Picture this: a loan officer pulls a supervisor aside and says she believes a colleague has been steering customers toward products that violate federal consumer protection rules. The supervisor, caught off guard, reports the concern to Human Resources. HR, not sure what to do, suggests the loan officer sign a confidentiality agreement before anyone investigates further. When performance reviews come around a couple months later, the loan officer receives her first negative evaluation in five years.
That seemingly unassuming sequence of events could potentially expose your organization to a whistleblower retaliation claim. This area of law in recent years has shifted significantly in favor of employees. Financial institutions should be mindful of these evolving rules as their employees are subject to additional protections than those applicable to most employers in Indiana.
The laws that apply to banks
Most employers tend to focus on standard discrimination and retaliation claims. While banks face those same issues, they also have more to consider, such as two federal statutes that create separate whistleblower protections specific to the banking and financial services industry.
The Depository Institution Employee Protection Remedy is a whistleblower protection law that broadly applies to employees of insured depository institutions who provide information to a federal regulator regarding a possible violation of law or “gross mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety.”112 U.S.C.S. § 1831j
The Sarbanes-Oxley Act, passed in 2002 in the wake of the Enron and WorldCom scandals, prohibits employers from retaliating against employees who report what they reasonably believe to be fraud, securities violations or violations of any rule of the Securities and Exchange Commission.2Sarbanes-Oxley Act of 2002, 18 U.S.C. § 1514A (2002). The Consumer Financial Protection Act goes further and is especially relevant to community banks. Section 1057 therein protects employees who report potential violations of any federal consumer financial protection law to their employer, the CFPB, or any federal, state, or local law enforcement agency.3Consumer Financial Protection Act § 1057, 12 U.S.C. § 5567. In practice, that means an employee who raises concerns about fair lending practices, Truth in Lending Act disclosures,4Truth in Lending Act, 15 U.S.C. § 1601 et seq. (1968). Real Estate Settlement Procedures Act requirements,5Real Estate Settlement Procedures Act of 1974, 12 U.S.C. § 2601 et seq. (1974). or similar issues is a protected whistleblower from the moment they make that report.6Dodd-Frank Wall Street Reform and Consumer Protection Act, 12 U.S.C. § 5567 (2010).
The law got harder for employers
In February 2024, the United States Supreme Court issued a unanimous ruling in Murray v. UBS Securities, LLC that significantly lowered the bar for employees bringing whistleblower claims under Sarbanes-Oxley.7Truth in Lending Act, 15 U.S.C. § 1601 et seq. (1968).
Prior to the Murray ruling, courts generally interpreted the statutory framework to require an employee to prove that the employer acted with actual retaliatory intent, meaning the desire to punish the employee for “blowing the whistle” had to be a driving force behind the adverse employment action. The Supreme Court rejected that stringent standard and ruled that a whistleblower need only show that the protected activity was a contributing factor in whatever negative employment action followed the complaint.8Id.
The range of protected activity at a financial institution is broader than many managers realize.
In practice, this means that if a supervisor knew about an employee’s whistleblower complaint and a negative employment action followed within a reasonable time, that alone may be enough to shift the burden to the bank to prove it would have taken the same action regardless. Even if the bank can carry that burden, the cost of getting there can still be significant.
A warning on confidentiality agreements
In July 2024, the CFPB issued agency guidance that explicitly warned employers that use of overly broad confidentiality or non-disclosure agreements can itself violate Section 1057.9Consumer Financial Protection Bureau. (2024, July 24). Consumer Financial Protection Circular 2024-04: Whistleblower protections under CFPA Section 1057.
The CFPB reasoned that when an employee participates in or is aware of an internal investigation and is asked to sign an agreement restricting discussion of the matter, they may reasonably view that as a warning not to report concerns to regulators. Depending on the wording of the agreement, the CFPB could treat this chilling effect as a form of discrimination against a potential whistleblower.10Id.
Financial entities routinely use confidentiality and non-disclosure agreements in the context of employment investigations, separations and severance arrangements. If those agreements do not expressly carve out the right to communicate with regulators and government agencies, they may create additional legal exposure on top of the underlying issues being investigated.
What counts as protected activity at a bank
The range of protected activity at a financial institution is broader than many managers realize. An employee’s concerns about a potential violation do not have to be correct or even well-founded. In fact, employees only need a reasonable belief that a violation occurred. Courts have treated a wide range of conduct as protected activity, including reporting pressure to misstate information on loan documents, raising concerns about fair lending compliance, objecting to fee practices believed to violate TILA, and refusing to carry out tasks the employee believed were unlawful.11See Lysik v. Citibank, N.A., No. 16-cv-8949, 2017 WL 4164037 (N.D. Ill. Sep. 20, 2017).
In addition to reports made to outside regulators, internal complaints to a manager or to HR are also protected under Sarbanes-Oxley and CFPA. This is particularly important for community banks, where employees are far more likely to raise concerns internally before contacting the FDIC or CFPB.
The stakes
A successful whistleblower claim under Sarbanes-Oxley or the CFPA can carry significant consequences. For instance, remedies under Sarbanes-Oxley may include reinstatement, full back pay, compensatory damages for emotional distress and payment of the employee’s attorney’s fees.1218 U.S.C. § 1514A(c). CFPA complaints are initially filed with OSHA, but if the Department of Labor does not resolve the matter within 210 days, the employee can take the case to federal court.1312 U.S.C. § 5567(c); 29 C.F.R. § 1985.114(a)(2). These are not minor disputes, but rather high stakes claims that can quickly become expensive to defend.
What banks should do now
Banks should start with their confidentiality and severance agreements. Any agreement that does not expressly preserve the employee’s right to contact the CFPB, FDIC, SEC or other government agencies should be revised.14CFPB Circular (2024). The CFPB advised that an employer can reduce risk by ensuring agreements expressly permit employees to communicate freely with government enforcement agencies.
Banks should also train supervisors and HR staff to recognize and properly document whistleblower complaints. An employee does not have to use formal language or say the word “complaint;” a casual comment to a manager about a lending practice that seems unusual can be enough. Once a supervisor is aware of a concern, any adverse action affecting that employee needs to be carefully documented and justified on grounds independent of the complaint.
Finally, banks should review internal complaint and investigation processes. A bank that oversees complaints well is not just reducing legal risk but is also able to catch and address compliance problems early before they compound and develop further.
The rules around whistleblower retaliation have never been more favorable to employees. For community financial institutions, where a single piece of litigation can consume significant management time and resources, getting ahead of these issues is worth the effort.
Information in this article is provided for general information purposes only and does not constitute legal advice or an opinion of any kind. You should consult with legal counsel for advice on your institution’s specific legal issues.
