I. Introduction
The SEC Whistleblower Program has become one of the agency's most effective enforcement tools. Since Congress created it in the wake of the 2008 financial crisis, the program has generated tips that led to significant civil penalties, deterred misconduct, and resulted in awards of more than $2.2 billion to the individuals responsible for surfacing that misconduct through fiscal year 2024. This article traces the program's statutory origins, explains its operating mechanics, summarizes the legal protections available to whistleblowers, reviews recent statistics from the SEC's Annual Reports to Congress, and outlines how an attorney assists a client considering or pursuing a whistleblower claim.
II. Statutory Origins
Congress created the program through Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 922(a), 124 Stat. 1841 (2010). Section 922 amended the Securities Exchange Act of 1934 by adding Section 21F, "Securities Whistleblower Incentives and Protection," codified at 15 U.S.C. § 78u-6. The SEC implemented Section 21F through a body of regulations at 17 C.F.R. Part 240, Rule 21F, adopted in 2011. The Commission's Office of the Whistleblower administers the program day to day. Congress has amended Section 21F since 2010, most recently on July 4, 2025 (Pub. L. No. 119-21, Title III, § 30003(b), 139 Stat. 126), which rewrote the subsection governing use of the Investor Protection Fund.
Congress modeled the program in part on the False Claims Act's qui tam mechanism, but built it around a narrower objective. It encourages individuals with knowledge of securities law violations to come forward by pairing a financial incentive with statutory confidentiality and anti-retaliation protections.
III. How the Program Works
A. Submitting a Tip
A whistleblower begins the process by submitting a Tip, Complaint, or Referral (TCR) to the SEC, either through the agency's online TCR portal or on Form TCR by mail or fax, and must declare under penalty of perjury that the information is true and correct to the best of the whistleblower's knowledge and belief. 17 C.F.R. § 240.21F-9(a)-(b). Individuals may submit anonymously, but only if represented by counsel. Under Rule 21F-9(c), the attorney submits the TCR on the client's behalf and certifies that the attorney has verified the client's identity and reviewed the client's signed Form TCR. The whistleblower must disclose his or her identity to the SEC before any award is paid. 15 U.S.C. § 78u-6(d)(2)(B).
B. Eligibility for an Award
Under Section 21F(b), an award requires that the whistleblower voluntarily provide the SEC with original information that leads to a successful enforcement action, meaning a covered action resulting in monetary sanctions exceeding $1 million. Each element carries its own rules.
Voluntary submission. Under Rule 21F-4(a), a submission is voluntary if it is made before the SEC, the PCAOB or a self-regulatory organization (in connection with an investigation, inspection, or examination), or Congress, another federal authority, or a state attorney general or securities regulator (in connection with an investigation) directs a request, inquiry, or demand about the same subject matter to the whistleblower or the whistleblower's representative. A submission made after such a request is not voluntary, unless the whistleblower gave the same information to another listed authority first, and the rule also treats a submission as involuntary when the whistleblower had a pre-existing legal or contractual duty to report it to the Commission or a listed authority. In Doe v. SEC, 176 F.4th 32 (D.C. Cir. 2026), the D.C. Circuit upheld that reading against a whistleblower who first gave his information to the news media and gave it to the SEC only after the Commission had contacted him, reasoning that the media lacks the formal relationship with the Commission that the listed authorities have, and it held a separate plain-meaning challenge forfeited. 176 F.4th at 38-40. The court nonetheless vacated the SEC's denial of the whistleblower's request for an exemption and remanded for a fuller explanation, because the Commission had answered a credible showing with a general statement of policy. Id. at 42-43.
Information that leads to a successful action. A whistleblower must also show that the information he or she gave the SEC led to the enforcement action. In Doe v. SEC, No. 25-1152, 2026 U.S. App. LEXIS 27691 (D.C. Cir. Sept. 1, 2026, reissued Sept. 9, 2026), a divided panel held that the statute requires both a voluntary submission of original information to the Commission and a showing that the submission itself led to the successful action. The claimant had given his information to a journalist and to the Department of Justice and waited more than a year to give it to the SEC, by which time the staff had been investigating for eight months and the submission added nothing. The court denied the petition for review even though the claimant was the original source of information that reached the Commission through others. Id. at *16-17, *19-21, *24-25. One judge dissented.
Who can qualify. Rule 21F-4(b)(4) removes several categories of information from the definitions of independent knowledge and independent analysis. The rule excludes information obtained through attorney-client privileged communications, and information obtained through the legal representation of a client when the lawyer would use it for his or her own whistleblower submission, subject to narrow exceptions where an attorney's disclosure is otherwise permitted. It also excludes information obtained by a means that a United States court has determined violates federal or state criminal law. In addition, information is excluded when the whistleblower obtained it in one of four roles:
• as an officer, director, trustee, or partner of an entity who was told of allegations of misconduct or learned the information through the entity's processes for identifying, reporting, and addressing possible violations of law;
• as an employee whose principal duties involve compliance or internal audit, or as someone employed by or associated with a firm retained to perform compliance or internal audit functions;
• as someone employed by or associated with a firm retained to conduct an inquiry or investigation into possible violations of law; and
• as an employee of, or person associated with, a public accounting firm who obtained information about a violation by the engagement client or its directors, officers, or other employees through an engagement required of an independent public accountant under the federal securities laws (other than an audit subject to Rule 21F-8(c)(4)).
Three exceptions can restore eligibility for information obtained in those four roles:
• a reasonable basis to believe that disclosure to the Commission is necessary to prevent conduct likely to cause substantial injury to the financial interest or property of the entity or investors;
• a reasonable basis to believe that the entity is engaging in conduct that will impede an investigation of the misconduct; and
• the passage of at least 120 days since the person gave the information to the entity's audit committee, chief legal officer, chief compliance officer (or their equivalents), or supervisor, or since the person received it under circumstances indicating that one of them already knew of it.
The 120-day lookback. Rule 21F-4(b)(7) protects a whistleblower's priority date when the whistleblower first reports to Congress, another federal authority, a state attorney general or securities regulator, a self-regulatory organization, the PCAOB, or the entity's own internal whistleblower, legal, or compliance procedures. If the same information reaches the SEC under Rule 21F-9 within 120 days of that earlier report, the Commission treats the submission as made on the date of the earlier report, and the whistleblower must establish the date of the earlier report to the Commission's satisfaction. The D.C. Circuit has described the lookback as a rule about timing only. The whistleblower must still give the information directly to the Commission. Doe, 2026 U.S. App. LEXIS 27691, at *6. Counsel advising a client on the sequence and timing of internal reporting and SEC reporting should build the analysis around these provisions.
Related actions. Awards also extend to successful "related actions," meaning an action based on the same original information that is brought by one of four categories of authorities under Section 21F(a)(5) of the Exchange Act, 15 U.S.C. § 78u-6(a)(5), and Rule 21F-3(b)(1):
• the Attorney General of the United States, who heads the Department of Justice;
• an "appropriate regulatory authority," which Rule 21F-4(g) defines as an "appropriate regulatory agency" other than the Commission. Rule 21F-4(f) lists the Commission, the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of Thrift Supervision, along with any other agency defined as an appropriate regulatory agency under Exchange Act Section 3(a)(34), 15 U.S.C. § 78c(a)(34);
• a "self-regulatory organization," which Rule 21F-4(h) defines to include the national securities exchanges, registered securities associations, registered clearing agencies, the Municipal Securities Rulemaking Board, and any other organization defined as a self-regulatory organization under Exchange Act Section 3(a)(26), 15 U.S.C. § 78c(a)(26); and
• a State attorney general, but only when the state action is a criminal case.
A related action requires that the SEC's own covered action succeed first, 15 U.S.C. § 78u-6(a)(5); 17 C.F.R. § 240.21F-3(b)(1), and the Commission must determine that the same original information also led to the successful enforcement of the related action. 17 C.F.R. § 240.21F-3(b)(2). Courts have read these requirements strictly. In Hong v. United States SEC, 41 F.4th 83, 98-99 (2d Cir. 2022), cert. denied, the Second Circuit held that an action is "brought by the Commission" only if the SEC led it in some respect, and that a related action must rest on a covered action. A whistleblower whose tip helped other agencies obtain settlements of more than $10 billion therefore recovered nothing from the SEC's program, because the SEC itself brought no action. The Second Circuit applied the Chevron framework and deferred to the SEC's regulations on what counts as an "action" and a "related action," and the Supreme Court has since overruled Chevron. Loper Bright Enterprises v. Raimondo, 603 U.S. 369, 412 (2024). Loper Bright also stated that prior holdings that relied on Chevron remain subject to statutory stare decisis. Id. A later Fifth Circuit decision reached a consistent result from the ordinary meaning of "action brought," holding that a motion to appoint a Chapter 11 trustee is neither a covered action nor a related action. Barr v. SEC, 114 F.4th 441, 449-52 (5th Cir. 2024), cert. denied (U.S. Oct. 6, 2025).
The Commodity Futures Trading Commission is not among the listed related-action authorities, and it runs its own whistleblower program under 7 U.S.C. § 26. When a judicial or administrative action is also subject to a separate monetary award program established by the federal government, a state government, or a self-regulatory organization, Rule 21F-3(b)(3) makes the action eligible as a related action only if the SEC's maximum potential award would not exceed $5 million or the SEC finds that its own program has the more direct or relevant connection to the action. Where eligibility rests on that connection, the SEC will not make or pay a related-action award if the claimant receives any payment from the other program for that action, and it may condition an award on an irrevocable waiver of any claim to an award from the other program.
C. Award Amount
Awards range from 10% to 30% of the monetary sanctions collected in the covered action and any related actions, an amount the Commission sets at its discretion by weighing factors set out in Rule 21F-6, including the significance of the information, the whistleblower's assistance, and any culpability or unreasonable reporting delay attributable to the whistleblower. The Commission pays awards from the Investor Protection Fund, which is funded generally by monetary sanctions the SEC obtains. 15 U.S.C. § 78u-6(g)(3); Hong, 41 F.4th at 102.
The $5 million presumption. Rule 21F-6(c) adds a presumption in favor of the statutory maximum for smaller awards. It applies to a meritorious claim when 30% of the monetary sanctions collected in the covered and related actions, in the aggregate, is $5 million or less, and the Commission does not reasonably anticipate that future collections would push the maximum award above $5 million. In that case the award is the statutory maximum of 30% if three further conditions are met:
• none of the culpability factors in Rule 21F-6(b)(1) or the interference-with-internal-compliance factors in Rule 21F-6(b)(3) is present, and the claim does not trigger Rule 21F-16 (awards to whistleblowers who engage in culpable conduct);
• the claimant did not unreasonably delay reporting, although the Commission may, in its sole discretion and in limited circumstances, waive that condition if the claimant shows that a waiver is consistent with the public interest, investor protection, and the program's objectives; and
• the Commission does not determine, in its sole discretion, that the enhancement would be inappropriate because the whistleblower's assistance was limited or because it would be inconsistent with the public interest, investor protection, or the program's objectives.
Rule 21F-6(c)(1)-(2). When two or more claimants qualify in the same action and at least one satisfies these criteria, the aggregate award to all meritorious claimants is the statutory maximum, and the Commission allocates it among them after considering whether each claimant's application satisfies the first two conditions above. Rule 21F-6(c)(3). Separately, Rule 21F-6(d) allows the Commission to consider the dollar amount of a potential award only to increase it, never to lower it.
D. The Notice of Covered Action and Award Application
Once a covered action results in monetary sanctions exceeding $1 million, the Office of the Whistleblower posts a Notice of Covered Action (NoCA) on the SEC's website. Posting a NoCA opens a 90-calendar-day window, under Rule 21F-10(a) and (b), during which anyone who believes they are entitled to an award based on that action must file a Form WB-APP application. A claimant who misses the 90-day deadline is barred from an award tied to that particular action.
E. Review by the Claims Review Staff
The Director of the Division of Enforcement designates the staff members who serve as the Claims Review Staff (CRS). The CRS evaluates every timely Form WB-APP application against the criteria set out in the rules, including whether the applicant's information was original, whether it led to the covered action, the applicant's degree of assistance, and any conduct that could reduce or bar an award. Rule 21F-10(d) gives the Commission an opportunity to review the CRS determination before the Office of the Whistleblower sends the claimant a Preliminary Determination, and it sets no timetable for that review.
For most claims, the Preliminary Determination states whether the claim should be allowed or denied and, if allowed, the proposed award as a dollar amount and a percentage of the monetary sanctions collected, between 10% and 30%. For a narrower category of claims, the Office of the Whistleblower itself may instead issue a Preliminary Summary Disposition (PSD) under Rule 21F-18, a streamlined denial mechanism with shorter response deadlines. The rule permits that process for applications that are untimely, that did not follow the submission requirements of Rule 21F-9 and do not qualify for a waiver, that rest on information the staff never received or used and otherwise had no contact with the claimant about, that did not comply with Rule 21F-8(b), that failed to identify the submission on which the claim rests, or that raise no novel or important legal or policy question.
F. Contesting the Preliminary Determination
Once the Office of the Whistleblower sends a claimant a Preliminary Determination, Rule 21F-10(e) gives the claimant 30 calendar days to request the materials the CRS relied on, and separately to request a meeting with Office of the Whistleblower staff to discuss the determination, a meeting the office may decline in its sole discretion. The claimant then has 60 calendar days from the date of the Preliminary Determination, or from the date the office makes the requested materials available, to submit a written response contesting the determination along with any supporting documentation.
A PSD carries shorter deadlines. If the Office of the Whistleblower withholds the staff declaration pending a confidentiality agreement, the claimant has 15 calendar days to return it, and the claimant may respond within 30 calendar days of the later of the PSD or the date the office sends the declaration. Rule 21F-18(b)(2)-(3). A PSD that draws no timely response becomes the Final Order of the Commission. Rule 21F-18(b)(4). The same is true of a Preliminary Determination recommending denial, but one that recommended an award instead goes to the Commission as a Proposed Final Determination. Rule 21F-10(f). Under Rule 21F-10(f), failure to respond also counts as a failure to exhaust administrative remedies, which bars an appeal.
G. Commission Review and the Final Order
If a claimant contests a Preliminary Determination, the CRS considers the response and any supporting documentation and prepares a Proposed Final Determination. The Office of the Whistleblower notifies the Commission, and within 30 days any Commissioner may ask the Commission to review it. If no Commissioner asks, the Proposed Final Determination becomes the Final Order of the Commission. If a Commissioner does ask, the Commission reviews the record the staff relied on, including the claimant's earlier submissions, and issues its Final Order. Rule 21F-10(g)-(h).
H. Judicial Review
A claimant aggrieved by a Final Order may petition for review in the United States Court of Appeals for the District of Columbia Circuit, or in the circuit where the claimant resides or has a principal place of business, within 30 days of the Final Order, under Section 21F(f) of the Exchange Act and Rule 21F-13. Section 21F(f) carves out of that right of appeal the amount of an award made in accordance with the statute's 10% to 30% framework, and Rule 21F-13(a) goes further by stating that, where the Commission makes an award of 10% to 30% based on the Rule 21F-6 factors, its determination of the amount, including the allocation of an award among multiple whistleblowers, is not appealable. Judicial review therefore centers on whether, and to whom, the Commission made an award.
The D.C. Circuit has held that the 30-day filing window is not jurisdictional because the statute does not frame it in jurisdictional terms, and that non-jurisdictional deadlines are presumptively subject to equitable tolling. Nelson v. SEC, 138 F.4th 514, 521-23 (D.C. Cir. 2025). The Nelson court assumed without deciding that the claimant's circumstances warranted tolling and rejected his petition on the merits. Id. at 524. One judge concurred in the judgment but disagreed with the majority on timeliness, tolling, and forfeiture. Id. at 526-28. Claimants should not count on tolling. The Supreme Court has since emphasized that a deadline's non-jurisdictional character does not automatically make it tollable, because the presumption can be rebutted by the statute's text, structure, and context. Enbridge Energy, LP v. Nessel, 608 U.S. 67, 75, 83-84 (2026). Nelson predates Enbridge, and a judge of the Fifth Circuit has criticized Nelson's reading of the appellate rules in an immigration case. Martinez v. Blanche, 185 F.4th 553, 555 (5th Cir. 2026) (Ho, J., concurring). The safe course is to treat the 30 days as firm.
IV. Legal Rules and Protections
A. Confidentiality
Section 21F(h)(2) restricts the SEC's disclosure of information that could reveal a whistleblower's identity. That confidentiality, combined with the option to submit through counsel, allows employees to report suspected violations without their employer learning who made the report.
B. Rule 21F-17: No Impeding Communications
Rule 21F-17(a) prohibits any person from taking any action to impede an individual from communicating directly with the SEC about a possible securities law violation, including by enforcing or threatening to enforce a confidentiality agreement. The SEC has used Rule 21F-17 aggressively against employers whose severance agreements, employment contracts, or compliance policies contain language that could discourage or penalize SEC reporting, regardless of whether any employee was actually deterred. As of the FY2024 Annual Report to Congress, the Commission had brought 32 Rule 21F-17 enforcement actions since the rule's first use in 2015, including 11 in FY2024 and 5 in FY2023.
Illustrative enforcement actions include:
• In the Matter of KBR, Inc. (April 1, 2015): the first SEC enforcement action under Rule 21F-17 based on a restrictive confidentiality agreement. KBR required witnesses in internal investigation interviews to agree not to discuss the particulars of the interview without prior authorization from the law department, on pain of discipline up to and including termination. The SEC found that the language impeded reporting even though it was unaware of any instance in which an employee was prevented from communicating with the staff or KBR enforced the statement. KBR was ordered to pay a $130,000 penalty and amended its confidentiality statement.
• In the Matter of D. E. Shaw & Co., L.P. (September 29, 2023): the SEC found that the investment adviser's employment agreements barred disclosure of confidential information to third parties without a whistleblower carve-out, and that approximately 400 departing employees had to sign releases affirming they had not filed complaints with any government agency to receive deferred compensation. D. E. Shaw was ordered to pay a $10 million penalty.
• In the Matter of J.P. Morgan Securities LLC (January 16, 2024): the SEC extended Rule 21F-17 beyond the employment context, finding that the firm regularly asked advisory clients and brokerage customers to whom it had issued a credit or settlement over $1,000 to sign confidential release agreements, using release language from March 2020 through July 2023 and securing signatures from at least 362 clients. JPMS was ordered to pay an $18 million penalty, which the SEC's FY2024 Annual Report called the highest penalty to date for an action of this type.
• In the Matter of Nationwide Planning Associates, Inc., et al. (September 4, 2024): a broker-dealer and two affiliated investment advisers asked eleven brokerage customers and advisory clients, from May 2021 through February 2024, to sign confidentiality agreements in connection with compensatory payments. The agreements permitted a client to communicate with the SEC or another securities regulator only where the regulator first initiated an inquiry, and some required clients to represent that they had not reported the underlying dispute and would forever refrain from doing so. The firms were ordered to pay a combined $240,000 penalty.
• Seven settled actions announced September 9, 2024, against Acadia Healthcare Company, Inc., and a.k.a. Brands Holding Corp. (two separate companies), AppFolio, Inc., IDEX Corporation, LSB Industries, Inc., Smart for Life, Inc., and TransUnion. The SEC found violative language in employee agreements, including provisions requiring employees to waive the right to possible whistleblower awards, and, for AppFolio and TransUnion, in consulting service agreements as well, extending the rule's reach beyond direct employer-employee relationships. The seven companies were ordered to pay a combined total of more than $3 million, with individual penalties ranging from $19,500 to $1,386,000.
• In re Foot Locker, Inc. (May 22, 2026): the SEC's most recent Rule 21F-17 settlement in its published list of such matters. About 148 departing employees, including senior executives, directors, and employees in finance, legal, supply chain, and operations, signed separation agreements between July 2020 and June 2024 that purported to waive their right to receive an SEC whistleblower award. The SEC found that the award waiver itself impeded whistleblowing, as it had in the September 2024 settlements. Foot Locker was ordered to pay a $148,000 penalty.
Across these and similar matters, the Commission has consistently taken the position that a restrictive provision violates Rule 21F-17 based on its chilling potential alone, without regard to whether the company ever attempted to enforce it or whether any individual was actually discouraged from contacting the SEC.
C. Anti-Retaliation Protections
Section 21F(h)(1) prohibits an employer from discharging, demoting, suspending, threatening, harassing, or otherwise discriminating against a whistleblower because of lawful acts the whistleblower performed in reporting to the SEC. A whistleblower who suffers retaliation may sue directly in federal district court, without first exhausting any administrative remedy, and may recover reinstatement, double back pay with interest, and compensation for litigation costs, expert witness fees, and reasonable attorneys' fees. 15 U.S.C. § 78u-6(h)(1)(B)-(C). The claim may not be brought more than six years after the violation or more than three years after the facts material to the claim were known or should have been known, and in no event more than ten years after the violation. Id. § 78u-6(h)(1)(B)(iii).
The scope of that protection has a critical limit. In Digital Realty Trust, Inc. v. Somers, 583 U.S. 149, 153 (2018), the Supreme Court held, with no Justice dissenting, that Dodd-Frank's anti-retaliation provision protects only individuals who have reported to the SEC, not those who report solely through internal, company channels. Three Justices joined only part of the opinion. The decision resolved a circuit split. The Second Circuit's Berman v. Neo@Ogilvy LLC, 801 F.3d 145, 155 (2d Cir. 2015), had extended protection to internal-only reporters under Chevron deference to the SEC's own rule, while the Fifth Circuit's Asadi v. G.E. Energy (USA), L.L.C., 720 F.3d 620, 630 (5th Cir. 2013), had read the statute the way the Supreme Court ultimately did. Digital Realty sided with Asadi, and Berman's contrary holding cannot be squared with it.
Digital Realty draws the line at the gateway to whistleblower status, not at every later act of retaliation. The Court explained that once a person qualifies as a whistleblower by reporting to the SEC, the statute also protects against retaliation because of other disclosures that are required or protected under Sarbanes-Oxley or other laws within the SEC's jurisdiction, so a whistleblower who reports both to the SEC and to another entity can recover when the retaliation was prompted by the non-SEC disclosure. 583 U.S. at 165; 15 U.S.C. § 78u-6(h)(1)(A)(iii). An employee who reports internally but never files a TCR with the SEC may still have a retaliation claim, but it typically arises under the Sarbanes-Oxley Act, 18 U.S.C. § 1514A, which protects internal reporting and carries different procedural requirements. Those include filing an administrative complaint with the Department of Labor within 180 days of the violation (or of when the employee became aware of it) before suing in federal court. 18 U.S.C. § 1514A(b)(1), (b)(2)(D).
D. Interaction with Other Whistleblower Regimes
The SEC program operates alongside comparable regimes at the CFTC, 7 U.S.C. § 26, and the whistleblower provisions of Sarbanes-Oxley. Counsel evaluating a potential securities-related tip should consider whether the underlying conduct also implicates CFTC jurisdiction, since a single set of facts can sometimes support parallel submissions. Rule 21F-3(b)(3) governs how the SEC handles a related-action claim that overlaps with another government's award program.
V. Program Statistics from the SEC's Annual Reports to Congress
The Commission's Office of the Whistleblower reports program statistics to Congress each year, as required by Section 21F(g)(5).
As of the SEC's FY2024 Annual Report to Congress, the program had awarded more than $2.2 billion to 444 individual whistleblowers since its 2011 launch. The FY2025 Annual Report does not restate a cumulative total.
Multi-Year Trends
Tip volume has climbed nearly every year since FY2017, when the SEC reported 4,484 tips, to FY2025's approximately 27,000. The series is not strictly comparable from year to year. The SEC's FY2017 and FY2018 counts exclude tips from a few outlier repeat filers, while the FY2023 through FY2025 totals include them, among them about 7,000 of the 18,354 tips in FY2023, more than 14,000 in FY2024, and about 12,000 in FY2025 from just two individuals. The total dollar amount awarded has moved far less predictably over the same period, swinging from nearly $50 million (FY2017) to nearly $600 million (FY2023), because a handful of very large awards can dominate any given fiscal year's total.
Fiscal Year 2024 (October 1, 2023 - September 30, 2024)
• The Commission awarded more than $255 million to 47 individual whistleblowers, the third-highest annual total in the program's history.
• One award, approximately $98 million split between two whistleblowers, ranks as the fifth-largest in program history.
• The SEC received approximately 24,980 tips, though more than 14,000 of those came from just two individuals.
• The Commission brought 11 enforcement actions addressing agreements or conduct that impeded whistleblower communications with the SEC, more than double the five brought in FY2023, including one that resulted in an $18 million penalty, which the report describes as the highest penalty to date for an action of this type.
Fiscal Year 2025 (October 1, 2024 - September 30, 2025), reported February 11, 2026
• The Commission awarded more than $60 million to 48 individual whistleblowers across 31 covered actions, a sharp decline from FY2024. The Commission separately made 82 Preliminary Determinations recommending awards, a figure distinct from the 48 individuals awarded.
• The SEC received approximately 27,000 tips, about 12,000 of them from two individuals. The most common allegation categories were manipulation (28%), offering fraud (27%), corporate disclosures and financials (11%), and cryptocurrency and crypto asset securities (7%), as characterized by the whistleblowers themselves.
• The Commission issued 198 Preliminary Summary Dispositions and made 114 Preliminary Determinations recommending denials, and it issued Final Orders denying awards to 275 individuals. It barred five claimants from participating in the program. It reduced eight awards for unreasonable delay and four for culpability.
• Outside the United States, the highest numbers of tips came from Canada, the United Kingdom, Italy, Germany, and China.
• The SEC's FY2025 Agency Financial Report separately disclosed that the agency paid approximately $170 million to whistleblowers during the fiscal year, comprising $110.3 million for awards granted in prior years and $59.9 million for FY2025 awards. For awards it considered probable, the report estimated a range of loss of $218 million to $655 million and recorded a liability of about $498 million.
• The Agency Financial Report also states that the SEC's offices and divisions decreased headcount by 17 percent since the beginning of the fiscal year. Neither that report nor the Office of the Whistleblower's annual report ties the reduction to the decline in awards.
These figures should be read with a caveat. The SEC's tip counts include a substantial volume of duplicative or low-quality submissions from repeat filers, and the Commission denied awards to far more individuals in FY2025 than it granted.
Geographic Reach: Where Tips Originate
The program is national and international by design. Section 21F contains no residency or citizenship requirement, so an individual anywhere in the world may submit a tip and qualify for an award if the SEC's other eligibility criteria are met.
Domestic distribution. In the program's first year, FY2012, the SEC received tips from individuals in all 50 states, the District of Columbia, and Puerto Rico. In FY2024, the states generating the largest volume of whistleblower submissions were South Carolina, Florida, California, Texas, and New York. In FY2022 and FY2023 the same five states led, with Florida listed first.
International distribution. The SEC reported in its FY2021 report that it had received tips from whistleblowers in approximately 133 countries since the program's inception. The countries the SEC's reports name as the leading foreign sources have shifted from year to year:
• FY2017: the United Kingdom, Canada, and Australia
• FY2018: Canada, the United Kingdom, and Australia
• FY2019: Canada, Germany, and the United Kingdom
• FY2020: Canada, the United Kingdom, and China
• FY2021: Canada, China, and the United Kingdom
• FY2022: Canada, the United Kingdom, Germany, China, Mexico, and Brazil
• FY2023: Canada, the United Kingdom, Australia, Germany, and India
• FY2024: Canada, the United Kingdom, India, Australia, and Germany
• FY2025: Canada, the United Kingdom, Italy, Germany, and China
Latin American sources. Latin American jurisdictions have not typically placed among the handful of foreign sources the SEC names each year, but FY2022 was an exception: Mexico and Brazil both ranked among the six leading foreign jurisdictions that year, alongside Canada, the United Kingdom, Germany, and China. The country charts in the appendices to the SEC's FY2017 through FY2021 reports, which count individuals submitting from abroad, show submissions from other Latin American jurisdictions as well, including Argentina, Chile, Colombia, Costa Rica, Panama, Peru, and Venezuela, consistent with the program's reach into more than 130 countries.
Awards to whistleblowers located abroad. Overseas whistleblowers are eligible for awards under the same statutory framework as domestic ones, and the Commission has highlighted awards connected to overseas whistleblowers and overseas conduct, for example an award of over $900,000 in November 2020 to a whistleblower who identified securities law violations occurring overseas, and an award of over $5 million in March 2021 to joint whistleblowers located abroad. The annual reports to Congress do not appear to break out a separate cumulative dollar total paid specifically to foreign-based whistleblowers, so any such aggregate figure should be independently confirmed with the SEC's Office of the Whistleblower before being cited.
VI. How an Attorney Assists a Whistleblower
Retaining counsel changes the practical posture of a whistleblower matter at nearly every stage.
Pre-filing evaluation. Counsel assesses whether the client's information qualifies as "original" under Rule 21F-4, whether the client's own role brings any of the Rule 21F-4(b)(4) exclusions into play, whether the client is submitting voluntarily, whether the information is likely to lead to a covered action exceeding the $1 million sanctions threshold, and whether the client's own conduct raises culpability issues that could reduce or bar an award under Rule 21F-6.
Anonymous submission. Because only counsel can submit a TCR anonymously on a client's behalf, representation is a prerequisite for whistleblowers who want to report without disclosing their identity to their employer or the public.
Strategic sequencing. Counsel can help a client decide whether, when, and how to report internally in addition to reporting to the SEC, and can build that decision around the Rule 21F-4(b)(7) 120-day lookback so an internal report does not cost the client priority on an SEC submission. Recent D.C. Circuit decisions show why timing matters, since a submission made after the SEC has already contacted the whistleblower is not voluntary, and one made after the staff has already developed the same information may not have led to the action. Given Digital Realty, the sequencing decision also affects which anti-retaliation statute, Dodd-Frank or Sarbanes-Oxley, will govern if the employer retaliates.
Building the submission. A well-organized TCR and supporting narrative, with documents identified and legal theories framed clearly, materially improves the SEC staff's ability to act on a tip and can affect both the likelihood and size of an eventual award.
Retaliation response. If an employer retaliates, counsel evaluates and pursues claims under Section 21F(h) or Section 1514A, litigates in federal court or before the Department of Labor as applicable, and pursues the reinstatement, back pay (doubled under Dodd-Frank), and fee-shifting remedies those statutes provide.
Award determination and appeal. Counsel represents the client through the Preliminary Determination process, prepares any response contesting a proposed denial or award percentage, and, if necessary, petitions for review of a Final Order in a United States Court of Appeals within the 30-day window, mindful that the award percentage itself is not appealable.
VII. Conclusion
The SEC Whistleblower Program has matured into a durable feature of the securities enforcement landscape, one that pairs a specific statutory framework with a growing body of Commission and judicial interpretation. FY2025's decline in award activity, set against a still-elevated volume of incoming tips and a large number of denials, suggests that attorneys advising prospective whistleblowers should expect closer scrutiny of individual claims even as the program's basic incentive structure remains intact. The Foot Locker settlement shows that Rule 21F-17 enforcement continued into 2026 and that clauses waiving the right to a whistleblower award remain a target, as in the September 2024 sweep, a point counsel on both sides of the table should watch. Anyone considering a submission, and any company facing one, benefits from counsel who understands both the statutory mechanics and the practical realities the annual reports to Congress reveal.
