How the SEC Whistleblower Program Works: Awards, Protections and Company Risk

The SEC whistleblower program, created by Section 922 of the Dodd-Frank Act in 2010, pays monetary awards to individuals who voluntarily provide original information leading to successful enforcement actions with sanctions exceeding $1 million: the award is between 10 and 30 percent of what the agency collects. The program also prohibits retaliation against whistleblowers and — the feature companies most often mishandle — the Supreme Court's 2018 decision in Digital Realty Trust v. Somers held that the anti-retaliation protection attaches only when the report is made to the SEC, not merely through internal channels. Through fiscal 2025 the program has awarded well over $2 billion cumulative, funded not by taxpayers but by an investor-protection fund fed by sanctions.

USA Post publishes information about enforcement programs, not legal advice.

Who qualifies for an award?

Three requirements define eligibility. The information must be voluntary — provided before any request, inquiry, or demand directed at the whistleblower or their counsel; information demanded in an exam or subpoena does not qualify. It must be original — derived from independent knowledge or analysis, not publicly disclosed unless the whistleblower is the source, and not already known to the SEC from another whistle. And it must lead to a successful enforcement action producing monetary sanctions above $1 million — the "related action" provision lets a whistleblower collect on a parallel criminal or state action within limits amended by Congress in 2021 to tighten the SEC's discretion. Compliance and audit personnel face restrictions under Exchange Act 21F-4: they generally may not report information gained through their roles unless 120 days pass after internal reporting or the SEC determines internal channels were inadequate. The Supreme Court's 2022 decision in Murray v. UBS Securities on the analogous Sarbanes-Oxley whistleblower provision also made prevailing easier — a whistleblower need not prove retaliatory intent as part of the prima facie case, only that reporting was a contributing factor.

How large are the awards in practice?

The largest single award, $279 million in May 2023, reflected the scale of underlying actions; awards above $100 million have recurred as cases from the whistleblower era matured. The 10-30 percent band is set by rule criteria: significance of information, assistance provided, program interest in deterring violations, participation in internal compliance, and unreasonable reporting delay. In 2020 the SEC adopted — and after criticism declined to finalize — proposals that would have presumptively capped awards at lower percentages; the commission stepped back, confirming the full statutory band remains available. Awards are taxable, and the program pays only on collected money: a $1 billion judgment against a defunct entity yields nothing to the fund.

What does this mean for companies and their counsel?

Two structural realities. First, any internal investigation now runs on a clock: once an employee knows facts, the employee's lawyer knows the SEC pays for them, and Digital Realty means internal-only reporting carries no retaliation shield — a strong incentive to file with the agency early. Second, confidentiality agreements that could impede SEC reporting are themselves violations: SEC Rule 21F-17, enforced in dozens of actions with penalties through 2025, prohibits agreements — separation agreements, code-of-conduct provisions — that restrict or threaten employees for communicating with the commission, and the SEC has penalized companies for wording that required waiver of whistleblower awards. Every severance template should be audited against 21F-17.

How should companies manage whistleblower risk?

1. Build a real internal channel with an anonymous option, and publicize outcomes, not just the mailbox: employees report externally when internal channels seem inert.
2. Never include SEC-reporting restrictions, waivers of award rights, or notification duties in confidentiality or settlement agreements.
3. Train managers on retaliation law — the employment decision after a report, not the report, generates liability under SOX 806 and Dodd-Frank 922, with double back pay available.
4. When an internal report arrives on securities issues, document the investigation immediately; the 120-day compliance-personnel window means delay converts a managed internal matter into an SEC matter.
5. Treat tips as risk intelligence: recurring themes in internal reports are what the SEC later reads as red flags the board ignored.

What happens after a tip is filed?

The claimant gets a TCR number, submits a Form TCR with the information, and waits — enforcement timelines run years. The SEC's Office of the Whistleblower determines preliminary award eligibility when the action closes and posts notices of covered actions; claimants then have 90 days to file a claim. Award determinations are reviewable in the Court of Appeals for the D.C. Circuit, which has trimmed the SEC's discretion at the margins — for instance, requiring reasoned decisions when related-action awards are denied. For companies, the practical consequence of the pipeline's length is that today's internal tip is a 2029 enforcement action; the record being built now is the one that will matter then.