1. What Laws Apply to Whistleblower Policies in New York?
New York companies are not subject to SOX, SEC, or FinCEN requirements merely because they operate in the state. Coverage depends on issuer status, industry, regulated activities, and the nature of the employment relationship.
| Framework | Who or What It Covers | Key Obligation |
|---|---|---|
| NY Labor Law §740 | Most New York employers and covered workers | Anti-retaliation, notice posting, internal-notice rules and exceptions |
| SOX §301 | Audit committees of covered issuers | Confidential and anonymous accounting complaint procedures |
| SOX §806 | Employees of covered companies and related entities | Protection for specified internal and external reporting |
| Exchange Act §21F / Rule 21F-17 | SEC reporting and conduct that impedes reporting | No restriction on direct SEC communications or award eligibility |
| FinCEN program | Qualifying BSA, sanctions, and related reports | Account for external reporting; note proposed implementing rules |
| DOJ Corporate Enforcement Policy | Corporate criminal self-disclosure and remediation | Prompt escalation, preservation, investigation, and disclosure analysis |
What Does New York Labor Law §740 Require?
New York Labor Law §740 prohibits retaliation against employees, former employees, and certain independent contractors who disclose or threaten to disclose conduct they reasonably believe violates a law, rule, or regulation or poses a substantial and specific danger to public health or safety. Employers subject to §740 must post notice of protected rights. The statute includes an internal-notice requirement under which an employee must ordinarily notify the employer before reporting to a government agency, subject to exceptions including situations where the employee reasonably believes that internal reporting would result in destruction of evidence or harm to the employee. Health care employers are subject to additional protections under Labor Law §741.
What Do Sox Sections 301 and 806 Require?
Section 301 of the Sarbanes-Oxley Act requires audit committees of public companies to establish procedures for receiving, retaining, and treating complaints about accounting, internal controls, or auditing matters, including an anonymous and confidential submission mechanism for employees. Section 806 prohibits retaliation against employees of covered companies and their covered subsidiaries or affiliates who report conduct they reasonably believe constitutes a violation of federal securities laws, SEC rules, or fraud against shareholders. If the Department of Labor has not issued a final decision within 180 days, and the delay is not attributable to the employee's bad faith, the employee may bring the claim in federal district court.
2. What Core Elements Should a Whistleblower Policy Include?
Depending on the company's legal obligations, industry, and governance structure, a whistleblower policy should identify available reporting channels, prohibit retaliation, establish escalation procedures, and explain how reports will be documented and investigated. Covered issuers subject to SOX Section 301 must provide procedures for confidential and anonymous employee complaints concerning accounting, internal controls, and auditing matters.
The policy should state that employees may communicate directly with regulators where permitted by law and that use of an internal channel is not a condition of SEC or FinCEN reporting or award eligibility. The policy should also account for any separate internal-notice requirements and exceptions under applicable state law, including those under Labor Law §740.
How Should a Policy Address Material Nonpublic Information?
An internal investigation triggered by a whistleblower report will frequently involve access to material nonpublic information. A policy that does not address who may access MNPI during an investigation, how that information is segregated, and what trading restrictions apply creates independent securities law risk beyond the underlying compliance issue. Policies that restrict employees from communicating with the SEC about potential securities violations may violate Exchange Act Rule 21F-17 regardless of their stated intent.
3. How Do Federal Programs Affect Corporate Internal Reporting?
Federal whistleblower programs create financial incentives for individuals to report violations directly to regulators. When an employee reports externally before raising the issue internally, the company loses the opportunity to investigate and remediate before a formal inquiry begins. Understanding how each program works is necessary to designing an internal policy that functions as intended.
How Does the Sec Whistleblower Program Work?
The SEC Whistleblower Program under Exchange Act Section 21F pays monetary awards to individuals who provide original information leading to a successful SEC enforcement action with sanctions exceeding $1 million. An employee who first reports internally may still be eligible for an SEC award if they also report to the SEC within 120 days. Dodd-Frank's Section 21F anti-retaliation remedy generally requires the individual to have reported a possible securities law violation to the SEC in writing before the alleged retaliation. SOX Section 806 separately protects certain internal and external reporting by employees of covered companies.
What Is the Status of the Fincen Whistleblower Program?
FinCEN began accepting tips through a dedicated portal in February 2026 and issued a proposed implementing rule in March 2026. The proposal would establish submission procedures, award criteria, and protections for qualifying reporters under the Bank Secrecy Act and related anti-money laundering laws. These terms should not be treated as final until FinCEN completes the rulemaking. Financial institutions subject to BSA compliance obligations should monitor the final rule and ensure internal procedures are consistent with employees' ability to file tips directly with FinCEN.
How Does Doj'S Corporate Enforcement Policy Apply?
As of March 2026, DOJ's department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy governs most corporate criminal matters across the Department, other than criminal antitrust matters. An effective whistleblower policy does not guarantee a declination, non-prosecution agreement, or reduced penalty. What matters is whether the program functioned in practice, whether the company escalated reported conduct promptly, and what steps were taken after a report was received. A New York company facing an inquiry from the Southern District of New York should evaluate voluntary disclosure under this framework while considering the facts, timing, and investigative posture of the specific matter.
4. What Should a Company Do after Receiving a Whistleblower Report?
The period immediately after a report is received is often the most consequential for the company's legal exposure. The company should preserve potentially relevant information promptly and determine whether anticipated litigation or a regulatory inquiry warrants a formal legal hold. Independent or outside counsel may be appropriate when the report involves senior management, potential criminal conduct, securities violations, or a significant conflict of interest. Involving counsel does not automatically make every investigative communication privileged; privilege depends on whether the communication was made for the purpose of obtaining or providing legal advice.
The audit committee should be notified when the report involves accounting, internal controls, executive conduct, or potential federal violations. The decision whether to make a voluntary disclosure to DOJ, the SEC, or another regulator should be made with counsel, taking into account the applicable self-disclosure policies and what the investigation has revealed.
5. Can Employment Agreements Restrict External Reporting?
Under Exchange Act Rule 21F-17, no person may take action to impede an individual from communicating directly with the SEC about a potential securities violation. An agreement that conditions severance on not reporting to the SEC, requires pre-approval before making regulatory disclosures, or purports to waive eligibility for a government award may violate Rule 21F-17. Only the SEC may enforce Rule 21F-17, although a qualifying employee may have a separate retaliation claim under Dodd-Frank, SOX, or applicable state law. In 2026, the SEC brought an enforcement action against Foot Locker for award-waiver provisions in its separation agreements. Separation agreements and confidentiality agreements should be reviewed for provisions that could be construed to restrict SEC communication before they are executed.
6. How Can Corporate Compliance Counsel Help Review a Whistleblower Policy?
Counsel can assess whether an existing policy satisfies the requirements of Labor Law §740, SOX Sections 301 and 806, Exchange Act Rule 21F-17, and applicable FinCEN and DOJ expectations, identify provisions in employment or separation agreements that create Rule 21F-17 exposure, and evaluate whether investigation procedures would qualify for credit under DOJ's Corporate Enforcement Policy.
When a report is received, counsel familiar with securities enforcement, SEC investigations, and corporate governance can advise on investigation scope, privilege, document preservation, board escalation, and whether voluntary disclosure is appropriate. An insider trading matter, accounting fraud, or executive misconduct report may require coordinated analysis of regulatory exposure, criminal liability, privilege, and complex commercial litigation risk.
19 Aug, 2026
