When Congress passed the Sarbanes-Oxley Act in July 2002 in the wake of the Enron and WorldCom collapses, Section 806 of the statute created something that had not previously existed in federal law: a private right of action protecting employees of publicly traded companies who report suspected corporate fraud. More than two decades later, the Sarbanes-Oxley whistleblower claim – codified at 18 U.S.C. § 1514A and administered by the Occupational Safety and Health Administration’s whistleblower protection program – remains the workhorse statute for corporate retaliation cases that fall outside the financial-award framework of the Dodd-Frank SEC whistleblower program.
Section 806 does not pay bounties. It restores employees to their jobs, makes them whole financially, and shifts the litigation burden onto the employer in ways that materially change the calculus of a retaliation dispute. Understanding the statute, the procedural path, and the recent case law that has reshaped it is essential for anyone weighing whether to report suspected fraud at a publicly traded company.
How Sarbanes-Oxley Created the First Federal Corporate Whistleblower Right of Action
Section 806 was enacted as part of the Public Company Accounting Reform and Investor Protection Act of 2002. The drafters’ diagnosis was straightforward: the Enron and WorldCom frauds had survived for years because employees who saw the misconduct had no federal protection if they spoke up. State whistleblower laws were a patchwork, common-law wrongful discharge doctrines were thin, and the Securities Exchange Act of 1934 did not create individual employment rights for tipsters.
The statute the drafters produced makes it unlawful for a publicly traded company – or its officers, employees, contractors, subcontractors, or agents – to discharge, demote, suspend, threaten, harass, or in any other manner discriminate against an employee because the employee provided information about, caused information to be provided about, or otherwise assisted in an investigation regarding conduct the employee reasonably believed constituted a violation of certain federal securities laws or any provision of federal law relating to fraud against shareholders.
The protected statutes enumerated in § 1514A(a)(1) are mail fraud (18 U.S.C. § 1341), wire fraud (§ 1343), bank fraud (§ 1344), securities fraud (§ 1348), any rule or regulation of the Securities and Exchange Commission, and any provision of federal law relating to fraud against shareholders. The list is narrower than it sometimes appears in practice – generalized complaints about workplace illegality that do not touch one of those categories are not covered.
Who Section 806 Actually Covers
The coverage question has been litigated repeatedly since 2002, and the answer is broader today than it was at enactment.
Publicly Traded Companies and Their Subsidiaries
The core covered employer is a company with a class of securities registered under Section 12 of the Securities Exchange Act, or required to file reports under Section 15(d) of that Act. The Dodd-Frank Act of 2010 amended § 1514A to clarify that subsidiaries and affiliates whose financial information is included in the consolidated financial statements of a publicly traded parent are also covered employers – a fix that resolved years of conflicting Department of Labor and federal court rulings.
Contractors and Agents After Lawson v. FMR
The Supreme Court’s decision in Lawson v. FMR LLC, 571 U.S. 429 (2014), extended SOX whistleblower coverage to employees of private contractors and subcontractors of public companies. The case involved former employees of investment advisers that managed mutual funds for Fidelity. The Court held that the statute’s reference to “employees” of a “contractor” of a public company meant exactly that – protection follows the contractor relationship, not the publicly traded status of the immediate employer. The practical effect was to bring large categories of financial-services employees, accounting firm personnel, and consulting staff inside the protected class.
Nationally Recognized Statistical Rating Organizations
Dodd-Frank added § 1514A coverage for employees of credit rating agencies registered as Nationally Recognized Statistical Rating Organizations, addressing the role those firms played in the 2008 financial crisis.
The “Reasonable Belief” Standard and What Counts as Protected Activity
The employee does not need to prove that fraud actually occurred. The statute protects disclosures the employee “reasonably believes” constitute a covered violation. The Department of Labor’s Administrative Review Board (ARB) and the federal circuits have interpreted “reasonable belief” as having both a subjective component – the employee actually believed the conduct was unlawful – and an objective component – a reasonable person with the employee’s training and experience could have held that belief.
That standard is generous to employees in principle. In practice, it is also where many SOX cases are won or lost. The Supreme Court’s 2024 decision in Murray v. UBS Securities, LLC, 601 U.S. 23 (2024), held that a SOX whistleblower does not need to prove “retaliatory intent” to meet the contributing-factor burden – clarifying language that lower courts had used to add an animus requirement absent from the statute. The decision was understood as broadening the practical scope of protected activity by removing an evidentiary obstacle that had been creeping into SOX jurisprudence.
Protected Disclosure Channels
The statute protects disclosures made to (1) a federal regulatory or law enforcement agency, (2) a member or committee of Congress, or (3) a person with supervisory authority over the employee, or another person working for the employer who has the authority to investigate, discover, or terminate misconduct. Internal complaints to a supervisor – including verbal ones – are covered. Disclosures to the press are not covered by § 1514A, though they may be protected by other statutes.
The Filing Path: OSHA Complaint, ALJ Hearing, and the 180-Day Clock
A SOX whistleblower retaliation claim begins not in federal court but with the Occupational Safety and Health Administration, which administers the program for the Department of Labor.
The 180-Day Filing Deadline
The employee must file a complaint with OSHA within 180 days of the alleged retaliatory action – a deadline that runs from when the employee knew or reasonably should have known of the adverse action. The 180-day window is jurisdictional in practice; late filings are routinely dismissed. Continuing violations can extend the clock, but the safe assumption is that the deadline starts on the day of the termination, demotion, or other discrete adverse action.
OSHA Investigation
OSHA’s regional investigator opens a file, requests a position statement from the employer, and may interview witnesses. The investigation typically takes several months to more than a year. OSHA’s findings can include reinstatement orders enforceable while any appeal is pending.
The “Kick-Out” Provision
If OSHA has not issued a final decision within 180 days of the complaint filing – a benchmark almost never met in practice – the complainant has the right to “kick out” the case to federal district court for de novo review, including a jury trial. The kick-out provision, found at 18 U.S.C. § 1514A(b)(1)(B), is one of the most distinctive features of SOX whistleblower procedure. It gives experienced complainants a strategic choice: continue with the administrative process at the Office of Administrative Law Judges and the Administrative Review Board, or pivot to federal court.
The Administrative Track
Complainants who remain in the Department of Labor system receive a hearing before an Administrative Law Judge if either party objects to OSHA’s preliminary findings. The ALJ decision can be appealed to the Administrative Review Board, and ARB decisions can be appealed to the federal court of appeals for the circuit where the violation occurred.
The Burden-Shifting Framework and Why It Matters
SOX whistleblower cases use a burden-shifting framework borrowed from the AIR21 aviation-safety whistleblower statute. The employee must show by a preponderance of the evidence that the protected activity was a “contributing factor” in the adverse employment action. Once that showing is made, the employer must rebut by “clear and convincing evidence” that it would have taken the same action absent the protected activity.
That asymmetry – preponderance for the employee, clear and convincing for the employer – is materially more favorable to complainants than the McDonnell Douglas framework used in Title VII discrimination cases. The Supreme Court’s Murray v. UBS ruling reinforced this framework by rejecting attempts to layer additional intent requirements onto the contributing-factor test.
Remedies Available Under SOX § 806
The remedial provisions at § 1514A(c) entitle a prevailing employee to “all relief necessary to make the employee whole.” Specifically enumerated remedies include:
- Reinstatement to the same seniority status the employee would have had absent the retaliation;
- Back pay with interest;
- Compensation for any special damages sustained as a result of the discrimination, including attorneys’ fees and costs.
The “special damages” category has been interpreted by the ARB and federal courts to include emotional distress damages, reputational harm, and other non-economic injuries. Punitive damages are not available under SOX, though they may be available under parallel state-law claims filed alongside a federal SOX case.
SOX vs. Dodd-Frank: When Each Applies
The relationship between Sarbanes-Oxley retaliation protection and the Dodd-Frank Act’s SEC whistleblower retaliation provision (15 U.S.C. § 78u-6(h)) has been a recurring source of litigation.
The Supreme Court’s decision in Digital Realty Trust, Inc. v. Somers, 138 S. Ct. 767 (2018), drew a sharp line: Dodd-Frank’s anti-retaliation provision protects only employees who report violations to the SEC. Internal-only reporters who never contact the Commission cannot invoke Dodd-Frank, even if they otherwise meet the statute’s substantive criteria. SOX § 1514A, by contrast, protects internal reporters who never approach a regulator.
The practical implication is that an employee who reports suspected securities fraud only to a supervisor or compliance officer is covered by SOX but not by Dodd-Frank. An employee who reports to the SEC may have claims under both. Counsel typically file dual claims where both are available because Dodd-Frank offers a longer statute of limitations – six years from the violation, or three years from discovery, capped at ten years – and the prospect of double back pay, while SOX offers the OSHA process and the 180-day federal-court kick-out.
Recent Case Law Reshaping the Standard
The doctrinal landscape has shifted measurably in the years since 2018.
Digital Realty v. Somers (2018)
As discussed above, the Court narrowed Dodd-Frank coverage to SEC-reporters only, indirectly raising the importance of SOX as the protection of choice for internal-only complainants.
Murray v. UBS (2024)
The unanimous decision held that a SOX whistleblower need not prove the employer acted with retaliatory animus to satisfy the contributing-factor standard. Lower courts had begun importing animus requirements that were not in the statutory text. Murray closed that line of cases and made the contributing-factor test materially easier to meet on the elements an employee directly controls.
ARB Coverage Decisions
The Administrative Review Board has issued a series of decisions in recent years expanding the categories of conduct that count as protected activity. Disclosures about suspected violations of internal controls and accounting standards required by SOX itself – not just disclosures about underlying fraud – have been treated as protected. Disclosures about conduct affecting consolidated subsidiaries are protected. Disclosures made through internal compliance channels are protected.
Practical Considerations Before Filing
For employees weighing a SOX retaliation complaint, several practical considerations matter as much as the legal framework.
The 180-day OSHA filing deadline is unforgiving. Calendar it the day the adverse action occurs and treat any delay as a substantive risk to the claim. Document everything contemporaneously – emails, memos, performance reviews, the timing sequence between the disclosure and the adverse action. The contributing-factor test turns heavily on chronology and on the employer’s documentary record.
Consider the parallel-track question early. A complainant who has reported to the SEC and to a supervisor has potential claims under both SOX and Dodd-Frank. The strategic choice between filing only one, filing both, and which to keep in administrative process versus federal court is consequential and irreversible after the kick-out window closes.
Counsel experienced in the federal whistleblower statutes can substantially affect outcomes. A SEC Whistleblower Advocate with experience handling parallel SOX and Dodd-Frank claims will typically map out the procedural path – OSHA complaint, kick-out timing, parallel SEC Form TCR filing where appropriate, and the choice between administrative and federal-court tracks – before the first complaint is filed. The choices made in the first 30 days of a retaliation matter constrain the options available later.
Finally, the question of internal compliance reporting before external disclosure deserves careful evaluation. SOX protects both internal and external reporting, and internal reporting can affect the SEC’s award percentage calculation under the Dodd-Frank program (a factor that, under 17 C.F.R. § 240.21F-6, increases the award percentage). But internal reporting also increases the employer’s awareness of the disclosure and, by extension, the operational risk of retaliation. There is no single right answer; the question is fact-specific and time-sensitive.
The Standing of SOX § 806 in 2026
Twenty-four years after enactment, Sarbanes-Oxley § 806 remains the most important corporate-fraud whistleblower protection statute in U.S. law. It covers a broader class of employees than Dodd-Frank, protects internal-only reporting, and provides remedies – reinstatement, back pay with interest, special damages, attorneys’ fees – designed to make the employee whole rather than to fund the agency’s enforcement priorities. The procedural path is administrative-first but offers a federal-court kick-out that gives experienced complainants a meaningful strategic option.
The post-Murray framework is more favorable to employees than the pre-2024 doctrine. The post-Lawson coverage extends to contractor employees of public companies. The post-Digital Realty environment has made SOX the indispensable statute for internal-only reporters. For anyone considering a Sarbanes-Oxley whistleblower claim in 2026, the substantive law is more developed and more favorable than at any point since the statute was enacted – but the 180-day clock and the contributing-factor standard remain unforgiving of poor preparation.
