Key points

• Employees who raise concerns are protected by overlapping US and UK laws, and retaliation claims are often easier for a claimant to bring than the underlying misconduct claim.
• In the United States, the SEC whistleblower program offers financial awards, and SEC Rule 21F-17 prohibits actions, including contract terms, that impede communication with the SEC.
• In the United Kingdom, the Public Interest Disclosure Act 1998 protects workers who make qualifying disclosures, and regulated firms have additional obligations.
• Companies that receive reports internally and act on them reduce the likelihood of external reporting and are better placed to earn cooperation credit.
• Policies, training and investigations must work together: a hotline no one trusts is worse than none.

Introduction

Whistleblowers are among the most important sources of information for enforcement agencies, and regulators in both countries have made clear that they expect companies to welcome internal reports. A company that mishandles a report can also create a second problem, a retaliation claim or an obstruction allegation, that is worse than the first. This note compares the two legal regimes and sets out the features of a speak-up program that works.

The United States

Statutes and programs

The Sarbanes-Oxley Act protects employees of public companies and their contractors from retaliation for reporting suspected securities fraud and certain other violations, and a claimant must first file a complaint with the Occupational Safety and Health Administration. The Dodd-Frank Act created the SEC whistleblower program, which pays awards to individuals who provide original information leading to a successful enforcement action above a monetary threshold, and the Commodity Futures Trading Commission runs a similar program. In Digital Realty Trust v. Somers, decided in 2018, the Supreme Court held that the Dodd-Frank anti-retaliation provisions protect only individuals who have reported to the SEC, not those who report internally alone, although Sarbanes-Oxley may still apply. The Department of Justice has also run a pilot program offering corporate whistleblower awards in specified areas.

Rule 21F-17

Rule 21F-17 prohibits any person from taking action to impede an individual from communicating directly with the SEC about a possible securities law violation, including by enforcing or threatening to enforce a confidentiality agreement. The SEC has brought actions against companies whose separation agreements, confidentiality provisions or policies lacked a carve-out for communication with regulators, in some cases with no evidence the term was ever used to silence anyone. Every template should be reviewed for this point, including employment, separation, vendor and investigation-related agreements.

The United Kingdom

The Public Interest Disclosure Act 1998 amends the Employment Rights Act 1996 to protect workers who make a qualifying disclosure in the public interest, such as one about a criminal offense, a breach of legal obligations or a danger to health and safety, to an employer, a prescribed person or, in limited cases, more widely. A worker who suffers a detriment or dismissal as a result can bring a claim, and compensation is not capped as it is in many unfair dismissal claims. The Financial Conduct Authority expects regulated firms to have whistleblowing arrangements, to appoint a whistleblowers' champion where required and to tell workers about external routes. Non-disclosure agreements cannot prevent protected disclosures.

Cross-border and EU considerations

Groups with operations in Europe must also follow the EU Whistleblower Directive 2019/1937, as implemented in each member state, which requires internal reporting channels in larger organizations, acknowledgment of reports within seven days, feedback within three months and protection against retaliation. Data protection law also matters: investigating a report involves personal data of the reporter and the person accused, and works councils in some countries have a say in how the channel is designed. A global hotline should be reviewed country by country.

Designing a speak-up program that works

• Multiple channels. Offer a hotline, a web form, line managers and a named senior contact, and permit anonymous reports where the law allows.
• Clear triage. Assign every report to someone with authority and independence, record it, and decide within days whether it needs a privileged investigation.
• Protection from retaliation. Monitor the reporter's treatment after the report, and review disciplinary decisions involving anyone who has raised a concern.
• Feedback. Tell reporters what happened as far as confidentiality allows, since silence leads to external reporting.
• Board oversight. The audit committee or equivalent should receive regular metrics, including volume, time to close and outcomes, and see significant matters promptly.
• Agreement terms. Include regulator-communication carve-outs and statutory protections in every relevant agreement.

When a report arrives

The first days matter. A company should preserve documents, limit the circle of people who know the reporter's identity, avoid any step that could look like retaliation, and decide whether to engage outside counsel. Where the report alleges securities fraud, bribery or sanctions violations, the company should consider whether and when to self-report, bearing in mind that a whistleblower may already have gone to the authorities. A company that reports first, with a credible investigation behind it, is better placed than one that learns of the matter from a regulator.

Julian Okonkwo-Hart, Helena Strand and Corvane Ryle's investigations lawyers advise on speak-up programs, internal investigations and the response to whistleblower allegations in the United States and the United Kingdom.