FinCEN Issues Proposed Whistleblower Rule to Incentivize AML Reporting and Compliance

The Financial Crimes Enforcement Network (FinCEN) on April 1, 2026, published a Notice of Proposed Rulemaking (Proposed Rule) regarding regulations implementing the whistleblower provisions of the Bank Secrecy Act (BSA). The lengthy Proposed Rule sets forth details regarding how whistleblowers, including compliance professionals, may seek an award if they voluntarily provide original information to the U.S. Department of the Treasury or U.S. Department of Justice (DOJ) that results in a successful enforcement action relating to the BSA or other covered statutes.

FinCEN already has been accepting whistleblower tips for many years through its whistleblower program webpage.  The Proposed Rule seeks to formalize the program and implement years-old statutory mandates imposed by the Anti-Money Laundering Act of 2020 (AMLA). The announcement of the Proposed Rule was accompanied by the rollout of an additional Treasury Department webpage regarding whistleblower reporting.

The Proposed Rule highlights the many issues facing would-be whistleblowers and employers and the tensions that can exist between compliance staff and management. The Proposed Rule also underscores the government's interest in gathering and pursuing whistleblower tips and difficulties businesses can face when attempting to assess and respond to such complaints. Prompt action is increasingly important and, as always, avoiding retaliation is critical. For whistleblowers, meaningful insider knowledge is valuable, but that same knowledge may lead to culpability issues that reduce or prevent a potential award or even invite potential prosecution.

Statutory Provisions

The AMLA amended the BSA to expand whistleblower incentives and strengthen protections. Specifically, the AMLA amended 31 U.S.C. § 5323 to provide that if the government recovers more than $1 million through an AML or related enforcement action, any qualifying whistleblower will receive a mandatory reward of up to 30 percent of the collected amount of "monetary sanctions."

The U.S. Congress added teeth to these provisions by passing in 2022 the Anti-Money Laundering Whistleblower Improvement Act (Improvement Act). First, the Improvement Act entitled whistleblowers to an award of between 10 percent and 30 percent of the value of "monetary sanctions" above $1 million collected as a result of an enforcement action. Second, the Improvement Act created a "Financial Integrity Fund" to pay for whistleblower awards, which can hold up to $300 million. The fund receives monetary sanctions collected by the Treasury Department Secretary or U.S. Attorney General through BSA enforcement or enforcement of certain provisions of the International Emergency Economic Powers Act (IEEPA), Trading with the Enemy Act and Foreign Narcotics Kingpin Designation Act.

The Proposed Rule

Original Information

To qualify for an award, the whistleblower must provide "original information" derived from either the whistleblower's 1) "independent knowledge," which cannot relate exclusively to information derived from publicly available sources, or 2) "independent analysis," which can rest on publicly available information "so long as it results in material insights into or interpretations of the significance of such information that are not generally known or available to the public." Further, neither the Treasury Department nor DOJ can be aware already of the whistleblower's information.

A whistleblower will need to submit an elaborate proposed form, FinCEN's Tip, Complaint or Referral form (Form TCR), for all initial submissions of information. A whistleblower may choose to proceed anonymously and/or without an attorney.

120-Day Waiting Period for Management Insiders and Compliance Personnel

One of the most unusual and interesting things contained in the Proposed Rule is a requirement that a whistleblower must wait 120 days from the date they obtained the information before providing it to FinCEN if they obtained their information because they are a management insider (an officer, a director, trustee or partner) or learned the information through the entity's audit and compliance program functions, either as an internal employee or employee of a firm retained to perform such functions. The NPRM explains:

The rationale for requiring these categories of individuals to wait before reporting their original information to FinCEN is to provide entities that invest in strong internal audit and compliance programs the opportunity to benefit from such programs. The waiting period provides these entities the opportunity to review and assess information that could relate to a violation of a covered statute and, where they deem it appropriate, address and/or voluntarily disclose the information to the government. Furthermore, the waiting period is calibrated to help avoid any incentive for whistleblowers to undermine effective audit or compliance programs while minimizing any potential harm from delayed reporting of tips to law enforcement.

This timing requirement, if finalized, clearly incentivizes entities to try to correct and/or disclose potential compliance failures quickly. This requirement could create some tense workplace dynamics between compliance staff and management: The 120-day window might prove short for serious/systemic violations, and it will put significant pressure on those tasked with investigating the potential violations, including in-house compliance staff and/or in-house or outside counsel. For employers, the 120-day window creates a particularly high-risk period during which employers must be cautious to avoid taking any adverse action against the reporting employee that could be perceived as retaliatory.

Voluntariness

A whistleblower must "voluntarily" provide information. This means that the whistleblower must submit their information prior to receiving a formal (e.g., a subpoena or other compelled process) or informal (a noncompulsory demand) request for information regarding the issue by Congress, law enforcement, a regulatory agency or self-regulatory organization. Further, in some circumstances – to be explained in future public guidance – the whistleblower must provide their information prior to a similar request for information to the whistleblower's employer. This is a critical issue that will need clear explication and has the potential to create a Catch-22 for would-be whistleblowers who are subject to the 120-day waiting period described above because disclosure of the potential violation by the entity may draw a government request for information.

Determining the Award and Ineligibility Rules

For a "covered action" to result in an award, it must be an action resulting in "monetary sanctions" exceeding $1 million in a single judicial or administrative action brought by the Treasury Department or DOJ under one of the covered statutes. Further, recoveries through "related actions" accompanying successful "covered actions" also count toward the calculation of "monetary sanctions." Related actions are simply other enforcement actions based upon the whistleblower's original information. For example, a securities enforcement action might accompany an IEEPA enforcement action.

"Monetary sanctions" include penalties, fines, settlement payments, disgorgement and interest. However, "monetary sanctions" do not include blocked property, forfeiture, restitution or victim compensation payments. The exclusion of forfeiture proceeds from this definition is particularly problematic from the perspective of the whistleblower because historically, many BSA/AML enforcement action penalties have had a large forfeiture component.

FinCEN will apply three statutory criteria when determining whether to issue an award: 1) the significance of the information provided by the whistleblower to the success of the covered or related action, 2)degree of assistance provided by the whistleblower in the covered or related action, and 3)programmatic interests of the Treasury Department or DOJ in deterring the violation(s) at issue.

If a whistleblower is eligible for an award due to a successful "covered action," they are entitled to no less than 10 and no more than 30 percent of the collected "monetary sanctions." If there are multiple whistleblowers, FinCEN will make separate awards to each whistleblower, using its discretion as to each one's share, which collectively must be within the 10 percent to 30 percent range. If collected monetary sanctions are $15 million or less, there is a rebuttable presumption that the award will be the maximum amount of 30 percent, depending upon the whistleblower's conduct.

In addition, the Proposed Rule provides that FinCEN has discretion to modify the amount of the award by considering the whistleblower's role with respect to an entity's internal compliance or reporting systems, as well as "the lawful considerations and conclusions of an appropriate agency or authority, or a self-regulatory organization relating to the whistleblower and the covered action."

A whistleblower's culpability and timing are important. A whistleblower is ineligible for an award if they are convicted of a crime relating to the matter at issue. Potential criminal (or civil) liability is not a bar to receiving an award – only an actual conviction prohibits receipt. However, when setting the amount of an award, FinCEN has discretion under the Proposed Rule to modify the amount due to the whistleblower's perceived culpability or involvement in the underlying violation(s), as well as whether the whistleblower "unreasonably delayed reporting the violations." Further, and as always, would-be whistleblowers with a degree of culpability must consider if they are exposing themselves to potential prosecution by drawing government attention to themselves.

A whistleblower is ineligible if they lie, obstruct or mislead in their submission or during related dealings with the government. Further, a whistleblower is ineligible if they obtained their information "by a means or in a manner that is determined by a United States court to violate applicable Federal or state criminal law." This rule will generate issues regarding whistleblowers who misappropriate information from their employers.

A whistleblower is also ineligible if they obtained their information through a communication subject to attorney-client privilege or work product doctrine, "unless the disclosure is otherwise permitted by the applicable Federal or state law and/or attorney conduct rules." Although this rule appears to be directed primarily at attorneys themselves, this provision likely will create issues involving employees who receive privileged communications from in-house or outside counsel.

Although a claimant may appeal a final decision by FinCEN to deny an award, a claimant has no ability to appeal the amount of any award issued. Further, "decisions regarding the investigation or prosecution of allegations made by whistleblowers … are at the discretion of Treasury or DOJ. Such decisions are not considered determinations or dispositions … and are not appealable[.]"

Anti-Retaliation

The Proposed Rule also includes anti-retaliation provisions that prohibit an employer from retaliating against an employee who alleges compliance violations. Retaliation is defined broadly to include discharge, demotion, suspension, threats, harassment and other changes to the terms and conditions of the employee's employment. It also includes employees who report potential violations internally to the employer whether or not the employee submits a formal complaint. A whistleblower alleging retaliation may file a complaint with the U.S. Department of Labor and potentially sue the employer in federal district court. Similarly, no one may try to impede another from attempting to communicate with the Treasury Department or DOJ about any possible violations of the covered statutes.

Employers should take note that anti-retaliation protections apply regardless of whether the whistleblower's underlying tip ultimately results in a successful enforcement action or an award. This means that an employer can face liability even if the employee's complaint is ultimately unsubstantiated, as long as the employee had a reasonable belief that a violation occurred.

Other Whistleblower and Corporate Voluntary Disclosure Programs

The Proposed Rule acknowledges the existence of several other whistleblower programs, such as DOJ's pilot whistleblower program, as well as related programs administered by the U.S. Securities and Exchange Commission and Commodities Futures Trading Commission. If the FinCEN whistleblower has received or may receive an award through a separate program, FinCEN may decide to award less than 10 percent of the collected monetary sanctions as long as the combination of all awards would not be less than 10 percent of the total monetary sanctions.

The Proposed Rule further acknowledges that companies already are affected by other programs encouraging voluntary self-disclosure, including DOJ's Corporate Enforcement and Voluntary Disclosure Policy, the voluntary self-disclosure policy of DOJ's Nation Security Division, Office of Foreign Assets Control's enforcement guidelines encouraging self-disclosure and voluntary self-disclosure process under the Outbound Investment Security Program executive order. Companies facing a potential whistleblower complaint may need to simultaneously navigate multiple programs.

Prior Whistleblower Tip History and New Standard Forms

During the five years that have elapsed between Congress passing the AMLA and FinCEN issuing the Proposed Rule, FinCEN already has received many whistleblower tips and applications. The Proposed Rule sets forth the following chart reflecting that the number of tips has risen significantly since the passage of the AMLA but leveled off since 2023, the year in which FinCEN received the most tips and applications:

Going forward, the Proposed Rule would require Form TCR for all initial submissions of information. Form TCR contains 48 questions, ranging from simple (e.g., the applicant's name) to complex (a request for the whistleblower to upload any supporting documents, describe in detail the availability and location of additional evidence not in the whistleblower's possession, and describe how and from whom they obtained the information supporting the complaint). FinCEN has emphasized its desire for a standardized form. Form TCR will be submitted to FinCEN through a secure online portal and receive a unique reference number.

The proposed Form TCR requests the whistleblower to select the option that best describes the nature of the tip: 1) violations or evasion of U.S. economic sanctions, 2) violations of the BSA, 3) violations of the Data Security Program regulations (enacted to implement Executive Order (EO) 14117, "Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern"), 4) violations of the Outbound Investment Security Program regulations (enacted to implement EO 14105, "Addressing United States Investments in Certain National Security Technologies and Products in Countries of Concern") or 5) a catchall option for other matters not captured by the above categories.

Form TCR then sets forth further options, depending upon which category the whistleblower selected, as to the details of the tip (e.g., if the sanctions option was selected, the whistleblower is asked to select the relevant industry and sanctions program; if the BSA option was selected, the whistleblower is asked about the violation at issue, as well as the type of financial institution).

Form TCR finally requires the whistleblower to declare under penalties of perjury that the information provided is true, correct and complete to the best of their knowledge. The form also requires any counsel for the whistleblower to similarly certify.

There is a second proposed form: Application for Award for Original Information Submitted Pursuant to 31 U.S.C. 5323 (Form WB-APP). A whistleblower who provided information submits a Form WB-APP to actually claim an award based upon a successful action(s). Like Form TCR, Form WB-APP contains 48 questions, including whether the applicant submitted the same information to DOJ or another part of the Treasury Department, why the applicant believes they are entitled to an award, whether the submission of original information occurred after a related contact from FinCEN or other authority, and whether the applicant is under criminal investigation.

Again, timing is important. The Proposed Rule provides that "a whistleblower must submit an application for an award based on a covered action to FinCEN no later than ninety (90) calendar days after the relevant notice of covered action was first published." As to related actions, a whistleblower must submit an application for an award based on a related action no later than one 180 calendar days after either 1) the date on which the relevant notice of covered action was first published on a Treasury Department website or 2) the successful enforcement of that related action.

Moreover, a whistleblower must be vigilant: "whistleblowers would bear complete responsibility for monitoring for whether and when a relevant notice of covered [or related] action has been published. Accordingly, Treasury and DOJ are not required to contact whistleblowers directly to alert them to the publication of notices of covered [or related] actions."

Request for Comments

FinCEN is requesting comment on a variety of topics, including the clarity and organization of the Proposed Rule, how to define a "covered action," the appropriateness of the ineligibility criteria, timing requirements and criteria for determining an award amount.

Takeaways

Although the Proposed Rule is new, employers have faced whistleblower liability for years, including for potential BSA and sanctions violations. In part, the Proposed Rule has more new practical implications for would-be whistleblowers, given all of its proposed procedural requirements, rather than for employers, which should continue to implement traditional controls to best protect themselves from liability and legitimate whistleblowers from retaliation. Nevertheless, the Proposed Rule's financial incentives will almost certainly increase the volume of employee complaints and externals reports, and employers in the financial services, financial technology and other regulated industries should prepare for a more active whistleblower landscape.

Nonetheless, the proposed 120-day delay for insiders reporting information highlights the need for employers to respond promptly to a compliance complaint. This is often easier said than done because a careful and accurate internal investigation can take time, and a hasty decision to self-report to the government or not can turn out later to rest on incomplete or incorrect information.

Although assessing situations involving potential whistleblowers can be very difficult, here are some basic considerations that employers should continue to apply:

• Employers should ensure that compliance staff have adequate resources and authority. Failures to do so are often highlighted in enforcement actions. Sufficient compliance staffing and resources will reduce the chances of underlying violations occurring, as well as resulting complaints. Investing sufficient authority in compliance staff will reduce the chances of internal tensions with management and potential perceptions by compliance staff that they need to act or arguably overreact on the basis of self-preservation. Compliance staff can be in the unenviable position of having the most detailed and direct knowledge of potential violations and may resent perceived managerial indifference.
• Employers should remember that anyone can become a whistleblower, and they do not always reveal their status. Regardless of whether a whistleblower succeeds in obtaining an award, an investigation triggered by a complaint can present many challenges.
• Employers should ensure that they have robust policies outlining complaint mechanisms for employees and protecting whistleblowers from retaliation for reporting, in good faith, allegations of company wrongdoing. Employers should train their employees regularly on these policies and, for anyone with supervisory authority, ensure that such training encompasses the prohibition against retaliation and mechanisms by which employees can report concerns.
• Employers should clearly document, in real time, any decision to terminate, discipline or demote an employee, including the legitimate, nonretaliatory business reasons supporting such decision. The timing of the decision and protected activity are often the center of litigation, and the timing can be problematic in the absence of evidence that establishes the employer made the decision prior to the protected conduct and/or for unrelated reasons.
• Employers and their legal counsel should understand that with the proliferation of government whistleblower programs incentivizing timely reporting, it is important to investigate and assess internal complaints as swiftly and as accurately as possible. This includes determining whether to retain an outside investigator or legal counsel to conduct the investigation. Decisions regarding whether to self-report to the government can be extremely difficult and require the government to send a message that voluntary reporting is truly rewarded.

For questions about FinCEN’s proposed whistleblower regulations, anti-money laundering compliance or related enforcement risks, please contact the authors or your Holland & Knight relationship attorney.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.