Whistleblower policies: when does a NY charity need one?

When New York enacted Not-for-Profit Corporation Law Section 715-b, effective July 1, 2014, the legislature drew a clear line for charitable organizations operating in this state: if your nonprofit corporation or charitable trust employs twenty or more people and brought in more than one million dollars in revenue during the prior fiscal year, you are required to adopt a formal whistleblower policy, and you are required to oversee it as a governance matter rather than treat it as a perfunctory human resources filing. I want to walk you through what that mandate actually demands in daily operations, because the statute is written in the kind of compressed legal cadence that can make even seasoned executive directors pause before they feel they fully understand what compliance looks like in practice. The threshold question, however, is more layered than it first appears, and the answer changes considerably once you account for the overlapping protections of New York Labor Law Section 740, the implied private right of action recognized in Ferris v. Lustgarten Foundation, and the very real possibility that a small organization can be swept into the larger statutory regime through a joint employer relationship it never intended to create.

The N-PCL 715-b Threshold: When Formal Policies Become Mandatory

Section 715-b triggers an affirmative obligation when two conditions are met simultaneously. The first is a headcount test: the organization must have twenty or more employees at the relevant time. The second is a revenue test: the organization must have reported annual revenue in excess of one million dollars during the immediately preceding fiscal year. These are conjunctive requirements, meaning that an organization with nineteen employees but three million dollars in revenue is not required to adopt a policy under 715-b, and conversely, an organization with thirty employees but only nine hundred thousand dollars in revenue falls outside the statute as well. I raise this distinction because I often hear nonprofit leaders assume that revenue alone, or size alone, controls, and the statute is clearer than that.

For organizations that do cross both thresholds, the obligation is not a soft suggestion. The board must adopt a written whistleblower policy, must distribute it to every director, officer, key person, employee, and to volunteers who provide substantial services, and must designate a specific person — most often a compliance officer, an executive director, or a board officer — to administer the policy and report on its functioning to the full board. That administrator cannot be a fellow employee-director when board deliberations touch the policy's administration, and the person who is the subject of a complaint cannot be present during any board or committee discussion or vote concerning that complaint. These procedural guardrails are the substantive spine of 715-b, and they reflect a legislative judgment that the integrity of the reporting channel depends on visible structural separation between accuser, adjudicator, and subject.

A compliant whistleblower framework is not a document you file — it is a chain of governance decisions you can defend when asked who knew what, when, and what they did about it.

Core Components of a Compliant Whistleblower Framework

The statute does not prescribe exact policy language, but it does prescribe the categories of people who must be protected and the categories of conduct they must be protected for reporting. A policy that is functionally compliant will, at minimum, cover the following architectural elements.

Before I move to distribution logistics, I want to draw a line that the statute draws but that drafters routinely blur. The list of protected reporters and the list of people to whom the policy must be distributed are not the same list. 715-b protects every volunteer who makes a good-faith report, regardless of how many hours they contribute or whether they have been formally onboarded into a structured distribution channel. The substantial-services qualifier attaches only to the distribution requirement — that is, the organization must take affirmative steps to physically deliver the policy to volunteers who provide substantial services. A volunteer who contributes a few hours a month is no less protected when they surface a concern in good faith than a volunteer who is in the office every day, and the policy itself should say so on its face. I have watched organizations narrow their internal policies to mirror the narrower distribution list, and that narrowing is a mistake: it can leave a board defending a position that the statute does not actually support when a part-time volunteer files a retaliation claim and the organization's own document describes them as outside the protected class.

I want to emphasize the distribution requirement, because I have watched boards treat it as a formality. Distributing a policy is not the same as posting it on an intranet page that no one reads. The statute contemplates actual delivery to covered individuals, and I would encourage you to build a contemporaneous record of that distribution — a signed acknowledgment, a logged email, a moment in onboarding where the policy is reviewed and confirmed. When an organization later faces a retaliation claim, the documentation of distribution often becomes the difference between a defensible position and a problematic one.

The protection itself extends beyond the act of firing. 715-b prohibits retaliation, harassment, and adverse employment consequences, which means that subtle degradations of assignments, exclusion from meetings, shifts in performance evaluations, and changes to supervisory relationships can all be examined under the statute's umbrella. The legislative choice to write broadly reflects a recognition that retaliation in nonprofit life rarely arrives as a dramatic termination; more often it arrives as a slow cooling of opportunity.

Navigating the 'Joint Employer' Doctrine and Small Organization Risks

If your organization sits below the 715-b threshold, the natural assumption is that you have no compliance exposure under the statute at all, and for many small charities that assumption is correct. The Ferris v. Lustgarten Foundation decision, issued by the New York Appellate Division, Second Department on December 9, 2020, however, introduced a meaningful wrinkle. In that case, the court recognized that an implied private right of action exists under 715-b, meaning an employee can sue the nonprofit directly rather than waiting for the Attorney General to act. The same decision also established that a nominally small organization can be pulled into 715-b's reach if it operates as part of an integrated enterprise with an affiliated entity, and if the combined workforce across those entities meets or exceeds the twenty-employee threshold.

I have seen executive directors react to the joint employer doctrine with alarm, and I want to translate it into something more workable. The doctrine generally examines whether separate entities share common ownership, common management, shared offices, integrated operations, or centralized control over employment decisions. A small community foundation with eleven employees that shares its executive director, payroll, and office lease with a separately incorporated sister organization of twelve employees may, depending on the structure, find itself treated as a combined workforce of twenty-three. If that combined entity also clears the million-dollar revenue threshold, 715-b applies, and the question becomes not whether you need a policy but how quickly you can adopt one that meets the statute.

For executive directors of small organizations, my practical advice is straightforward. Map your affiliated entities on a single page. Identify shared personnel, shared premises, and shared governance. If the map shows meaningful integration, treat the 715-b threshold as a live question rather than a closed one, and consider adopting a policy voluntarily. The cost of a well-drafted whistleblower policy at a small organization is modest; the cost of defending against a retaliation claim without one is significantly larger.

Labor Law 740: Universal Protections Beyond the N-PCL Mandate

While 715-b governs a defined subset of larger nonprofits, New York Labor Law Section 740 governs virtually every employer in the state, including every charitable organization regardless of size, revenue, or staff count. The two statutes are complementary rather than duplicative, and they operate on different timelines and different standards. Section 740 protects employees and, since the January 26, 2022 amendments, former employees and independent contractors who report activity they reasonably believe violates a law, rule, or regulation.

The reasonable belief standard is the hinge on which many retaliation claims turn. Under amended Section 740, a reporter does not need to prove that an actual violation occurred; they need only demonstrate that their belief in a violation was reasonable under the circumstances they faced. For nonprofit leaders, this raises the practical floor of internal response. When a staff member surfaces a concern that they characterize as fraud, discrimination, safety violations, or misuse of charitable assets, the organization cannot wait for a final adjudication before taking protective steps internally. The reasonableness of the reporter's belief will be evaluated based on the information available to them at the time, not on what subsequent investigation reveals.

The 2022 amendments also extended the statute of limitations for retaliation claims to two years, introduced a civil penalty of up to ten thousand dollars per violation, and required employers to post a notice of whistleblower rights in the workplace. For New York City charities, that posting requirement is a small but visible compliance step that an inspector, a funder conducting a site visit, or a plaintiff considering litigation will look for. I would encourage you to confirm that your workplace posting is current, that it reflects the 2022 amendment language, and that it is displayed in the locations where your staff and volunteers actually gather.

Section 740 is not a question of whether your charity is covered — every nonprofit employer is — but a question of whether your internal response infrastructure can withstand scrutiny under the reasonable-belief standard.

The Private Right of Action: Lessons from Ferris v. Lustgarten Foundation

The Ferris decision deserves its own moment of attention because it reshaped the litigation landscape in ways that nonprofit counsel are still working through. By recognizing an implied private right of action under 715-b, the Second Department opened a pathway for aggrieved employees to bring suit directly, without waiting for regulatory intervention, and without relying solely on Section 740. The case also signaled that courts will examine organizational structures with care when the question is whether the statutory thresholds have been satisfied.

For boards, the practical implication is that compliance with 715-b is not a static achievement. The policy that satisfied the statute when you adopted it may need to be revisited when your workforce crosses twenty, when a sister organization is added to your operational map, when a new affiliated entity begins sharing administrative functions, or when your revenue profile shifts. The board's oversight obligation under 715-b is ongoing, and the minutes that record your adoption of the policy should also record your periodic review of whether the statute continues to apply on the same terms.

For executive directors, the practical implication is that even an organization that believes it is below the threshold should still ask itself whether the conditions that triggered Ferris — joint operations, integrated workforces, common management — are present. If the answer is yes, the question of whether to adopt a policy voluntarily turns from a discretionary matter into a risk-management priority.

Building a Strategic Roadmap for Compliance and Advocacy

I want to leave you with a sequenced approach that I have found useful in practice, and that reflects the full arc of what 715-b, Section 740, and the Ferris decision together require.

1. Confirm the threshold question with current data. Pull your most recent headcount and prior-year revenue figures and document the calculation, with the date and the source. If you fall below both thresholds, you are not required to adopt a 715-b policy, but Section 740 still applies, and your workplace posting must reflect the 2022 amendments.

2. Map your affiliated entities. Identify any shared ownership, shared management, shared premises, or shared employment functions with separate legal entities. If integration is present, evaluate whether the combined enterprise might be viewed as meeting the 715-b threshold under the joint employer doctrine.

3. Adopt or refresh the policy with governance-grade drafting. Ensure the policy names the full protected-class list — directors, officers, key persons, employees, and volunteers — without narrowing the volunteer category to those who provide substantial services. Name prohibited adverse actions, designate an administrator who reports to the board, and explicitly address recusal for employee-directors and complaint subjects. Keep the policy's protected-reporter language and the distribution schedule in separate, clearly labeled sections so that the two cannot be conflated.

4. Distribute with documentation. Provide the policy to every covered individual — directors, officers, key persons, employees, and volunteers who provide substantial services — and retain a record of that distribution. Consider a short acknowledgment form signed at onboarding and during annual policy refreshes.

5. Build the internal response infrastructure. Identify who receives a complaint, how complaints are logged, how investigations are scoped, how the board is informed, and how the complainant is protected during the inquiry. The reasonableness of your response under Section 740 will be measured against the infrastructure you had, not the infrastructure you wished you had.

6. Engage in periodic board review. Treat the policy as a standing governance item, not a one-time adoption. Reconfirm thresholds annually and revisit the policy text when the statute, the case law, or your operational footprint changes.

New York's whistleblower framework is, at its core, an invitation to charitable organizations to take the integrity of their reporting channels seriously, regardless of whether the statute formally obligates them to do so. The organizations that navigate this terrain most effectively are not the ones that adopt the longest possible policy document; they are the ones that can answer, in real time, who would receive a concern, how it would be investigated, how the board would be informed, and how the reporter would be protected during the process. That is the operational meaning of compliance under 715-b, and it is also the operational meaning of resilience under Section 740. The threshold question matters, but the operational answer matters more.