What should I include in a whistleblower submission to show I was directly involved?

If you helped design, operate, review or escalate a process connected to suspected money laundering or sanctions violations, your first-hand knowledge may matter to a regulator. But being close to the issue is not the same as proving direct involvement. A useful submission makes clear what you personally did, what you observed, when it happened and how your information can be checked.

This article focuses on the United States Bank Secrecy Act (BSA) whistleblower programme. Its rules changed substantially in 2022. The discussion is general information, not legal advice: eligibility, award calculations and retaliation claims depend on the facts and applicable law. Consider getting advice from a lawyer experienced in whistleblower matters before making a submission, especially if you are still employed or have access to confidential records.

What “directly involved” should mean in a submission

“Direct involvement” is not a magic phrase that guarantees eligibility or an award. The important distinction is between information you can support from your own role and conclusions you have drawn from second-hand accounts or public material.

For example, you might have personally reviewed transaction alerts, configured monitoring rules, approved a procedure, handled an escalation, prepared a Suspicious Activity Report (SAR) or documented a decision not to file one. Those activities can help explain how you came to know particular facts. They do not, by themselves, prove a violation or establish that you qualify for an award.

A strong account separates:

• What you personally did: your tasks, decisions, approvals, communications and access to relevant systems.
• What you personally observed: records, transactions, alerts, instructions or events you witnessed first-hand.
• What others told you: who said it, when, and whether you can identify a record or witness that corroborates it.
• What you infer: your explanation of why the facts may indicate misconduct, clearly labelled as your assessment rather than established fact.

That separation helps a regulator assess the source and reliability of your original information. It also avoids overstating what you know.

Why the 2022 overhaul matters

The Anti-Money Laundering Act of 2020, enacted as part of the National Defence Authorisation Act for Fiscal Year 2021, directed changes to the BSA whistleblower programme. In 2022, the BSA whistleblower provisions were amended to provide for awards and strengthen protections. The programme is administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the US Department of the Treasury.

In broad terms, the amended law provides that qualifying whistleblowers may receive an award when their original information leads to successful enforcement actions resulting in monetary sanctions above the statutory threshold. The programme is not a promise of payment for reporting. The regulator must assess the legal conditions, the value of the information and the outcome of enforcement proceedings.

The law also provides anti-retaliation protections and a federal cause of action for covered retaliation. Those protections are important, but they should not be treated as a guarantee that retaliation will not occur or that a claim will succeed. Timing, documentation, confidentiality and filing requirements can matter.

Mandatory awards and the $1 million sanctions trigger

Under the amended BSA framework, an award is generally mandatory if the statutory requirements are met and the relevant enforcement action results in monetary sanctions exceeding $1 million. “Mandatory” does not mean that every person who submits a tip receives money. It means that, once the required conditions are satisfied, the law directs an award within the applicable range.

The key threshold concerns the monetary sanctions resulting from qualifying enforcement actions—not the amount of suspicious activity, the size of a company or the whistleblower’s personal loss. A regulator must also determine whether the information is original, whether it led to the action and whether the claimant meets the programme’s requirements.

Do not assume that a submission about a serious issue will cross the threshold. Nor should you inflate figures or describe potential losses as sanctions already imposed. State the amounts you know, explain their source and distinguish estimates from confirmed figures.

What the 10 to 30 per cent award range means

For a qualifying award, the statutory range is generally 10 to 30 per cent of the monetary sanctions collected in the covered action or related actions. The percentage is not a fixed rate. The programme considers relevant factors, including the significance of the information, the extent of the whistleblower’s assistance and other factors set out in law and applicable rules.

Put simply, the range describes a possible share of collected sanctions, not a guaranteed percentage of a fine announced in a press release. Collection, eligibility and the award determination all matter. A person who provides useful evidence may still receive no award if the statutory conditions are not met.

Your submission should therefore focus on making the information usable and verifiable. Avoid negotiating with yourself in the document by claiming a particular percentage. Explain https://dlf-ne.org/what-are-the-biggest-policy-gaps-in-the-bsa-whistleblower-programme-right-now/ your contribution accurately and let the programme assess it.

Evidence that can show your direct involvement

Build a factual account around your role and the evidence you can lawfully identify. A concise chronology is often more useful than a long narrative full of conclusions.

Describe your role and access

State your job title, relevant responsibilities, reporting line and dates in the role. Explain what systems, processes or records you were authorised to use. If your duties changed, identify when and how. This context helps distinguish personal knowledge from assumptions.

Give a dated chronology

For each key event, record the date or approximate date, the people involved, what happened and how you know. For example: “On 14 March, while reviewing the queue assigned to me, I saw three alerts relating to the same customer. I escalated them to my manager through the case-management system.” Avoid vague descriptions such as “the company routinely ignored alerts” unless you can explain the period, examples and basis for that statement.

Identify non-public operational details

Non-public operational details can help a regulator understand how a control worked in practice, where it failed and who made relevant decisions. Depending on your role and the matter, this might include:

• how alerts were generated, assigned, reviewed and closed;
• the internal escalation route and the people responsible at each stage;
• specific control settings, review criteria or procedural exceptions;
• how a decision about SAR filing was documented or escalated;
• the dates and nature of instructions to change, suppress or override a review; and
• records that could corroborate your account, such as case references, emails, meeting notes or audit logs.

Explain why each detail matters. A list of technical terms without context may not help. If you do not know a setting’s exact value or a decision-maker’s motive, say so rather than guessing.

Connect your actions to the evidence

Show how you came across each fact. Did you review a case, sanctions violations whistleblower attend a meeting, receive an instruction or prepare a document? Identify the record or potential witness that could verify it. If a document exists, describe it precisely; do not suggest that you have attached it if you have not.

Keep original records intact. Do not alter, annotate or remove company documents, and do not access systems or take material you are not authorised to access. Legal obligations involving confidentiality, personal data, privileged material and record handling can be complex. Ask a lawyer how to preserve and describe evidence lawfully.

Original information: make the source clear

In this context, original information generally means information derived from your independent knowledge or analysis and not already known to the regulator from another source, subject to the programme’s rules and exceptions. Simply repeating a news report, a public enforcement release or an internal rumour may add little. Your submission should explain what you know that is not already public and how you learned it.

That does not mean every relevant fact must be entirely new. You may be able to add value by providing first-hand context, identifying records, explaining a process or pointing to evidence that allows investigators to test a public allegation. Be specific about what you contributed and avoid claiming sole credit if others also reported the matter or helped develop it.

Internal reporting channels and external submissions

Many firms have internal compliance reporting channels, such as an ethics line, a manager escalation route or a financial crime team. These channels may help the organisation investigate and address a problem. They are distinct from an external submission to a regulator, and reporting internally is not the same as submitting information to FinCEN or another government authority.

Whether to report internally, externally or both depends on the circumstances. Consider the seriousness and urgency of the conduct, the risk that evidence may be lost, whether people implicated control the internal process, your employment position and any applicable legal deadlines. Do not assume that an internal report automatically preserves a right to an award or satisfies an external programme’s requirements.

For BSA matters, SAR obligations belong to covered financial institutions and other regulated entities under the applicable rules. An employee’s concern about whether a SAR should have been filed is not, by itself, a determination that a violation occurred. Describe the facts you observed—such as a documented decision, a missed escalation or a pattern of handling alerts—and leave the legal conclusion to the regulator.

Before making an external submission, check the current FinCEN process and the programme’s instructions. A lawyer can help you understand whether you may submit anonymously through counsel, what disclosures are required and how your employment or confidentiality obligations may affect the process.

Retaliation: protect your position and document events

The amended BSA provisions include anti-retaliation protections for covered whistleblowing and a federal cause of action for a whistleblower who experiences prohibited retaliation. The protections do not prevent an employer from taking every adverse action, and a dispute may turn on the facts, the reason for the action and whether statutory requirements were followed.

Record employment events promptly and factually. Keep a personal chronology of relevant dates, communications and changes to duties or treatment. Do not copy confidential company information to a personal account or take material in a way that breaches policy or law. If you receive a warning, lose access, are demoted or are dismissed after raising concerns, obtain legal advice quickly: deadlines and procedural steps may apply.

Think about safety and practical risk before making a report. Confidentiality may have limits, and an employer or colleagues may infer who raised an issue from the facts. A submission should not promise anonymity unless the process and your circumstances support it.

A practical submission checklist

1. Identify the conduct: describe what happened without treating suspicion as proven fact.
2. Set out your role: explain your responsibilities, access and period of involvement.
3. Use a chronology: provide dates, events, participants and how you learned each fact.
4. Separate knowledge from inference: label what you saw, what you were told and what you conclude.
5. Highlight original information: explain what is non-public, first-hand or independently analysed.
6. Point to corroboration: identify records, case references, systems or witnesses that could verify the account.
7. Be precise about SAR issues: describe the handling or escalation you observed; do not claim a filing duty was breached unless you have a sound basis.
8. Preserve evidence lawfully: do not alter records or access or remove information without authority.
9. Consider retaliation and timing: document employment events and seek advice before deadlines become an issue.
10. Use the right channel: distinguish an internal compliance report from a formal external submission to a regulator.

Conclusion: make your contribution verifiable

The clearest way to show direct involvement is not to claim that you were “at the centre” of a problem. It is to show your role, give a dated account of what you personally did and observed, and identify the non-public operational details and records that can corroborate it. Be candid about what you do not know.

The BSA programme’s 2022 changes created a statutory award framework, including a 10 to 30 per cent range for qualifying cases with more than $1 million in monetary sanctions, as well as anti-retaliation protections and a federal cause of action. Those provisions do not guarantee an award or eliminate workplace risk. A careful, evidence-led submission—and timely legal advice where appropriate—can help a regulator assess your information without overstating your case.