What are the practical implications of BSA whistleblower reforms for law firms?

The Bank Secrecy Act (BSA) whistleblower programme is no longer a little-used feature of the United States’ anti-money-laundering framework. Reforms enacted in December 2022 made awards mandatory in qualifying cases, set an award range and strengthened protection against retaliation. For law firms, the change matters in two directions: lawyers may advise people considering a report, and they may help financial institutions assess whether their reporting arrangements and workplace practices create avoidable legal risk.

The reforms do not make every internal complaint an award-winning whistleblower disclosure. Nor do they override the rules governing Suspicious Activity Reports (SARs), which financial institutions must file in defined circumstances and whose existence and contents are generally protected from disclosure. The practical task for counsel is to explain the distinctions clearly, without promising a result that depends on the facts, the investigation and the government’s enforcement action.

What changed in 2022?

The BSA whistleblower programme was created in 2010, but its award structure was widely viewed as uncertain. The AML Whistleblower Improvement Act, enacted in December 2022, revised that framework. In qualifying cases, the Secretary of the Treasury must pay an award to an eligible whistleblower when the relevant enforcement action results in more than $1 million in monetary sanctions collected.

The award is generally between 10 and 30 per cent of the monetary sanctions collected in the covered action and any related action. The percentage is not automatic or fixed. The statute directs the Treasury Department to determine the amount, taking account of matters such as the significance of the information, the assistance provided and the programme’s objectives. An award may be reduced in specified circumstances, including where the whistleblower bears responsibility for the conduct at issue.

That is a meaningful change from a system in which an award was discretionary. But “mandatory” does not mean that every person who reports suspected misconduct will receive money. Eligibility, the quality and originality of the information, a successful enforcement outcome and the sanctions threshold all matter.

Issue Practical point for counsel Sanctions threshold The covered enforcement action must result in more than $1 million in monetary sanctions collected. Award range An eligible award is generally 10 to 30 per cent of sanctions collected, with the percentage determined under the statutory framework. Reporting route Internal reporting may be relevant, but it is not the same as submitting information to the government. Retaliation The law provides protections and a federal cause of action, but timing and evidence can affect a claim.

Why the $1 million trigger changes client advice

The threshold gives potential whistleblowers and their lawyers a concrete feature to assess, but not a reliable way to predict the outcome. The relevant figure is not simply the amount of suspicious activity, the value of a bank’s transactions or a proposed penalty. It is the monetary sanctions collected in a covered enforcement action. A report may contribute to an investigation that takes years, leads to no action, or results in sanctions below the threshold.

For whistleblower representation, early advice should therefore focus on the information and the process, not an estimate of a future award. Counsel should establish what the client knows firsthand, what records exist, how the information was obtained and whether it has already been reported. They should also identify potential eligibility issues, including the client’s role in the conduct and whether the information is genuinely useful and not already known to the government.

Lawyers should be careful not to equate the statutory award range with a promised recovery. Even if an enforcement action clears the threshold, the client may still need to meet the programme’s requirements, and the award percentage is determined by the relevant authorities. The timing of an award is also tied to enforcement and collection, not simply to the date a person makes a report.

Internal channels are not external submissions

A company’s internal compliance reporting channels and a submission to a regulator serve different purposes. Internal channels can help an organisation detect and address problems early. They can also create a record of what the company knew, when it knew it and how it responded. But telling a supervisor, compliance officer or general counsel does not, by itself, mean that information has been submitted to the Treasury Department or another regulator.

That distinction has direct consequences for client advisory work. An employee may believe that raising an issue internally is enough to preserve rights or qualify for an award. Counsel should explain that the BSA programme has its own submission requirements and that internal reporting alone is not a substitute for a qualifying government submission. At the same time, the statute treats internal reporting as relevant to the award process in appropriate cases. Advisers should verify the current Treasury procedures and the facts rather than assume that one route automatically helps or harms a potential claim.

For organisations, a well-designed internal channel remains important. A clear route to compliance staff, protection against retaliation, reliable escalation procedures and prompt investigation can help surface concerns before they become enforcement matters. But a policy that says employees must report internally should not be presented as eliminating their ability to approach regulators. Legal advice should take account of the law’s protections and the possibility that a person may make an external submission.

SAR obligations need separate handling

SAR obligations create a particular challenge for financial institutions and their advisers. A SAR is a confidential report made by a covered financial institution to the government about suspected activity that may indicate a legal or regulatory concern. The BSA generally prohibits a financial institution and its personnel from disclosing that a SAR has been filed, or from disclosing information that would reveal its existence, subject to limited legal exceptions.

The whistleblower reforms do not give an employee a general licence to disclose a SAR, identify its existence to a customer or take confidential material without regard to applicable law. Nor should a lawyer assume that information in a client’s possession can be shared externally simply because the client is considering whistleblowing. The proper treatment of SAR-related material depends on the client’s role, the information’s source and the rules that apply to the institution and the individual.

In practice, counsel should separate the underlying facts from protected reporting material. A person may have relevant information about transactions, controls or management decisions, but that does not settle whether they may disclose a particular SAR or documents revealing that one was filed. Specialist advice is especially important where a proposed submission could expose confidential customer information, privileged material or trade secrets.

Retaliation protections and a federal cause of action

The reforms also strengthen the position of people who face retaliation for protected whistleblowing activity. The BSA provides a federal cause of action for a whistleblower who alleges prohibited retaliation. Depending on the circumstances, remedies can include reinstatement, double back pay with interest, special damages and reasonable legal fees and costs.

These protections are significant, but they are not a guarantee that a retaliation claim will succeed. The person must show that the relevant conduct falls within the statutory protection and connect it to the employer’s adverse action. A poor performance history, a reorganisation or another stated reason for dismissal may become part of the lawyer-monthly.com dispute. So may the employer’s records of how it handled the report.

Timing matters. A potential whistleblower should consider how to preserve a clear record of the report, the response and any subsequent changes to duties, compensation, access or employment status. That does not mean secretly copying company systems or taking documents without advice. Unauthorised access or disclosure may create separate legal and employment risks. Counsel should discuss lawful preservation methods and applicable deadlines promptly, as delay can complicate both a retaliation claim and a whistleblower submission.

What law firms should review for institutional clients

For firms advising banks, money services businesses and other regulated clients, the reforms are a reason to test how the organisation handles concerns in practice, not just whether it has a written policy. Compliance program reviews should examine the whole reporting path: how a concern is received, who assesses it, how conflicts are managed and whether the person who raised it is protected from adverse treatment.

• Check the reporting routes. Confirm that staff can raise concerns with compliance or another appropriate function, including where their usual manager may be implicated.
• Test escalation and investigation. Review whether reports are assessed promptly, documented consistently and escalated when the concern involves senior personnel or possible systemic weaknesses.
• Review anti-retaliation practice. Look beyond policy wording to changes in roles, access, performance assessments and compensation after a report.
• Train managers and investigators. Staff should understand that a report can be made internally or externally and that retaliation can create separate legal exposure.
• Protect SAR confidentiality. Make sure investigation procedures do not lead staff to disclose the existence or contents of a SAR improperly.
• Coordinate legal, compliance and human resources teams. Clear responsibilities can reduce the risk of inconsistent responses or inadvertent retaliation.

These steps cannot prevent every external report or guarantee a favourable regulatory outcome. Their purpose is more practical: to help the organisation identify concerns, respond credibly and avoid making a difficult situation worse through poor process or retaliation.

Building whistleblower representation into practice

Law firms representing individuals should be ready to advise on both the submission and the employment relationship. That means assessing the client’s evidence, explaining the difference between an internal report and an external submission, considering SAR confidentiality, and discussing the risk of retaliation before a dispute develops. Where the client is still employed, advice about communications and document preservation should be specific and cautious.

Firms representing institutions face a different but related task. They should help clients maintain credible internal channels while avoiding policies or practices that appear to obstruct lawful reporting. If an employee raises a concern, the response should be documented and handled by people able to assess it fairly. A swift, impartial investigation does not erase the employee’s rights, but it can give the organisation a more reliable basis for deciding what action to take.

A more consequential programme, not a guaranteed payout

The 2022 reforms make the BSA whistleblower programme more consequential for potential reporters, employers and their lawyers. The mandatory award framework, 10 to 30 per cent range and $1 million sanctions trigger provide clearer statutory signposts than the earlier scheme. The strengthened retaliation provisions also make workplace response and recordkeeping central parts of the risk analysis.

For law firms, the practical implication is to give advice that is precise about routes, evidence, confidentiality and timing. Internal compliance reporting remains valuable, but it is distinct from a submission to regulators. SAR rules remain in force. And although the reforms create meaningful incentives and protections, no lawyer should suggest that reporting guarantees an award or shields a person from every employment or legal risk.