US whistleblower laws: SOX, Dodd-Frank, the False Claims Act and OSHA

No single one. Section 806 of Sarbanes-Oxley protects employees, contractors and agents of public companies and their consolidated subsidiaries who report fraud against shareholders. Dodd-Frank protects and pays people who report securities violations to the SEC. The False Claims Act lets a person sue on the government's behalf over fraud against the United States. OSHA enforces the anti-retaliation provisions of 25 federal statutes, from workplace safety to anti-money laundering. The Whistleblower Protection Act covers federal employees, and every state adds its own law. Which applies depends on who the employer is, what was reported and where the report went.

The federal employee statute, at 5 U.S.C. 2302(b)(8). It makes it a prohibited personnel practice to take or threaten action against a federal employee because of a protected disclosure. Complaints go to the Office of Special Counsel and appeals to the Merit Systems Protection Board. The Special Counsel was removed on 7 February 2025 and a successor, Charles Baldis, sworn in on 7 August 2026, and the Board was without a quorum from April to October 2025. The Act does not apply to private employers, whose employees rely on the laws above.

Two things. Section 301 requires each audit committee of a listed issuer to establish procedures for the receipt, retention and treatment of complaints about accounting, internal accounting controls or auditing matters, and for the confidential, anonymous submission by employees of concerns about questionable accounting or auditing matters. Section 806 then protects anyone who provides information or assists an investigation into mail, wire, bank or securities fraud, an SEC rule or fraud against shareholders, whether they go to a federal agency, Congress or a supervisor. A complaint goes to OSHA within 180 days, and if there is no final decision in 180 days the employee can sue in federal court for reinstatement, back pay with interest and costs.

Confide whistleblowing software →

Yes. Under section 922 of Dodd-Frank the SEC pays 10 to 30 percent of sanctions collected in an action with monetary sanctions above USD 1 million. In its 2025 financial year it paid more than USD 60 million to 48 people from about 27,000 tips, and since its first award in 2012 more than USD 2.2 billion. The largest single award was nearly USD 279 million in May 2023. The CFTC runs the same program for commodities and the DOJ's pilot program pays up to 30 percent of the first USD 100 million forfeited in corporate cases in the areas it covers, where net forfeiture exceeds USD 1 million. Two things matter for the employer: under Digital Realty v. Somers, in February 2018, Dodd-Frank's retaliation protection only covers people who reported to the SEC, and under Rule 21F-6 reporting internally first increases the award.

It depends on the statute, and the windows are short. Under section 11(c) of the OSH Act a complaint must be filed within 30 days. Under Sarbanes-Oxley it is 180 days from the violation or from the day the employee became aware of it, to OSHA. Under Dodd-Frank a whistleblower who reported to the SEC has six years from the violation or three from discovery, never more than ten. New York Labor Law 740 gives two years and New Jersey's Conscientious Employee Protection Act one. OSHA docketed 2,701 complaints under section 11(c) and 314 under Sarbanes-Oxley in the 2026 fiscal year.

Guide to whistleblower retaliation →

Yes, and they vary, so this page covers three and your own states need their own reading. California Labor Code 1102.5 forbids any policy preventing an employee from disclosing to a government agency, a supervisor or an investigator, protects an employee the employer merely believes may disclose, carries a civil penalty of up to USD 10,000 per employee per violation, and since 1 January 2025 is satisfied by the Labor Commissioner's model notice. New York Labor Law 740, as amended from 26 January 2022, covers former employees and contractors, allows a jury trial, front pay and punitive damages, and asks for good-faith notice to the employer before going to a public body. New Jersey's CEPA protects an employee who objects to or refuses to join a practice they reasonably believe unlawful, with fines up to USD 20,000 and notices displayed and distributed annually in English and Spanish.