The SEC reaches out to the company to let them know they are considering an investigation (Wells Notice) and then decides if they want to do an investigation after they confirm issues.

Then they settle with the companies.

If settlement is large enough, whistleblower gets paid some too.

As the whistleblower is not the accuser in the civil charge, the company doesn't get to know who it was.