What is the simplest checklist for a potential AML whistleblower before filing a tip?

If you suspect a bank, payments firm or other financial institution is breaching anti-money laundering (AML) rules, deciding what to do can feel urgent. But a rushed tip, a copied file or a premature internal complaint can create avoidable legal and practical risks.

This checklist concerns the United States Bank Secrecy Act (BSA) whistleblower programme. It is general information, not legal advice. The programme’s rules are technical, and your role, evidence and timing can affect both protection and eligibility for an award. Consider speaking confidentially with a lawyer experienced in whistleblower cases before submitting anything.

The short checklist

1. Identify the conduct. Write down what you believe happened, who was involved, when it occurred and why it may breach the BSA or related rules.
2. Run the original information check. Ask whether you have specific, non-public facts or analysis that you can lawfully share—not just a suspicion or information already known to regulators.
3. Make a safe documentation checklist. Record what you observed and where relevant records are held. Do not remove, forward or access material without authority.
4. Choose a reporting route. Compare internal compliance channels with a submission to the Treasury Department, including its Financial Crimes Enforcement Network (FinCEN), or the Department of Justice (DOJ).
5. Check timing and retaliation risks. Consider internal investigations, regulator contact, employment deadlines and whether you need legal advice before your identity becomes known.
6. Keep expectations realistic. An award is not automatic, and a tip does not guarantee an investigation, payment or protection from every adverse consequence.

What changed in the BSA whistleblower programme?

The BSA requires certain financial institutions to maintain anti-money-laundering programmes and report specified suspicious activity to the government. Those reports are commonly called Suspicious Activity Reports (SARs). The institution’s SAR obligations are distinct from an individual’s decision to submit a whistleblower tip.

The Anti-Money Laundering Act of 2020 created a BSA whistleblower framework. Congress significantly revised it through the Anti-Money Laundering Whistleblower Improvement Act of 2022, enacted in December 2022. The revisions made awards mandatory for qualifying whistleblowers and strengthened anti-retaliation protections.

In broad terms, a qualifying person may be eligible for an award if original information leads to a successful enforcement action under the BSA or another covered law and the action results in more than $1 million in monetary sanctions. The statute provides for an award of 10 to 30 per cent of monetary sanctions collected, subject to the programme’s rules and the circumstances of the case.

“Mandatory” does not mean that every person who reports a concern receives money. The statutory conditions still have to be met. Regulators must obtain and collect qualifying sanctions, the information must meet the programme’s requirements, and award decisions are made under the governing rules. The $1 million figure is a sanctions threshold—not a promise of an award to every tipster, and not necessarily a measure of the institution’s total conduct.

1. Do the original information check

The first question is whether you can offer information that is both useful and eligible under the programme. The statutory concept of “original information” is more specific than “something I know”. It generally involves information derived from your independent knowledge or analysis, rather than information already known to the government from another source, subject to statutory exceptions.

Before filing, test your information against these questions:

• What did you personally see, do or analyse? Distinguish direct observations from what a colleague told you, your assumptions, or conclusions you have not tested.
• Is it specific? Dates, transactions, products, accounts, control failures, decision-makers and relevant business units may help explain the concern.
• Is it new to regulators? A public news report or an existing enforcement action may not be enough by itself. If you believe you supplied information earlier, keep a record of when, how and to whom.
• Can you explain the connection to a possible violation? Describe the conduct and facts. Avoid presenting a legal conclusion as established fact.

Do not try to improve a tip by guessing, conducting unauthorised searches or provoking a colleague into making statements. A clear account of what you know—and what you do not know—is more credible than an inflated claim.

2. Use a documentation checklist, not a data grab

Good preparation does not mean collecting every internal file you can reach. Financial records may contain customer data, confidential business information, privileged communications or SAR-related material. Accessing or disclosing them without authority can create serious risks, even where your underlying concern is genuine.

Start with a personal, factual chronology. Record dates, meetings, instructions, systems involved and the steps you took in your ordinary work. Separate facts you observed from your interpretation. Note potential witnesses by role or name, where appropriate, and identify records that may whistleblower tip timing exist without copying them.

Practical documentation checklist

• A dated timeline of relevant events and conversations.
• A plain-language description of the suspected conduct and why it concerns you.
• The names or roles of relevant teams, decision-makers and witnesses.
• Descriptions of potentially relevant records, their location and the system or business process involved.
• Notes of any internal report: date, channel used, recipient and response, if known.
• A record of any pressure, threats or adverse employment action, including dates and people involved.

Keep personal notes secure and do not move them to a work account or device if that could expose them to unauthorised access. Do not alter records, use another person’s credentials, bypass access controls, or take customer information to a personal device or email account. Ask a lawyer how to handle evidence before making copies.

Take particular care with SARs

A SAR is a confidential report made by a covered institution to the government. Federal law restricts disclosure of a SAR and information that would reveal its existence. If your concern relates to a SAR, do not attach the report, quote its contents or tell people that one was filed unless a lawyer confirms that the disclosure is permitted. You can often describe the underlying conduct without disclosing a SAR.

A whistleblower tip is not a substitute for an institution’s own obligation to assess and file SARs when required. Nor should an employee assume that an internal report automatically satisfies the institution’s reporting duties or that a regulator tip resolves them.

3. Compare internal channels with external submissions

Internal reporting can alert the organisation’s compliance team, preserve the chance to correct a control failure and create a record that you raised the concern. Possible routes include a manager, compliance or legal function, an ethics hotline, or a board-level channel. Check the organisation’s policy, but do not assume you must report internally before contacting a regulator.

Internal channels also have limits. The people receiving the report may be implicated, the organisation may not act, or your identity may become known. If you fear retaliation, have already been threatened, or believe evidence could be destroyed, obtain advice before deciding whether and how to report internally.

External submissions go to government authorities rather than the employer. The BSA programme is administered through the Treasury framework, with FinCEN playing a central role; the DOJ may also be relevant. Follow the current official submission process and provide accurate contact details through the authorised channel. A lawyer can help assess whether an anonymous submission is possible and how anonymity could affect follow-up or an award claim.

Route Potential benefit Questions to weigh Internal compliance channel May trigger a prompt review or corrective action and document that you raised a concern. Who receives the report? Is the channel independent? Could reporting expose you to retaliation or compromise evidence? External regulator or government submission Brings information directly to authorities and may preserve a route to whistleblower protections or an award, if statutory conditions are met. Which agency and process apply? Is the information eligible and lawful to disclose? What identity and timing rules apply?

You may have more than one route, but sequence matters. An internal investigation, an existing government inquiry and another person’s prior submission can affect how authorities assess the information. Do not delay solely to make an internal report if a lawyer advises that doing so could put you or the evidence at risk.

4. Understand the award range and the $1 million trigger

For qualifying cases, the award range is 10 to 30 per cent of monetary sanctions collected. It is not 10 to 30 per cent of the company’s revenue, the amount of a suspected transaction, or the total value mentioned in a tip. The relevant calculation depends on what sanctions are imposed and collected and on the programme’s award rules.

The percentage is not a fixed rate. Authorities consider statutory factors when setting an award, including the significance of the information and the whistleblower’s assistance. The award may be reduced or denied in circumstances set out by law. A tip that helps an investigation but does not lead to a qualifying action above the statutory threshold may not produce an award under this programme.

Do not make a disclosure solely on the assumption that it will result in payment. The process can take time, the government controls whether and how to bring an action, and a whistleblower cannot dictate the outcome. Ask counsel to check the current rules and any filing requirements that could affect eligibility.

5. Know the anti-retaliation protections—and their limits

The revised BSA framework prohibits specified forms of retaliation for protected whistleblowing activity. In general, covered employers may not discharge, demote, suspend, threaten, harass or otherwise discriminate against a whistleblower because of a qualifying disclosure or participation in a covered investigation.

The law also provides a federal cause of action in court for a person who believes they have suffered unlawful retaliation. Remedies can include reinstatement, back pay with interest, special damages and legal costs, subject to the statute and the facts. Deadlines and procedural requirements matter; the statute generally sets a short period—180 days—to bring a retaliation action after the alleged violation. Get legal advice promptly if adverse treatment occurs.

Protection is not a guarantee that retaliation will not happen, that every complaint will qualify, or that a court will find in your favour. Keep a contemporaneous record of employment changes, performance reviews, threats and explanations given. Avoid recording conversations or taking workplace material unless you have checked that doing so is lawful.

6. Think carefully about timing

Timing can affect evidence, employment risk and award eligibility. Before filing, consider whether regulators may already know about the conduct, whether an internal review is under way, and whether a colleague or former employee may have reported similar facts. Do not wait for perfect proof if you have a credible concern, but do not rush into an unsafe disclosure either.

If you are asked to sign a settlement, severance agreement or confidentiality clause, do not assume it can prevent a lawful report to government authorities. Have a lawyer review the wording. Keep copies of documents you are entitled to retain, such as your employment agreement and performance reviews, but do not take company or customer records without permission.

Before you press submit

Use this final check:

• Can you state the concern in a short, factual summary?
• Have you separated direct knowledge from assumptions and hearsay?
• Have you identified records without improperly collecting them?
• Have you protected SAR confidentiality and customer information?
• Have you considered internal and external routes without assuming one is compulsory?
• Have you checked the current filing process, timing and retaliation risks with a qualified lawyer?

A careful tip is accurate, focused and lawfully prepared. The simplest checklist is not “copy everything and report everywhere”. It is to preserve your own factual account, avoid unauthorised access or disclosure, choose a reporting route with advice, and act promptly if retaliation or a legal deadline becomes a concern.