Latest Thinking

Whistleblower Protections Under the Dodd-Frank Act

Following Congress' enactment last summer of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. 111-203, 124 Stat. 1376, employers have sought guidance on how Dodd-Frank's whistleblower protections will affect the workplace. The Dodd-Frank Act—which touches virtually every area of the U.S. financial system—contains many new rules and standards designed to encourage whistleblowers to report alleged misconduct, while protecting employee whistleblowers from retaliation by their employer. Some of these provisions create new incentives and protections for employees, and some merely clarify or expand upon the requirements of existing laws.

Foremost among Dodd-Frank's whistleblower provisions is a new "bounty" system, which enables whistleblowers to seek monetary rewards by reporting violations of federal securities and commodity laws to the Securities and Exchange Commission (SEC) or the Commodity Futures Trading Commission (CFTC). While this reward program has attracted the most media attention, Dodd-Frank also contains strong anti-retaliation provisions that may make employers more vulnerable to retaliation claims, and increase the cost of litigating those claims when they arise. These provisions broaden the whistleblower protections of the Sarbanes-Oxley Act (SOX), create whistleblower protection for employees of financial services companies, and broaden and clarify the whistleblower provisions of the False Claims Act (FCA).

This article provides a summary of Dodd-Frank's whistleblower provisions and highlights some of those provisions that have caused employers concern. We also offer some guidance as to how employers may assess the risk of liability arising under the new law. The SEC and CFTC are scheduled to publish final regulations in April 2011, which will provide additional guidance to employers. We offer some commentary on elements of the proposed regulations that seek to address certain employer concerns.

Securities, Commodity Laws

Dodd-Frank amends the Securities and Exchange Act of 1934 (SEA) and the Commodities Exchange Act (CEA) by rewarding, under certain circumstances, individuals who provide information to the SEC or CFTC regarding securities law and commodity law violations. See Dodd-Frank Act §§748, 922. To be eligible for the reward, the whistleblower must provide "original information" that leads to a successful enforcement action resulting in sanctions. "Original information" is information based on the whistleblower's "independent knowledge or analysis," and not already known to the SEC or the CFTC. A whistleblower may recover a reward equal to 10 to 30 percent of the amount of any sanction, based on his or her tip, that exceeds $1 million.

Employers may not retaliate against employees who (i) provide information to the SEC or the CFTC pursuant to these new programs; (ii) initiate, testify, or assist in an investigation or judicial or administrative action based on or related to such information; or (iii) make disclosures that are required or protected under SOX.

Unlike the anti-retaliation provisions of SOX, a Dodd-Frank whistleblower may sue for retaliation directly in federal court, without first exhausting administrative remedies. Remedies for whistleblower retaliation include reinstatement, double back pay under the SEC program (single back pay under the CFTC program), and the payment of litigation costs, expert witness fees, and attorney's fees.

Under the SEC program, the statute of limitations is six years from the date of the retaliation or three years from the date the employee discovered (or should have discovered) the facts supporting the claim, but under no circumstances may an employee commence a retaliation action more than 10 years after the retaliation occurred. The statute of limitations under the CFTC program is two years from the date of the retaliation.


SOX provides a civil cause of action for any employee of a publicly traded company that discriminates against the employee for reporting information or making a complaint about employer conduct that the employee reasonably believes (i) constitutes the federal crime of mail fraud, wire fraud, bank fraud, or securities fraud; (ii) violates any rule or regulation of the SEC; or (iii) violates any provision of federal law relating to fraud against shareholders.1

Dodd-Frank amends SOX's whistleblower provisions in several ways. First, it doubles the limitations period for such actions from 90 to 180 days, and starts the limitations period on "the date on which the employee became aware of the violation" rather than "the date on which the violation occurs." Second, Dodd-Frank broadens the classes of employees whom SOX protects. Because SOX applies only to public companies, some federal courts have held that SOX's whistleblower provisions do not protect employees of the private subsidiaries and affiliates of public companies. See, e.g., Rao v. Daimler Chrysler Corp., No. 06-13723, 2007 WL 1424220 (E.D. Mich. May 14, 2007). Dodd-Frank amends SOX to expressly cover those employees. Dodd-Frank also extends SOX's whistleblower provisions to employees of "nationally recognized statistical rating organizations" (for example, Moody's Investor Service and Standard & Poor's).

Third, Dodd-Frank gives SOX whistleblowers an express right to a jury trial in retaliation cases, which is at odds with court decisions interpreting SOX more narrowly.2 Fourth, Dodd-Frank bans the use of pre-dispute arbitration agreements that cover SOX retaliation claims, which also is inconsistent with judicial interpretations of SOX. See, e.g., Guyden v. Aetna Inc., 544 F.3d 376 (2d Cir. 2008) (holding that SOX whistleblower claims are arbitrable.) Finally, Dodd-Frank provides that employees may not waive their SOX whistleblower rights and protections.

Financial Services Employees

Dodd-Frank prohibits retaliation against "any individual performing tasks related to the offering or provision of a consumer financial product or service" who has engaged in protected activity. Dodd-Frank Act §1057. Protected activity includes (i) providing information about potential violations of financial consumer protection laws to the employer, the newly created Bureau of Consumer Financial Protection, or any other state, local, or federal, government authority or law enforcement agency; (ii) testifying in connection with financial consumer protection enforcement proceedings; (iii) commencing a proceeding under federal consumer financial law; or (iv) objecting to or refusing to participate in any activity that the employee reasonably believed to be in violation of any financial consumer protection law.

Dodd-Frank requires financial services employees to administratively exhaust whistleblower retaliation claims by filing a complaint with the U.S. Department of Labor within 180 days after the date of the alleged retaliation. This complaint will trigger a multiple stage process, which may involve an investigatory phase, a written determination by the Labor Department of whether reasonable cause exists to believe that the complaint has merit, a preliminary order of relief, and a hearing on the record. The employee's burden during this process is to establish that the protected activity was a "contributing factor" in the alleged "unfavorable personnel action."

The employer may rebut the employee's case with "clear and convincing" evidence that it would have taken the same action in the absence of the protected activity. Remedies for retaliation can include reinstatement, back pay, compensatory damages, and award costs and expenses. If the Labor Department fails to issue a final order within 210 days after the filing of the complaint, or within 90 days after receipt of the reasonable cause determination, the employee may bring an action in the U.S. District Court, in which either party may request a jury trial.

If the Labor Department issues a final order within the prescribed time limits, "any person adversely affected or aggrieved" by the final order may file a petition for review with the U.S. Court of Appeals in that circuit. Financial services employees may not waive these rights. Further, pre-dispute arbitration agreements covering these claims are invalid, except if contained in a collective bargaining agreement. This union exception applies only to financial services employees, but Dodd-Frank expressly permits the Bureau of Consumer Financial Protection to eliminate the exception by rule if the bureau determines that arbitration agreements in collective bargaining agreements are inconsistent with the purposes of Dodd-Frank.

False Claims Act

The FCA is a whistleblower law that allows a private individual with knowledge of past or present fraud committed on the federal government to sue on the government's behalf and recover a portion of any damages award. See 31 U.S.C. §3729-3733. Dodd-Frank broadens the FCA to cover conduct by persons "associated" with a whistleblower in furtherance of an FCA whistleblower action. Dodd-Frank Act §1079B(c). Dodd-Frank also specifies that the statute of limitations for an FCA retaliation claim is three years. Courts previously applied the most analogous state law limitations period.3

Practical Considerations

Dodd-Frank may increase employee disclosure and reporting activity to the SEC and the CFTC. According to a recent report, the SEC forecasts that it will receive 30,000 tips a year under the new program, which the SEC will enforce through a separate office dedicated to that purpose.4 The SEC has delayed the creation and staffing of the "Whistleblower Office" indefinitely due to "budget uncertainty"—which may just mean a lack of funding—but this delay may not alleviate employers' concerns about the program's impact once the office is staffed.5 Employers are concerned that the reward system will encourage employees to bypass internal reporting mechanisms with the hope of obtaining a windfall recovery from the government, generate frivolous complaints, and undermine employers' ability to investigate and resolve complaints from within.

The SEC sought to address these concerns in its proposed regulations but deliberately stopped short of requiring mandatory internal disclosure before reporting to the SEC. See 75 Fed. Reg. 70,488, 70,488, 70,496 (proposed Nov. 3, 2010) (to be codified at 17 C.F.R. pts. 240 & 241). The SEC declined to require internal reporting because it believes many companies lack established investigation procedures. Rather than require it, the SEC sought "not to discourage" internal reporting by providing employees a 90-day period within which the employee can report "original information" internally (and thus give the company an opportunity to investigate) without losing his or her "place in line" for a potential reward from the SEC.

The SEC also will consider whether internal reporting occurred when determining the amount of a whistleblower reward (rewarding higher percentage amounts to employees who internally report before contacting the SEC). The CFTC issued its own proposed regulations implementing Dodd-Frank, which are substantially similar to the SEC's proposed regulations. See 75 Fed. Reg. 75,728 (proposed Nov. 10, 2010) (to be codified at 17 C.F.R. pt. 165). However, while the CFTC also provides a 90-day window to allow internal reporting, the CFTC apparently will not consider internal reporting as a basis for a larger reward.

Final regulations from the SEC and the CFTC are due by April 17, 2011. Dodd-Frank Act §§924(a), 748. Depending on how receptive the SEC is to employers' concerns expressed in the hundreds of comments it has received, the final regulations may differ materially from the proposed regulations. Given this uncertainty, employers may be well advised simply to "wait and see" what changes the SEC may make, and what incentives the final regulations create, before undertaking review of internal compliance and reporting procedures.

If the regulations remain substantially the same as those proposed by the SEC, employers then may attempt to reduce the risk that employees will bypass internal reporting mechanisms. Steps that may help employers do so include reviewing and evaluating all compliance programs and internal investigation processes to ensure that they are effective, not overly complicated, and clearly communicated to employees. Employers will want to create confidence in their commitment and ability to identify and eliminate misconduct. At the same time, employees need to be clearly educated as to why internal reporting is important and helpful to the success of the company.

Greater Exposure to Claims

Dodd-Frank also may increase the likelihood that an employer will be sued for retaliation and may increase the cost of defending those claims, both in terms of higher litigation expenses and greater damages exposure. First, Dodd-Frank redefines the limitations period for SOX whistleblower claims which gives employees a much longer period of time within which to sue. Second, more employees now have the ability to sue—Dodd-Frank extends SOX whistleblower protection to employees of private subsidiaries and affiliates of public companies and employees of "nationally recognized statistical rating organizations," and creates new whistleblower protection for financial services employees.

Third, responding to whistleblower complaints will cost more because these claims must be litigated in court, as opposed to in arbitral fora (which typically is less expensive). Employers must also face the risk of potentially higher damage awards at a jury trial versus a bench trial, and must deal with the loss of additional privacy provided in arbitration. To lessen the risk of claims of retaliation, employers may wish to incorporate strong rules of confidentiality or anonymity (to the extent practicable), into their compliance programs. Employers may also consider ensuring that the person or persons responsible for investigating employee whistleblower reports will not be responsible for making employment decisions with regard to such employees.

Jeffrey S. Klein and Nicholas J. Pappas are partners at Weil, Gotshal & Manges. Daniel J. Venditti, an associate at the firm, assisted with the preparation of this article.


  1. See 18 U.S.C. 1514A. For further background on Sarbanes-Oxley, see Klein and Pappas, "The Whistleblower Provisions of the Sarbanes-Oxley Act," NYLJ, Dec. 2, 2002, at 3; Klein and Pappas, "Defining 'Whistleblower' Under the Sarbanes-Oxley Act," NYLJ, Aug. 7, 2006, at 3; Klein and Pappas, "Limitations on Conduct Protected Under ," NYLJ, Feb. 1, 2010, at 3.
  2. See, e.g., Schmidt v. Levi Strauss & Co., 2008 WL 859705 (N.D. Cal. March 28, 2008); Walton v. Nova Info. Sys., 514 F.Supp.2d 1031 (E.D. Tenn. 2007).
  3. See Graham County Soil & Water Conservation Dist. v. United States ex rel. Wilson, 545 U.S. 409 (2005); see also Riddle v. Dyncorp Int'l Inc., No. 3:10-CV-0546-L, 2010 WL 3304245 (N.D. Tex. Jan. 14, 2011) (holding that Dodd-Frank's revisions to the FCA do not apply retroactively to employees' retaliation claim, and applying 90-day limitations period set forth in the Texas Whistleblower Act).
  4. Jean Eaglesham and Ashby Jones, Dec. 10, 2010, "Whistleblower Bounties Pose Challenges," WALL ST. J., Dec. 10, 2010, at C1.
  5. See Dodd-Frank Act §924(d); Implementing the Dodd-Frank Wall Street Reform and Consumer Protection Act—Dates to Be Determined, (last modified Dec. 2, 2010).

Copyright 2011. ALM Media Properties, LLC. All rights reserved. New York Law Journal Online

Reprinted with permission from the February 7, 2011 edition of the New York Law Journal © 2011 ALM Media Properties, LLC. All rights reserved. Further duplication without permission is prohibited. For information, contact 877-257-3382, or visit