# Whistleblower Exposure

> SKILL 43: Whistleblower Exposure

- Skill: `nickgallick/whistleblower-exposure` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nickgallick/whistleblower-exposure`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nickgallick/whistleblower-exposure/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: nickgallick (https://skillmd.com/u/nickgallick)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/nickgallick/whistleblower-exposure

---

# SKILL 43: Whistleblower Exposure

## Purpose
Understand SEC and CFTC whistleblower programs, how they affect operations, and how to build internal processes that reduce external reporting risk.

## SEC Whistleblower Program (Dodd-Frank §21F)
- **Who can report**: ANY person — employees, contractors, ex-partners, competitors, users
- **Reward**: 10–30% of sanctions collected if tip leads to enforcement action over $1M
- **Total awards to date**: Over $2 billion since 2012 (as of 2024)
- **Protected activity**: Retaliation against a whistleblower is ILLEGAL under §21F(h)
- **Wrongful termination remedy**: reinstatement, double back pay, attorneys' fees

## CFTC Whistleblower Program
- Same structure: 10–30% of sanctions over $1M
- Covers: Commodity Exchange Act violations, market manipulation, fraud, unregistered activities
- **Key for Perlantir**: prediction market CFTC violations → someone reports → earns 10–30% of any fine
- CFTC program has paid out hundreds of millions; awards are publicly announced

## What This Means Operationally
- Every employee, contractor, and business partner is a potential whistleblower
- If they observe what they believe is a securities or CFTC violation → financial incentive to report
- You cannot contract away whistleblower rights (NDAs cannot prohibit SEC/CFTC reporting)
- SEC has brought enforcement actions against companies that tried to silence whistleblowers with NDAs

## Proactive Risk Reduction

### Internal Reporting Culture
- Create internal compliance reporting channel: "If you have a legal or compliance concern, report it to [designated contact]"
- Document that concerns are taken seriously and investigated
- Fix problems internally BEFORE the SEC/CFTC hears about them → no enforcement action → no whistleblower award → less incentive to report externally
- The math: internal fix costs $0 in fines. External enforcement = fine + 10–30% whistleblower award + litigation costs + reputational damage

### What NOT to Do
- Never retaliate against someone who raises legal concerns internally — EVER
- Never pressure employees to do things they're legally uncomfortable with
- Never include NDA language that purports to prohibit government agency reporting (illegal under Dodd-Frank)
- Never discuss regulatory gray areas casually in Slack/Discord where employees can screenshot
- Never suggest that "no one is going to find out"

### Attorney-Client Privilege Protection
- Legal strategy discussions: always have counsel present or involved to preserve privilege
- Slack messages about legal risk are NOT privileged
- Emails to your attorney ARE privileged (attorney-client)
- If you write a legal risk memo without an attorney → it's discoverable

## Internal Investigation Protocol
When an employee or contractor raises a legal concern:

1. **Acknowledge**: "Thank you for raising this. We take compliance seriously."
2. **Document**: Write down exactly what was said, by whom, and when
3. **Escalate**: Notify your compliance lead or outside counsel immediately
4. **Investigate**: Outside counsel conducts privileged investigation (if counsel leads → privileged)
5. **Remediate**: If a violation is found, fix it. Document the fix.
6. **Report back**: Inform the employee that the concern was investigated and addressed (without revealing privileged details)
7. **Never**: Suggest the employee was wrong to raise the concern, even if the concern was unfounded

## Red Flags That Trigger Whistleblower Reports
- Running a prediction market without CFTC designation or exemption
- Offering tokens that could be securities without registration
- Telling users a platform is "compliant" when legal review hasn't been completed
- Collecting funds from users without proper money transmission licensing
- Any statement that implies you're "above" regulatory requirements

## Privilege Log
Maintain a privilege log of all attorney-client communications regarding legal risk. This demonstrates good faith compliance effort.

---
*This is legal research and intelligence, not legal advice. Consult qualified legal counsel before taking action.*