What are the risks of reporting AML issues internally first?

Raising a suspected anti-money laundering (AML) problem through an employer’s compliance channel can be responsible and, in some cases, necessary. It may prompt a quick investigation, help correct a control failure and give the organisation a chance to meet its reporting duties. But internal escalation is not the same as reporting to a regulator, and it does not automatically preserve every protection or award that may be available to a whistleblower.

For employees at US financial institutions, the distinction matters. The Bank Secrecy Act (BSA) requires certain institutions to maintain anti-money laundering controls and file Suspicious Activity Reports (SARs) when applicable. The institution’s SAR obligation is not usually an employee’s personal filing obligation. Separately, federal law provides a route for individuals to give information about possible BSA violations to the US government.

The practical question is not simply whether to report internally or externally. It is how to act promptly, lawfully and safely, without assuming that an internal report is a substitute for an external submission—or that making one will guarantee protection or compensation.

Internal reporting and external reporting do different jobs

An internal compliance channel might be a manager, compliance officer, ethics hotline, legal department or board committee. These channels are designed to help an organisation identify and address problems. An external submission goes to a public authority, such as the Financial Crimes Enforcement Network (FinCEN), the US Department of the Treasury or the Department of Justice (DOJ), depending on the applicable process.

These routes can be complementary. An employee may report internally and also contact a government authority. But an internal report alone does not necessarily put information before a regulator, trigger an investigation or preserve eligibility for a BSA whistleblower award. The employer may investigate and resolve the issue itself; it may also disagree with the employee’s assessment, delay action or fail to escalate the matter.

There is another important distinction: an employee’s concern about suspicious activity is not itself a SAR. In general, the covered institution decides whether a SAR must be filed and is responsible for filing it. SARs are subject to strict confidentiality rules. Employees should not take, share or disclose a SAR or information that would reveal its existence unless they are authorised to do so. A whistleblower strategy must account for those rules, not bypass them.

What changed in the BSA whistleblower programme?

Congress strengthened the BSA whistleblower programme through the Anti-Money Laundering Act of 2020, enacted in January 2021. A further legislative change in December 2022—the Anti-Money Laundering Whistleblower Improvement Act—addressed shortcomings in how the programme could reward eligible whistleblowers. The changes made awards mandatory when the statutory conditions are met, rather than leaving the programme without a clear funding mechanism for paying them.

The programme is not a general reward for reporting any workplace concern. It concerns qualifying information about violations of the BSA and related laws, provided through the relevant government process. A person considering a submission should check the current FinCEN rules and requirements, including how to submit information and preserve a claim. The details of eligibility can be decisive.

The $1 million sanctions threshold

The award provision applies in qualifying actions that result in monetary sanctions exceeding $1 million. That threshold is about sanctions imposed in an enforcement action, not the value of the suspected conduct, the amount mentioned in an internal report or a company’s overall revenue. A report can describe serious alleged misconduct https://www.lawyer-monthly.com/2026/10/bsa-whistleblower-program-policies-for-2027/ and still fail to produce an award if the legal and outcome requirements are not met.

The threshold also makes timing and evidence relevant. It may take years for an authority to investigate, bring an action and collect sanctions. An employee cannot assume that a report will lead to an enforcement case, that the case will cross the threshold or that the employee’s information will be found to have contributed to the result.

What does the 10 to 30 per cent range mean?

For an eligible whistleblower, the statutory award range is generally 10 to 30 per cent of the monetary sanctions collected in a qualifying action, subject to the law’s rules. It is a share of qualifying collections—not a percentage of the amount a company is alleged to have laundered, the size of a loss or a penalty announced but never collected.

The word “mandatory” is significant, but it is not a promise of payment to everyone who reports a concern. The person must satisfy the programme’s requirements, the information must meet the relevant standard, and a qualifying action must produce the required sanctions. The amount within the range depends on statutory factors and the circumstances of the case. The range should therefore be understood as a framework for eligible awards, not a predictable personal return.

Internal escalation risk: what can go wrong?

Reporting internally first can be sensible, but it carries risks that are easy to overlook. The employee may assume that the company will keep the report confidential, investigate independently and protect them from adverse treatment. Those expectations may not match the organisation’s response or the limits of legal confidentiality.

• Delay: Internal review can take time. If the concern is urgent, evidence is at risk or activity is ongoing, waiting for an internal process may postpone contact with the appropriate authority.
• Loss of control over information: The organisation may interview colleagues, preserve records or alert senior management. That can help an investigation, but it may also reveal who raised the concern.
• Retaliation before protection: A worker may experience reduced responsibilities, exclusion, poor reviews or dismissal before a dispute is resolved. Protections do not prevent every employer from acting, and a legal remedy may come only after harm has occurred.
• Evidence problems: An employee may be tempted to copy records or take documents to prove a point. Doing so can breach confidentiality, privacy, employment or data-protection rules, and may undermine the employee’s position.
• False confidence: An internal report may not count as an external submission for award purposes. It may also fail to satisfy the notice, timing or content requirements of a particular programme.
• Conflicts of interest: The person receiving the report may be implicated, may report to someone implicated or may prioritise the organisation’s response over the reporter’s interests.

None of this means employees should avoid internal channels. A well-designed channel can surface a problem early and produce effective remediation. The risk lies in treating internal escalation as a guaranteed safe harbour or as a substitute for understanding the external route.

Retaliation protections and a federal cause of action

The BSA includes anti-retaliation protections for qualifying whistleblowers. Broadly, the law prohibits an employer from taking certain adverse actions because an employee provided information about a possible BSA violation to an appropriate authority or supervisor, or engaged in other protected activity covered by the statute. The precise scope depends on the facts and the statutory requirements.

The 2022 legislation strengthened the programme’s anti-retaliation framework. A worker who believes they have been retaliated against may have a federal cause of action—a right to bring a legal claim under federal law—if the statutory conditions and procedures are met. Potential relief can include reinstatement, back pay and other remedies available under the law.

That protection is important, but it is not the same as immunity from workplace consequences in every situation. A dispute may turn on whether the employee made a protected disclosure, whether the employer took a prohibited action and whether the action was because of that disclosure. Employers may argue that a decision was based on performance, restructuring or another reason. The process can be stressful, time-consuming and costly.

Deadlines matter. The BSA retaliation process includes a route through the Department of Labor and, in specified circumstances, access to federal court if the administrative process has not concluded within the statutory period. The applicable filing deadline and procedure should be checked promptly with a US employment or whistleblower lawyer. Waiting until the consequences are obvious can narrow available options.

How to think about a whistleblower strategy

A whistleblower strategy is not about choosing the most dramatic route. It is about protecting the integrity of the report, complying with confidentiality rules and making informed choices about timing. Before escalating, consider the following steps:

1. Write down what you know. Record dates, transactions, systems, people involved and why the activity raised concern. Separate direct observations from assumptions or second-hand information.
2. Use lawful access only. Do not access systems outside your role, alter records or remove documents without authorisation. Preserve information through approved channels and seek advice before handling sensitive material.
3. Check the right reporting route. Review the organisation’s policy, but do not assume it is the only route. Identify whether the issue may be reported to FinCEN, the DOJ or another relevant authority under the applicable process.
4. Consider urgency and risk. If activity is continuing, records may be destroyed or a subject may be alerted, the timing of internal and external contact deserves particular care.
5. Keep a factual record of retaliation. If your treatment changes after a report, note dates, decisions, stated reasons and relevant communications. Avoid speculation and preserve records lawfully.
6. Get independent advice where needed. A lawyer familiar with US whistleblower and employment law can help assess eligibility, confidentiality, deadlines and the consequences of internal or external disclosure.

Do not disclose SAR information or identify a SAR merely to strengthen a complaint. Nor should you assume that an internal hotline is confidential in the same way as a communication with your own lawyer. Ask what the channel can and cannot keep confidential, while recognising that an employer may need to investigate and share information internally.

Comparing the routes

Issue Internal channel External submission Purpose Alert the organisation and support internal review or remediation. Provide information to a government authority under its process. Effect on the institution’s SAR duties May help the institution assess whether it must file a SAR. Does not itself replace the institution’s SAR obligations. Whistleblower award Generally not, by itself, a qualifying government submission. May be relevant if statutory submission and award requirements are met. Retaliation protection Some disclosures to supervisors may be covered, but protection depends on the law and facts. May fall within statutory protections if the disclosure and process qualify. Key caution Do not assume confidentiality, prompt action or protection from adverse treatment. Do not assume an award, investigation or favourable outcome is guaranteed.

The practical answer

Reporting AML concerns internally first can help an organisation identify and correct a problem. It can also expose an employee to delay, loss of control over the report and retaliation before protection is tested. Most importantly, an internal report is not automatically equivalent to an external submission to a regulator and should not be treated as a guaranteed route to a whistleblower award.

The 2022 improvement to the BSA whistleblower programme made qualifying awards mandatory and established a 10 to 30 per cent range for eligible cases involving more than $1 million in monetary sanctions. It also strengthened the framework for anti-retaliation claims. Those are meaningful changes, but they do not remove the need to meet statutory requirements, observe SAR confidentiality rules or act within deadlines.

For employees, the safest course is usually a carefully documented, lawful and timely decision—not an assumption that one channel is always best. Where the potential stakes are high, independent advice before or soon after reporting can help clarify the available routes and reduce avoidable risks. This article is general information, not legal advice; US law and individual circumstances should be checked with a qualified lawyer.