Recent Developments in Federal Whistleblower Programs and Rules
The U.S. Department of Justice (“DOJ”) and the Securities and Exchange Commission (“SEC”) have announced several changes to their whistleblower programs and rules, reflecting the federal government’s continued focus on encouraging individuals to report corporate misconduct. Specifically, on May 12, 2025, DOJ expanded its whistleblower program to prioritize additional “high impact” subject areas. On September 9, 2024, during the Biden administration, the SEC announced settled charges against seven public companies for Rule 21F-17(a) violations in connection with employment-related agreements that impeded whistleblowers from reporting potential misconduct to the SEC.
As federal agencies strengthen protections for whistleblowers, employers likewise face evolving challenges. These developments not only increase the likelihood of internal concerns being brought to the attention of federal authorities but also raise the stakes for organizations that fail to comply with whistleblower protections.
In this article, we examine changes in whistleblower programs and enforcement trends, including key updates to federal policies and notable enforcement actions. We also discuss the practical implications for employers navigating this complex web of legal requirements and heightened scrutiny. Finally, we offer actionable strategies to help organizations foster a culture of compliance, respond effectively to whistleblower reports, and reduce the risk of costly investigations or penalties. By understanding these new risks and proactively addressing them, employers can better protect their interests while supporting a transparent and ethical workplace.
DOJ’s Whistleblower Program Expands
During the early months of the second Trump administration, the DOJ Criminal Division announced changes to the Division’s corporate and white-collar enforcement policies and priorities aimed at bringing the Division’s priorities in line with those of the new Trump administration. The head of the Criminal Division, Matthew R. Galeotti, announced those changes in a speech on May 12, 2025. Remarks at SIFMA’s Anti-Money Laundering and Financial Crimes Conference, Matthew R. Galeotti, 12 May 2025, available here. On the same day, Galeotti issued a memorandum that laid out changes to the Criminal Division. DOJ Criminal Division Memorandum: Focus, Fairness, and Efficiency in the Fight Against White-Collar Crime, Matthew R. Galeotti, 12 May 2025, available here.
In the memorandum, Galeotti announced that the Criminal Division will prioritize investigating and prosecuting corporate crime in ten “high-impact” areas. To further underscore the Division’s focus on these priority areas, Galeotti simultaneously announced an expansion of the Criminal Division’s Corporate Whistleblower Awards Pilot Program (“CWAPP”) to encompass these areas.
As background, the Biden administration established the CWAPP in August 2024 to encourage individuals with knowledge of specific categories of white-collar crime to come forward in exchange for potential financial compensation provided the information enables the DOJ to recover more than $1 million dollars in civil or criminal forfeiture. DOJ Press Release: Corporate Whistleblower Awards Pilot Program, available here. The potential financial compensation for DOJ whistleblowers is substantial: whistleblowers may receive up to 30 percent of the first $100 million in net proceeds forfeited, and up to 5 percent of any net proceeds forfeited between $100 million and $500 million. CWAPP does include a safe harbor provision whereby companies that voluntarily self-report within 120 days of receiving an internal whistleblower report may be eligible for a presumption of a declination under the Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy. DOJ Press Release: Temporary Amendment to the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy, available here.
In the memorandum, Galeotti announced that the CWAPP would be expanded to encompass violations committed by or through companies that reflect the Trump administration’s broader enforcement priorities, including:
- “Violations by corporations related to international cartels or transnational criminal organizations, including money laundering, narcotics, Controlled Substances Act, and other violations;”
- “Violations by corporations of federal immigration law;”
- “Violations by corporations involving material support of terrorism;”
- “Corporate sanctions offenses;”
- “Trade, tariff, and customs fraud by corporations;” and
- “Corporate procurement fraud.”
Employers should take particular note of the inclusion of immigration law violations as among the administration’s enforcement priorities now eligible for CWAPP awards. This change marks a significant departure from the prior administration’s priorities. Potential corporate violations of immigration law may include knowingly employing unauthorized workers, misuse of or circumvention of visa programs, failure to properly maintain I-9 Forms for all employees, or immigration fraud.
Traditionally, the Department of Homeland Security enforced corporate violations of immigration law through the Immigration and Customs Enforcement agency and its worksite enforcement program. Expanding the DOJ Criminal Division’s CWAPP to cover violations of federal immigration law—effectively placing immigration law violations in the same category as traditional white-collar crimes like money laundering and material support of terrorism—may reflect a shift towards increased criminal enforcement of these violations through the DOJ. At a minimum, whistleblowers will now have financial incentive through the CWAPP to bring information related to possible federal immigration law violations to the DOJ.
To mitigate the risk of whistleblower activity and enforcement related to violations of federal immigration law, employers should thoroughly assess any vulnerabilities in their immigration policies, practices, and procedures. This should include a close examination of hiring and sponsorship practices, I-9 Form procedures, and third-party staffing contracts. Employers should also establish robust and confidential reporting channels through which employers encourage employees to report any concerns regarding immigration compliance.
SEC Rule 21F-17(a)
In 2010, as part of the Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), Congress established the SEC’s whistleblower program to incentivize whistleblowers to report information about possible federal securities laws violations. Pub. L. No. 111-203, 124 Stat. 1376 (2010). Dodd-Frank authorizes the SEC to provide monetary awards to eligible individuals who come forward with information that leads to enforcement actions in which over $1 million in sanctions is ordered. Awards range between ten to thirty percent of the money collected. In 2024, the SEC granted over $255 million in whistleblower awards, underscoring the program’s robustness. SEC Office of the Whistleblower Annual Report to Congress for Fiscal Year 2024, available here.
Dodd-Frank and the Sarbanes-Oxley Act, Pub. L. No. 107-204, 116 Stat. 745 (2002), afford whistleblowers certain legal protections. After Dodd-Frank, the SEC implemented rules enabling the SEC to take legal action against employers who have retaliated against whistleblowers. The SEC also promulgated a rule that prohibits any person from taking any action to “impede an individual from communicating directly with the Commission staff about a possible securities law violation.” SEC enforcement actions based on Rule 21F-17(a) “impeding” violations have recently played a more prominent role in the SEC’s enforcement strategy.
During the Biden administration, there was an uptick in enforcement actions against companies for Rule 21F-17(a) violations based on employee agreements. For example, on September 9, 2024, the SEC announced settled charges against seven public companies for violations of Rule 21F-17(a) in connection with employment, separation, and other agreements that impeded whistleblowers from reporting potential misconduct to the SEC. SEC Press Release: SEC Charges Seven Public Companies with Violations of Whistleblower Protection Rule, 9 Sept. 2024, available here. More recently, on January 16, 2025, the SEC announced settled charges against an investment advisory firm for, in part, violating Rule 21F-17(a) by requiring departing employees in separation agreements to state that they had not filed a complaint with any governmental agency. Two Sigma Investments, LP, and Two Sigma Advisers, LP, Securities Exchange Act Release No. 102207 (Jan. 16, 2025), available here. The SEC found that this requirement could, in effect, identify whistleblowers and prohibit them from receiving post-separation payments and benefits, thereby constituting illegal impeding activity.
Employers should remain aware and monitor the extent to which the SEC continues to focus on Rule 21F-17(a) enforcement actions during the current Trump administration. During the first Trump administration, the SEC did not prioritize Rule 21F-17(a) enforcement actions based on language in employer agreements that might potentially impede reporting. The SEC instead focused its enforcement efforts on cases where individuals were actively impeded from reporting information to the SEC by company actions. For example, on November 4, 2019, the SEC filed suit against a company alleging, among other things, that the company “took actions to impede individuals from communicating directly with SEC staff about possible securities violations, including by enforcing and threatening to enforce confidentiality agreements with respect to such communications.” Amended Complaint at ¶ 11, United States Securities and Exchange Commission v. Collector’s Coffee, Inc. (d/b/a Collectors Café), and Mykalai Kntilai, 697 F. Supp. 3d 138 (S.D.N.Y. 2023) No. 1:19-cv-04355, available here.
While the SEC has not yet announced settled charges based on Rule 21F-17(a) under the current Trump administration, in April the SEC issued a press release publicizing a $6 million whistleblower award, signaling a continued commitment to the program. SEC Press Release: SEC Awards $6 Million to Joint Whistleblowers, 21 April 2025, available here. Further, in the past month the SEC announced five additional whistleblower awards. Whistleblower Award Proceeding File No. 2025-45, 28 Aug. 2025, available here; Whistleblower Award Proceeding File No. 2025-47, 2 Sept. 2025, available here; Whistleblower Award Proceeding File No. 2025-48, 2 Sept. 2025, available here; Whistleblower Award Proceeding File No. 2025-49, 3 Sept. 2025, available here; Whistleblower Award Proceeding File No. 2025-51, 4 Sept. 2025, available here.
To mitigate the risk of Rule 21F-17(a) enforcement actions, employers should review all employee-related procedures, policies, and agreements to eliminate any language that reasonably could be interpreted to impede reporting to the SEC. This includes compliance manuals, ethics codes, training manuals, non-disclosure agreements, confidentiality agreements, contractor and consulting agreements, and separation agreements. For example, the SEC charged a Rule 21F-17(a) violation where a company’s compliance manual prohibited employees from initiating contact with any regulator without prior approval from the company’s legal or compliance department. Guggenheim Securities, LLC, Securities Exchange Act Release No. 92237 (June 23, 2021), available here. In another enforcement action, the SEC charged a Rule 21F-17(a) violation where a company entered into severance agreements that required departing employees to forgo any monetary recovery in connection with filing a charge or complaint with any applicable governmental administrative agency. Gaia, Inc. and Paul C. Tarell, Jr., CPA, Securities Exchange Act Release No. 97548 (May 23, 2023), available here.
Additionally, if an employee, or other individual, raises concerns about securities law violations, employers should avoid taking actions against the employee, or individual, that could be seen as impeding their ability to report to the SEC, including limiting their access to company systems. David Hansen, Securities Exchange Act Release No. 94703 (April 12, 2022), available here (charging a Rule 21F-17(a) violation where a company co-founder removed an employee’s access to company computer systems after the employee raised concerns that the company was overstating its number of paying customers).
________________________
Reprinted with permission from the October 1st, 2025 edition of the New York Law Journal © 2025 ALM Global Properties, LLC. All rights reserved. Further duplication without permission is prohibited, contact 877-256-2472 or asset-and-logo-licensing@alm.com
