What should compliance officers tell staff about going to FinCEN vs using the hotline?

Staff should understand two things at once: an internal hotline can help an organisation identify and address a problem, but it is not a substitute for reporting concerns to the authorities. In the United States, the Bank Secrecy Act (BSA) whistleblower programme gives qualifying individuals a route to provide information to the Treasury Department or the Department of Justice (DOJ), with FinCEN administering the programme. The law also protects certain reporting and prohibits retaliation.

That does not mean every concern belongs in a regulator’s inbox, or that a tip guarantees an award. But compliance officers should not suggest that staff must use the hotline first, promise that internal reporting will keep a matter confidential, or imply that external reporting is forbidden. A sound message explains both routes, the limits of each, and the risks of retaliation and delay.

The short version for staff

You may report internally. Use the hotline or another designated channel to raise suspected misconduct. The organisation should explain how reports are handled and how to escalate a concern if the usual route is unsuitable.
You may also report externally. Qualifying information can be provided to the relevant authorities, including through FinCEN’s whistleblower programme. The law does not generally require staff to report internally before going to the authorities.
There may be legal protections and a potential award. Eligibility depends on the facts and the statutory requirements; neither protection nor payment should be presented as automatic.
Do not disclose suspicious activity report information. A suspicious activity report (SAR) is subject to strict confidentiality rules. Staff should report the underlying concern through appropriate channels, not reveal whether a SAR has been filed or disclose its contents.

What changed in the BSA whistleblower programme?

The Anti-Money Laundering Act of 2020 created a whistleblower framework under the BSA. Congress strengthened it in 2022 through the Anti-Money Laundering Whistleblower Improvement Act, enacted as part of the National Defense Authorization Act for Fiscal Year 2023. The changes lawyer-monthly.com addressed a central weakness in the original framework: the uncertainty around whether qualifying whistleblowers would actually receive an award.

Under the amended programme, the Treasury Secretary must pay an eligible whistleblower an award when the statutory conditions are met. The award is generally between 10 and 30 per cent of the monetary sanctions collected in the relevant successful action or related actions. This is a range, not a fixed percentage, and the law does not promise payment simply because someone submits a tip.

In broad terms, the information must be original information that leads to a successful enforcement action, and the action must result in monetary sanctions exceeding $1 million. The statutory threshold refers to sanctions collected, not merely alleged misconduct, a proposed penalty or a headline figure in an enforcement announcement. The precise application depends on the case and the programme’s rules.

What does the $1 million trigger mean?

The $1 million threshold is a gate to the award provision. It is not a minimum amount an individual whistleblower receives, and it does not mean the whistleblower must personally identify $1 million in losses. The relevant question is whether the qualifying enforcement action results in more than $1 million in monetary sanctions collected.

That distinction matters when setting expectations. A tip may be important to an investigation but not lead to a qualifying action, or the resulting sanctions may not pass the statutory threshold. A report can still be worth making for reasons other than a potential award, but compliance teams should not market the programme as a likely financial return.

How to explain the 10 to 30 per cent range

The award range is a share of qualifying sanctions collected, not a share of a company’s revenue, a whistleblower’s loss or the value of the conduct described in a tip. The award is assessed under the statutory framework and applicable rules. Relevant considerations can include the significance of the information, the whistleblower’s assistance and the degree to which the information contributed to the successful action.

Several whistleblowers may be involved, and the award process may take time. Staff should be told that an award is conditional, its amount is not known in advance, and no employer can determine what FinCEN or the Treasury Department will decide. Avoid language such as “report and you will get 30 per cent”. It overstates both eligibility and outcome.

Internal hotline and FinCEN reporting are different routes

An internal hotline is a company reporting channel. It allows an organisation to receive concerns, investigate them, address control failures and consider whether regulatory reporting is required. It may also help staff raise an issue with someone outside their immediate management chain. But the channel is run by, or on behalf of, the organisation. It is not an independent regulator.

FinCEN reporting is external reporting to a government authority. FinCEN administers the BSA whistleblower programme and receives information about possible violations within its remit. The DOJ may also have a role in relevant enforcement matters. A whistleblower can seek advice from a lawyer about how to make a submission and whether to use the programme’s procedures, including its rules for anonymous submissions.

Staff do not generally have to use an internal hotline before making a protected external report. A policy that says “you must report to the company first” risks giving a misleading account of statutory rights. Internal reporting can be encouraged, but it should not be presented as a precondition to contacting an authority.

Route What it is for What staff should know Internal hotline or compliance channel Raising suspected misconduct with the organisation so it can assess and respond. Explain who receives reports, how to escalate concerns and what confidentiality can and cannot be promised. FinCEN whistleblower reporting Providing qualifying information about possible BSA-related violations to the external programme. Internal reporting is not generally a prerequisite. Award eligibility and protection depend on legal requirements. Suspicious activity reporting by the institution Meeting a financial institution’s regulatory duty to report certain suspicious activity. A SAR is not a staff whistleblower tip. Its existence and contents are subject to confidentiality restrictions.

Explain the SAR boundary clearly

Financial institutions may have obligations to identify and report suspicious activity by filing a SAR. That institutional obligation is conceptually separate from an employee’s decision to raise a concern internally or provide information to an authority under a whistleblower programme.

Staff should not be told that they personally “file a SAR” when they make a hotline report or contact FinCEN as a whistleblower. Nor should they be encouraged to tell a customer, colleague or other unauthorised person that a SAR has been filed, is being considered, or contains particular information. SAR confidentiality rules can restrict disclosure. Staff can describe the underlying conduct to appropriate internal or external recipients without revealing protected SAR information.

Compliance teams should train staff on the distinction using practical examples. For instance, an employee may report suspicious transactions or suspected control failures through the hotline. The institution’s authorised process then determines whether a SAR is required. Separately, the employee may decide to provide relevant information to a regulator, subject to the applicable law and programme procedures.

Retaliation protections: what the law does and does not promise

The BSA includes anti-retaliation protections for qualifying whistleblowing. Broadly, an employer may not discharge, demote, suspend, threaten, harass or otherwise discriminate against an individual because of protected whistleblowing activity. The protection can cover certain disclosures to the employer as well as reports to government authorities and other specified recipients.

The 2022 changes strengthened the framework by providing a federal cause of action for eligible individuals who suffer retaliation. A person may bring a claim in federal district court. The statute sets a 180-day period for filing after the alleged violation, so timing matters. Potential remedies can include reinstatement, double back pay with interest, special damages, and reasonable legal fees and costs. The availability of a remedy depends on the facts and legal requirements; it is not an automatic result of making a report.

Protection is not a reason to promise that retaliation cannot happen. Staff may still face workplace pressure, strained relationships or practical consequences while a matter is examined. Compliance officers should take concerns about retaliation seriously, preserve relevant records and route them to an appropriate, independent decision-maker. A manager who is implicated in the concern should not control the response.

What staff should do if they fear retaliation

Use a channel outside the chain of command if a manager is involved or the usual route feels unsafe.
Keep a factual, lawful record of relevant events, dates and communications. Do not take confidential company material unlawfully or access systems without authorisation.
Seek independent legal advice promptly if considering an external report, an award claim or a retaliation claim.
Note that statutory deadlines can be short. Do not assume that an internal investigation pauses a legal filing deadline.

What compliance officers should say—and avoid saying

A useful staff message is direct and balanced: “You can report concerns through our internal channels, and you may also report qualifying information to the authorities. You do not generally have to report internally first. We prohibit retaliation, but we cannot promise a particular investigation outcome or award. Do not disclose SAR information. If you are unsure about your rights or deadlines, consider independent legal advice.”

That message supports internal reporting without trying to control where an employee goes. It also avoids suggesting that the organisation can guarantee confidentiality. A hotline may be confidential within defined limits, but an investigation may require information to be shared with people who need it to assess the concern, and the law may require disclosure.

Policies and training should be checked for wording that could chill protected external reporting. Avoid instructions that require advance approval before contacting a regulator, prohibit staff from discussing concerns with authorities, or threaten discipline for lawful whistleblowing. If an organisation wants staff to use internal channels where appropriate, it should explain the practical benefits—such as allowing the company to investigate and correct a problem—without describing internal reporting as mandatory.

Build a credible reporting culture

Staff are more likely to use a hotline when they believe reports will be assessed fairly, promptly and without reprisals. That requires more than a poster with a phone number. Organisations should offer accessible reporting routes, explain how concerns are triaged, protect information appropriately and monitor for adverse treatment after a report.

They should also train investigators and managers not to speculate about who made a report or to discourage staff from contacting regulators. Where a concern involves a potential BSA violation, the organisation should preserve evidence, assess its own reporting obligations and involve suitable legal and compliance advisers. Those steps do not cancel an employee’s independent right to make a protected external report.

The practical takeaway

Tell staff that the internal hotline and FinCEN reporting serve different purposes and can coexist. The hotline gives the organisation a chance to investigate and respond; external reporting gives qualifying whistleblowers a route to provide information to government authorities. Under the strengthened BSA programme, eligible individuals may receive a mandatory award of 10 to 30 per cent when the statutory conditions—including more than $1 million in sanctions collected—are met. The award is not guaranteed, and neither is a retaliation-free experience.

The clearest compliance message is therefore neither “always come to us first” nor “go straight to FinCEN”. It is: know your options, understand the protections and limits, keep SAR information confidential, act promptly if retaliation occurs, and do not let an internal policy stand in the way of protected external reporting.