Suspicious activity reporting and whistleblower reporting can concern the same suspected financial crime, but they are not the same process. A financial institution may have a legal duty to report suspicious activity to the US government. Separately, an employee or other individual may provide information to regulators about possible breaches of the Bank Secrecy Act (BSA) or related anti-money laundering laws.
That distinction matters in practice. A suspicious activity report (SAR) is a confidential regulatory filing made by an institution or other covered business. A whistleblower tip is information supplied by a person to a government agency. An internal compliance report, meanwhile, is raised through an organisation’s own channels. These routes can overlap, but one does not automatically replace the others.
For compliance teams, the challenge is to manage overlapping requirements: investigate and escalate concerns internally, meet any external reporting duties, protect SAR confidentiality, and avoid conduct that could be seen as obstructing a person’s communication with regulators. For prospective whistleblowers, the key points are that awards may be available in qualifying cases, but eligibility depends on statutory conditions and outcomes that no one can promise in advance.
Three reporting routes, three different purposes
Route Who reports? Main purpose Internal compliance channel An employee or another person using the organisation’s reporting process To alert the organisation so it can assess and address a concern SAR filing A financial institution or other covered business To report qualifying suspicious activity to the relevant US authorities Whistleblower tip An individual providing information to a government agency To alert regulators or law enforcement to possible violations and, in eligible cases, seek an awardA SAR is not a general-purpose account of every compliance concern. The filing obligation depends on the rules applying to the particular institution and activity. A whistleblower tip can cover alleged misconduct more broadly, including failures to meet reporting or anti-money laundering obligations. The same facts may be relevant to both processes, but the legal tests and recipients differ.
What changed in the BSA whistleblower programme?
The BSA whistleblower provisions were substantially revised by the Anti-Money Laundering Whistleblower Improvement Act, enacted as part of the National Defense Authorization Act for Fiscal Year 2023 in December 2022. The changes followed criticism that the earlier programme offered limited financial incentives and did not provide sufficiently strong protection against retaliation.
The revised framework provides for awards to eligible individuals whose original information leads to a successful enforcement action with more than US$1 million in monetary sanctions. It also strengthens protections against retaliation. The programme is administered by the US Department of the Treasury, with the Financial Crimes Enforcement Network (FinCEN) playing a central role in BSA matters.
The reforms make the programme potentially more significant for people with information about money laundering, sanctions evasion, or other covered financial misconduct. They do not, however, turn every report into an award claim. A tip must satisfy the statutory requirements, and the information must contribute to a qualifying enforcement result.
The US$1 million sanctions trigger and mandatory awards
The headline threshold is more than US$1 million in monetary sanctions. Broadly, the award provisions apply where a whistleblower’s original information leads to a successful covered action that results in monetary sanctions above that threshold. Related actions may also be relevant under the statute.
Where the legal conditions are met, the statute directs that an award be paid. That is an important change from a scheme in which an award could be discretionary. But “mandatory” does not mean that every claimant receives money, nor does it guarantee a particular amount. The person must first qualify, the information must meet the statutory tests, and a covered action must produce the required sanctions.
For example, an employee who identifies a suspicious pattern internally may have useful information. But if the issue is resolved without a covered enforcement action, or the action does not cross the sanctions threshold, the award provisions may not be engaged. The result depends on the facts and the regulator’s process—not simply on whether the concern was serious.
What does the 10 to 30 per cent award range mean?
For a qualifying award, the statutory range is generally 10 to 30 per cent of the monetary sanctions collected in the covered action or actions. The percentage is not calculated from the value of the suspicious transactions, the institution’s revenue, or a headline penalty that has not been collected. The relevant figure is tied to monetary sanctions collected under the programme’s rules.
The range leaves room for the authorities to assess the contribution and circumstances of a particular case. The quality, significance and usefulness of the information may matter, as may the claimant’s assistance and any role the claimant played in the misconduct. The percentage is therefore not fixed at 30 per cent, and a person should not treat the top of the range as an expected outcome.
- 10 per cent is not an automatic minimum payment: the person must be eligible and an award must be approved. 30 per cent is not a promised share: it is the top of the statutory range, not a standard rate. The underlying information matters: a tip must be original and must lead to the relevant successful action. The enforcement result matters: without qualifying collected sanctions above the threshold, the award mechanism may not apply.
Internal reporting and external tips can overlap
Internal compliance channels can help an organisation identify a problem early, preserve records and meet its own legal obligations. They may also give employees a practical way to raise concerns without immediately approaching a regulator. But internal reporting is not the same as making a whistleblower submission to Treasury or another government authority.
Nor should an organisation assume that requiring staff to use an internal channel first will prevent them from contacting regulators. The BSA whistleblower provisions prohibit employers from taking steps to impede an individual’s direct communication with the Treasury or the Department of Justice about a possible violation. That restriction can reach confidentiality agreements and other workplace arrangements when they are used to block protected communications, subject to applicable legal limits such as attorney-client privilege.
There may also be circumstances in which an internal report and a later external report interact for award purposes. The timing and treatment of information can be important, including where an organisation subsequently reports information that an employee first raised internally. Anyone considering a submission should check the current programme requirements rather than assume that an internal report preserves a particular claim or deadline.
SAR confidentiality needs separate attention
SARs are confidential. Federal law generally bars a financial institution and its personnel from notifying a person involved in the reported transaction that a SAR has been filed. SAR information is also subject to restrictions on disclosure. These rules protect investigations and the reporting system; they are not simply internal preferences that can be waived in a staff policy.
At the same time, SAR confidentiality should not be used as a blanket reason to prevent an employee from reporting suspected wrongdoing to the government. The distinction is between communicating relevant facts to an authorised authority and improperly disclosing a confidential SAR or its protected contents. The detail can be legally sensitive, so an individual should not assume that copying a SAR into an external submission is permitted.
Organisations should give staff clear, legally reviewed guidance on how to raise concerns without revealing restricted material. Individuals should take particular care with SAR documents, references to a filing, customer information and investigative material. If in doubt, seek advice from a lawyer familiar with BSA confidentiality rules and the whistleblower programme before sharing documents.
Retaliation protections and a federal cause of action
The 2022 reforms strengthened anti-retaliation protections for people who lawyer-monthly.com provide information or assist in a covered investigation or proceeding. Prohibited conduct can include dismissal, demotion, suspension, threats, harassment, or other discrimination connected to protected activity.
The law also provides a federal cause of action for a whistleblower who believes an employer retaliated unlawfully. This gives the individual a route to seek legal remedies through the statutory process. It is not a guarantee of success: the person must meet the relevant legal requirements, and timing and procedure matter. A prospective claimant should obtain prompt legal advice about deadlines, evidence and the correct steps to take.
Retaliation risk should be considered before, during and after a report. Keep a careful record of relevant events, including the date and content of reports, changes to work responsibilities, performance reviews and communications about the concern. Do not remove confidential business records or SARs in an attempt to preserve evidence; doing so can create separate legal problems.
Practical steps for compliance teams
Separate the processes. Document who assesses internal concerns, who decides whether a SAR is required, and who handles regulator communications. Train managers not to obstruct reporting. Staff should not be threatened or told that they are barred from contacting government authorities. Protect SAR confidentiality. Limit access to SARs and related information, and give staff specific guidance on what may be shared externally. Preserve a reliable record. Record concerns, investigation steps, decisions and escalation dates in a way that supports audit and regulatory review. Address retaliation promptly. Treat adverse employment action following a report as a matter requiring careful review, not as an ordinary personnel issue by default.Practical points for potential whistleblowers
A person considering whistleblower tips should distinguish what they personally know from what they suspect, preserve lawful evidence, and avoid taking documents they are not entitled to access. They should also consider whether the issue involves privileged material or confidential SAR information. Independent legal advice can help with submission procedures, confidentiality, retaliation concerns and the effect of any internal report.
There is no need to assume that an internal channel is always the right first step, or that an external submission will automatically lead to an investigation or award. The safest route depends on the facts, the applicable law and the risk of retaliation. In some cases, timing is critical; delaying advice while an investigation or employment decision unfolds can narrow a person’s options.
The bottom line
SAR obligations and the BSA whistleblower programme address related but distinct responsibilities. A covered institution may have to file a confidential SAR. An individual may separately report suspected violations to government authorities and, if the statutory conditions are satisfied, qualify for an award. The 2022 overhaul created a mandatory award framework for qualifying cases above the US$1 million sanctions threshold, with awards generally ranging from 10 to 30 per cent of collected monetary sanctions.
Neither internal reporting nor a SAR filing should be treated as a substitute for understanding the other routes. Institutions need procedures that meet reporting duties without blocking whistleblower communications. Individuals need to protect confidential material, consider retaliation and act with an understanding of the programme’s timing and eligibility rules. The overlap is real; the processes remain legally distinct.