SEC whistleblower program: How to file a securities fraud report under Rule 21F

What is the SEC whistleblower program?

The SEC whistleblower program is administered by the SEC Office of Whistleblower (OWB) under §922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act, codified at 15 U.S.C. §78u-6 and implemented through Rule 21F (17 CFR §240.21F-1 et seq.). The program rewards individuals who voluntarily provide the SEC with original information that leads to a covered enforcement action with monetary sanctions exceeding $1 million.

Three things distinguish the SEC program from the IRS and FCA tracks:

• No "taxpayer-specific" requirement. The SEC rewards information about a violation, not a particular wrongdoer's tax bill — so an SEC tip can describe a pattern across multiple issuers or trading desks without naming a specific defendant in advance.
• Bounty in addition to any SEC recovery. The award is calculated as a percentage of the total sanctions the SEC collects in the covered action — including disgorgement, prejudgment interest, and civil penalties — not a percentage of any single settlement.
• Confidentiality and retaliation protection are statutory defaults. The SEC cannot disclose your identity without your consent (limited exceptions apply), and anti-retaliation under §21F-17(h) gives you a private right of action against an employer who fires, demotes, or harasses you for reporting.

Tipsters file through the SEC's TCR (Tip, Complaint, or Referral) portal. From there the OWB forwards the matter to Enforcement, and an award determination is issued after the underlying action concludes — typically several years later, but with current award payouts that scale to the eight-figure range.

Who qualifies as an SEC whistleblower?

To receive an award under Rule 21F-1, you must satisfy two threshold requirements:

• Original information. The information must be original — that is, derived from your independent knowledge or independent analysis, and not already known to the SEC from any other source (with limited exceptions for information you provide that the SEC could not have obtained elsewhere and that leads to a successful action).
• Voluntary submission. You must report through the TCR process or other channels the SEC accepts, and your submission must precede (or in narrow cases accompany) an enforcement action the SEC opens based on your information.

Several classes of people are excluded from awards under Rule 21F-2(b):

• Compliance and internal-audit personnel who learn of the violation through internal-audit or compliance functions — unless they have a reasonable basis to believe disclosure is necessary to stop the conduct.
• Officers, directors, and control persons of the entity that committed the violation — with limited carve-outs (chief compliance officers who report upward can still recover in narrow circumstances).
• Government employees, foreign government officials, and self-regulatory organization (SRO) personnel — except where the tip concerns the SRO itself.
• People convicted of, or otherwise criminally responsible for, the conduct they are reporting.

Most importantly, anti-retaliation protection under §21F-17(h) shields whistleblowers from employer retaliation — termination, demotion, suspension, harassment — for reporting securities-law violations to the SEC. The protection applies whether or not you ultimately receive an award, and violation of §21F-17(h) gives you a private right of action in federal court (remedies include reinstatement, back pay with interest, and attorney's fees).

SEC reward structure

Under Rule 21F-1, the SEC's Claims Review Staff applies the following bands when determining an award:

For context, here are the comparable reward ranges under the other federal whistleblower programs WhistleForge tracks:

A rule of thumb for an SEC tip: (sanctions collected by SEC) × ~20% ≈ expected award midpoint. WhistleForge's reward calculator on the landing page lets you model rough payouts for all five programs.

How WhistleForge helps with SEC cases

WhistleForge runs a daily automated scan across SEC EDGAR, USAspending.gov, and other federal sources to surface SEC-relevant signals. Each lead gets a confidence score (0–100) based on recovery size, evidence strength, entity clarity, OIG red-flag pattern matches, and data freshness. The highest-confidence leads (≥75 score, $5M+ recovery, named entity, multiple sources, OIG pattern) are flagged as gated attorney-grade leads.

For SEC cases specifically, the scan highlights patterns mapped to the EDGAR core dataset:

• Form 4 insider- transaction clusters — late-filing anomalies, abnormal size, or cluster timing around earnings windows.
• 8-K restatement and auditor-change events — material events that often precede SEC enforcement and frequently co-occur with revenue-recognition disputes.
• 10-K disclosure anomalies — risk-factor shifts, restated comparatives, and segment-level reporting patterns that diverge from industry peers.
• Cross-reference against shell-network entity clusters — the same shared-address / fuzzy-name detection that powers the FCA scan surfaces shell-company patterns in securities filings, which often correlate with fraud enforcement risk.

Cross-referencing these gives you an early read on whether a complaint has the "specific and credible" original information the OWB looks for — and, critically, lets you build a Form TCR narrative that names the right entity and points to source documents already on EDGAR.

From there, the platform does two things a normal research workflow can't:

• Surfaces signals you would not see by hand. The scan cross-references EDGAR insider trades and 8-K events against entity networks (shell companies, shared addresses, fuzzy name matches) so a single 8-K auditor-change can reveal a cluster of related issuers ramping up for a coordinated disclosure.
• Matches you with a vetted SEC whistleblower attorney. Submitting a tip at /submit triggers an automatic match to 2–3 law firms in WhistleForge's vetted network based on program specialty, geographic coverage, and case size. The claiming workflow prevents double-match.

To use it:

• Browse gated leads in the dashboard at /app — Investigator-tier subscribers see confidence score breakdowns, top red flags, and one-click PDF export.
• Already have a theory? Submit it at /submit and WhistleForge will route it to matching firms.
• Want unlimited scans + permanent archive? See /pro for what the Investigator tier adds.
• Working an IRS case alongside? See the IRS whistleblower guide for the parallel §7623 pathway.
• Working an FCA case alongside? See the qui tam whistleblower guide for the parallel False Claims Act pathway.
• Working an SEC cyber-disclosure (Item 1.05) case alongside? See the /cybersecurity-whistleblower guide for the cyber overlay.