US whistleblower protection laws, from the Whistleblower Protection Act to Sarbanes-Oxley and Dodd-Frank

The United States has no single whistleblower law. Instead it protects whistleblowers through a patchwork of federal and state statutes, each tied to a sector or a type of wrongdoing. Three federal laws form the backbone: the Whistleblower Protection Act of 1989 for federal employees, Section 806 of the Sarbanes-Oxley Act of 2002 for staff of public companies, and Section 922 of the Dodd-Frank Act of 2010, which created the SEC reward program. Below we explain who each one covers, how the money rewards work, and how a report is protected from retaliation.

Is there one US whistleblower law?

No. The United States never passed a single, all-purpose whistleblower act. The European Union took the opposite path, setting one rule that every member state had to copy into national law. You can see how those national versions compare in our list of whistleblowing laws by country. The US framework grew piece by piece, with each law aimed at a specific group or a specific kind of fraud.

Three federal laws carry most of the weight. They cover different workers and are run by different agencies. On top of them sit dozens of sector laws and the whistleblower statutes of all 50 states.

Who is protected as a whistleblower?

It depends on the law, not on a single shared definition. Each statute draws its own line. We cover the wider question in our piece on who counts as a whistleblower. Under the three federal pillars the groups are:

• under the Whistleblower Protection Act, most federal civil servants who report wrongdoing inside a government agency;
• under Sarbanes-Oxley, employees, officers, contractors, and agents of any company listed on a US exchange or required to file with the SEC;
• under Dodd-Frank, any individual, inside or outside the company, who gives the SEC original information about a breach of the securities laws.

The Dodd-Frank route is the widest. You do not have to be an employee of the firm you report. A supplier, an investor, or an industry insider can all qualify, as long as the tip is theirs and not already known to the regulator.

What wrongdoing can you report?

Each law has its own list, but the themes overlap. The reports that earn protection are about real harm to the public, to investors, or to the law, not private workplace gripes. In broad terms, you can report:

• under the Whistleblower Protection Act, a breach of law, gross waste of public money, gross mismanagement, an abuse of authority, or a clear danger to public health or safety;
• under Sarbanes-Oxley, mail, wire, bank, or securities fraud, a breach of an SEC rule, or any fraud against shareholders;
• under Dodd-Frank, any breach of the federal securities laws, from accounting fraud to bribery abroad and market manipulation.

An honest belief is enough. You do not have to prove the wrongdoing before you speak up. These laws protect a report you make on a reasonable belief that it is true, even if a later inquiry clears the company. That matters, because most whistleblowers see only one piece of the picture.

How does the SEC reward program work?

This is what makes US law stand out worldwide. Dodd-Frank turned reporting fraud into a paid act. The SEC must pay a whistleblower a slice of the money it collects when their tip leads to a successful case. Few other countries pay whistleblowers at all.

The reward is a band, not a fixed sum. When sanctions in a case top $1 million, the award runs from 10% to 30% of what the government collects. The exact figure is up to the SEC, which weighs how useful the tip was and how much the whistleblower helped.

The tip has to be yours, and it has to come first. The reward only covers original information: something you know from your own knowledge or analysis, that the SEC did not already have, and that you hand over voluntarily before anyone asks for it. A tip that just repeats a public report, or an answer forced out by a subpoena, does not earn an award.

"In any covered judicial or administrative action ... the Commission ... shall pay an award or awards to 1 or more whistleblowers who voluntarily provided original information to the Commission that led to the successful enforcement of the ... action, in an aggregate amount equal to not less than 10 percent ... and not more than 30 percent ... of what has been collected of the monetary sanctions."
Section 21F(b), Securities Exchange Act of 1934, as added by Section 922 of the Dodd-Frank Act

The numbers are large. Since the program began in 2011, the SEC has paid more than $1.9 billion to about 400 whistleblowers. The biggest single award, announced in 2023, was nearly $279 million. Awards come from an Investor Protection Fund, so they do not reduce what victims of the fraud get back.

You can report to the SEC without giving your name. The one condition is that a lawyer files the tip on your behalf. You only have to reveal who you are before the award is paid.

You do not have to be American. The program takes tips from anywhere in the world, and many awards have gone to whistleblowers living outside the United States. That global reach is part of why a US securities case can start with a report filed from another continent.

How are whistleblowers protected from retaliation?

Each law bans payback and gives a way to fight it. An employer cannot fire, demote, suspend, threaten, or harass someone for a protected report. The route to a remedy, and the prize at the end, differ by statute.

Sarbanes-Oxley

You start with the Department of Labor. A worker files a complaint with OSHA within 180 days of the retaliation. If the Department does not rule within that time, the case can move to a federal court, where either side can ask for a jury. A worker who wins is made whole: their job back at the same seniority, all the back pay they lost with interest, and the cost of bringing the case, including expert and lawyer fees.

Dodd-Frank

You go straight to court. A whistleblower can sue in a federal district court. The relief is stronger than under Sarbanes-Oxley: reinstatement, double the back pay owed with interest, and legal costs. A company also cannot force the dispute into private arbitration or make a worker sign those rights away.

The Whistleblower Protection Act

Federal workers have their own channel. They can take a reprisal to the Office of Special Counsel or file an Individual Right of Action with the Merit Systems Protection Board, an independent body that can order the agency to undo the harm.

How do you report wrongdoing?

There is usually more than one route open at once. The main ones are:

An internal channel is still the backbone for most companies. A strong one catches problems early, builds trust, and keeps a clear record if a case ever reaches a regulator. Wemoral, as a whistleblowing system, gives you a confidential channel that accepts anonymous reports and logs every step. If you are starting from scratch, our guide to setting up the system walks you through it, and our piece on why whistleblowing matters makes the business case.

What other US whistleblower laws are there?

The three pillars are only the start. The US framework reaches much wider, and several other laws follow the same reward-driven model:

• the False Claims Act, which lets a private citizen sue on the government's behalf when someone defrauds it, and share in what is recovered;
• reward programs run by the IRS for tax fraud and the CFTC for commodities fraud, both built on the same idea as the SEC program;
• sector laws covering areas such as the environment, transport safety, and nuclear work;
• the whistleblower statutes of each of the 50 states, which often protect private-sector workers the federal laws leave out.

The result is a dense web of overlapping rights. Which law applies depends on who you work for, what you report, and where. That complexity is exactly why a single, clear internal channel pays off, since it gives every worker one obvious place to start.

What does this mean for companies?

US rules reward the people who speak up, so silence is the costly option. A worker who is ignored inside the firm can take the same tip to the SEC and walk away with a share of a multi-million-dollar penalty. A good internal channel is the cheapest way to hear about a problem first.

The US approach is unusual, but the lesson is the same everywhere. To see how other countries handle the same question, browse our list of whistleblowing laws by country. The firms that treat reports as useful, not as threats, are the ones that rarely end up in front of a regulator.