What is the link between SAR obligations and the whistleblower programme?

Suspicious activity reports (SARs) and whistleblower tips are connected, but they are not the same thing. A SAR is a report that certain financial institutions and other regulated businesses must file when they identify activity that may involve money laundering or another financial crime. A whistleblower tip is information supplied by an individual to a government body, potentially leading to an investigation or enforcement action.

The distinction matters. A firm’s SAR obligations do not generally require every employee who spots suspicious activity to file a SAR personally. Nor does telling the firm’s compliance team automatically amount to reporting the matter to a regulator. But the same underlying facts may give rise to overlapping requirements: the firm may need to assess and file a SAR, while an individual may also choose to report suspected misconduct to the government.

In the United States, changes made in 2022 significantly strengthened the Bank Secrecy Act (BSA) whistleblower programme. They introduced a mandatory award framework, a 10 to 30 per cent award range in qualifying cases, and a federal anti-retaliation claim. Those changes make it more important for firms and individuals to understand how internal reporting, SAR processes and external whistleblower submissions fit together.

SAR obligations belong to the institution

The BSA and its implementing rules require covered financial institutions to monitor for suspicious activity and file SARs in specified circumstances.

The exact rules depend on the type of institution and the activity identified. In general, a SAR is an official report to the government, not a finding that a customer or other person has committed a crime.

Employees may identify warning signs, raise concerns internally or help investigate a matter. The institution’s designated personnel then assess the information and decide what action is required, including whether to file a SAR. Pretty simple.. That institutional process is distinct from an employee’s personal decision to submit a whistleblower tip to a government agency.

SAR confidentiality is also important. SARs, and information that would reveal whether a https://www.lawyer-monthly.com/2026/10/bsa-whistleblower-program-policies-for-2027/ SAR has been filed, are subject to strict restrictions on disclosure. Employees should not assume they can take or share a SAR, tell a customer that one has been filed, or attach a confidential SAR to an external complaint. A person considering a report should use an appropriate government channel and avoid disclosing protected material unlawfully. The underlying facts may be reportable even where the SAR itself is not.

Internal reporting is not the same as an external tip

An internal compliance channel allows staff to raise concerns with their employer—for example, through a manager, compliance officer, ethics hotline or financial crime team. It can give the firm a chance to investigate, address weaknesses and meet its regulatory obligations. It may also be the quickest way to alert people who can stop ongoing activity.

An external whistleblower submission, by contrast, goes to a government body. Under the BSA programme, information may be submitted to the US Department of the Treasury, including through the Financial Crimes Enforcement Network (FinCEN), which administers the programme, or to the Department of Justice (DOJ). Whether a submission qualifies for an award depends on the statutory criteria and how the information contributes to a qualifying enforcement action.

Reporting internally does not, by itself, make an employee a participant in the federal whistleblower programme. Equally, an individual generally does not have to wait for an internal investigation to finish before contacting the government. The two routes can overlap, but they serve different purposes and have different consequences.

When internal reporting may affect timing

The 2022 changes address a situation in which someone reports a concern internally first. In certain circumstances, a person who then reports the same information to the Treasury within 120 days may be treated as having reported it on the date of the internal disclosure for award-related purposes. This is not a blanket rule that makes every internal complaint a protected government submission. The individual still needs to meet the programme’s requirements, and the timing and content of the reports matter.

That 120-day provision can make the order of events significant. Someone considering an external report should get advice promptly rather than assume that an internal complaint preserves their position indefinitely. Internal policies, employment obligations, confidentiality restrictions and the federal programme’s rules may all need to be considered together.

What changed in the 2022 overhaul?

Congress strengthened the BSA whistleblower framework through legislation enacted in December 2022. Before the changes, the programme’s award provisions were widely viewed as less certain: the law did not provide the same clear mandatory payment structure or minimum sanctions threshold that now applies.

The revised framework provides for an award when a whistleblower supplies original information that leads to a successful covered action and the required monetary sanctions exceed $1 million. It also establishes a 10 to 30 per cent award range, subject to the statutory rules and the facts of the case. The changes were intended to give people with useful information a clearer financial incentive to report serious violations.

The programme is not a general reward for reporting any suspicious transaction or compliance failure. It is tied to qualifying actions and outcomes. A tip may be valuable to an investigation without ultimately producing a covered action or sanctions that meet the threshold.

The $1 million sanctions trigger and mandatory awards

The threshold is based on monetary sanctions imposed in a qualifying action—not simply the amount of money involved in the suspected conduct, the value of a transaction, or the size of a firm’s potential liability. The statute makes an award mandatory when its conditions are met and the relevant sanctions exceed $1 million.

“Mandatory” does not mean that every person who sends in a tip receives money. The individual must provide information that qualifies under the programme, and that information must lead to a successful covered action. The sanctions threshold must also be met. There are exclusions and other statutory conditions, and the government determines whether the award criteria are satisfied.

The programme can cover actions involving violations of the BSA and specified related laws. The precise scope depends on the statute and the government action in question. A person should not assume that any regulatory investigation, any SAR filing, or any financial penalty automatically qualifies.

What does the 10 to 30 per cent range mean?

Where a qualifying whistleblower’s information leads to an eligible action with more than $1 million in monetary sanctions, the award is generally set at between 10 and 30 per cent of the sanctions collected in the covered action and related actions, as the law provides. The percentage is not necessarily applied to every penalty announced in a press release: what counts depends on the statute, the action and the amounts collected.

The range leaves room for the government to assess the contribution and circumstances of a tip. Relevant considerations may include how useful and specific the information was, whether it was original, whether the person participated in internal reporting, and whether the person was involved in the misconduct. The programme’s rules govern that assessment; a maximum award is not promised simply because someone reports first.

Question Practical answer Does a SAR automatically qualify for an award? No. A SAR is an institutional filing. An award depends on an individual’s qualifying information and a successful covered action. Is $1 million the value of the suspicious activity? No. The trigger concerns monetary sanctions in a qualifying action, subject to the statute. Does the whistleblower always receive 30 per cent? No. The statutory range is 10 to 30 per cent, and the award is determined under the programme’s rules.

Anti-retaliation protections and a federal cause of action

The 2022 overhaul also strengthened anti-retaliation protection for people who report covered information. In broad terms, an employer may not retaliate against an eligible whistleblower because of protected reporting or participation in a covered process. Retaliation may take forms beyond dismissal, such as demotion, threats, suspension or other adverse treatment linked to the report.

The law provides a federal cause of action for retaliation. Depending on the circumstances and procedural requirements, available relief may include reinstatement, back pay with interest, special damages, and costs and attorneys’ fees. The process involves time limits and prescribed steps, including an administrative complaint to the Secretary of Labor. A person should seek prompt advice about the applicable deadline and whether court proceedings are available.

These protections do not remove practical risks. A worker may face pressure, strained relationships or attempts to identify the source of a report. Documentation matters: keep a careful record of reporting dates, the substance of concerns, relevant communications and subsequent employment decisions. Do not remove confidential business records or SAR materials without legal advice; doing so may create separate problems.

How firms should manage overlapping requirements

Firms should treat internal reporting and SAR decisions as related but separate processes. One client recently told me thought they could save money but ended up paying more.. A sound approach makes it clear who receives an internal concern, who assesses whether a SAR is required, how confidentiality is maintained, and how retaliation concerns are escalated. Staff should not be told that they must report only internally or that an internal report guarantees they will not contact a regulator.

Compliance teams should also avoid treating a whistleblower tip as a substitute for a SAR assessment. An external report does not necessarily discharge the institution’s own reporting duties. Conversely, filing a SAR does not necessarily resolve the individual’s concerns or prevent a person from making a lawful external submission.

Practical steps for employees and compliance teams

Separate the institution’s SAR decision from an individual’s whistleblower decision.
Use established internal channels where appropriate, but do not assume internal reporting is the same as reporting to the government.
Protect SAR confidentiality and avoid disclosing whether a SAR exists.
Record relevant dates and communications, particularly where internal reporting may be followed by an external submission.
Escalate suspected retaliation quickly and seek advice on filing deadlines and available remedies.
For potential whistleblowers, get independent legal advice before sharing confidential documents or making assumptions about award eligibility.

The practical link

SAR obligations and the BSA whistleblower programme can concern the same conduct, but they operate on different tracks. A regulated institution may have a duty to detect, assess and report suspicious activity. An individual may separately provide whistleblower tips to the government, potentially qualifying for an award if the statutory conditions are met.

The 2022 reforms made that second track more concrete: qualifying awards are mandatory when the requirements are satisfied, the relevant sanctions exceed $1 million, and the award generally falls within a 10 to 30 per cent range. They also strengthened protection against retaliation and created a federal route to challenge it. None of this guarantees an award or removes the need to handle confidential information carefully. Where overlapping requirements arise, the safest course is to distinguish the institution’s duties from the individual’s rights, pay close attention to timing, and obtain advice before taking steps that may be difficult to reverse.