Click Here to Receive the Latest Updates from the Blog

In May 2020, the U.K. Financial Conduct Authority, the authority charged with regulating financial firms and maintaining the integrity of the financial markets in the United Kingdom, reported that whistleblowing reports to the Financial Conduct Authority on workplace culture issues in 2019 had increased by 35%. There is also evidence of an increase in whistleblowing reports made during the COVID-19 lockdown, with WhistleB, the Swedish-European provider of whistleblowing solutions, reporting an increase of 40% in the number of concerns raised by whistleblowers in Europe from January to May 2020. Similarly, in the United States, the Securities and Exchange Commission (SEC) reported a 35% increase in the number of whistleblower tips, complaints and referrals between mid-March and mid-May 2020. And although the filing of whistleblower complaints (also known as “qui tam” complaints) are reported to be down compared to the same time last year, the recent distribution of billions of dollars in federal money to companies (discussed further below) is sure to reverse that trend.

In addition, there have been a number of high-profile press reports of investigations and enforcement actions which were prompted by whistleblower reports, with perhaps the most significant recent example being that of Wirecard AG, the German payment processor and financial services provider at the center of a financial scandal in Germany. In June 2020, the company reported €1.9 billion in missing cash. It is reported that Germany’s financial watchdog (BaFin) received a tip-off from a whistleblower about alleged irregularities at Wirecard.

In the wake of the COVID-19 pandemic, a wave of whistleblower reports alleging misconduct in key areas is likely to be inevitable. Whether they come via a regulator, a government authority, the media or directly to the company, companies must be prepared properly to tackle these cases as and when they arise, as a failure to do so could prove fatal to companies that are already fighting to recover from the detrimental economic impact caused by COVID-19. This will undoubtedly be made more difficult as those who usually investigate the reports are not in the office physically to gather all of the facts and evidence using established procedures. Perhaps more than ever, companies should understand the risks posed to their businesses and be ready for the inevitable emergence of whistleblower reports.

We consider below some of the main areas where whistleblowing reports are predicted to increase, as well as how companies can prepare to ensure that they are in the best position to handle any future claims.

The Perfect Storm

There is currently a perfect storm for whistleblower reports.

First, many countries now guarantee a high-level of protection for whistleblowers resulting in whistleblowers being more comfortable about raising issues. The European Union, for example, has introduced new rules – to take effect in 2021 – which guarantee protection to whistleblowers across a wide range of sectors including public procurement, financial services, money laundering, product and transport safety, nuclear safety, public health, consumer and data protection. The new rules will require the creation of safe channels for reporting both within an organization – private or public – and to public authorities. They will also provide a high level of protection to whistleblowers against retaliation, and require national authorities to adequately inform citizens and train public officials on how to deal with whistleblowing. In the U.S., whistleblowers are afforded similar protections, in particular under the Sarbanes-Oxley (SOX) Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) of 2010, and the False Claims Act. SOX prohibits publicly-traded companies, including any subsidiaries or affiliates, from retaliating against employees who provide information relating to fraud and any violations of state or federal securities laws. Dodd-Frank adds further protection for individuals who provide information to the Consumer Financial Protection Bureau as well as Commodities Futures Trading Commission (CFTC). Both SOX and Dodd-Frank entitle wrongfully discharged employees to compensation, including any special damages that may have followed termination, with Dodd-Frank permitting two times the amount of back pay otherwise owed. The False Claims Act similarly encourages reporting by permitting qui tam suits, which allow whistleblowers to file civil suits for false claims on behalf of the government. The False Claims Act also contains a private cause of action for retaliation.

Secondly, the downturn in global economies means that people are losing their jobs or seeing reductions in their wages and, legitimately or otherwise, may feel compelled to report misconduct at companies who they once worked at. Historical data shows, for example, that whistleblower reports are more likely to be made by disgruntled employees.

Thirdly, in many significant economies including the U.K. and the U.S, there has been the introduction of various government stimulus packages, bringing with them the risk of fraud as businesses fight to stay afloat and perhaps seek to take advantage of economic rescue in circumstances where they do not fall squarely into the criteria for eligibility. Moreover, as a result of the speed with which many of these packages were introduced, it is likely that there is going to be, amongst some companies, a (in some cases innocent) misunderstanding of the rules governing the packages. In the U.S., for example, since the Coronavirus Aid, Relief, and Economic Security Act (the CARES Act) was signed into law on March 27, 2020, over $525 billion has been distributed to businesses through the Paycheck Protection Program (PPP), and the Health & Human Services (HHS) Administration continues to make distributions from the nearly $175 billion allotted to it through the Act.

Finally, in some countries including the U.S. (but not the U.K.), there is potentially a significant economic upside to blowing the whistle. Under U.S. whistleblower programs. the SEC and CFTC will reward whistleblowers 10 to 30 percent of the amount that all government enforcement agencies recover, if the amount recovered based on a whistleblower’s information exceeds $1 million. The False Claims Act permits whistleblowers to share in 15 to 25 percent of proceeds recovered as a result of qui tam suits. Counsel for False Claims Act whistleblowers are also entitled to attorney’s fees, offering a further financial incentive for qui tam complaints to be filed.

Areas in which Whistleblower Reports are Expected to Increase

Although almost no area is immune, some of the areas which might see the greatest number of whistleblower reports are likely to be:

  • Worker Safety: Many governments are introducing guidelines as to how businesses can safely reopen following the COVID-19 lockdown, but the responsibility to interpret and observe the guidelines ultimately falls with the employer. Companies which fail to provide an environment within which employees feel safe, could see an increase in whistleblower reports. For example, the Occupational Safety and Health Administration, which is the U.S. agency responsible for worker protection, has received over 8,000 coronavirus-related complaints since the start of the pandemic. In the U.K., the Health and Safety Executive (the U.K. government agency responsible for the regulation and enforcement of workplace health, safety and welfare, and for research into occupational risks in Great Britain) was, in less than a three-month period, notified of almost 8,000 COVID-19 cases that are suspected to be linked to employment-related exposure, with 119 deaths linked to these cases.
  • Healthcare: As stated above, the CARES set aside $175 billion in relief specifically for healthcare providers. HHS guidance requires healthcare providers that receive funds to certify that the funds will be used for healthcare-related expenses or lost revenue attributable to the pandemic. A healthcare provider also may obtain funding though the PPP as a small business, which similarly contains conditional requirements. By accepting government funding from either source, healthcare providers increase the risk of facing liability under the False Claims Act.
  • Financial Fraud: As noted above, the introduction of various stimulus packages – some introduced at breakneck speed – brings the risk of fraud. In the U.S., the Department of Justice has made it clear that targeting fraud schemes related to coronavirus relief is a top priority, and has already brought numerous indictments. Most recently, for example, it announced charges against nine individuals who allegedly obtained more than $24 million in fraudulent federally-guaranteed loans through the PPP. The purported scheme represents one of the largest arising out of coronavirus relief in the U.S. to date. In the U.K., employers, banks and regulators are already witnessing claims that some businesses are improperly using the U.K. government’s three main schemes to provide guarantees to aid lending to companies affected by COVID-19. Separately, employees appear to already be blowing the whistle on their employers for furlough fraud, in circumstances where they are being required to falsely claim they are furloughed whilst being forced to continue to work.  In those cases, employers are benefiting from government payments for 80 per cent of their employee’s salaries whilst also using the services of their employees. One of the main whistleblowing charities in the U.K., Protect, has reported that 36 percent of its COVID-19 related calls involved furlough fraud with the number of cases rising each week.
  • Systems & Controls: With many people working from home, the risk of compliance processes being ignored, or loosened, is heightened. Financial services firms and other companies operating in regulated sectors who are subject to requirements to implement and maintain systems and controls relating to internal risk, legal, compliance, culture and human resources are likely to see significant departures from established systems and controls.  Those who witness those departures may be inclined to raise the flag.

Failing to Prepare is to Prepare to Fail

Given the inevitable increase in whistleblower reports, companies are well-advised to begin to consider their policies and procedures for dealing with them. As with almost every claim, it is imperative that whistleblower reports are dealt with in a considered and deliberate manner. A failure to deal with a report, or a failure to deal with it adequately, will almost certainly make the situation worse (including, if relevant, the risk of reports to regulators or the press with the resultant risk to the company’s reputation and ongoing business) and compound the harm.

A company may wish to consider the following steps:

  • Prevention is always better than a cure. When the COVID-19 pandemic hit and companies scrambled to take life-saving measures at speed, steps may have been taken (or not taken) that, in normal circumstances, would not have been taken (or would have been). For example, an application for a stimulus package might not have undergone the usual thorough review to ensure that the company met the relevant criteria; due diligence on a new business partner or customer may have been less thorough to account for the fact, for example, that it was more difficult to review hard copy documents from outside the office or the usual teams who undertake the checks were not available; or a payment may have been authorized to a new third-party for procuring protective equipment (masks, sanitizer, etc.). Companies may now wish to consider the decisions that were made in the immediate aftermath of COVID-19, to ensure that representations made were accurate and actions (or inactions) comply with the requirements of their established compliance programs.
  • Ensure that whistleblowing programs are in place and maintained. In many jurisdictions and sectors, companies are required to have in place a platform by which people can raise concerns (sometimes anonymously), where they are not subject to any retaliation for raising their concerns and where the concern is appropriately considered and dealt with. Companies are well advised to ensure that their programs meet relevant laws and regulations. A failure to have an appropriate and legally compliant program not only puts the company at risk of a sanction but also means that a potential whistleblower may have no option but to raise his or her concern in a more public and damaging way, including to the press or law enforcement agency.
  • If you’ve got a policy, follow it! Experience shows that the manner in which a whistleblower report is handled can be more damaging than the underlying concern. In some jurisdictions, retaliation against a whistleblower can be an offence and expose the company both to sanction and also increased civil or employment- related damages. The policy may also require the involvement of other departments within the company, including Human Resources, Legal and/or Compliance and/or the commencement of an investigation. The early involvement of Legal can be important to an investigation to ensure that the investigation is properly scoped and, as relevant, measures to protect legal professional privilege are considered at an early stage. Depending on the issue being raised, equally important at an early stage is to consider issues including suspension / termination of bad practices or employees, retention of relevant documents and early engagement with law enforcement agencies (which may be mandatory).