What should a bank do if an employee reports directly to regulators?

An employee who contacts a regulator before raising a concern through the bank’s internal channels may unsettle managers. It should not, by itself, be treated as misconduct or disloyalty. In the United States, federal law protects certain reports about possible breaches of the Bank Secrecy Act (BSA), and recent changes strengthened the BSA whistleblower programme.

For a bank, the right response is practical: protect the employee from retaliation, preserve relevant evidence, assess the alleged conduct promptly and independently, and keep meeting regulatory obligations. An internal process can help a bank find and address problems. It must not become a barrier to lawful external reporting.

This article focuses on the US BSA whistleblower framework. It is a general overview, not legal advice. The facts, the regulator involved and the bank’s legal status can all affect the analysis.

What changed in the BSA whistleblower programme?

The Anti-Money Laundering Act of 2020 created a stronger whistleblower framework under the BSA. Congress then amended that framework in the AML Whistleblower Improvement Act, enacted as part of the Consolidated Appropriations Act, 2023, in December 2022. The changes addressed awards, internal reporting and retaliation protections.

The programme applies to people who provide qualifying information about possible BSA violations or related misconduct to the US Treasury Department or the US Department of Justice (DOJ). The Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury Department, administers the BSA and receives relevant information. Other agencies may also be involved in an investigation or enforcement action.

The programme is not a guarantee of an award simply because someone contacts a regulator. Eligibility and the amount of any award depend on statutory conditions and the outcome of enforcement activity. But the changes matter to banks because an employee may have financial and legal reasons to report outside the organisation.

When can a whistleblower award be paid?

Under the amended BSA, an award is mandatory when the statutory criteria are met. In broad terms, a qualifying whistleblower may receive an award if the information leads to a successful enforcement action resulting in monetary sanctions exceeding $1 million. The award is generally 10 to 30 per cent of the monetary sanctions collected, subject to the law’s requirements and the facts of the case.

The $1 million figure is a threshold for an eligible enforcement action, not a promise that every report will produce a payment. The information must meet the applicable criteria, and the action must result in sanctions that are collected. The law also gives the Treasury Department discretion to determine the award within the prescribed range.

The 10 to 30 per cent range can be significant. It creates a clear financial incentive to provide original, useful information, particularly where a person believes that internal processes are unlikely to address the issue. It does not mean that an employee will receive 10 per cent of every penalty imposed on a bank, or that the employee can predict the result before an investigation concludes.

For a bank, the practical point is not to speculate about whether a report will qualify. It is to avoid conduct that could appear designed to discourage reporting, identify or punish the source, or interfere with a regulator’s work.

Internal channels and external reports are different routes

Banks usually provide internal compliance reporting channels, such as a manager, compliance function, legal team, ethics line or board-level escalation route. These channels can allow the bank to investigate concerns early, correct control failures and meet its own legal and regulatory duties.

But an internal report and an external submission are not the same thing. A report to the bank does not automatically count as a submission to a regulator. Equally, an employee who goes directly to a regulator does not necessarily breach policy simply by bypassing the bank’s preferred route. The law may protect qualifying external reporting, and internal reporting should not be made a precondition for contacting an authority.

That distinction matters in anti-money laundering work. A bank may have an obligation to file a Suspicious Activity Report (SAR) when the relevant legal criteria are met. A whistleblower’s communication to a regulator is not, by itself, a SAR filed by the bank, and it does not replace the bank’s own assessment or reporting duties. The bank must handle SAR-related information carefully: US law generally restricts disclosure of a SAR or information that would reveal its existence, subject to applicable rules and exceptions.

Policies should explain how employees can raise concerns internally without suggesting that they must do so before speaking to a regulator. They should also make clear that confidentiality rules do not authorise staff to obstruct lawful reporting or mislead an authority.

What should the bank do first?

A disciplined response helps protect the employee, the investigation and the bank’s legal position. The first steps should be coordinated by people who are not implicated in the allegation.

1. Escalate to independent decision-makers. Notify appropriate legal, compliance or board-level contacts. If senior management, the compliance function or the usual escalation route is implicated, use an independent route, such as the audit or risk committee.
2. Preserve relevant records. Issue a suitable preservation instruction covering email, messaging, transaction records, customer files, access logs and investigation materials. Suspend routine deletion where necessary. Preserve material neutrally; do not search for ways to identify or discredit the reporting employee.
3. Assess immediate risks. Consider whether customers, funds, records or ongoing controls may be at risk. Identify any time-sensitive legal or regulatory duties, including whether the bank must assess suspicious activity or make a regulatory notification.
4. Set investigation ownership and scope. Use investigators with suitable independence and expertise. Record the allegation, the issues to be tested, the evidence sources and the person responsible for each decision.
5. Restrict information appropriately. Share details only with people who need them to respond. That is different from promising secrecy that the bank cannot maintain, or imposing confidentiality terms that could deter protected reporting.
6. Document decisions and timing. Keep a clear record of when the bank learned of the concern, what it did, who approved key steps and why. Good records support both sound governance and later scrutiny.
FinCEN tip submission guide

Internal investigation steps that do not obstruct reporting

An internal investigation should establish what happened, whether controls failed and what action is needed. It should not be framed as an inquiry into whether the employee was entitled to contact a regulator. Nor should it be used to delay a required filing or to put pressure on the employee to withdraw, narrow or coordinate an external report.

Separate fact-finding from employment decisions

Where practicable, assign the investigation to people who do not control the employee’s pay, promotion, performance review or discipline. If a manager is implicated, do not leave that manager in charge of the response. Consider independent counsel or external investigators when conflicts, seniority or regulatory sensitivity make internal handling difficult.

Test the allegation objectively

Use a documented plan. Identify relevant transactions, systems, policies and time periods; interview witnesses fairly; and test evidence that supports as well as evidence that contradicts the allegation. Avoid assuming that an employee’s report is either accurate or malicious. Findings should follow the evidence.

Keep regulatory obligations on a separate track

The bank’s investigation does not suspend its legal duties. Compliance and legal teams should assess applicable reporting obligations on their own merits and within required timeframes. A bank should not wait for an internal investigation to finish where the law requires action sooner. The whistleblower’s contact with an authority also does not automatically tell the bank what the authority has received or expects from the bank.

Non-retaliation response: protect against direct and indirect pressure

The amended BSA includes anti-retaliation protections and a federal cause of action for covered whistleblowers. In general, protection can apply to lawful reporting activity, including certain reports made to the employer or a supervisor as well as disclosures to the relevant federal authorities. Whether a particular person and report are protected depends on the statutory requirements and the circumstances.

Retaliation is not limited to dismissal. It may include demotion, suspension, threats, reduced responsibilities, harassment, adverse changes in working conditions or other action that would penalise a protected report. Timing matters: a negative employment decision soon after a report can invite scrutiny, even if the bank believes it has a separate reason for the decision.

A credible non-retaliation response should include the following:

• Tell relevant managers not to retaliate, discourage lawful reporting or seek to discover the employee’s regulator contacts without a legitimate reason.
• Review proposed changes to the employee’s role, pay, location, access, performance rating or employment status with independent legal or compliance oversight.
• Record the business reason and supporting evidence for any employment decision, and check whether comparable employees were treated consistently.
• Offer a safe contact for the employee to report further pressure, without demanding details of communications with regulators.
• Monitor for indirect retaliation, including ostracism, threats, exclusion from work or pressure from colleagues.

These steps are not a shield against liability if retaliation occurs. They are a way to reduce preventable risk and make sure employment decisions are based on legitimate, documented reasons rather than the act of reporting.

What does the federal cause of action mean?

The BSA provides a route for a whistleblower alleging retaliation to pursue a claim. The statutory process involves a complaint to the US Secretary of Labor within the applicable deadline. The law provides for a federal court action in specified circumstances, including where the administrative process has not produced a final decision within the statutory period.

The rules are technical, and deadlines can be decisive. A bank should not assume that an employee must use an internal grievance process first, or that a delay in a workplace complaint removes the risk. Anyone handling a potential claim should obtain advice from US employment and whistleblower counsel promptly.

Available remedies can include reinstatement, back pay with interest and other relief, including compensation for special damages and reasonable legal costs, as provided by the statute. The FinCEN claim process exact remedy depends on the claim and the outcome. A bank should not tell employees that a claim is certain to succeed or that a regulator’s decision will resolve an employment dispute.

Policy compliance: make the written rules match practice

Policies are only useful if managers follow them. Banks should review whistleblowing, anti-retaliation, investigation, record-retention and SAR-related procedures together, rather than treating them as separate documents with conflicting instructions.

Policy area What to check Reporting channels Employees can raise concerns internally, and the policy does not require internal reporting before a lawful external submission. Non-retaliation The rule covers direct and indirect adverse treatment and explains how concerns about retaliation can be escalated independently. Investigations There are clear standards for independence, evidence preservation, interviews, findings and escalation of conflicts. SAR handling Staff know who assesses and files SARs, how confidentiality restrictions apply and how to avoid disclosing protected information. Training and oversight Managers and investigators receive practical training, and senior oversight reviews trends, complaints and remedial actions.

Build trust by responding to the substance

A bank cannot control whether an employee contacts a regulator. It can control whether its response is prompt, independent and fair. Treat the report as a potential signal of a control or conduct problem, not as a challenge to the organisation’s authority.

The sound approach is straightforward: preserve evidence, investigate objectively, meet reporting obligations, protect the employee from retaliation and review whether policy compliance matches day-to-day practice. An effective internal channel can encourage early escalation, but it earns trust through credible action—not by trying to prevent external reporting.