Stairway to M&A Safe Harbor: It’s Whistleblowing, Stupid!

By Dr. Fabian Ibel

In the realm of mergers and acquisitions (M&A), compliance is taking on an increasingly pivotal role. Recent updates from the U.S. Department of Justice (DOJ) underscore the significance of voluntary self-disclosures in corporate transactions. The DOJ’s Mergers & Acquisitions Safe Harbor policy promises prosecutorial leniency if companies voluntarily disclose misconduct, fully cooperate with authorities, and remediate issues discovered during due diligence, conducted shortly before or after a legitimate M&A deal.

As far as European companies are involved, U.S. acquiring entities may leverage EU’s new whistleblowing legislation, which protects whistleblowers from employer reprisals and mandates that companies with 50 and more employees establish internal reporting channels for criminal behavior. What this synergy may look like is outlined below.

DOJ’s Mergers & Acquisitions Safe Harbor Policy

In October 2023, Deputy Attorney General Lisa Monaco announced a pivotal safe harbor policy for M&A-related voluntary self-disclosures.¹ This policy provides that if an acquiring company uncovers misconduct during due diligence and meets specific criteria, it may avoid prosecution. These criteria include:

• Timely self-disclosure of the misconduct, typically within 180 days of the deal’s closing
• Prompt and full remediation of the misconduct, usually within one year of closing
• Payment of any associated disgorgement, forfeiture, and restitution²

However, these requirements, detailed in the DOJ’s Justice Manual § 9-28.900(A)(3), revised in March 2024, are not carved in stone.³ Prosecutors apply the policy to various types of transactions beyond traditional acquisitions, such as “mergers under equals” or may extend deadlines. The latter is what happened in the case of Lifecore Biomedical, Inc.⁴ Last November, shortly after the DOJ had announced its new policy, the DOJ opted not to prosecute Lifecore, despite its new subsidiaries’ involvement in bribery. The presumption of declination was granted by the DOJ although, based on publicly available information, the deadline of 180 days was not met. The DOJ explicitly acknowledged Lifecore’s pre-acquisition due diligence and the concealment efforts by the target’s employees.

Whistleblowing Channels Across Europe

The DOJ’s Safe Harbor Policy aligns powerfully with EU’s recently enacted whistleblowing legislation, embodied in the EU Whistleblowing Directive (2019/1937). The directive mandates protection for whistleblowers against employer retaliation and requires companies with 50 and more employees to establish internal reporting mechanisms for criminal activities (Art. 8 (3) EU Whistleblowing Directive).

In Germany, the directive has been implemented through the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG) in July 2023, affecting approximately 115,000 entities across the private and public sectors. Apart from companies exceeding the 50-employees-threshold companies from the financial sector, such as investment services companies as well as capital management companies (regardless of their number of employees) fall within the scope of the new law.

Non-compliance can result in fines of up to EUR 50,000 for directors and managers, with higher penalties possible for the company itself under the corporate fine rules (§§ 30, 130 OWiG).

Protective Measures for Whistleblowers

In addition to whistleblowing channels, the Whistleblower Protection Act includes a series of protective measures for whistleblowers. Those cover provisions ensuring whistleblowers’ confidentiality (§§ 8, 9 HinSchG) and stipulate that whistleblowers cannot be held legally responsible for obtaining or accessing information they have reported or disclosed, provided that the acquisition or access itself does not constitute a separate criminal offense (§ 35 HinSchG). The key provision in this regard is undoubtedly the prohibition of retaliation following a report (§ 36 (1) HinSchG). This is backed by a rule on the reversal of burden of proof, placing the onus on the employer to prove that any negative action is unrelated to the whistleblower’s report (§ 36 (2) HinSchG). Additionally, it includes a compensation regulation in favor of the whistleblower (§ 37 HinSchG) and, finally, a violation of the prohibition of reprisals constitutes an administrative offense (§ 40 (2) No. 3 HinSchG).

Advantages of Whistleblowing for Safe Harbor Qualification

Whistleblowing channels are critical in detecting corporate misconduct, as evidenced by reports indicating that 40% of corruption cases are exposed by whistleblowers.⁵ These employees, intimately involved in daily operations, are often the first to notice irregularities. Therefore, it is highly advisable to strategically utilize whistleblowing in the process of identifying misconduct to qualify for Safe Harbor provisions. It is no coincidence that the DOJ Deputy Attorney General Lisa Monaco recently announced that the DOJ is about to develop and implement a pilot program on whistleblowing as well.⁶ It serves to complement the scope of existing programs of other agencies, such as the Internal Revenue Service (IRS) or the Security and Exchange Commission (SEC). Even more important, the DOJ’s whistleblowing pilot program is specifically designed to enhance the effectiveness of the DOJ’s voluntary self-disclosure programs, such as Safe Harbor (“multiplier effect”).⁷

Optimizing Whistleblowing Systems: Strategies for Effective Implementation

Consequently, corporations can profit from fostering a culture encouraging whistleblowing, perceiving it not as denunciation but as a vital compliance tool. In this regard, entities’ managing directors should consider, under § 7 (1) HinSchG, that whistleblowers can also report to external reporting channels at the federal and state levels, i.e. whistleblowers have the right to choose between both types. So far, over 900 reports have been received by the external reporting offices since their implementation.⁸ Thus, corporations are well advised to actively support internal reporting in order to protect sensitive information.

To maximize the effectiveness of whistleblowing systems, companies can incentivize their use by broadening the scope of reportable issues. Beyond legal violations as stipulated in the catalogue of § 2 (1) HinSchG, companies could exceed this scope by adding issues such as conflicts of interest or violations of internal regulations (e.g. code of conduct) to their internal list of reportable incidents. The broadening of the scope of reportable issues can help tackle the employees’ reluctance to approach the channels.⁹

Furthermore, expanding whistleblower channels to all levels of a corporate structure can help to increase the effectiveness of the compliance system. Under the Whistleblower Protection Act, corporations within a group can establish whistleblower channels not only within the affected entity but also at other levels of the corporate structure (cf. § 14 (1) HinSchG). Thus, U.S. companies can centralize whistleblowing channels at the level they wish, streamlining the oversight and enforcement of compliance across all subsidiaries. Additionally, outsourcing these channels to third parties, such as law firms, is legit and appropriate as well as it can build trust and ensure the professional handling of reports. It is important to note that internal reporting channels must be staffed by knowledgeable and independent individuals, as required by § 15 HinSchG. Outside counsels, who are bound by professional confidentiality, are probably best suited for ombudsman tasks, especially when it comes to qualified follow-up actions, such as internal investigations.

Finally, internal reporting offices should also accept anonymous reports, although there is no obligation for those offices to set up their own (IT) systems to receive anonymous tips (§ 16 (1) para 4, 5 HinSchG).

Financial Incentives for Whistleblowers

Timing is crucial under the M&A Safe Harbor Policy, which requires disclosures within 180 days of closing. Hence, one might consider luring whistleblowers with financial rewards to report misconduct within the safe harbor period. The Whistleblower Protection Act does not explicitly address financial incentives. However, it generally encourages companies to create incentives for employees to use internal reporting channels (§ 7 (3) para 1 HinSchG). Unlike in the U.S., financial incentives for whistleblowers are not common to the German legal system.¹⁰ This may have historical reasons, as financial rewards for “reporting” evoke memories of the Stasi era in East Germany (GDR).

However, due to European legislation and the influence of the U.S. on Europe, Germany’s reluctance to provide financial incentives is likely to change. U.S. led companies, which are more familiar with financial rewards, can accelerate this shift: For instance, under the Dodd-Frank Act, the SEC Whistleblower Program offers rewards ranging from 10% to 30% of the monetary sanctions collected in actions where penalties exceed $1 million.¹¹ Similarly, the IRS Whistleblower Program provides awards of up to 30% of the collected proceeds resulting from information provided about tax fraud. The new DOJ pilot program will also include detailed provisions regarding financial incentives.

A consistent requirement across all programs is original, non-public, truthful information that is not already known to the DOJ.¹² Regarding the latter, it remains to be seen how the DOJ will structure its whistleblowing program in detail, especially with regards to the relationship between internal and external reporting channels.

Conclusion and Outlook

Whistleblowing is becoming an essential component of corporate compliance systems in the U.S. and Europe. Even if initial disclosures do not uncover misconduct within 180 days as stipulated by the DOJ’s M&A Safe Harbor policy, establishing robust whistleblowing channels demonstrates a company’s commitment to compliance, potentially mitigating penalties¹³ and fostering a culture of transparency and accountability.

Looking ahead, the integration of comprehensive whistleblowing systems within corporate structures will likely continue to evolve, driven by both regulatory demands and the growing recognition of their value in preempting and addressing corporate misconduct. Companies that proactively embrace these measures will not only enhance their compliance frameworks but also position themselves as leaders in ethical business practices.

The Author:

Dr. Fabian Ibel is Compliance Officer at Harmonic Drive SE and Co-Founder of Truveo Compliance. He advises his corporate and private clients on all compliance related matters. Fabian is the author of several academic articles in the corporate and compliance law fields.

Responsible Editor:

Isabel Cagala, TLB Co-Editor-in-Chief