When did the new BSA whistleblower rules start?

The short answer is 23 December 2022. That is when the whistleblower changes in the Anti-Money Laundering Whistleblower Improvement Act of 2022 became law, as part of the National Defense Authorization Act for Fiscal Year 2023.

But the programme did not begin from scratch in 2022. Congress first created a Bank Secrecy Act (BSA) whistleblower programme in 2021, through the Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act for Fiscal Year 2021. The 2022 amendments strengthened that earlier scheme, particularly by establishing a more definite award framework and strengthening protections against retaliation.

That distinction matters for potential whistleblowers and the organisations whose conduct they may report. The legal changes took effect when enacted, but they did not turn every internal report into a regulator submission, guarantee an award, or remove the practical risks of speaking up. The details of the individual’s information, the route it takes and the outcome of any enforcement action all matter.

The timeline: a programme that evolved in two stages

Stage Date What changed Initial programme 1 January 2021 The Anti-Money Laundering Act of 2020 created the BSA whistleblower framework. Strengthened programme 23 December 2022 The 2022 amendments revised awards and retaliation protections.

The 2022 law is often described in connection with the NDAA 2022, but the naming can cause confusion. The relevant whistleblower improvements were enacted in the National Defense Authorization Act for Fiscal Year 2023, signed on 23 December 2022. The original programme had been enacted in the previous legislative cycle, in 2021.

So, when asking when the “new rules” started, the clearest answer is: the 2022 improvements took effect on 23 December 2022. The wider programme has a longer history, beginning with the 2021 legislation.

What the 2022 amendments changed

The original programme allowed awards for certain people who provided original information that led to successful enforcement action under the BSA or related laws. The 2022 amendments addressed a major weakness in that framework: the uncertainty about whether funding would be available to pay awards.

Under the amended scheme, an eligible whistleblower may receive an award when their original information leads to a successful enforcement action resulting in more than US$1 million in monetary sanctions. The law provides for an award of between 10% and 30% of the monetary sanctions collected in qualifying actions, subject to the statutory criteria and the relevant authority’s assessment.

The amendments also strengthened anti-retaliation protections. They provide a federal cause of action for a whistleblower who suffers prohibited retaliation, allowing the person to bring a claim under the statutory framework. That is important, but it should not be mistaken for an assurance that retaliation will not happen or that a claim will succeed.

How the $1 million sanctions trigger works

The $1 million figure is a threshold for a qualifying enforcement action, not a payment promised to a whistleblower. In broad terms, the award provisions apply where the whistleblower’s information leads to a successful action and the monetary sanctions imposed exceed $1 million. The relevant award is calculated by reference to sanctions collected, rather than being a fixed percentage of a company’s headline penalty.

This distinction can be important in practice. A large announced penalty does not necessarily mean the same amount has been collected. Nor does a report automatically qualify simply because it concerns a serious compliance failure. The statutory tests still need to be met, and the information must have the required connection to a successful action.

The legislation’s reference to monetary sanctions can cover qualifying amounts in related actions, depending on the circumstances and applicable rules. But a potential whistleblower should not assume that every settlement, penalty or compliance undertaking counts towards the threshold. The facts and the law governing the particular action need to be assessed.

What does the 10% to 30% award range mean?

The range is a statutory framework for awards, not a standard rate. It means an eligible whistleblower may receive an award of at least 10% and no more than 30% of the monetary sanctions collected in qualifying enforcement actions. The precise amount depends on the applicable criteria and the circumstances of the report and enforcement outcome.

In practical terms, an award is contingent on several steps: the person must provide information that qualifies under the law; the information must lead to a successful enforcement action; the action must meet the monetary-sanctions threshold; and sanctions must be collected. The existence of a whistleblower programme does not guarantee that any of those steps will occur.

Nor should the percentage be read as a reliable estimate of a particular person’s eventual payment. Several factors can affect the outcome, including whether the information was original, how useful it was to the investigation, and whether the person falls within statutory exclusions. The award decision is not simply a matter of multiplying an announced penalty by a chosen percentage.

Why the mandatory-award change matters

The 2022 amendments are significant because they establish a statutory award framework for qualifying cases rather than leaving potential awards dependent on an uncertain funding arrangement. That is a meaningful change in the programme’s design. It is not, however, a guarantee of payment: the eligibility requirements and enforcement outcomes remain decisive.

Internal reporting is not the same as reporting to a regulator

Financial institutions commonly maintain internal compliance reporting channels. Staff may use those channels to raise concerns with a manager, compliance team, legal function, ethics hotline or other designated contact. These systems can help a firm identify how to report beneficial owners problems early, investigate them and meet its legal obligations.

But an internal report is not automatically a submission to the US government. Reporting a concern to an employer and providing information to a regulator are different acts. The BSA whistleblower programme concerns information provided through the relevant government process; an internal report alone should not be assumed to qualify for an award or to satisfy any regulator-submission requirements.

That distinction is particularly relevant when the issue involves Suspicious Activity Reports (SARs). Covered financial institutions may have obligations to detect and report suspicious activity through SAR processes. A worker who believes those obligations have been breached may use internal channels, contact government authorities or consider both routes. But the existence of an internal SAR process does not itself make an employee a whistleblower under the federal award programme.

• Internal channel: Raises a concern within the organisation and may trigger an internal review.
• External submission: Provides information to the relevant government authority under the applicable whistleblower process.
• Separate duties: A firm’s SAR obligations and an individual’s whistleblower options are related topics, but they are not interchangeable.

Anyone considering a report should take care not to access, copy or disclose information unlawfully. SARs and related materials may be subject to strict confidentiality requirements. The right reporting route can depend on what the person knows, how they obtained it and which laws apply. Specialist legal advice may help clarify those issues before action is taken.

Anti-retaliation protection: important, but not risk-free

The 2022 amendments strengthened protection against retaliation and established a federal cause of action for a whistleblower subjected to prohibited conduct because of protected activity. This gives a potential claimant a statutory route to seek legal redress. The availability and success of a claim will depend on the facts, the law and any deferred prosecution agreement AML procedural requirements.

Legal protection does not prevent an employer from taking action in the first place. Retaliation can be difficult to identify and prove, particularly where an employer gives another reason for a decision. Timing may also matter: a person who waits too long may face deadlines or other procedural obstacles. Someone who believes they have been retaliated against should keep a careful record of relevant events and seek advice promptly.

Confidentiality also needs careful handling. A whistleblower should not assume that their identity will always remain unknown or that every detail of a submission will be kept from the organisation under investigation. The protections and procedures depend on the law and the circumstances of the case. Avoiding unnecessary discussion, preserving relevant records lawfully and obtaining advice can help a person make informed decisions.

What this means for compliance teams

For firms, the programme’s evolution is a reason to make internal reporting channels clear, accessible and credible. A well-designed channel can help staff raise concerns without unnecessary delay. It should also be supported by consistent investigation practices, appropriate confidentiality controls and a clear prohibition on retaliation.

Internal channels are not a substitute for meeting external legal duties. If information raises a concern about potential BSA violations or SAR obligations, the organisation should assess its responsibilities under the law and follow its established escalation procedures. It should not discourage staff from making lawful external submissions or imply that internal reporting is the only permitted route.

Compliance teams should also avoid promising employees that they will qualify for a federal award, or that a report will remain anonymous in every circumstance. Those outcomes depend on legal requirements and facts that the employer may not control.

Practical questions to ask before reporting

1. What do I know first-hand? Distinguish direct knowledge from assumptions or information heard from others.
2. What reporting route am I considering? An internal channel and an external submission serve different purposes.
3. Could confidentiality rules apply? Take particular care with SAR-related information and other restricted material.
4. What records can I preserve lawfully? Do not remove or disclose documents without considering the rules that govern them.
5. Is there a retaliation concern or deadline? Seek legal advice early if employment action has occurred or appears likely.

The bottom line

The 2022 BSA whistleblower amendments started on 23 December 2022, when the National Defense Authorization Act for Fiscal Year 2023 became law. They strengthened a programme first created in 2021, setting out a 10% to 30% award range for qualifying cases involving more than $1 million in monetary sanctions and adding a federal cause of action for prohibited retaliation.

The programme’s evolution matters, but it is not a promise of an award or immunity from workplace risk. Internal compliance reports are distinct from submissions to regulators, and SAR confidentiality rules require particular care. Anyone weighing a report should focus on the statutory requirements, the available evidence, the reporting route and the timing—and should obtain independent legal advice where appropriate.