How do you write a non-retaliation policy that does not accidentally chill reporting?

A non-retaliation policy should make it safe to raise a concern—not make employees ask permission first. That distinction matters in financial services, where a worker may need to report suspected money laundering, a weakness in anti-money-laundering controls or pressure to mishandle a Suspicious Activity Report (SAR).

For firms subject to United States law, policy drafting must account for the Bank Secrecy Act (BSA) whistleblower framework as well as the rules governing SAR confidentiality. The policy should explain internal compliance reporting channels, preserve access to external submissions to regulators, and state clearly that retaliation is prohibited. It should not promise that every report will qualify for a financial award or legal protection.

This article focuses on United States law. It is a practical drafting guide, not legal advice. Firms operating across jurisdictions should have counsel check local reporting, employment and privacy requirements.

Start with a clear promise, not a reporting condition

A sound policy says that employees may raise concerns in good faith and will not be punished for doing so. It should cover actual or suspected misconduct, control failures, legal breaches, attempts to discourage reporting and concerns that a report has been mishandled.

Do not make internal escalation a precondition to contacting a regulator. A policy may invite employees to use internal channels because the firm can often investigate and address a problem quickly. But wording such as “employees must report internally before contacting a regulator” can deter https://dlf-ne.org/when-did-the-new-bsa-whistleblower-rules-start/ protected disclosures and create legal risk.

The same is true of prior-approval rules. Staff should not have to obtain clearance from a manager, legal team or compliance officer before making a disclosure that is protected by law. Policies should also avoid suggesting that a confidentiality agreement, code of conduct or employment contract overrides statutory reporting rights.

What changed in the BSA whistleblower programme?

The BSA requires certain financial institutions to maintain anti-money-laundering systems and file SARs with the Financial Crimes Enforcement Network (FinCEN) when reporting criteria are met. A SAR is a confidential report of potentially suspicious activity; it is not a finding that a customer has committed a crime. Employees may be involved in identifying, escalating and investigating activity that could require a filing.

The BSA whistleblower programme was substantially overhauled by the Anti-Money Laundering Whistleblower Improvement Act, enacted in December 2022 as part of the National Defense Authorization Act for Fiscal Year 2023. It amended the programme established under the Anti-Money Laundering Act of 2020. Among other changes, the 2022 legislation changed the award framework and strengthened the statutory anti-retaliation provisions.

Under the amended framework, the United States Treasury must pay an eligible whistleblower an award when the statutory conditions are met and monetary sanctions collected in the relevant action exceed $1 million. The award generally falls between 10 and 30 per cent of the monetary sanctions collected, subject to the statute and the circumstances of the case.

“Mandatory” does not mean automatic for every person who reports a concern. Eligibility depends on statutory requirements, including the information supplied, its role in a successful enforcement action, and the applicable programme rules. The award percentage is not a guaranteed payment or a percentage of a company’s total penalty. It is calculated under the law against qualifying monetary sanctions collected. Treasury’s rules and decisions determine how the provisions apply in a particular case.

For policy drafting, the practical point is not to market the award. It is to avoid language that discourages eligible people from providing information to the government, or implies that internal reporting is the only permissible route.

Internal channels and external submissions are different routes

A policy should explain how to report internally without presenting internal reporting as a substitute for external reporting. Employees might be able to contact a manager, compliance, the anti-money-laundering officer, an ethics hotline or a board-level channel. Give more than one option, including a route that bypasses a manager implicated in the concern.

Separately, make clear that employees may contact relevant regulators or law-enforcement authorities where the law permits or protects that disclosure. Depending on the issue, those bodies may include FinCEN, the United States Department of the Treasury, the Department of Justice or another regulator with jurisdiction. Avoid promising confidentiality that the firm cannot control once information is sent to an external authority.

Do not require employees to tell the company that they have made an external submission. Nor should the policy require them to share a regulator’s questions, correspondence or investigation plan. Such requirements may look like attempts to monitor or impede protected disclosures.

Policy topic Safer drafting approach Wording to avoid Internal reporting Offer accessible channels and alternatives if a usual contact is involved. “You must exhaust internal procedures first.” External reporting Recognise employees’ rights to make protected disclosures to authorities. “No contact with a regulator without approval.” Confidentiality Protect sensitive information while carving out legally protected reporting. “You may not disclose company information to anyone outside the firm.” Retaliation Prohibit direct and indirect adverse treatment and provide a reporting route. “Only formal disciplinary action counts as retaliation.”

Handle SAR confidentiality without silencing employees

SAR rules create a specific drafting challenge. Financial institutions and their employees must not disclose a SAR or information that would reveal its existence to people who are not authorised to receive it. That restriction is important, but it should not be stretched into a blanket ban on raising concerns or contacting authorities.

Explain the distinction in practical terms. Employees may raise a suspicion internally through approved channels, and authorised staff may escalate it so the firm can assess its obligations. A person who has filed, or is considering whether the firm should file, a SAR must follow the applicable confidentiality rules. They should not tell the customer that a SAR exists, show the report to an unauthorised colleague or treat a SAR itself as ordinary customer-service correspondence.

At the same time, do not instruct staff to keep quiet about suspected wrongdoing simply because a SAR might be involved. Employees should be able to report concerns about possible failures to identify, investigate or file a SAR. The policy can direct them to an authorised internal recipient and remind them not to disclose SAR-protected information to unauthorised people. It should also preserve lawful external reporting rights, without suggesting that an employee may disclose a SAR in a way the law prohibits.

Have United States counsel review the wording against the institution’s precise obligations. A general policy should not attempt to resolve every question about what information may be disclosed in a particular investigation.

Define retaliation broadly enough to catch subtle pressure

A prohibition limited to dismissal is too narrow. Retaliation can take forms that are less visible but still affect a person’s work or prospects. The policy should prohibit adverse treatment because someone raised a concern, helped with an investigation, refused to take part in suspected misconduct or made a protected disclosure.

Examples may include dismissal, demotion, reduced hours, a pay or bonus decision, an unjustified negative performance review, exclusion from meetings, threats, harassment, changes to duties, or pressure to withdraw a report. The examples should not imply that a person must prove every listed form of harm before the company will investigate.

Be careful about the boundary between legitimate management and retaliation. A policy need not immunise employees from ordinary performance management or discipline for unrelated misconduct. But where a decision affects someone who has reported a concern, the firm should be able to show that it was based on a documented, legitimate reason rather than the report. That is a governance safeguard, not a guarantee that a decision cannot be challenged.

Explain the federal cause of action without overstating it

The BSA provides anti-retaliation protection for qualifying whistleblowers and a federal route to seek a remedy. The statute prohibits an employer from taking specified adverse action against an employee because the employee provided information, or participated in a proceeding, in circumstances covered by the law. The statutory framework includes a process involving a complaint to the United States Department of Labor and, in defined circumstances, a federal court action.

Potential remedies under the BSA may include reinstatement, back pay with interest, special damages, and legal costs and fees. The statute also provides for double back pay in relevant circumstances. The availability of a remedy depends on the facts, https://dlf-ne.org/what-are-the-biggest-policy-gaps-in-the-bsa-whistleblower-programme-right-now/ the statutory requirements and the procedural steps and deadlines that apply. A policy should not suggest that every employee who raises a concern has a viable federal claim, or that a claim will succeed.

Use a plain-language explanation rather than a promise. For example: “Federal law may protect employees who provide information or participate in proceedings covered by the Bank Secrecy Act. The company prohibits retaliation. Nothing in this policy limits rights to contact a regulator or to seek legal advice.” Have counsel confirm the final wording and any required references to filing procedures.

Make the process credible after someone reports

A strong statement is not enough if the process that follows makes reporting risky. Set out who receives a concern, how conflicts of interest are handled, how urgent risks are escalated and how the firm will protect information on a need-to-know basis. Avoid promising absolute secrecy: investigations may require the firm to share relevant facts with others, and law may require disclosure.

Give employees a way to report suspected retaliation that does not route the complaint back to the person they have accused. The policy should say that retaliation concerns will be assessed promptly and impartially, and that interim safeguards may be considered where appropriate. Do not promise a specific outcome or timeline the firm cannot reliably meet.

Keep records of reports, investigation steps and decisions affecting the reporting person. If a manager proposes an employment action involving someone who recently raised a concern, require appropriate independent review and a contemporaneous explanation. This can help identify retaliation risk early; it cannot eliminate liability.

A practical policy-drafting checklist

1. State the protection plainly. Ban retaliation for good-faith reporting, participation in an investigation and protected disclosures.

   

2. Offer several internal channels. Include a route outside the reporting line and a way to raise concerns about compliance or senior management.

3. Preserve external rights. Do not require internal exhaustion, advance notice or permission before a protected submission to a regulator.

4. Explain SAR boundaries. Protect SAR confidentiality without using it to block reporting of suspected misconduct or control failures.

5. Cover indirect retaliation. Include threats, pressure, isolation and unfavourable changes to work, not only dismissal.

6. Set out a credible response. Identify independent review, a separate retaliation-reporting route and proportionate safeguards.

7. Train managers and reviewers. Make clear that they must not obstruct reporting or retaliate, and that employment decisions may need independent scrutiny.

8. Review the wording regularly. Check it against current BSA requirements, regulator guidance, SAR procedures and relevant employment laws.

   

The drafting test

Before publication, ask whether a reasonable employee could read the policy as saying: “Report here first, keep quiet outside the firm, and risk your job if the allegation is not proved.” If so, revise it. A well-designed policy invites internal reporting while recognising lawful external routes, protects SAR confidentiality without suppressing concerns, and treats retaliation liability as a real operational risk.

The aim is not to promise whistleblowers an award or a successful claim. It is to avoid adding company-imposed barriers to protected disclosures—and to make clear that raising a concern will not, by itself, be grounds for adverse treatment.