What Should I Do Before Filing an AML Whistleblower Report?

If you have information about possible money laundering or another violation of U.S. anti-money laundering laws, pause before sending documents or details to a government agency. First, understand what the whistleblower program covers, preserve what you lawfully know, and consider getting legal advice.

That preparation matters. A report is not automatically eligible for an award just because it describes suspicious activity. The information generally must be original, sufficiently specific, and lead to a successful enforcement action that meets the program’s requirements. This guide explains what to check before filing and how to avoid common mistakes.

What Is the AML/BSA Whistleblower Program?

The Bank Secrecy Act (BSA) is the primary U.S. law establishing anti-money laundering and financial-recordkeeping obligations for many financial institutions and other covered businesses. The Anti-Money Laundering (AML) whistleblower program provides a way for people with original information about certain BSA violations to report it to the U.S. Treasury Department and potentially qualify for a monetary award.

The program is administered by the Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury Department. FinCEN’s website, fincen.gov, is the official source for program information, filing instructions, and updates. Pretty simple.. Check it directly before filing, because rules and procedures can change.

A whistleblower may be an employee, former employee, customer, contractor, or another person with relevant information. You do not necessarily need to work for the institution involved. But eligibility depends on the facts, the type of violation, the information provided, and the applicable legal requirements.

Legal Origin and Timeline

Congress created the current AML whistleblower framework through the Anti-Money Laundering Act of 2020, which was enacted as part of the National Defense Authorization Act (NDAA) for Fiscal Year 2021. Congress later amended and strengthened the framework through the NDAA for Fiscal Year 2023, signed on December 23, 2022.

The December 23, 2022 law addressed important features of the program, including award eligibility and protections. The framework allows for an award in qualifying cases when an individual voluntarily provides original information that leads to a successful enforcement action and the statutory conditions are met. An award is not guaranteed, and the agency determines eligibility under the law and its procedures.

Because implementation details may be updated, use FinCEN’s current guidance rather than relying only on old articles, summaries, or informal advice.

What Counts as “Original Information”?

“Original information” is a central concept. In general, it refers to information derived from your independent knowledge or analysis, not information already known to the government or simply repeated from public sources. The legal test can be fact-specific, so do not assume that one detail makes a report eligible or ineligible.

For example, consider an employee who notices that a business customer repeatedly sends funds through related accounts, while internal monitoring alerts are repeatedly closed without documented review. The employee’s first-hand observations, dates, transaction patterns, and knowledge of how the alerts were handled may be useful. Merely forwarding a news story about the customer, without adding independent facts, may be much less useful.

Information may come from direct observation, records you treasury bureau FinCEN were authorized to access, or analysis that connects facts in a meaningful way.

However, access to information does not always mean you are legally allowed to take or disclose it. Confidentiality rules, privacy laws, employment agreements, and other restrictions may matter.

Which Violations May Qualify?

The program concerns specified violations of the BSA and related laws. The following examples can be relevant, depending on the facts and the law in effect:

Suspicious Activity Reports (SARs): A SAR is a confidential report that certain financial institutions file with FinCEN to report transactions that may involve illegal activity or lack an apparent lawful purpose. Potentially relevant conduct may include failing to file a required SAR, filing late, or knowingly submitting a materially inaccurate report. The existence of suspicious activity does not, by itself, prove a violation.
Structuring: Structuring generally means breaking transactions into smaller amounts to evade reporting requirements. It can involve cash deposits or other transactions. A transaction near a reporting threshold is not automatically structuring; intent and surrounding facts matter.
Customer Due Diligence (CDD): CDD means steps covered financial institutions take to understand customers and assess money-laundering risk. Possible concerns might involve failures in required customer identification, beneficial-ownership procedures, risk assessment, or ongoing monitoring.
Recordkeeping and reporting: The BSA imposes certain obligations to keep records and make reports. Examples may include failures involving required records, transaction reports, or controls designed to support compliance.
Sanctions-related conduct: Facts involving transactions with sanctioned persons or entities may be relevant, particularly where they also implicate BSA obligations or other laws. U.S. sanctions are administered by the Office of Foreign Assets Control (OFAC), so not every sanctions concern necessarily falls within FinCEN’s whistleblower program.

These categories are not a substitute for legal analysis. A weak control, a mistake, or an isolated unusual transaction does not automatically establish a reportable violation. Focus on verifiable conduct and avoid making legal conclusions you cannot support.

Before Filing: A Practical Pre-Filing Checklist

Use this pre-filing checklist to organize your thinking. It is not a legal form, and completing it does not guarantee an award or any other outcome.

Document what you know. Write down what you personally observed, what you learned from records you were authorized to access, and what you are inferring. Label each category clearly.
Build a timeline. Record approximate dates, transaction periods, alert or review dates, escalation steps, and when you first raised a concern. Note where a date is uncertain rather than guessing.
Identify the conduct. Describe what may have happened in plain language. For example: “The same transaction pattern appeared in several accounts, and the related monitoring alerts were closed without an explanation.” Avoid declaring that a person committed a crime unless you have a reliable basis.
Identify who may have been involved. List relevant institutions, business units, customers, counterparties, and decision-makers, using names or roles only where you know them.
Separate facts from conclusions. A useful note might say, “I saw three cash deposits on these dates,” followed separately by, “I believe they may have been structured because…”
Note the source of each fact. Indicate whether a fact comes from direct observation, an authorized business record, a conversation, or public information. This helps assess what is original and what can be verified.
Record internal reporting history. Note whether you raised the issue internally, to whom, when, and what response you received. Do not alter or recreate records to make the history look more complete.
Check for corroboration. Identify other lawful sources that may confirm the concern, such as public filings or transaction records you are permitted to retain. Do not contact customers or suspected participants to investigate on your own.
Preserve, don’t collect indiscriminately. Keep a factual record of what you already know. Do not download, forward, photograph, or remove confidential files unless a lawyer advises that the specific action is lawful.
Review immediate risks. Consider workplace confidentiality policies, legal holds, privacy obligations, and any risk of retaliation or interference with an investigation.

Handling SARs and Confidential Information

SARs require special care. They are confidential, and laws and regulations restrict disclosure of a SAR or information that would reveal its existence. If your concern involves a SAR, do not casually copy, attach, or discuss the report itself with coworkers, the subject of the report, or anyone who is not authorized to receive it.

You may be able to report the underlying conduct without disclosing a SAR. For instance, you could describe the transaction pattern, the dates, the relevant alert process, or a suspected failure to follow reporting obligations—while avoiding disclosure of a SAR or information that identifies one. Whether a particular detail is protected can be nuanced. Talk to an attorney before sharing confidential material.

Do not use a work laptop, work email, or employer-controlled phone to research the issue or contact counsel. Use a personal device and personal account, while still following the law and your lawyer’s advice about handling any company information. Do not bypass access controls or take records you were not authorized to access.

Talk to an Attorney Before You File

For many potential whistleblowers, the most important next step is to talk to an attorney who handles whistleblower matters and understands BSA, SAR confidentiality, or financial-regulatory issues. A lawyer can help assess whether the conduct may fall within the program, whether your information may be original, and how to describe it without unnecessarily disclosing protected material.

Ask about the attorney’s experience with FinCEN whistleblower submissions, confidentiality, retaliation concerns, and any other reporting channels that may apply. You can explain the issue at a high level when arranging a consultation, but avoid sending sensitive records before the lawyer explains how to share them safely.

Legal advice is especially important if you are still employed by the institution, have access to nonpublic customer information, signed confidentiality agreements, participated in the conduct, or have already contacted a regulator or law enforcement agency. Do not assume that being a whistleblower automatically protects every disclosure or prevents workplace consequences.

What to Expect From a Report

A report should be clear, specific, and organized around facts the agency can evaluate. Include the who, what, when, where, and how. Explain why you believe the conduct may violate the law, but distinguish your interpretation from what you directly know. Identify records or witnesses that may help verify the account, without sending material you are not authorized to disclose.

FinCEN’s process may involve reviewing information and, where appropriate, coordination with other agencies. A person generally cannot control whether an investigation is opened, how long it takes, or whether it results in an enforcement action. An award depends on statutory requirements and a qualifying outcome; filing a report alone does not establish a right to payment.

Use FinCEN.gov to confirm current submission instructions and program details. If the facts involve sanctions, securities, tax, or another regulatory area, an attorney can help determine whether a separate reporting route may also be relevant.

What to Do Next

Write a private timeline and document what you know, clearly separating observation from inference.
Do not remove or distribute SARs, customer data, or confidential records without legal guidance.
Talk to an attorney before filing or contacting people who may be involved.
Review the current AML whistleblower information and instructions at fincen.gov.
Keep realistic expectations: eligibility and any award depend on the law, the quality and originality of the information, and the outcome of the government’s action.

A careful report is more useful than a rushed one. Start with accurate facts, protect information that may be confidential, and get legal advice before taking steps that could affect your rights or someone else’s privacy.