| name | design-whistleblower-bounty-compliance-program |
| description | Use when a public company needs to comply with SEC and CFTC whistleblower bounty program requirements — ensuring internal policies, employment agreements, and settlement terms don't impede an employee's ability to report directly to regulators or receive a bounty award, distinct from designing the company's own internal speak-up culture and reporting channel. |
| source | Dodd-Frank Wall Street Reform and Consumer Protection Act, Section 922; SEC Rule 21F (Securities Whistleblower Incentives and Protection) |
| tags | ["law","corporate","whistleblower-bounty","sec-compliance","dodd-frank","regulatory-compliance"] |
| related | ["design-speak-up-framework","design-conflict-of-interest-policy","design-compensation-clawback-policy"] |
Design Whistleblower Bounty Compliance Program
Ensure internal policies, employment agreements, and settlement terms don't impede an employee's ability to report directly to the SEC or CFTC or receive a bounty award under the mandatory whistleblower incentive programs — distinct from the separate practice of designing the company's own internal speak-up culture and reporting channel.
Why This Is Best Practice
Adopted by: Dodd-Frank Act Section 922 established the SEC whistleblower program, implemented through SEC Rule 21F, awarding whistleblowers 10-30% of monetary sanctions collected above $1 million in successful enforcement actions based on their original information — and the SEC has actively brought enforcement actions specifically against companies whose employment agreements or confidentiality provisions impeded this reporting right, making Rule 21F-compliant contract language now standard practice among public companies' legal departments.
Impact: The SEC has documented numerous enforcement actions against companies for using standard confidentiality, severance, or employment agreement language that violated Rule 21F(b) by requiring employees to waive their right to report to the SEC or to a monetary award — even when the company had no intent to actually prevent SEC reporting, since the rule violation is based on the agreement's chilling effect on the right, not on provable intent.
Why best: A company can have an excellent internal speak-up culture and still separately violate federal whistleblower protections through boilerplate legal language in unrelated agreements (severance, NDAs, employment contracts) that an employee might reasonably read as restricting their right to report to regulators — compliance requires reviewing this contract language specifically for Rule 21F compliance, a distinct legal exercise from building an effective internal reporting culture.
Sources: Dodd-Frank Wall Street Reform and Consumer Protection Act (2010), Section 922; SEC Rule 21F, "Securities Whistleblower Incentives and Protection"
Steps
Step 1: Audit existing agreements for impermissible whistleblower restrictions
Audit existing employment agreements, severance agreements, and confidentiality/NDA templates for language that could be read as restricting an employee's right to report to the SEC or CFTC, or waiving their right to receive a monetary whistleblower award — since SEC enforcement actions have targeted exactly this kind of boilerplate language even absent provable intent to obstruct reporting.
Step 2: Include required carve-out language in confidentiality provisions
Include explicit carve-out language in confidentiality and non-disclosure provisions clarifying that nothing in the agreement restricts the employee's right to report possible securities law violations to the SEC or other government agency, or to receive a whistleblower award for doing so.
Step 3: Remove any provision requiring pre-notification before external reporting
Remove any contractual requirement that an employee notify the company or seek internal approval before reporting to a regulator — such prior-notification requirements have specifically been found by the SEC to violate Rule 21F, regardless of whether internal reporting is separately encouraged.
Step 4: Review severance and settlement agreements for award waiver language
Review severance and litigation settlement agreements specifically for any provision requiring an employee to waive their right to a monetary whistleblower award — this specific type of waiver has been a recurring focus of SEC enforcement actions and cannot be cured by other favorable terms in the same agreement.
Step 5: Train legal, HR, and compliance staff on the specific compliant language
Train the specific staff who draft or negotiate employment, severance, and confidentiality agreements on the required Rule 21F-compliant language, since this is a specialized compliance requirement that general employment law training doesn't automatically cover.
Rules
- Audit all existing agreement templates for impermissible whistleblower-restriction language, not only newly drafted agreements going forward.
- Include explicit SEC/CFTC reporting-right carve-out language in confidentiality provisions.
- Never require prior internal notification or approval before an employee reports to a regulator.
- Never require an employee to waive their right to a monetary whistleblower award as a condition of any agreement.
Examples
Audit catching a legacy compliance gap: A company's compliance review of its standard severance agreement template reveals boilerplate confidentiality language, drafted years earlier, that could be read as requiring departing employees to affirm they haven't reported any company information to outside parties — language the SEC has specifically found problematic in past enforcement actions. The company revises the template to include the required regulatory-reporting carve-out.
Compliant carve-out language avoiding a violation: A company's updated NDA template includes explicit language stating that nothing in the agreement prohibits an employee from reporting possible securities violations to the SEC or from receiving a monetary award for doing so — satisfying Rule 21F's requirements while still maintaining legitimate confidentiality protections for other information.
Common Mistakes
- Assuming a strong internal speak-up culture is sufficient for whistleblower compliance — internal culture and Rule 21F contract compliance are distinct requirements; a company can have excellent internal reporting culture and still violate Rule 21F through unrelated contract language.
- Failing to audit legacy agreement templates, focusing compliance review only on newly drafted agreements — SEC enforcement actions have specifically targeted older, unreviewed boilerplate language.
- Including any prior-notification-before-external-reporting requirement, even framed as encouraging internal resolution first — this type of provision has been specifically found to violate Rule 21F regardless of framing.
- Overlooking severance and settlement agreements specifically, focusing only on standard employment agreements — award-waiver language in severance and settlement contexts has been a distinct, recurring focus of SEC enforcement.
When NOT to Use
- For a private company with no SEC or CFTC regulatory exposure — this specific compliance program addresses federal securities and commodities whistleblower programs.
- As a substitute for building genuine internal reporting culture and channels — Rule 21F compliance addresses external regulatory reporting rights specifically; internal speak-up culture is a separate, complementary practice (see
design-speak-up-framework).
- For determining whether a specific existing agreement provision actually violates Rule 21F — that determination requires case-specific legal analysis of the exact language and context.
Legal disclaimer: This skill encodes professional best practices for educational purposes. It is not legal advice. Whistleblower compliance carries significant regulatory enforcement risk — consult licensed securities counsel to review specific agreement language for Rule 21F compliance.
