This guest blog was written by Matt Stock and Jason Zuckerman [1].

As revealed in its 2018 Annual Report to Congress, the SEC Whistleblower Program has been successful in enhancing the SEC’s efforts to root out securities fraud and protect investors. In particular, whistleblower tips have enabled the SEC to recover more than $1.7 billion in monetary sanctions from wrongdoers (up from $1 billion reported in fiscal year 2017), including more than $901 million in disgorgement of ill-gotten gains.

As SEC Chair Jay Clayton recognized in a statement about proposed amendments to the SEC whistleblower rules, “retaliation protections are a key component of the whistleblower program.”  Similarly, former Chair Mary Jo White noted in a speech titled The SEC as the Whistleblower’s Advocate that “[s]trong enforcement of the anti-retaliation protections is critical to the success of the SEC’s whistleblower program.”

One year ago, however, the Supreme Court narrowed the scope of Dodd-Frank whistleblower protection due to an apparent drafting error.  In particular, the Court held in Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767 (2018) that the definition of “whistleblower” in the anti-retaliation provision of the Dodd-Frank Act, 5 U. S. C. §78u– 6(h), requires that an individual report a possible securities law violation to the Securities and Exchange Commission (“SEC”) to qualify for protection against retaliation.  As approximately 80% of whistleblowers report internally before reporting to the SEC, Digital Realty significantly weakens Dodd-Frank’s whistleblower protection provision, thereby dissuading whistleblowers from reporting potential securities law violations to their employers.

Congress should amend the anti-retaliation of the Dodd-Frank Act to broaden the scope of protected conduct and correct other deficiencies in the Act’s whistleblower protection provision. In the interim, whistleblowers should carefully assess how they can utilize Dodd-Frank and other remedies, including Section 806 of the Sarbanes-Oxley Act, to combat retaliation.  This article provides an overview of protections available for SEC whistleblowers.

Does the Dodd-Frank Act protect whistleblowers that disclose potential violations of securities law to the SEC?

Yes.  To qualify for protection under the anti-retaliation provision of the Dodd-Frank Act, a whistleblower must demonstrate that they reported a potential securities law violation to the SEC.  In particular, the Dodd-Frank Act protects three types of whistleblowing:

  1. providing information to the SEC in accordance with the whistleblower incentive section;
  2. initiating, testifying in, or assisting in any investigation or judicial or administrative action of the SEC based upon or related to such information; or
  3. making disclosures that are required or protected under the Sarbanes-Oxley Act of 2002, the Securities Exchange Act of 1934, and any other law, rule, or regulation subject to the jurisdiction of the SEC.

Does the Dodd-Frank Act’s whistleblower protection provision protect internal disclosures (disclosures made to a supervisor, company management, or a corporate compliance program)?

Yes, but only if the whistleblower also disclosed the potential violation to the SEC prior to the employer taking an adverse action.  There is, however, some ambiguity as to whether an internal disclosure is protected if it does not relate to the same subject matter as the disclosure to the SEC.  In June 2018, the SEC proposed amendments to its whistleblower rules that address the scope of Dodd-Frank whistleblower protection.  The Government Accountability Project, National Employment Lawyers Association, and Public Citizen submitted comments to the SEC concerning the SEC’s constrcution of Dodd-Frank whistleblower protection.  The comments are posted at

Does the Dodd-Frank whistleblower protection law require a whistleblower to demonstrate  that the employer knew about the whistleblower’s disclosure to the SEC?

No.  In Digital Realty, the Supreme Court held where an employee blows the whistle to the SEC and subsequently reports the misconduct to the employer and then suffers retaliation because of the internal disclosure (not because of the disclosure to the SEC, which the retaliating employer is unaware of), the internal disclosure is protected under Dodd-Frank even where the employer does not know that the employee reported a possible securities law violation to the SEC:

[Dodd-Frank] protects a whistleblower who reports misconduct both to the SEC and to another entity, but suffers retaliation because of the latter, non-SEC, disclosure.  That would be so, for example, where the retaliating employer is unaware that the employee has alerted the SEC.  In such a case, without clause (iii), retaliation for internal reporting would not be reached by Dodd-Frank, for clause (i) applies only where the employer retaliates against the employee “because of” the SEC reporting. §78u–6(h)(1)(A). Moreover, even where the employer knows of the SEC reporting, the third clause may operate to dispel a proof problem: The employee can recover under the statute without having to demonstrate whether the retaliation was motivated by the internal report (thus yielding protection under clause (iii)) or by the SEC disclosure (thus gaining protection under clause (i)).

Somers, 138 S. Ct. at 779.

Does the Sarbanes-Oxley Act also protect corporate whistleblowers that suffer retaliation for reporting fraud or other potential violations of securities law to the SEC or to an employer?

Section 806 of SOX protects both internal whistleblowing (e.g., reporting securities fraud to a supervisor) and whistleblowing to the SEC.  In particular, the whistleblower protection provision of SOX prohibits employers from retaliating against whistleblowers for reporting to law enforcement, regulatory authorities, Congress, or the employee’s supervisor suspected mail fraud, wire fraud, bank fraud, securities fraud, a violation of any rule or regulation of the SEC, or any provision of federal law relating to fraud against shareholders.  Unlike the Dodd-Frank Act, SOX whistleblower protection is not predicated on a showing that the whistleblower disclosed a potential violation directly to the SEC.  Instead, it expressly protects internal disclosures, including disclosures made in the course of participating in an internal investigation.  For more information about SOX whistleblower protection, see Sarbanes-Oxley Whistleblower Protection: Robust Protection for Corporate Whistleblowers.

This table identifies some of the major differences between the anti-retaliation provisions of SOX and Dodd-Frank.  To maximize the potential recovery, a whistleblower could initially bring a SOX claim at OSHA, subsequently remove it to federal court, and add a Dodd-Frank claim.  Doing so could enable the whistleblower to recover double back pay (authorized by Dodd-Frank) and uncapped special damages (authorized by SOX).

SOX Dodd-Frank
Scope of coverage Any company with a class of securities registered under section 12 of the Securities Exchange Act of 1934, or that is required to file reports under section 15(d) of the Securities Exchange Act of 1934, including any subsidiary or affiliate whose financial information is included in the consolidated financial statements of such company, or nationally recognized statistical rating organization, or any officer, employee, contractor, subcontractor, or agent of such company. Any employer
Protection for internal whistleblowing Yes Internal whistleblowing protected only if individual has also reported a possible securities violation to the SEC
Protection for whistleblowing to SEC Yes Yes
Statute of Limitations 180 days 6 years
Administrative exhaustion Must file initially with OSHA None
Arbitration Exempt from mandatory arbitration Not exempt
Back pay Ordinary back pay Double back pay
Special damages for emotional distress and reputational harm Available Not available

What acts of retaliation are prohibited under the Dodd-Frank anti-retaliation law?

The anti-retaliation provision of the Dodd-Frank Act prohibits an employer from:

  • Discharging;
  • Demoting;
  • Suspending;
  • Threatening;
  • Harassing; or
  • Directly or indirectly, or in any other manner discriminating against, a whistleblower in the terms and conditions of employment.

What damages can a SEC whistleblower recover in a retaliation case?

A prevailing whistleblower can recover:

  • double back pay (lost wages) with interest;
  • reinstatement or front pay in lieu thereof; and
  • reasonable attorneys’ fees, litigation costs, and expert witness fees.

If the whistleblower also brings a SOX retaliation claim, the whistleblower can recover uncapped “special damages” for emotional distress and reputational harm.

What is the statute of limitations for a Dodd-Frank Act whistleblower retaliation claim?

The statute of limitations for a Dodd-Frank retaliation claim is 6 years after the date on which the violation occurred, which is tolled (the time period is suspended) by three years after the date “when facts material to the right of action are known or reasonably should have been known” by the whistleblower.  This extends the time period for a Dodd-Frank retaliation claim beyond the 6 year statute of limitations, but a retaliation claim may not in any circumstance be brought more than 10 years after the date on which the violation occurred.

Are auditors and compliance personnel protected from retaliation under the Dodd-Frank Act?

Yes, but individuals who are integral to a company’s compliance will not be protected under Dodd-Frank when they initially make a mandatory internal disclosure that is required as a precondition to eligibility for a SEC whistleblower award.

Employees whose principal duties involve compliance or internal-audit responsibilities, employees of public accounting firms, and officers and directors are eligible for a SEC whistleblower award only if they meet one of the following requirements:

  1. They reasonably believe the disclosure is necessary to prevent conduct that is likely to cause “substantial injury” to the financial interest or property of the entity or investors;
  2. They reasonably believe the entity is engaging in “conduct that will impede an investigation of the misconduct”; or
  3. At least 120 days have passed either since they properly disclosed the information internally, or since they obtained the information under circumstances indicating that the entity’s officers already knew of the information.

Under the third requirement, the whistleblower will not be protected when they make the required internal disclosure.  Therefore, if the employer retaliates against the whistleblower before the whistleblower reports the violation to the SEC, Dodd-Frank would not protect the whistleblower.  If the whistleblower works at a SOX-covered entity, however, they may have a remedy under SOX.

Should a corporate whistleblower suffering retaliation bring a claim under Dodd-Frank, Sarbanes-Oxley, or both laws?

We recommend bringing claims under both SOX and Dodd-Frank to maximize the potential recovery, although the claims cannot be brought simultaneously in federal court (the SOX claim must be filed initially at OSHA).  The statute of limitations for a SOX whistleblower claim is just 180 days and this short statute of limitation applies to each discrete adverse employment action, with the exception of hostile work environment claims.  Accordingly, if you have suffered retaliation for whistleblowing, it is critical to promptly identify each actionable adverse action and file within the 180-day SOX statute of limitations.

There are four advantages to bringing a SOX claim in addition to a Dodd-Frank claim:

There are four advantages to bringing a Dodd-Frank claim in addition to a SOX claim:

  • Double back pay:  Dodd-Frank authorizes an award of double back pay (double lost wages) plus interest, whereas SOX authorizes ordinary back pay with interest along with other damages. Both statutes authorize reinstatement and attorney fees.
  • Longer statute of limitations:  Whereas the statute of limitations for a SOX retaliation claim is just 180 days, the statute of limitations for a Dodd-Frank retaliation claim is six to ten years.
  • Broader scope of coverage:  SOX whistleblower protection applies primarily to employees of public companies and contractors of public companies.  The Dodd-Frank prohibition against whistleblower retaliation applies to “any employer,” not just public companies.
  • No administrative exhaustion:  In contrast to SOX, Dodd-Frank permits a whistleblower to sue a current or former employer directly in federal district court without first exhausting administrative remedies at DOL.

Can a whistleblower obtain a reward for reporting a securities law violation to the SEC?

Yes, under the SEC’s Dodd-Frank whistleblower reward program, a whistleblower who voluntarily provides original information to the SEC that leads to a successful enforcement action that recovers more than $1 million in disgorgement or penalties is eligible for an award ranging from 10% to 30% of the monetary sanctions collected in the enforcement action.  To learn more about the SEC whistleblower awards, download our guide SEC Whistleblower Program: Tips from SEC Whistleblower Attorneys to Maximize an SEC Whistleblower Award.

Can a whistleblower settle a retaliation lawsuit without waiving their ability to recover a potential Dodd-Frank whistleblower award?

Although no court has ruled on this issue, the SEC has taken a firm position that an employer cannot require a whistleblower to waive the right to obtain a potential whistleblower award.  And indeed, the SEC has taken several enforcement actions against companies for violating Rule 21F-17(a), which provides that “[n]o person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement…with respect to such communications.”  See, e.g., In the Matter of Homestreet, Inc. and Darrell Van Amen, File No. 3-17801 (January 19, 2017); In the Matter of Blackrock, Inc., File No. 3-17786 (January 17, 2017); In the Matter of SandRidge Energy, Inc., File No. 3-17739 (December 20, 2016); In the Matter of NeuStar, Inc., File No. 3-17736 (December 19, 2016); In the Matter of Anheuser-Busch InBev SA/NV, File No. 3-17586 (September 28, 2016); In the Matter of Health Net, Inc., File No. 3-17396 (August 16, 2016); In the Matter of BlueLinx Holdings Inc., File No. 3-17371 (August 10, 2016).

Does the SEC enforce the anti-retaliation provision of the Dodd-Frank Act?

Yes, the SEC enforces the anti-retaliation provision of the Dodd-Frank Act, but it does not secure relief for the whistleblower, i.e., the SEC does not obtain lost wages or order reinstatement.  Instead, it can take an enforcement action against the registrant for violating the anti-retaliation provision of the Dodd-Frank Act.

In a June 28, 2018 public statement at an open meeting announcing proposed amendments to the rules governing the SEC Whistleblower Program, Chair Clayton stated: “Many have asked whether the SEC will continue to enforce the anti-retaliation provisions of Dodd-Frank. Let me be clear: retaliation protections are a key component of the whistleblower program, and we will bring charges against companies or individuals who violate the anti-retaliation protections when appropriate.” Statement at Open Meeting on Amendments to the Commission’s Whistleblower Program Rules, available at

The SEC has taken enforcement actions for whistleblower retaliation, and such an enforcement action can increase an SEC whistleblower award.   In September 2016, the SEC ordered International Game Technology (“IGT”) to pay a $500,000 penalty for terminating the employment of a whistleblower because he reported to senior management and to the SEC that the company’s financial statements might be distorted. See Exchange Act Release No. 78991 (Sept. 29, 2016). During an internal investigation into the whistleblower’s allegations, IGT removed him from opportunities that were integral to his ability to perform his job successfully. IGT then fired the whistleblower the same day as the internal investigation concluded that IGT’s cost-accounting model was appropriate and did not cause its financial statements to be distorted. The whistleblower was protected under the SEC whistleblower program, despite being mistaken, because he reasonably believed that IGT’s cost-accounting model constituted a violation of federal securities laws.

On June 16, 2014, the SEC announced that it was taking enforcement action against Paradigm Capital Management, Inc. (“Paradigm”), a hedge fund advisory firm, for engaging in prohibited principal transactions and for retaliating against the whistleblower who disclosed the unlawful trading activity to the SEC. See Exchange Act Release No. 72393 (June 16, 2014). This was the first case in which the SEC exercised its authority under Dodd-Frank to bring enforcement actions based on retaliation against whistleblowers.

According to the order, Paradigm retaliated against its head trader for disclosing, internally and to the SEC, prohibited principal transactions with an affiliated broker-dealer while trading on behalf of a hedge fund client. The transactions were a tax-avoidance strategy under which realized losses were used to offset the hedge fund’s realized gains.

When Paradigm learned that the head trader had disclosed the unlawful principal transactions to the SEC, it retaliated against him by removing him from his position as head trader, changing his job duties, placing him on administrative leave, and permitting him to return from administrative leave only in a compliance capacity, not as head trader. The whistleblower ultimately resigned his position.

Paradigm settled the SEC charges by consenting to the entry of an order finding that it violated the anti-retaliation provision of Dodd-Frank and committed other securities law violations; agreeing to pay more than $1 million to shareholders and to hire a compliance consultant to overhaul their internal procedures; and entering into a cease-and-desist order.

Is an employee protected against retaliation for providing testimony in an SEC investigation or at a hearing in an administrative or judicial enforcement action?

The whistleblower protection provision of SOX protects such testimony. The plain meaning of the anti-retaliation provision of Dodd-Frank should also protect the witness, but the SEC has proposed limiting Dodd-Frank protection to written disclosures to the SEC. 

Retaliation against a witness in an SEC investigation could also violate the criminal prohibition against retaliation in Section 1107 of SOX, 18 U.S.C. § 1513(e).  Section 1107 of SOX provides:

Whoever knowingly, with the intent to retaliate, takes any action harmful to any person, including interference with the lawful employment or livelihood of any person, for providing a law enforcement officer any truthful information relating to the commission or possible commission of any federal offense, shall be fined under this title, imprisoned not more than 10 years, or both.

18 U.S.C. § 1513(e).

The Seventh Circuit’s decision in DeGuelle v. Camilli, 664 F.3d 192 (7th Cir. 2011) illustrates how a whistleblower suffering retaliation can potentially pursue a RICO action relying on Section 1107 as a predicate offense.  To plead a RICO case, the whistleblower must aver  a second predicate act that is related to the Section 1107 violation, e.g., securities fraud.  RICO is a potent remedy because it authorizes treble damages (financial compensation that is triple the amount of the actual or compensatory damages).

Another potential remedy for a whistleblower that suffers retaliation for participating in a federal court proceeding is 42 U.S.C. § 1985(2).  This civil rights statute prohibits conspiracies to intimidate or retaliate against parties, witnesses or jurors testifying or participating in federal court proceedings.  Under 42 U.S.C. § 1985(2), a victim of intimidation or retaliation who suffers injury to “his person or property” can recover damages against the perpetrators of the conspiracy.  The Supreme Court held in Haddle v. Garrison, 525 U.S. 121 (1998) that a conspiracy to terminate an employee’s at-will employment constitutes injury to person or property and is therefore actionable under 42 U.S.C. § 1985(2).

In addition to SOX, do other whistleblower protection laws protect corporate whistleblowers?

Yes, some state whistleblower protection laws protect disclosures about corporate fraud, and some states recognize a common law tort action for wrongful discharge in violation of public policy.  Adding a state law claim can potentially enable the whistleblower to recover punitive damages.

Should a whistleblower report internally before disclosing a violation to the SEC?

Prior to deciding whether to report internally, the whistleblower should carefully weigh several factors, including the risk of retaliation, the employer’s potential inclination to destroy evidence or otherwise cover-up a violation, the extent to which senior management is profiting from the violation, and the adequacy of the company’s compliance program.  There is a significant incentive to report internally in that a whistleblower who initially reports internally, and reports the same information to the SEC within 120 days, will receive credit for any information the company subsequently self-reports to the SEC.

[1] Stock and Zuckerman represent whistleblowers in whistleblower rewards and whistleblower retaliation claims.  Matthew Stock, CPA, CFE, is the Director of the Whistleblower Rewards Practice at Zuckerman Law and is an attorney, Certified Public Accountant, Certified Fraud Examiner, and former KPMG external auditor.