Can a Contractor File an AML Whistleblower Report?

Yes. A contractor may be eligible to submit an anti-money-laundering (AML) whistleblower report if they have original information about a qualifying violation of the Bank Secrecy Act (BSA) and meet the program’s other requirements. The law does not limit potential whistleblowers to direct employees of a bank or other financial institution.

That does not mean every tip qualifies for an award—or that every contractor has the same legal protections as an employee. The strength of a report depends on what you know, how you learned it, whether the information is genuinely new to the government, and whether it helps lead to a successful enforcement action.

This guide explains contractor eligibility, what “original information” means, which BSA violations may qualify, and practical steps to consider before reporting. It is general information, not legal advice for a specific situation.

What is the AML/BSA whistleblower program?

The BSA is the U.S. law that requires financial institutions and certain other businesses to keep records and help detect and report money laundering and other financial crimes. The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) administers key parts of the BSA, including the whistleblower program.

Under the program, an individual who voluntarily provides original information about a qualifying BSA violation may be eligible for a monetary award if that information leads to a successful enforcement action resulting in monetary sanctions above the statutory threshold. The law generally provides for an award of 10% to 30% of monetary sanctions collected, subject to the program’s rules and the facts of the case. An award is not automatic: FinCEN determines eligibility and the amount, and a report by itself does not guarantee an investigation, enforcement action, or payment.

The program is distinct from a financial institution’s obligation to submit a Suspicious Activity Report (SAR). A SAR is a confidential report that a covered institution files with FinCEN when it detects certain suspicious activity. An individual can provide information to FinCEN as a whistleblower; that is not the same as filing a SAR on behalf of an institution.

Legal origin and timeline

Congress created a BSA whistleblower framework in the Anti-Money Laundering Act of 2020, which was enacted as part of the National Defense Authorization Act for Fiscal Year 2021. Congress later expanded and strengthened that framework in the AML Whistleblower Improvement Act, included in the National Defense Authorization Act for Fiscal Year 2023 (NDAA FY2023), signed on December 23, 2022.

The 2022 law addressed incentives and protections for people who report suspected violations. It established the current statutory award range and added anti-retaliation provisions. The details of how the program applies to a particular report—including whether the information qualifies and whether an award is available—depend on the law and applicable FinCEN procedures.

Contractor eligibility: who can report?

The program is designed for individuals, not just an institution’s payroll employees. A contractor, consultant, vendor, or other service provider is not automatically excluded simply because they were hired under a contract rather than as an employee. Former workers may also have relevant information, provided they satisfy the applicable requirements.

For example, a contractor who helped a bank review transaction alerts might have firsthand knowledge that alerts involving a customer were repeatedly closed without meaningful investigation. A technology vendor could discover that a system was configured to suppress certain monitoring results. Those facts may be worth reporting if they relate to a possible BSA violation and the person has information that meets the program’s standards.

Eligibility can be more complicated where the person is a government employee, works for a regulator or law-enforcement agency, or learned the information through a role subject to special restrictions. The statute also limits eligibility in certain circumstances—for example, where a person is convicted of a criminal violation related to the enforcement action. These questions are fact-specific, so do not assume that a job title alone resolves eligibility.

Situation What it may mean Contractor or consultant with firsthand knowledge May qualify; contractor status alone does not disqualify the person. Employee or former employee May qualify if the information and reporting meet program requirements. Person who learned the facts through a restricted government role Special statutory limits may apply; get advice before submitting. Person who only repeats public allegations May not have qualifying original information unless an exception applies.

What counts as “original information”?

Original information is a central part of a potential claim. In broad terms, it is information that comes from the person’s independent knowledge or analysis, is not already known to the government from another source, and is provided voluntarily. The law also limits claims based solely on information that has already appeared in certain public proceedings, government reports, or news media, while recognizing exceptions in some circumstances.

“Independent knowledge” does not necessarily mean that you personally witnessed every event. It can include facts you learned through your work, such as reviewing internal transaction records, investigating alerts, testing controls, or seeing how a reporting decision was made. “Independent analysis” may include conclusions drawn from information that is not publicly available—for example, identifying a pattern across transaction data that suggests a monitoring control was being bypassed.

On the other hand, a general suspicion, an internet article, or a rumor repeated by a colleague may not be enough. The more specific and verifiable the information, the more useful it is likely to be. A clear account can identify what happened, when it happened, the business process involved, who had responsibility, and what records or witnesses may corroborate it.

Concrete example

Imagine a contractor supporting a bank’s transaction-monitoring team notices that alerts for a group of related accounts are routinely closed as “no issue,” despite repeated transfers just below an internal review threshold. The contractor has access to the alert history and can explain how the accounts were linked. That may be more than a generalized concern: it could be independently learned information relevant to possible suspicious activity or controls failures.

But the contractor should not take customer data or confidential records without authorization just to strengthen a report. The right way to openclassactions.com preserve and share evidence can be legally sensitive. Consider speaking with a lawyer before copying, downloading, or sending restricted material.

What kinds of BSA violations may qualify?

The program can cover information about a range of possible BSA violations. The underlying conduct—not simply the fact that someone filed a complaint—matters. Examples may include failures involving suspicious-activity reporting, recordkeeping, customer due diligence, or efforts to evade transaction-reporting requirements.

• Suspicious Activity Reports (SARs): Possible failures to detect, investigate, or report suspicious activity when required, or practices that undermine an institution’s SAR process. A contractor’s report to FinCEN is not itself a SAR filed by the institution.
• Structuring: Breaking transactions into smaller amounts to evade reporting or recordkeeping requirements. A report might describe an employee’s direction to divide transactions, or a known pattern designed to avoid required reporting.
• Customer due diligence (CDD): Possible failures to identify or understand customers and beneficial owners, assess risk, or maintain appropriate ongoing monitoring, where those failures relate to BSA obligations.
• Records and reporting: Possible failures to keep required records, maintain adequate controls, or make required reports—or conduct intended to conceal or falsify records.
• Sanctions-related conduct: Information about sanctions evasion may be relevant, particularly when it also connects to a BSA violation or falls within the program’s covered enforcement framework. Sanctions violations can involve separate legal regimes, so not every sanctions concern will qualify under the BSA whistleblower program.

A weak control, a mistake, or an unpopular business decision is not automatically a BSA violation. The relevant question is whether the facts may show conduct covered by the law, such as a failure to meet a legal obligation or an effort to evade it.

SAR confidentiality and other reporting risks

SARs are confidential. Federal law generally prohibits a financial institution and its employees from disclosing that a SAR was filed, or disclosing information that would reveal its existence, except in circumstances permitted by law. Do not attach a SAR or discuss its existence casually with coworkers, customers, or people outside authorized channels.

If you are a contractor, your agreement may also contain confidentiality, data-security, or intellectual-property terms. Those terms do not automatically answer whether a report is protected or what evidence you may share. Avoid using a work device, work email, or company messaging account to seek confidential legal advice or prepare a personal report if doing so could expose sensitive communications. Do not remove customer information or institutional records without legal guidance.

The whistleblower law includes anti-retaliation protections, but whether a specific contractor relationship falls within a protection—and what remedy may be available—can depend on the facts and legal interpretation. If you face threats, termination, reduced assignments, or other adverse treatment after raising concerns, document the events lawfully and speak with an attorney promptly. Deadlines may apply to retaliation claims.

How to prepare a report

FinCEN’s website, fincen.gov, is the official place to look for current information about the program and how to submit information. Check the site for the latest forms, instructions, and contact details rather than relying on an old form or a third-party summary.

Before making a report, organize what you know. Do not embellish, guess, or present conclusions as facts. Separate what you personally observed from what someone else told you. If you are unsure whether a record can be shared, describe its existence and location to your lawyer rather than taking or transmitting it without advice.

What to do next: a practical checklist

1. Write a private chronology. Note dates, people involved, processes, and what you personally observed. Keep it factual and distinguish firsthand knowledge from secondhand information.
2. Identify the possible violation. Consider whether the facts relate to SARs, structuring, CDD, required records, or another BSA obligation. Avoid assuming that a compliance concern automatically proves a violation.
3. Preserve information lawfully. Do not alter records, access systems without permission, or take confidential customer data. Ask a lawyer how to handle relevant evidence.
4. Consider independent legal advice. An attorney experienced in whistleblower matters can assess contractor eligibility, original information, confidentiality issues, and retaliation risks. Ask about representation and fees before sharing sensitive details.
5. Use official FinCEN instructions. Review the whistleblower information on FinCEN’s website and follow the current submission process.
6. Keep a record of your submission. Maintain a lawful copy of what you submitted and the date, while protecting confidential information and following your lawyer’s advice.

Bottom line

A contractor can potentially report BSA violations and may be eligible for an award. The key issues are not simply whether the person was an employee, but whether they voluntarily provide original information about covered conduct and whether that information contributes to a qualifying enforcement action. The law’s protections and procedures can be complex—especially when a report involves confidential SAR information, customer records, or a contractor agreement—so careful preparation and independent legal advice can help you understand your options.