Is Internal Reporting Protected Activity Under the AML Whistleblower Law?

Often, yes—but internal reporting and qualifying for a whistleblower award are not the same thing. The federal Anti-Money Laundering (AML) whistleblower law can protect certain employees who report suspected violations to their employer, including through a compliance function. But an internal report by itself generally does not satisfy the separate requirement to provide information to the federal government to qualify for an award.

The distinction matters if you work in a bank, money services business, or another covered organization and discover possible money laundering, sanctions evasion, or suspicious transaction reporting failures. The rules are fact-specific, and deadlines may apply if you believe you have faced retaliation.

What Is the AML/BSA Whistleblower Program?

The Bank Secrecy Act (BSA) is the main federal law requiring financial institutions to help detect and prevent money laundering. The AML whistleblower program lets people provide information about certain BSA and related violations to the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) or the U.S. Department of Justice (DOJ). In some circumstances, a whistleblower whose information leads to a successful enforcement action may be eligible for a monetary award.

The law also provides anti-retaliation protections. In general, an employer may not take certain harmful actions against a whistleblower because https://bizzmarkblog.com/what-counts-as-original-information-for-an-aml-whistleblower/ the person engaged in protected activity. That can include reporting suspected misconduct through an internal channel, depending on the circumstances and the applicable statutory protections.. (my cat just knocked over my water)

FinCEN’s website, fincen.gov, is the federal source for information about the program, reporting procedures, and current guidance. This program is separate from an institution’s own suspicious activity reporting obligations. For example, a Suspicious Activity Report (SAR) is a confidential report that a covered financial institution may be required to file with FinCEN. An employee’s internal report about a possible SAR failure is not itself a SAR.

Legal Origin and Timeline

Congress created the AML whistleblower framework in the Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act (NDAA) for Fiscal Year 2021. The original law established an award and anti-retaliation framework for people who provide information about certain violations of the BSA and related laws.

On December 23, 2022, Congress enacted the NDAA for Fiscal Year 2023, which included the AML Whistleblower Improvement Act. Among other changes, the 2022 legislation strengthened the program, including its protections and award framework. As a result, it is important to distinguish the current amended law from early summaries based only on the original 2020 provisions.

The core provision is found at 31 U.S.C. § 5323. The details of how it applies to a particular internal report can depend on what was reported, to whom, when, and what happened afterward. If you are considering a report or believe you have experienced retaliation, get advice about your specific facts rather than relying on a general summary.

Does Reporting Internally Count as Protected Activity?

Internal reporting can be protected activity under the AML whistleblower law. The amended statute includes protection for certain lawful disclosures to an employer about conduct the employee reasonably believes is a violation. This is significant for employees who raise concerns through a supervisor, an ethics hotline, an AML officer, or a compliance function.

Protection does not necessarily depend on whether the employee is correct about the suspected violation. The law focuses in part on whether the employee had a reasonable belief and acted lawfully. But not every workplace complaint qualifies. A concern about poor management, for example, is not automatically protected under the AML statute unless it relates to conduct within the law’s scope. Other whistleblower or employment laws may also apply, depending on the facts.

Internal reporting may be especially relevant in AML work because employees often first identify problems through transaction monitoring, customer onboarding, sanctions screening, or https://dlf-ne.org/can-former-employees-file-a-bsa-whistleblower-claim/ a review of account activity. A concrete example: an analyst notices that repeated transactions appear designed to avoid reporting thresholds, raises the issue through an internal escalation channel, and later faces a demotion. The report and the employer’s response would need to be assessed under the law, including whether the concern was reasonably held and whether the adverse action was connected to the report.

Internal reporting is not the same as reporting to FinCEN or DOJ

For an award, the person generally must provide qualifying information to the government through the process established by the statute. Telling a manager or the compliance function alone is not the same as submitting information to FinCEN or DOJ. Internal reporting may be protected against retaliation while still being insufficient, on its own, to establish eligibility for an award.

This distinction can matter in practice. A person may report internally first, report to the government later, or choose not to report internally. Whether and how to make a government submission is a separate decision with procedural and legal consequences. Do not assume that an internal hotline report has been forwarded to FinCEN, or that it preserves any deadline for a federal submission.

Eligibility and “Original Information”

Not everyone who raises an AML concern will qualify for an award. Eligibility depends on the statutory requirements and the circumstances of the submission. In general, the program is aimed at individuals who voluntarily provide the government with original information about covered violations, and whose information contributes to a successful enforcement action resulting in the required monetary sanctions.

“Original information” generally means information based on the person’s independent knowledge or analysis that is not already known to the government from another source, subject to statutory exceptions. Information does not necessarily have to be a complete proof of wrongdoing. A useful report may identify specific transactions, control failures, records, systems, or people that investigators can examine.

There are limits. Information already available to the government or derived solely from certain public sources may not qualify. Some people involved in wrongdoing, people who obtained information through certain roles or processes, and people with specified legal or compliance responsibilities may face restrictions or special rules. The answer depends on the statute and the person’s role; being a compliance employee does not automatically settle eligibility either way.. Pretty simple.

Also, “voluntary” has a legal meaning. A report may not be considered voluntary if it is made after a government request, examination, or other event described in the law. Timing can therefore matter. The award program is not a guarantee of payment: an award depends on statutory criteria and the outcome of an enforcement action.

What Violations May Qualify?

The program covers information about specified violations of the BSA and related laws. Common AML-related issues may include:

• SAR violations: Failing to file a required Suspicious Activity Report, filing it late, or submitting a report that is materially deficient. A report about a suspected institutional failure is different from an employee personally filing a SAR.
• Structuring: Breaking up transactions to evade applicable reporting requirements. For example, a customer may make a series of cash deposits in amounts designed to avoid a reporting threshold. The specific facts matter; a pattern alone does not prove a violation.
• Customer due diligence (CDD): Failures involving required customer due diligence, including applicable beneficial ownership identification and risk-based controls.
• Records and reporting: Violations involving required records, transaction reporting, or other BSA obligations.
• Sanctions-related conduct: Certain conduct involving sanctions evasion or violations of laws administered by the Office of Foreign Assets Control (OFAC) may fall within the program’s coverage, subject to the statute and applicable rules.

These examples are not a checklist for deciding that a violation occurred. A missed alert, unusual transaction, or control weakness may warrant review without necessarily establishing a legal violation. Whistleblowers should describe what they observed and avoid overstating conclusions they cannot support.

How Internal Reporting and the Compliance Function Fit Together

Financial institutions typically have procedures for escalating potential AML issues. Those may include a manager, AML investigations team, BSA officer, ethics hotline, or compliance function. Using an established channel can create a record that the concern was raised and give the institution an opportunity to investigate. But internal procedures do not replace federal rights or requirements.

Employees should be careful with confidential information. SARs and information that would reveal whether a SAR was filed are subject to strict confidentiality rules. Do not copy, disclose, or send SAR material to personal accounts or unauthorized recipients. If you have questions about what can lawfully be shared, get legal advice before moving documents. The rules for reporting wrongdoing do not give a blanket license to disclose protected customer information or take records you are not authorized to retain.

What to Do Next: A Practical Checklist

1. Write down the facts. Record dates, transactions, control steps, and what you personally observed. Separate firsthand knowledge from assumptions or secondhand information.
2. Use authorized channels carefully. Review your employer’s reporting procedures and consider an appropriate internal channel, such as compliance or an ethics hotline. Keep a lawful record of when and how you raised the concern.
3. Protect confidential information. Do not forward SARs, customer records, or other restricted material to a personal email or device. Ask a lawyer how to preserve relevant information lawfully.
4. Consider independent legal advice. A lawyer experienced in whistleblower matters can help assess protected activity, eligibility, confidentiality, and whether a government submission is appropriate.
5. Check current government guidance. Review FinCEN’s whistleblower information at fincen.gov. Do not assume an internal report has been sent to the government.
6. Act promptly if retaliation occurs. Keep a timeline of relevant events and get advice quickly. Whistleblower claims can involve strict filing deadlines and procedural requirements.

Bottom Line

Reporting suspected AML misconduct internally can be protected activity under the amended AML whistleblower law, including when an employee raises concerns through a compliance function. But internal reporting alone generally does not satisfy the separate government-reporting requirements for an award. The protection, award eligibility, confidentiality rules, and available remedies depend on the details—including what was reported, how it was reported, and what followed.

This article is general information, not legal advice. For the current program details, consult FinCEN’s official materials and a lawyer familiar with the AML whistleblower statute.