Foundation Five

By George Dowd

18 min read · Last updated May 2026

Whistleblower Programs

Federal whistleblower programs convert insider knowledge into actionable enforcement information, with statutory protections against retaliation and monetary awards drawn from sanctions collected by the government. Four programs structure most financial markets whistleblower practice: the SEC, CFTC, FinCEN, and the Department of Justice Criminal Division’s Corporate Whistleblower Awards Pilot Program.

The whistleblower architecture

The modern federal financial markets whistleblower architecture was built principally by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, which established the Securities and Exchange Commission and Commodity Futures Trading Commission whistleblower programs. It was substantially expanded by the Anti-Money Laundering Act of 2020 and the Anti-Money Laundering Whistleblower Improvement Act of 2022, which together built the Financial Crimes Enforcement Network whistleblower program. The Department of Justice Criminal Division’s Corporate Whistleblower Awards Pilot Program, launched in 2024 and expanded in 2025, addresses corporate crime areas not covered by the other programs.

Each program addresses specific subject matter jurisdiction. The SEC program covers violations of federal securities laws. The CFTC program covers violations of the Commodity Exchange Act. The FinCEN program covers Bank Secrecy Act and OFAC sanctions violations. The DOJ pilot program covers gaps in the others. A whistleblower’s choice of program (or programs, because concurrent submissions are often appropriate) depends on subject matter, identity of the wrongdoer, the nature of the violation, and procedural posture.

SEC Whistleblower Program

The SEC program was established by Section 922 of the Dodd-Frank Act, codified at Section 21F of the Securities Exchange Act (15 U.S.C. § 78u-6). Implementing rules appear at 17 C.F.R. § 240.21F-1 through 21F-18.

The program covers violations of the federal securities laws, including the Securities Act of 1933, the Securities Exchange Act of 1934, the Investment Advisers Act of 1940, the Investment Company Act of 1940, and the Sarbanes-Oxley Act. A whistleblower may be eligible for an award if voluntarily providing original information to the Commission that leads to a successful enforcement action resulting in monetary sanctions exceeding $1 million.

Awards range from 10 to 30 percent of monetary sanctions collected, with the specific percentage determined in the Commission’s discretion based on factors including the significance of information, the assistance provided, the agency’s programmatic interest, and any participation by the whistleblower in the wrongdoing. Submissions are made via Form TCR (Tip, Complaint, or Referral) through the SEC website. Anonymous submission is permitted when the whistleblower is represented by counsel.

Section 21F(h) prohibits retaliation against whistleblowers and provides a private right of action for double back pay and other remedies. In Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018), the Supreme Court held that the Dodd-Frank anti-retaliation provision protects only those who report to the SEC, not those who report solely internally. The gap left by Digital Realty is partially filled by Section 806 of the Sarbanes-Oxley Act (18 U.S.C. § 1514A), which protects employees of publicly traded companies (and their subsidiaries and certain contractors) who report securities law violations either to the SEC or internally through company channels. Coverage, filing deadlines, and remedies differ between the two statutes, and many whistleblowers preserve both pathways by reporting to the Commission while also raising the matter internally.

CFTC Whistleblower Program

The CFTC program was established by Section 748 of the Dodd-Frank Act, codified at Section 23 of the Commodity Exchange Act (7 U.S.C. § 26). Implementing rules appear at 17 C.F.R. Part 165.

The program covers violations of the Commodity Exchange Act, including manipulation, spoofing, wash trading, false reporting, and registration violations affecting futures, options on futures, swaps, and certain retail foreign exchange activities. Eligibility, award structure, and confidentiality provisions parallel the SEC program: original information leading to enforcement with sanctions exceeding $1 million, awards of 10 to 30 percent of sanctions collected, anonymous submission permitted through counsel.

Submissions are made via Form TCR through the CFTC’s whistleblower portal. Section 23(h) anti-retaliation provisions parallel those of the SEC program. The CFTC program has been particularly significant in spoofing and market manipulation enforcement; its largest single award to date is approximately $200 million, paid in October 2021. (Across all federal financial markets whistleblower programs, the largest single award is the SEC’s approximately $279 million award paid in May 2023.)

FinCEN/OFAC AML Whistleblower Program

The Financial Crimes Enforcement Network whistleblower program was established by Section 6314 of the Anti-Money Laundering Act of 2020, codified at 31 U.S.C. § 5323. The program was significantly expanded by the Anti-Money Laundering Whistleblower Improvement Act of 2022, enacted as part of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328).

The program covers violations of the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and U.S. economic sanctions laws (principally the International Emergency Economic Powers Act, the Trading with the Enemy Act, and the Foreign Narcotics Kingpin Designation Act) administered by the Office of Foreign Assets Control. The 2022 amendments broadened coverage to include OFAC sanctions violations alongside BSA violations, established a minimum award (10 percent of sanctions collected), and created a dedicated funding source.

Eligibility requires original information leading to a successful judicial or administrative action with monetary sanctions exceeding $1 million. Awards may be up to 30 percent of monetary sanctions collected. Anti-retaliation provisions at 31 U.S.C. § 5323(g) provide protections similar to those of the SEC and CFTC programs, with adaptations specific to financial institutions covered by the BSA.

FinCEN published a Notice of Proposed Rulemaking implementing the program on April 1, 2026. Final rules remain pending, and FinCEN has indicated that awards will not be processed until the implementing regulations are issued in final form.

DOJ Corporate Whistleblower Awards Pilot Program

The Department of Justice Criminal Division’s Corporate Whistleblower Awards Pilot Program was launched on August 1, 2024, and is designed to fill gaps in the existing federal whistleblower programs. Unlike the SEC, CFTC, and FinCEN programs, the DOJ pilot is not statutory; it operates under the Department’s general enforcement authorities and is detailed in published program guidance. The program was substantially expanded by Criminal Division guidance issued in May 2025, which both broadened existing categories and added six new ones.

As originally constituted, the program covered four specific categories of corporate misconduct, all identified by the Department as gaps in existing whistleblower programs: (1) violations by financial institutions and abuse of the financial system not covered by FinCEN’s program, including obstruction or defrauding of financial regulators, failure to register money transmitting businesses, and fraud against U.S. financial institutions; (2) foreign corruption schemes not covered by the SEC program, including Foreign Corrupt Practices Act and Foreign Extortion Prevention Act violations that do not involve issuers; (3) domestic corruption schemes committed by or through companies; and (4) federal health care offenses not covered by the False Claims Act (originally limited to fraud involving private insurers, a limitation removed by the May 2025 update). The May 2025 expansion added six further categories: cartels and transnational criminal organizations (including money laundering, narcotics, and Controlled Substances Act violations); federal immigration violations; material support of terrorism; sanctions offenses; trade, tariff, and customs fraud; and procurement and federal program fraud.

Eligibility requires original and truthful information leading to a successful prosecution that includes criminal or civil forfeiture exceeding $1 million. The award structure differs from other programs in that awards are calculated on net forfeited proceeds: up to 30 percent of the first $100 million in net proceeds forfeited, and up to 5 percent of the next $400 million.

Submission is made via the Whistleblower Intake Form emailed to [email protected]. Anonymous submission is permitted when the whistleblower is represented by counsel; identity must be disclosed to the Department before any award is paid, and the Department reserves the right to require disclosure at any point in the process. Awards are made in the Department’s sole discretion.

The pilot program incentivizes internal reporting while preserving award eligibility: a whistleblower who reports internally to a company must report to the Department within 120 days of the internal report to remain eligible for an award. Companies that voluntarily self-report within 120 days of receiving an internal whistleblower report may qualify for a presumption of declination under the Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy, provided self-disclosure occurs before the Department contacts the company.

Although the pilot program does not itself create new statutory anti-retaliation protections, the Department considers retaliation by employers as a factor in assessing cooperation or obstruction by the company, with potential consequences including reduced cooperation credit and enforcement action for obstruction. Existing statutory protections under Dodd-Frank, Sarbanes-Oxley, and the AML statutes remain available if separately invoked.

Anti-retaliation protections

Anti-retaliation provisions apply across the federal whistleblower programs but vary in scope and remedies. The Dodd-Frank anti-retaliation provision (15 U.S.C. § 78u-6(h)) provides a private right of action for double back pay, reinstatement, litigation costs, and attorneys’ fees, but applies only to those who report to the SEC. The Sarbanes-Oxley anti-retaliation provision (18 U.S.C. § 1514A) reaches more broadly, covering employees of publicly traded companies and protecting internal reporting; remedies are pursued first administratively through OSHA. The CFTC anti-retaliation provision (7 U.S.C. § 26(h)) parallels Dodd-Frank’s SEC provision. The FinCEN anti-retaliation provision (31 U.S.C. § 5323(g)) parallels but with refinements specific to financial institutions.

Practice considerations

Several themes recur in financial markets whistleblower practice. Choice of forum is often not exclusive: a spoofing scheme involving both securities and futures products may generate eligibility for both SEC and CFTC awards, and counsel typically file with each program for which the conduct potentially qualifies, with appropriate cross-references. Internal reporting before government reporting is incentivized by each program; the DOJ pilot program explicitly preserves award eligibility for 120 days after an internal report. Anonymous submission is permitted by all four programs when the whistleblower is represented by counsel. Documentation contemporaneous with the alleged violation strengthens the eligibility argument that the whistleblower provided original information rather than information already in the agency’s possession. Information about an existing investigation can still qualify for an award if the whistleblower’s contribution materially and significantly advanced the investigation. Award determinations follow the underlying enforcement action’s resolution, including all forfeiture and appeal processes; this typically takes a number of years.

How this Foundation connects

Whistleblower work intersects with several other Foundations on this resource. Foundation Two (Trading Conduct & Supervision) describes the substantive duties whose breach often gives rise to whistleblower complaints. Foundation Three (Disputes & Enforcement) describes the enforcement procedures that follow. Foundation Six (Futures, FX & Trading Conduct) describes the market conduct violations (manipulation, spoofing, false reporting) that are common subjects of CFTC whistleblower submissions. The Whistleblower and Dodd-Frank entries in the Glossary provide quick reference; the FAQ addresses related procedural questions on enforcement and statute of limitations.

Frequently Asked Questions

Do I need a lawyer to file a whistleblower claim?

A lawyer is not required for non-anonymous submissions, but is strongly advisable in most cases. Anonymous submission to the SEC, CFTC, FinCEN, and DOJ programs requires representation by counsel. Even where anonymous submission is not used, counsel adds substantial value by framing the information to meet program eligibility standards, by handling communications with agency staff, by managing parallel submissions where the same conduct touches multiple programs, and by enforcing anti-retaliation protections where they become necessary. Most successful financial markets whistleblower claims involve counsel from the earliest stage.

Can I file a whistleblower claim anonymously?

Yes, with caveats. The SEC, CFTC, FinCEN, and DOJ programs all permit anonymous submission when the whistleblower is represented by counsel. The SEC and CFTC do not require disclosure of the whistleblower’s identity until an award is processed. The DOJ Corporate Whistleblower Awards Pilot Program requires identity disclosure to the Department before an award is paid and reserves the right to require disclosure at any earlier point in the process.

Will my employer find out I filed a whistleblower claim?

The whistleblower’s identity is treated as confidential by the SEC, CFTC, FinCEN, and DOJ programs, and each program permits anonymous submission when the whistleblower is represented by counsel. Where anonymous submission is used, the whistleblower’s identity is not disclosed to the employer at the time of submission. In the SEC, CFTC, and FinCEN programs, identity is typically disclosed only when an award is processed. In the DOJ pilot program, identity must be disclosed to the Department before an award is paid. There are circumstances in which identity may be discoverable through compelled process in subsequent enforcement proceedings or litigation. Counsel can advise on the practical confidentiality protections in a particular matter.

How much can a whistleblower receive?

Awards under the SEC, CFTC, and FinCEN programs range from 10 to 30 percent of monetary sanctions collected in connection with the enforcement action, provided sanctions exceed $1 million. The DOJ Corporate Whistleblower Awards Pilot Program calculates awards on net forfeited proceeds: up to 30 percent of the first $100 million in net proceeds forfeited, and up to 5 percent of the next $400 million. Individual awards have ranged from several hundred thousand dollars to nine figures. The largest single award to date is the SEC’s approximately $279 million award paid in May 2023; the CFTC’s largest is approximately $200 million, paid in October 2021.

How are whistleblower attorneys paid?

Most financial markets whistleblower attorneys work on a contingency fee basis. The attorney is paid only if the whistleblower receives an award, with the fee calculated as a percentage of the award. Upfront fees, retainers, and hourly billing for the whistleblower submission itself are not typical. Some matters that combine a whistleblower submission with a related anti-retaliation claim may have a different fee structure for the retaliation work. The specific fee arrangement should be set out in a written engagement letter.

How long does it take to receive a whistleblower award?

Award timelines depend on the underlying enforcement action. The agency must complete its investigation, bring an action, obtain sanctions, and collect the monetary recovery (including resolution of any appeals) before the award process proceeds. From submission to payment commonly takes three to seven years, and longer in complex matters. Some submissions resolve in less time; some take considerably longer. The whistleblower’s counsel typically remains engaged throughout to monitor the underlying action and to support the award determination.

What information do I need to provide?

Each program requires “original information” the agency does not already possess from public sources or other channels. Original information may be based on the whistleblower’s independent knowledge, observation, or independent analysis. Documentation contemporaneous with the conduct strengthens both the credibility and the originality of the submission. The most persuasive submissions identify specific transactions, dates, individuals, and the basis of the alleged violation, supported by documents or other evidence where available. Counsel can advise on what additional information is helpful and what should not be included.

Should I report to my company before going to the government?

It depends. Each program incentivizes internal reporting in different ways. The DOJ Corporate Whistleblower Awards Pilot Program preserves award eligibility for 120 days after an internal report, giving the company an opportunity to self-disclose before the government is notified. The SEC program awards a higher percentage within the discretionary 10 to 30 percent range to whistleblowers who report through internal compliance and reporting systems before reporting to the Commission. Internal reporting also carries risk, however: of destruction or alteration of evidence, of retaliation, and of the company beating the whistleblower to a government submission. The decision is fact specific and should be made with counsel.

Which whistleblower program should I file with?

The choice depends on the subject matter, the identity of the wrongdoer, and the nature of the violation. The SEC program covers federal securities law violations. The CFTC program covers Commodity Exchange Act violations, including futures, swaps, and certain retail foreign exchange manipulation. The FinCEN program covers Bank Secrecy Act and OFAC sanctions violations. The DOJ Corporate Whistleblower Awards Pilot Program covers gaps not addressed by the others, including domestic and foreign corruption schemes not covered by the SEC program, certain federal health care offenses, and the categories added in the May 2025 expansion. Where conduct spans more than one program, concurrent submissions are common and often appropriate.

What protects me against retaliation by my employer?

Federal anti-retaliation protections vary by program and by the identity of the employer. The Dodd-Frank anti-retaliation provision (15 U.S.C. § 78u-6(h)) provides a private right of action for double back pay, reinstatement, and attorneys’ fees, but the Supreme Court held in Digital Realty Trust, Inc. v. Somers, 583 U.S. 149 (2018), that this provision protects only whistleblowers who report to the SEC. Section 806 of the Sarbanes-Oxley Act (18 U.S.C. § 1514A) covers employees of publicly traded companies who report securities law violations internally or to the SEC. The CFTC anti-retaliation provision (7 U.S.C. § 26(h)) and the FinCEN anti-retaliation provision (31 U.S.C. § 5323(g)) provide parallel protections in their respective spheres. Many whistleblowers preserve maximum coverage by reporting both to the government and internally.

What if I participated in the wrongdoing?

A whistleblower’s participation in the wrongdoing does not automatically disqualify the whistleblower from an award, but it is considered in determining the award percentage. The SEC and CFTC programs identify culpability as one of the factors that may decrease the award percentage within the 10 to 30 percent range. Whistleblowers convicted of a criminal violation in connection with the conduct are ineligible for SEC and CFTC awards. The DOJ pilot program excludes individuals who meaningfully participated in the criminal activity. Counsel can advise on how participation in the conduct affects eligibility and the likely award percentage.

Can a non-U.S. citizen or someone outside the United States file a whistleblower claim?

Yes. The federal whistleblower programs are open to whistleblowers regardless of nationality or country of residence, provided the underlying violation falls within the agency’s jurisdiction. The SEC, CFTC, FinCEN, and DOJ programs have all paid awards to non-U.S. persons. Foreign citizens play a significant role in cross-border financial markets enforcement, including in Foreign Corrupt Practices Act matters and money laundering and sanctions matters under the FinCEN program.

Are there time limits on filing a whistleblower claim?

There is no statute of limitations on filing the whistleblower submission itself, but the underlying enforcement action must be brought within the applicable statute of limitations for the violation, which varies by statute and remedy. The most valuable submissions concern ongoing or recent conduct that the agency can still investigate and prosecute. Information about long-past violations may have limited award potential if the conduct is time barred. Counsel can assess the limitations posture of a particular set of facts before submission.

What if I am a current or former registered person in the securities or futures industry?

Whistleblowers who are themselves current or former registered representatives, registered principals, investment advisers, registered commodity trading advisors, or other regulated persons can and do file submissions. Such whistleblowers should consider how the submission interacts with any continuing regulatory obligations, including reporting obligations under FINRA Rule 8210 or NFA Compliance Rule 2-9, and with any pending regulatory matters involving the whistleblower. Counsel can navigate the intersection of the whistleblower submission and the whistleblower’s own regulatory posture.

Related Foundations