Global Crisis Management Series:  This post is part 7 in a series concerning topics further elaborated on in Cleary Gottlieb’s Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis.  The current version is available here.

While legal protections for whistleblowers in the United States were first adopted in the late 1970s for federal employees, statutory protections enacted in the last 20 years have substantially increased protection beyond the federal workforce to certain private-sector employees.  These protections create a number of potential issues for companies today, ranging from employee retaliation lawsuits to regulatory investigations.

This note provides a high-level description of the primary whistleblower legal protections in the United States today.  Companies are well-advised to keep these protections in mind as they implement and enhance their compliance programs.  The right policies and procedures—tailored to a company’s particular risk profile—can reduce the risk of whistleblower complaints and ensure that concerns are appropriately investigated internally and remediated as necessary to reduce costly and intrusive regulatory scrutiny. 

Key Anti-Retaliation Statutes   

The primary goal of whistleblower statutes, rules and regulations is to protect employees who come forward with concerns about actual or potential violations of law from retaliation by their employers.  More than a dozen statutes include anti-retaliation provisions, but the most significant of these statutes are the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act and their implementing rules.  There are some key differences between Sarbanes-Oxley and Dodd-Frank that are important to keep in mind.


Sarbanes-Oxley extends whistleblower protections to federal employees and employees of publicly-held companies.  Employees need only raise concerns internally, and not with the government, for Sarbanes-Oxley’s anti-retaliation provision to apply.  Therefore, an employee who raises concerns to her superior regarding suspected violations of law, such as securities fraud, may be eligible for protection under the statute were adverse employee action to follow her report.

A person who alleges termination or other retaliatory employment action as a result of blowing the whistle may seek relief by filing a complaint with the Secretary of Labor.  If the Secretary of Labor does not issue a final decision within 180 days, though, the person may file a complaint in federal district court.[1]

Recent actions show the expansive scope of Sarbanes-Oxley’s protections, as well as the potentially costly repercussions of successful whistleblower retaliation actions.  In a New York federal court, a jury recently awarded nearly $1.6 million in back pay to a pharmaceutical employee who was terminated after raising concerns over his employer’s disclosures to shareholders.[2]  However, the total award ballooned to nearly $5 million once the judge awarded an additional $2.7 million in “front pay” and more than $600,000 in prejudgment interest.[3]  Awards of this size are becoming more commonplace.  Under the statute, employees can seek not only back pay with interest and special damages, such as attorney’s fees and costs, but also reinstatement.[4]  And where reinstatement is not feasible, “front pay” may be awarded, as was the case here.


Dodd-Frank can be viewed as a further expansion of the legal protections available to whistleblowers.  Dodd-Frank’s anti-retaliation provision extends to any person who has a reasonable belief that federal securities laws have been violated and raises those concerns to the SEC.[5]  Moreover, Dodd-Frank provides for a longer statute of limitations period than the 180 day period under Sarbanes-Oxley, allowing whistleblowers to bring a cause of action up to six years after the date of retaliation.[6]  Unlike Sarbanes-Oxley, however, Dodd-Frank’s anti-retaliation protections do not apply to employees who strictly raise concerns internally.  Instead, protection under Dodd-Frank is triggered only once those concerns are reported to the SEC.[7]  This potentially creates an incentive for employees to report their concerns directly to the SEC whether or not they have reported internally.  This incentive underscores the need for companies to implement a robust compliance program, demonstrating a commitment to compliance and encouraging employees to come forward with concerns.

Rather than requiring employees to file their complaints with the Secretary of Labor, Dodd-Frank creates a private right of action for employees to file a lawsuit directly in federal court.[8]  Under the statute, employees can seek substantial compensation: double back pay, reinstatement, and attorney’s fees and costs.[9]

Dodd-Frank also empowers the SEC to initiate its own retaliation suit against a company.[10]  This creates a separate cause of action based on the company’s reaction to an employee’s concerns, regardless of whether an underlying violation of law is found to have occurred.  In a recent retaliation case brought by the SEC under Dodd-Frank, the SEC found that International Game Technology (“IGT”) terminated the employment of one of its directors for raising concerns about potential discrepancies in the company’s financial disclosures.  The director’s underlying disclosure about a potential securities law violation was never substantiated, and an internal investigation by IGT concluded that there were no misstatements in the disclosures.  Nevertheless, the SEC found that the director reasonably believed there could be a violation of the securities laws, and his subsequent termination was a direct result of raising those concerns.  Without admitting or denying the SEC’s findings, IGT agreed to pay a $500,000 penalty.

In addition to protecting whistleblowers from retaliation, Dodd-Frank contains an award program that incentivizes employees to come forward with concerns related to violations of the securities laws.  To be eligible for an award, a whistleblower must voluntarily provide the SEC with original information that leads to a successful enforcement action resulting in sanctions totaling more than $1 million.  Whistleblowers are then eligible for between 10 and 30 percent of the monetary sanction collected.[11]

In a recent award, for example, an employee at Biomet, a publicly traded medical device company, received a $4.5 million award from the SEC after disclosing to his employer and the SEC an alleged kickback scheme within the company.  The kickback scheme allegedly involved the illicit distribution of the company’s products in Mexico and Brazil through bribes and other means.  Biomet ultimately agreed to pay approximately $30 million to resolve SEC and Department of Justice investigations into violations of the Foreign Corrupt Practices Act.[12]

This recent award highlights the incentive structure behind the Dodd-Frank’s whistleblower award program.  The SEC’s program seeks to incentivize employees to come forward with actionable information to help further the SEC’s enforcement goals.  To date, the results of the whistleblower program suggest that the law may be having its intended effect.  Since the program’s inception, the SEC has received an increasing number of whistleblower tips every year, starting with 334 in 2011 and rising to 5,282 in 2018.  In addition, the SEC has awarded more than $300 million to whistleblowers since 2011, with two of the largest awards issued in 2018, alone.  Over the same time period, the SEC has collected more than $1.7 billion in total monetary sanctions as a result of those whistleblower tips.[13]

There are two additional aspects of whistleblower regulations in the United States that have potential significance for U.S. companies.  First, the Commodity Futures Trading Commission (“CFTC”) has its own whistleblower program that provides anti-retaliation protections for whistleblowers, as well as monetary incentives to whistleblowers who report potential violations of the Commodity Exchange Act.  The CFTC’s whistleblower program was also created by Dodd-Frank and, following amendment to its rules in July 2017, largely mirrors the protections and incentives provided by the SEC.[14]

Second, each state also provides some degree of whistleblower protection to employees.  The scope of these laws vary widely from state to state,[15] and companies should ensure they consult with knowledgeable counsel about the protections in the states in which they operate.

Bottom Line

Understanding U.S. whistleblower regulations is critical to properly navigating a complex regulatory landscape and, to the extent practicable, avoiding lawsuits, regulatory investigations, and fines that can impact a company’s bottom line.  Therefore, when implementing or reviewing internal compliance programs, companies should consider whether whistleblower regulations are accounted for in those programs, and what changes are required in view of this dynamic area of the law.

[1] 18 U.S.C. § 1514A(b)(1)(B).

[2] See Jury Verdict Form, Perez v. Progenics Pharm., Inc., No. 10 Civ. 8278 (LAP), 2015 WL 5321080 (S.D.N.Y. 2015).

[3] Perez v. Progenics Pharm., Inc., 204 F. Supp. 3d 528 (S.D.N.Y. 2016).

[4] 15 U.S.C. § 1514A(c).

[5] 15 U.S.C. § 78u-6(a)(6).

[6] 15 U.S.C. § 78u-6(h)(1)(B)(iii).  Alternatively, an action may be brought within three years after the date “facts material to the right of action are known or reasonably should have been known by the employee” but not more than 10 years after the date the violation occurs.  Id.

[7] Digital Realty Tr., Inc. v. Somers, 138 S. Ct. 767 (2018).

[8] 15 U.S.C. § 78u-6(h)(1)(B)(i).

[9] 15 U.S.C. § 78u-6(h)(1)(C).

[10] See, e.g., SEC, Casino-Gaming Company Retaliated Against Whistleblower (Sept. 29, 2016),‌news/pressrelease/2016-204.html.

[11] 15 U.S.C. § 78u-6(b)(1).

[12] Jason Zuckerman & Matthew Stock, $4.5M SEC Whistleblower Award Underscores Incentives to Report Internally, Nat’l L. Rev. (May 28, 2019),

[13] SEC Office of the Whistleblower, Annual Report to Congress (2018),

[14] 17 C.F.R. § 165.

[15] Pub. Emps. for Envtl. Responsibility, State Watch,, (last visited June 25, 2019).