addressing violations of the AKS:

  • The Second Circuit held in this case that a defendant does not act “willfully” within the meaning of the AKS unless that defendant “act[s] knowing that his conduct is unlawful, even if the defendant is not aware that his conduct is unlawful under the AKS specifically.” United States ex rel. Hart v. McKesson Corp., 96 F.4th 145,154 (2d Cir. 2024).
  • The Eleventh Circuit, in accord with the Second, has also held that a defendant must know that its conduct is unlawful in order to violate the AKS. United States v. Sosa, 777 F.3d 1279, 1293 (11th Cir. 2015) (“[T]o find that a person acted willfully in violation of § 1320a-7b, the person must have acted voluntarily and purposely, with the specific intent to do something the law forbids, that is with a bad purpose, either to disobey or disregard the law.”) (internal quotations omitted)).
  • The relator argues in the petition that the Fifth and Eighth Circuits are split with the Second Circuit. Relator relies on a Fifth Circuit case holding that “willfully” requires that a “defendant willfully committed an act that violated the . . . Statute” without a requirement that a defendant know its conduct is unlawful. United States v. St. Junius, 739 F.3d 193, 210 & n.19 (5th Cir. 2013). However, a more recent Fifth Circuit case, which was cited by the Second Circuit, defines “willfully” to mean “the act was committed voluntarily or purposely, with the specific intent to do something the law forbids; that is to say, with bad purpose either to disobey or disregard the law.” United States v. Nora, 988 F.3d 823, 830 (5th Cir. 2021) (citation omitted).
  • The relator cites an Eighth Circuit case holding a defendant’s conduct is willful if a defendant “knew that his conduct was wrongful,” but asserts the Eighth Circuit has not “require[d] proof that [the defendant] . . . knew it violated ‘a known legal duty.’” United States v. Jain, 93 F.3d 436, 441 (8th Cir. 1996). However, a more recent Eighth Circuit relied on Jain to uphold a jury instruction stating, “[a] defendant acts willfully if he knew his conduct was wrongful or unlawful.” United States v. Yielding, 657 F.3d 688, 708 (8th Cir. 2011).
  • The Second Circuit did recognize a circuit split, but described its view as in “align[ment] with the approach to the AKS taken by several of our sister courts [including the Third, Fifth, Sixth, Seventh, Eighth, and Eleventh Circuits], which have held or implied that to be liable under the AKS, defendants must know that their particular conduct was wrongful.” United States ex rel. Hart, 96 F.4th at 154-55.

It is important to remember that the AKS is a felony statute subject to criminal fines and up to 10 years of imprisonment. It also criminalizes conduct that, in other industries, is not illegal. Further, due to the breadth of the statute and its complexity, Congress and the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) have developed a complicated set of guidance to help attorneys and compliance professionals understand and provide counsel with respect to AKS compliance, including statutory exceptions, regulatory safe harbors, advisory opinions, and an enormous body of sub-regulatory guidance. The Second Circuit understood this and noted that its “interpretation of the AKS’s willfulness requirement thus protects those (and only those) who innocently and inadvertently engage in prohibited conduct.” Id. at 155-56.

If the Supreme Court takes an interest in this case, it likely will invite the view of the Solicitor General. Any Supreme Court interest in granting this petition will likely attract a wide range of amici participation at the certiorari stage by health care industry groups and associations, pharmaceutical company associations, other business groups, as well as associations of whistleblower counsel and other supporters of the private action qui tam provisions of the FCA. Though the range of holdings by the Courts of Appeal are often nuanced, Supreme Court consideration of the issue would be viewed as very significant, and a decision that creates a rigorous standard for “willfulness,” or alternatively, a lenient one, could considerably impact the Department of Justice (DOJ) and relators’ ability to successfully plead, and prove, an AKS violation as a predicate to an alleged FCA violation.

©1994-2024 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more news on Criminal Anti-Kickback Statutes, visit the NLR Criminal Law & Business Crimes section.

FinCEN Publishes Updated FAQs

Entities terminated in 2024 are required to file Corporate Transparency Act beneficial ownership information reports, as are administratively dissolved entities.

The Financial Crimes Enforcement Network (“FinCEN”) recently published updates to its list of Frequently Asked Questions (“FAQs”) to assist entities in complying with the beneficial ownership reporting requirements of the Corporate Transparency Act (“CTA”).

Principal among these updates was FinCEN’s clarifying requirement that business entities terminated in the year 2024 (whether existing prior to 2024 or formed in 2024) are required to file beneficial ownership information reports (BOIR) under the CTA.

This filing requirement also expressly includes BOIR filings for administratively dissolved entities.

Each of these concepts were the subject of debate as to their applicability under the CTA prior to this FAQ release, with some conjecture that terminating an entity’s existence prior to its BOIR filing deadline would alleviate the need to make a BOIR filing – a position now refuted by FinCEN.

As Polsinelli has consistently advised, the obligation to file under the CTA has accrued for all entities in existence in 2024, only the deadline for filing the BOIR has not yet arrived. Entities are advised to file their BOIR prior to consummating their termination process.

The July 8 FAQs also included clarification on beneficial owner disclosure scenarios involving an entity fully or partially owned by an Indian Tribe.

FinCEN expects to publish further guidance in the future. The updated FAQs can be accessed here.

* * * * *

Several of the updates bear special note:

1. FAQ C. 12. – Reporting Company Status

Do beneficial ownership information reporting requirements apply to companies created or registered before the Corporate Transparency Act was enacted (January 1, 2021)?

FinCEN stated “Yes.” Beneficial ownership information reporting requirements apply to all companies that qualify as “reporting companies”, regardless of when they were created or registered. Companies are not required to report beneficial ownership information to FinCEN if they are exempt or ceased to exist (i.e., are formally terminated with the Secretary of State) as legal entities before January 1, 2024.

2. FAQ C. 13. – Reporting Company Status

Is a company required to report its beneficial ownership information to FinCEN if the company ceased to exist before reporting requirements went into effect on January 1, 2024?

A company is not required to report its beneficial ownership information to FinCEN if it ceased to exist as a legal entity (i.e., was formally terminated with the Secretary of State) before January 1, 2024. This means that the entity entirely completed the process of formally and irrevocably dissolving (i.e., was formally terminated with the Secretary of State). A company that ceased to exist as a legal entity before the beneficial ownership information reporting requirements became effective January 1, 2024, was never subject to the reporting requirements and thus is not required to report its beneficial ownership information to FinCEN.

Although state or Tribal law may vary, a company typically completes the process of formally and irrevocably dissolving by, for example, filing dissolution paperwork with its jurisdiction of creation or registration, receiving written confirmation of dissolution, paying related taxes or fees, ceasing to conduct any business, and winding up its affairs (e.g., fully liquidating itself and closing all bank accounts).

If a reporting company continued to exist as a legal entity for any period of time on or after January 1, 2024 (i.e., did not entirely complete the process of formally and irrevocably dissolving (i.e., terminating) before January 1, 2024), then it is required to report its beneficial ownership information to FinCEN, even if the company had wound up its affairs and ceased conducting business before January 1, 2024.

Similarly, if a reporting company was created or registered on or after January 1, 2024, and subsequently ceased to exist, then it is required to report its beneficial ownership information to FinCEN—even if it ceased to exist before its initial beneficial ownership information report was due.

A company that is administratively dissolved or suspended—because, for example, it failed to pay a filing fee or comply with certain jurisdictional requirements—generally does not cease to exist as a legal entity unless the dissolution or suspension becomes permanent. Until the dissolution becomes permanent, such a company is required to report its beneficial ownership information to FinCEN.

3. FAQ C. 14. – Reporting Company Status

If a reporting company created or registered in 2024 or later winds up its affairs and ceases to exist before its initial BOI report is due to FinCEN, is the company still required to submit that initial report?

FinCEN stated “Yes.” Reporting companies created or registered in 2024 must report their beneficial ownership information to FinCEN within 90 days of receiving actual or public notice of creation or registration. Reporting companies created or registered in 2025 or later must report their beneficial ownership information to FinCEN within 30 days of receiving actual or public notice of creation or registration. These obligations remain applicable to reporting companies that cease to exist as legal entities—meaning wound up their affairs, ceased conducting business, and entirely completed the process of formally and irrevocably dissolving—before their initial beneficial ownership reports are due.

It bears note that, if a reporting company files an initial beneficial ownership information report and then ceases to exist, then there is no requirement for the reporting company to file an additional report with FinCEN noting that the company has ceased to exist.

4. FAQ D. 17. – Beneficial Owner

Who should an entity fully or partially owned by an Indian Tribe report as its beneficial owner(s)?

An Indian Tribe is not an individual, and thus should not be reported as an entity’s beneficial owner, even if it exercises substantial control over an entity or owns or controls 25 percent or more of the entity’s ownership interests. However, entities in which Tribes have ownership interests may still have to report one or more individuals as beneficial owners in certain circumstances.

Entity Is a Tribal Governmental Authority. An entity is not a reporting company—and thus does not need to report beneficial ownership information at all—if it is a “governmental authority,” meaning an entity that is (1) established under the laws of the United States, an Indian Tribe, a State, or a political subdivision of a State, or under an interstate compact between two or more States, and that (2) exercises governmental authority on behalf of the United States or any such Indian Tribe, State, or political subdivision. This category includes tribally chartered corporations and state-chartered Tribal entities if those corporations or entities exercise governmental authority on a Tribe’s behalf.

Entity’s Ownership Interests Are Controlled or Wholly Owned by a Tribal Governmental Authority. A subsidiary of a Tribal governmental authority is likewise exempt from BOI reporting requirements if its ownership interests are entirely controlled or wholly owned by the Tribal governmental authority.

Entity Is Partially Owned by a Tribe (and Is Not Exempt). A non-exempt entity partially owned by an Indian Tribe should report as beneficial owners all individuals exercising substantial control over it, including individuals who are exercising substantial control on behalf of an Indian Tribe or its governmental authority. The entity should also report any individuals who directly or indirectly own or control at least 25 percent or more of the ownership interests of the reporting company. (However, if any of these individuals own or control these ownership interests exclusively through an exempt entity or a combination of exempt entities, then the reporting company may report the name(s) of the exempt entity or entities in lieu of the individual beneficial owner.)

© Polsinelli PC, Polsinelli LLP in California

The SEC Continues Its War On Crime Victims

More than a decade ago, I expressed concern when the Securities and Exchange Commission charged Koss Corporation and one its CEO, Mr. Koss, with filing materially false financial statements after the corporation had discovered that it had been the victim of employee embezzlement. In the post, I decried the SEC’s decision to punish the victims of crime:

The SEC’s decision to prosecute this case is troubling. Surely, neither Koss Corporation nor Mr. Koss intended or wanted to be the victim of a criminal embezzlement. It is also hard to see how the shareholders’ benefited from the company incurring the legal costs associated with defending and settling the SEC investigation. While the SEC did force the return of bonus compensation, the injunctive relief ordering the company and Mr. Koss not to do this again strikes me as silly. Does it really make sense for the court to order a company not to be the victim of a theft?

I was therefore heartened by the recent statement by Commissioners Hester Peirce and Mark Uyeda on the SEC’s recent settlement of administrative proceeding against R.R. Donnelly & Sons, Co.:

Also concerning is the Commission’s decision to stretch the law to punish a company that was the victim of a cyberattack. While an enforcement action may be warranted in some circumstances, distorting a statutory provision to form the basis for such an action inappropriately amplifies a company’s harm from a cyberattack.

According to the SEC’s press release, R.R. Donnelly & Sons, Co. “cooperated throughout the investigation, including by reporting the cybersecurity incident to staff prior to filing a disclosure of the incident, by providing meaningful cooperation that helped expedite the staff’s investigation, and by voluntarily adopting new cybersecurity technology and controls”. Nonetheless, the SEC thought a just resolution required payment of a $2.125 million civil penalty for transfer to the U.S. Treasury. I remain unconvinced that the expropriation of millions of dollars from a crime victim to the U.S. Treasury protects, much less helps, the shareholders of R.R. Donnelly & Sons, Co.

© 2010-2024 Allen Matkins Leck Gamble Mallory & Natsis LLP
For more news on SEC Punishing Crime Victims, visit the NLR Securities SEC section.

Junk Science or Relevant Evidence: Supreme Court Says Experts May Now Aid in Determining Criminal Intent

In criminal cases, oftentimes the most significant element in dispute is whether the defendant harbored the intent to “knowingly” or “willfully” violate the criminal law at issue. If the defendant denies that he knew what he was doing was illegal, the government must prove beyond a reasonable doubt that the defendant had the required mens rea — or mental state — to violate the law. The government does this by presenting circumstantial evidence that it argues supports a reasonable inference that the defendant had the required mental state to violate the law. And defense lawyers test that evidence largely on cross examination and by presenting counterevidence.

The more complicated the law — think tax, securities, or federal election conduit contribution laws — the riskier it is that a person can be held criminally liable for what seemed like innocent or at least not illegal conduct. In these cases, experts may be called to testify about how a certain industry or regulatory regime is structured or how it operates, and the parties can argue to the jury whether the facts of the case circumstantially prove the reasonable inference that the defendant knowingly or willfully violated a criminal law related to that industry or regulatory regime. But Federal Rule of Evidence 704(b) prohibits an expert from stating an opinion about whether a criminal defendant “did or did not have the mental state or condition that constitutes an element of the crime charged or of a defense. Those matters are for the trier of fact alone.” FRE 704(b) was adopted in response to President Ronald Reagan’s shooter, John Hinkley, being found not guilty by reason of insanity after competing experts offered opinions on the ultimate issue of Hinkley’s sanity. So FRE 704(b) now requires that a jury alone must decide whether the defendant intended to commit a crime. And the answer to this question is often the difference between freedom or years in prison.

In Diaz v. United States, ___ S. Ct. ___, 2024 WL 3056012 (June 20, 2024), the U.S. Supreme Court ruled that FRE 704(b) does not preclude expert testimony about the likelihood that the defendant intended to commit a crime based on the defendant’s membership in a particular group. Diaz was charged with “knowingly” transporting drugs across the U.S.-Mexican border. She argued the “blind mule” defense: she did not know there were drugs in the car, therefore she did not knowingly transport them. The government called as an expert a Homeland Security Investigations Special Agent to testify that “in most circumstances, the driver knows they are hired to take drugs from point A to point B.” The Agent said that drug-trafficking organizations would expose themselves to too much risk by using unknowing couriers. The Agent admitted on cross examination that he was not involved in Diaz’s case, and that drug-trafficking organizations sometimes use unknowing couriers. The jury found Diaz guilty and she was sentenced to 84 months in prison.

Diaz argued that the Agent’s expert testimony violated FRE 704(b)’s proscription of expert’s providing opinions about whether a defendant did or did not have the required state of mind to violate the law. The Court affirmed the Ninth Circuit’s opinion that the Agent’s expert testimony did not violate FRE 704(b) because the expert “did not express an opinion about whether Diaz herself knowingly transported [drugs].” Instead, he testified that “most” drug couriers know they are hired to drive drugs from point A to point B. “That opinion does not necessarily describe Diaz’s mental state. After all, Diaz may or may not be like most drug couriers.” The Court acknowledged that it would have violated Rule 704(b) if the Agent had testified that “all” drug couriers know they are transporting drugs, since Diaz would be included in that drug courier group thus making it an opinion about Diaz’s mental state.

The Court said that FRE 704(b) only proscribes expert opinions “in a criminal case that are about a particular person (‘the defendant’) and a particular ultimate issue (whether the defendant has ‘a mental state or condition’ that is ‘an element of the crime charged or of a defense.’).” Because the Agent “did not give an opinion ‘about whether’ Diaz herself ‘did or did not have a mental state or condition that constitutes an element of the crime charged or of a defense,’ his testimony did not violate Rule 704(b).”

In her concurrence, Justice Ketanji Brown Jackson inferred that “what’s good for the goose is good for the gander” when she wrote that criminal defendants were now free to offer expert testimony “‘on the likelihood’ that the defendant had a particular mental state, ‘based on the defendant’s membership in a particular group.’” For example, “Diaz could have offered expert testimony on the prevalence and characteristics of unknowing drug couriers.” Justice Jackson said that the Diaz opinion will now allow psychiatrists to testify as experts “to tell the jury that when people with schizophrenia as severe as a defendant’s commit acts of violence, it is generally because they do not appreciate the wrongfulness of their conduct.” This would not create a “spectacle of dueling experts on the defendant’s mental state,” Justice Jackson wrote, but instead “could help jurors better understand a defendant’s condition and thereby call into question a mens rea that might otherwise be too easily assumed…given the biases, stereotypes, and uneven knowledge that many people have about mental health conditions.”

Justice Neil Gorsuch wrote a terse dissent that was joined by Justices Sonia Sotomayor and Elena Kagan. The dissent said the Agent’s probabilistic assessment that “most” couriers know they are transporting drugs violated FRE 704(b) because it was a statement “about whether the defendant” had a “mental state . . . that constitutes an element of the crime charged.” The word “about” is defined as “concerning, regarding, with regard to, with reference to; in the matter of.” And according to the dissent, expert testimony about what most drug couriers know was testimony about the likelihood of what Diaz knew. Justice Gorsuch warned of “warring experts” on the issue of a defendant’s intent, which he says will make the criminal justice system less reliable as lawyers may try and find probabilistic expert opinions on intent rather than doing the hard work of gathering circumstantial evidence and arguing about what that evidence reasonably infers about a defendant’s intent.

© 2024 Miller, Canfield, Paddock and Stone PLC

Whistleblower Tax Fraud Lawsuit Against Bitcoin Billionaire Settles for $40 Million

MicroStrategy’s founder is alleged to have falsified tax documents for ten years. The settlement resolves the first whistleblower lawsuit filed under 2021 amendments to the DC False Claims Act.

Key Takeaways
On June 3, the District of Columbia Office of the Attorney General announced the $40 million settlement with Michael Saylor
It is the largest income tax recovery in D.C. history
The settlement, which resolves a qui tam lawsuit filed under the DC False Claims Act, underscores the power of whistleblowers in combatting tax fraud
On June 3, the District of Columbia Office of the Attorney General (OAG) made a landmark announcement. The billionaire founder of MicroStrategy Incorporated, Michael Saylor, settled a tax fraud lawsuit for a staggering $40 million. This case, stemming from a qui tam whistleblower suit filed under the District’s False Claims Act, marks a significant milestone in the fight against tax fraud. The OAG declared this as the largest income tax recovery in D.C. history, underscoring the importance of this case.

The DC False Claims Act
This settlement is not just a victory for the District but also a testament to the power of whistleblowers. Under the 2021 extension of the D.C. False Claims Act, individuals have the power to file qui tam suits against large companies and suspected tax evaders. The 2021 amendments even offer monetary awards to those who report tax cheats. This settlement, the first settlement under these amendments, serves to put would-be tax cheats on notice.

As the District of Columbia expands its arsenal against tax fraud, other states should take note. The DC False Claims Act, now covering tax fraud, has become a powerful tool in the fight against financial misconduct. With the District joining the ranks of Delaware, Florida, Illinois, Indiana, Nevada, New York, and Rhode Island as states where false claims suits may be brought based on tax fraud claims, the fight against tax cheats looks promising.

The Case Against Saylor
In 2021, unnamed whistleblowers filed a lawsuit against Saylor, alleging that he had defrauded the District and failed to pay income taxes from 2014 to 2020. The OAG independently investigated these claims and filed a separate complaint against Saylor. The District’s lawsuit alleged that Saylor claimed to be a resident of Florida and Virginia to avoid paying over $25 million in income taxes. Another suit was filed against MicroStrategy, claiming it falsified records and statements that facilitated Saylor’s tax avoidance scheme.

The District’s allegations against Saylor paint a picture of a lavish lifestyle. Saylor is accused of unlawfully withholding tens of millions in tax revenue by claiming to live in a lower tax jurisdiction to avoid paying D.C. income taxes. The OAG’s investigation revealed that Saylor owned a 7,000-square-foot luxury penthouse overlooking the Potomac Waterfront and docked multiple yachts in the Washington Harbor. He purchased three luxury condominium units at 3030 K Street NW to combine into his current residence and a penthouse unit at the Eden Condominiums, 2360 Champlain St. NW. The Attorney General compiled several posts from Saylor’s Facebook, in which he boasted about the view from his D.C. residence.

Whistleblower Tax Fraud Lawsuit Against Bitcoin Billionaire Settles For $40 Million

Furthermore, the OAG found evidence that Saylor purchased a house in Miami Beach, obtained a Florida driver’s license, registered to vote in Florida, and falsely listed his residence on MicroStrategy W-2 forms. Attorney General Brian L. Schwalb stated, “Saylor openly bragged about his tax-evasion scheme, encouraging his friends to follow his example and contending that anyone who paid taxes to the District was stupid.”

The lawsuits allege that records from Saylor’s security detail provide Saylor’s physical location and travel from 2015 to 2020 and show that across six years, Saylor spent 449 days in Florida and 1,397 days in the District. Saylor allegedly directed MicroStrategy employees to aid his scheme to avoid paying District income taxes. The District claims that for the last ten years, MicroStrategy has falsely reported its income tax exemption on Saylor’s wages, claiming he was tax-exempt due to his residential status.

Saylor agreed to pay the District $40 million to resolve the allegations against him and MicroStrategy.

A copy of the settlement can be found here.

Copyright Kohn, Kohn & Colapinto, LLP 2024. All Rights Reserved.

by: Whistleblower Law at Kohn Kohn Colapinto of Kohn, Kohn & Colapinto

For more on Whistleblowers, visit the NLR Criminal Law / Business Crimes section.

Acting U.S. Attorney Levy Forecasts False Claims Act COVID Cases Targeting Private Lenders Of CARES Act Loans That Failed In Their Obligation To Safeguard Government Funds

Acting U.S. Attorney Joshua Levy discussed the enforcement priorities for the Massachusetts U.S. Attorney’s Office (USAO) during a Q&A session on May 29, 2024, and made clear that the historical focus of the office remains the top priority: detecting and combating health care fraud, waste, and abuse. In particular, both Levy and Chief of the USAO’s Civil Division, Abraham George, have recently indicated that the government will pursue large dollar COVID fraud cases both criminally and civilly. As we have discussed previously, we expect False Claims Act (FCA) COVID cases to materialize in the coming years as the government zeroes in on wrongdoers via enhanced data analytics and AI tools as well as via traditional investigative methods and the forthcoming Whistleblower Rewards Program.

Recent COVID FinTech Lender, Kabbage, $120 MM False Claims Act Settlement

The recent Kabbage settlement is illustrative of the types of COVID cases the office is looking to bring pursuant to the FCA. Acting U.S. Attorney Levy discussed the settlement, publicized in May, with now-bankrupt online lender, Kabbage Inc. Kabbage allegedly knowingly processed and submitted thousands of false claims for Paycheck Protection Program (PPP) loan forgiveness, loan guarantees, and processing fees. The PPP – a loan program for small businesses created via the Coronavirus Aid, Relief, and Economic Security (CARES) Act – was administered the federal Small Business Administration (SBA). The CARES Act authorized private lenders to approve PPP loans for eligible borrowers who could later seek forgiveness for the loans if borrowers used the loans for eligible expenses, including employee payroll.

Among other things, participating PPP lenders were obligated to 1) confirm borrowers’ average monthly payroll costs by PPP loan documentation; and 2) follow applicable Bank Secrecy Act/Anti-Money Laundering (BSA/AML) requirements. SBA guaranteed any unforgiven or defaulted PPP loans as long as the private lender adhered to PPP requirements.

Private lenders received a fixed fee calculated as a percentage of the loan amount. Here, U.S. Attorney Levy’s office alleged that Kabbage awarded inflated and fraudulent loans to maximize its profits, then sold its assets and left the remaining company financially depleted, leading to bankruptcy. Kabbage was allegedly aware of the following errors as of April 2020, failed to correct them, and continued to make improper loan disbursements after learning of the issues:

  1. double-counting state and local taxes paid by employees when calculating gross wages;
  2. failing to exclude annual compensation above $100,000 per employee; and
  3. improperly calculating employee leave and severance payments.

Kabbage also allegedly failed to implement appropriate fraud controls to comply with the PPP, BSA, and AML by knowingly:

  1. removing underwriting steps to facilitate processing a high volume of loan applications and maximizing loan processing fees;
  2. setting substandard fraud check thresholds;
  3. relying on automated tools that were inadequate in identifying fraud;
  4. devoting insufficient personnel to conduct fraud reviews;
  5. discouraging its fraud reviewers from requesting information from borrowers to substantiate their loan requests; and
  6. submitting to the SBA thousands of dubious PPP loan applications that were fraudulent or highly suspicious.

The settlement, which will result in the U.S. securing up to $120 million pursuant to bankruptcy proceedings, resolves qui tam complaints brought by two separate whistleblowers: an accountant who submitted PPP loan applications to multiple lenders and a former analyst in Kabbage’s collection department.

Predictions for Future COVID Fraud Enforcement

Acting U.S. Attorney Levy’s comments make clear that we can expect to see FCA COVID cases targeting private lenders of CARES Act loans that failed in their obligation to safeguard government funds. To date, COVID fraud prosecution has largely targeted “low-hanging fruit” criminal cases, such as those involving submission of false information to obtain COVID relief funding that the recipient spends on luxury items. We discussed in April that the COVID Fraud Enforcement Task Force (CFETF) and a bipartisan group of Senators had, via a report and draft legislation, pleaded with Congress to increase funding to prosecute COVID fraud. Investigations such as those involving Kabbage require a large investment of resources and, as U.S. Attorney Levy commented, his office must prioritize large-dollar COVID fraud cases most likely to result in specific and general fraud deterrence.

As we have written previously, the government is playing a long game tracking COVID fraud. The Justice Department’s CFETF reported in April that to date, the DOJ had seized or forfeited $1.4 billion in stolen relief funds as well as bringing criminal charges against 3,500 defendants and 400 civil settlements. With a ten-year statute of limitations and increasingly more accurate data analytics tools, we expect the DOJ will continue to identify and recover misappropriated funds from large and lower dollar fraudsters. So long as COVID fraud enforcement remains a well-funded priority of the government, we anticipate a steady stream of FCA COVID settlements involving lenders and borrowers. The government is casting a wide net to recoup the nearly $300 billion in COVID fraud estimates. We will continue to monitor and report on developments.

©1994-2024 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more on COVID, visit the NLR Coronavirus News section.

Mandatory Cybersecurity Incident Reporting: The Dawn of a New Era for Businesses

A significant shift in cybersecurity compliance is on the horizon, and businesses need to prepare. Starting in 2024, organizations will face new requirements to report cybersecurity incidents and ransomware payments to the federal government. This change stems from the U.S. Department of Homeland Security’s (DHS) Cybersecurity Infrastructure and Security Agency (CISA) issuing a Notice of Proposed Rulemaking (NPRM) on April 4, 2024. This notice aims to enforce the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). Essentially, this means that “covered entities” must report specific cyber incidents and ransom payments to CISA within defined timeframes.

Background

Back in March 2022, President Joe Biden signed CIRCIA into law. This was a big step towards improving America’s cybersecurity. The law requires CISA to create and enforce regulations mandating that covered entities report cyber incidents and ransom payments. The goal is to help CISA quickly assist victims, analyze trends across different sectors, and share crucial information with network defenders to prevent other potential attacks.

The proposed rule is open for public comments until July 3, 2024. After this period, CISA has 18 months to finalize the rule, with an expected implementation date around October 4, 2025. The rule should be effective in early 2026. This document provides an overview of the NPRM, highlighting its key points from the detailed Federal Register notice.

Cyber Incident Reporting Initiatives

CIRCIA includes several key requirements for mandatory cyber incident reporting:

  • Cyber Incident Reporting Requirements – CIRCIA mandates that CISA develop regulations requiring covered entities to report any covered cyber incidents within 72 hours from the time the entity reasonably believes the incident occurred.
  • Federal Incident Report Sharing – Any federal entity receiving a report on a cyber incident after the final rule’s effective date must share that report with CISA within 24 hours. CISA will also need to make information received under CIRCIA available to certain federal agencies within the same timeframe.
  • Cyber Incident Reporting Council – The Department of Homeland Security (DHS) must establish and chair an intergovernmental Cyber Incident Reporting Council to coordinate, deconflict, and harmonize federal incident reporting requirements.

Ransomware Initiatives

CIRCIA also authorizes or mandates several initiatives to combat ransomware:

  • Ransom Payment Reporting Requirements – CISA must develop regulations requiring covered entities to report to CISA within 24 hours of making any ransom payments due to a ransomware attack. These reports must be shared with federal agencies similarly to cyber incident reports.
  • Ransomware Vulnerability Warning Pilot Program – CISA must establish a pilot program to identify systems vulnerable to ransomware attacks and may notify the owners of these systems.
  • Joint Ransomware Task Force – CISA has announced the launch of the Joint Ransomware Task Force to build on existing efforts to coordinate a nationwide campaign against ransomware attacks. This task force will work closely with the Federal Bureau of Investigation and the Office of the National Cyber Director.

Scope of Applicability

The regulation targets many “covered entities” within critical infrastructure sectors. CISA clarifies that “covered entities” encompass more than just owners and operators of critical infrastructure systems and assets. Entities actively participating in these sectors might be considered “in the sector,” even if they are not critical infrastructure themselves. Entities uncertain about their status are encouraged to contact CISA.

Critical Infrastructure Sectors

CISA’s interpretation includes entities within one of the 16 sectors defined by Presidential Policy Directive 21 (PPD 21). These sectors include Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors, Materials, and Waste, Transportation Systems, Water and Wastewater Systems.

Covered Entities

CISA aims to include small businesses that own and operate critical infrastructure by setting additional sector-based criteria. The proposed rule applies to organizations falling into one of two categories:

  1. Entities operating within critical infrastructure sectors, except small businesses
  2. Entities in critical infrastructure sectors that meet sector-based criteria, even if they are small businesses

Size-Based Criteria

The size-based criteria use Small Business Administration (SBA) standards, which vary by industry and are based on annual revenue and number of employees. Entities in critical infrastructure sectors exceeding these thresholds are “covered entities.” The SBA standards are updated periodically, so organizations must stay informed about the current thresholds applicable to their industry.

Sector-Based Criteria

The sector-based criteria target essential entities within a sector, regardless of size, based on the potential consequences of disruption. The proposed rule outlines specific criteria for nearly all 16 critical infrastructure sectors. For instance, in the information technology sector, the criteria include:

  • Entities providing IT services for the federal government
  • Entities developing, licensing, or maintaining critical software
  • Manufacturers, vendors, or integrators of operational technology hardware or software
  • Entities involved in election-related information and communications technology

In the healthcare and public health sector, the criteria include:

  • Hospitals with 100 or more beds
  • Critical access hospitals
  • Manufacturers of certain drugs or medical devices

Covered Cyber Incidents

Covered entities must report “covered cyber incidents,” which include significant loss of confidentiality, integrity, or availability of an information system, serious impacts on operational system safety and resiliency, disruption of business or industrial operations, and unauthorized access due to third-party service provider compromises or supply chain breaches.

Significant Incidents

This definition covers substantial cyber incidents regardless of their cause, such as third-party compromises, denial-of-service attacks, and vulnerabilities in open-source code. However, threats or activities responding to owner/operator requests are not included. Substantial incidents include encryption of core systems, exploitation causing extended downtime, and ransomware attacks on industrial control systems.

Reporting Requirements

Covered entities must report cyber incidents to CISA within 72 hours of reasonably believing an incident has occurred. Reports must be submitted via a web-based “CIRCIA Incident Reporting Form” on CISA’s website and include extensive details about the incident and ransom payments.

Report Types and Timelines

  • Covered Cyber Incident Reports within 72 hours of identifying an incident
  • Ransom Payment Reports due to a ransomware attack within 24 hours of payment
  • Joint Covered Cyber Incident and Ransom Payment Reports within 72 hours for ransom payment incidents
  • Supplemental Reports within 24 hours if new information or additional payments arise

Entities must retain data used for reports for at least two years. They can authorize a third party to submit reports on their behalf but remain responsible for compliance.

Exemptions for Similar Reporting

Covered entities may be exempt from CIRCIA reporting if they have already reported to another federal agency, provided an agreement exists between CISA and that agency. This agreement must ensure the reporting requirements are substantially similar, and the agency must share information with CISA. Federal agencies that report to CISA under the Federal Information Security Modernization Act (FISMA) are exempt from CIRCIA reporting.

These agreements are still being developed. Entities reporting to other federal agencies should stay informed about their progress to understand how they will impact their reporting obligations under CIRCIA.

Enforcement and Penalties

The CISA director can make a request for information (RFI) if an entity fails to submit a required report. Non-compliance can lead to civil action or court orders, including penalties such as disbarment and restrictions on future government contracts. False statements in reports may result in criminal penalties.

Information Protection

CIRCIA protects reports and RFI responses, including immunity from enforcement actions based solely on report submissions and protections against legal discovery and use in proceedings. Reports are exempt from Freedom of Information Act (FOIA) disclosures, and entities can designate reports as “commercial, financial, and proprietary information.” Information can be shared with federal agencies for cybersecurity purposes or specific threats.

Business Takeaways

Although the rule will not be effective until late 2025, companies should begin preparing now. Entities should review the proposed rule to determine if they qualify as covered entities and understand the reporting requirements, then adjust their security programs and incident response plans accordingly. Creating a regulatory notification chart can help track various incident reporting obligations. Proactive measures and potential formal comments on the proposed rule can aid in compliance once the rules are finalized.

These steps are designed to guide companies in preparing for CIRCIA, though each company must assess its own needs and procedures within its specific operational, business, and regulatory context.

Listen to this post

© 2024 Bradley Arant Boult Cummings LLP
For more on Cybersecurity, visit the NLR Communications, Media & Internet section.