What are the biggest policy gaps in the BSA whistleblower programme right now?

The Bank Secrecy Act (BSA) whistleblower programme has a stronger statutory foundation than it did a few years ago. A 2022 legislative overhaul made awards mandatory in qualifying cases, set an award range and added a federal route for whistleblowers to challenge retaliation.

But stronger rules on paper do not automatically make a programme predictable or safe to use. Potential whistleblowers still need to understand where to report, what may qualify for an award, how long a claim might take and what protection exists if an employer retaliates. Publicly available information about the programme’s performance also remains limited.

Those gaps matter in the financial sector, where employees may see signs of suspicious activity before an investigation becomes public. Their information can help regulators assess possible violations of anti-money laundering rules, including whether an institution met its Suspicious Activity Report (SAR) obligations. But a reporting route is only useful if people can understand it and trust the process.

What changed in 2022?

The 2022 overhaul came through the Anti-Money Laundering Whistleblower Improvement Act, enacted as part of the Consolidated Appropriations Act, 2023. It amended the BSA’s whistleblower provisions. The change responded to criticism that the earlier framework did not offer sufficiently strong financial incentives or clear protections.

The law provides for awards when qualifying information leads to successful enforcement resulting in more than $1 million in monetary sanctions. It sets awards at 10 to 30 per cent of the monetary sanctions collected, subject to statutory conditions. It also provides anti-retaliation protections and a federal cause of action for eligible whistleblowers.

That is a material improvement. Yet core details of how the programme operates are still difficult for the public to assess. The central policy question is no longer simply whether the law authorises awards. It is whether the administration of the awards process and protections is sufficiently clear, timely and transparent to give people confidence in using it.

Gap one: the programme’s public data is hard to assess

For a whistleblower programme to earn trust, people need more than a statutory promise. They need a way to judge whether the programme receives useful information, produces enforcement results and pays awards within a reasonable period.

That is where program data matters. Public information about the BSA programme has not developed into a consistently detailed picture of its operation. The public would benefit from regular reporting on matters such as the number of tips received, how many are referred for further assessment, how many result in enforcement action, and how many award claims are resolved.

There are legitimate reasons not to publish details that could identify a source, expose an investigation or reveal protected financial information. SAR confidentiality is particularly important. A financial institution generally cannot disclose that it has filed a SAR, or disclose the SAR itself, except as authorised by law. Transparency should not mean releasing material that undermines an investigation or violates those restrictions.

But protecting confidential information does not prevent aggregate reporting. An annual report could give the public useful statistics without naming whistleblowers or disclosing sensitive case details. It could also explain how long claims take, the broad reasons claims are rejected and whether awards have been paid.

Without that information, transparency criticism is hard to answer. A person considering a report may not know whether the programme is active, how much delay to expect or what an award decision looks like in practice. BSA whistleblower attorney near me Lack of public data also makes it harder for lawmakers and oversight bodies to identify administrative problems.

Gap two: “mandatory” awards still leave practical questions

The most important change in the 2022 overhaul was the move towards mandatory awards in qualifying cases. If the statutory conditions are met and the relevant enforcement action produces more than $1 million in monetary sanctions, the law provides for an award. That is stronger than a system in which an award is simply a matter of discretion.

But “mandatory” does not mean every person who sends a tip receives money. The information must meet the programme’s requirements, contribute to a successful enforcement outcome and support an award claim that satisfies the applicable rules. The threshold concerns monetary sanctions collected, not merely a penalty announced in a press release. A large headline figure does not by itself establish that an award is payable.

The 10 to 30 per cent range also leaves important questions. The percentage is tied to monetary sanctions collected in the relevant action, not automatically to every penalty imposed on an organisation. The amount awarded within the range depends on statutory considerations, including the significance of the information and the whistleblower’s assistance. The range is therefore not a promise that every eligible person receives 30 per cent.

For prospective whistleblowers, the practical uncertainty is how the decision-maker will apply those factors. Clear guidance could explain how the programme weighs the usefulness, specificity and timing of a disclosure, as well as cooperation during an investigation. It should also clarify how claims are handled when several people contribute information, or when information is relevant to more than one enforcement action.

Those questions are not merely technical. Someone deciding whether to report may be weighing job security, legal exposure and the possibility that an investigation will take years. If the awards process is difficult to understand, the headline percentage may do less to encourage useful reporting than lawmakers intended.

Gap three: the awards process needs clearer milestones

Any enforcement-linked award system can take time. Regulators may need to verify information, investigate conduct, bring an action and collect sanctions before they can decide whether an award is due. An investigation may also close without public action, leaving a source uncertain about what happened to their information.

That makes process information particularly important. Whistleblowers should be able to find clear answers to basic questions: how to submit a claim, what information to include, whether there are filing deadlines, how the programme confirms receipt and how a person can ask about a pending claim without compromising an investigation.

There should also be understandable information about decisions. A person whose claim is denied needs to know the available review or challenge route, the relevant time limits and whether the reason for denial can be explained without disclosing protected information. An award decision can involve sensitive material, but silence is not the only way to protect it.

Defined milestones would not require regulators to disclose investigative strategy. They could, for example, distinguish between receipt of a tip, review of an award application and a final decision, while explaining that the agency cannot discuss whether a particular investigation is open. Predictable process information would help manage expectations without promising an outcome.

Gap four: internal channels and external reporting are easy to confuse

Financial institutions commonly expect employees to raise concerns through internal compliance reporting channels. Those channels can be valuable: compliance teams may be able to investigate and correct a problem quickly. But an internal report is not the same thing as a submission to a regulator, and employees should not assume that using one route automatically completes the requirements for another.

The BSA whistleblower framework covers specified disclosures and conduct. The details of who qualifies, what must be reported and how a claim should be submitted matter. Employees considering a report should consult the programme’s current instructions and, where appropriate, https://dlf-ne.org/what-are-the-biggest-policy-gaps-in-the-bsa-whistleblower-programme-right-now/ independent legal advice rather than relying on an employer’s policy summary.

There is also a practical tension. An employee may reasonably want to give the institution an opportunity to fix a problem. But waiting can create risks: records may change, deadlines may DPA vs deferred prosecution agreement matter, and a person may face pressure after raising a concern. Conversely, going outside the organisation can feel like an irreversible step. Clear public guidance should explain the relationship between internal reporting and external submissions without suggesting that one route is always required or always safer.

SAR obligations make the distinction especially important. A whistleblower may have information about whether a financial institution identified and reported suspicious activity as required. That does not give the individual a right to disclose a SAR or its existence. A report can describe underlying conduct and concerns through authorised channels without reproducing protected SAR material. Employees should take care not to breach confidentiality rules while reporting suspected misconduct.

Gap five: anti-retaliation rights need practical support

The law prohibits specified forms of retaliation against protected whistleblowers and provides a federal cause of action in defined circumstances. Remedies can include reinstatement, back pay, special damages and legal costs. Those protections are important, but they do not remove the personal risk of reporting.

Retaliation can be difficult to prove. An employer may describe an adverse action as a performance decision, a restructuring or a response to an unrelated workplace issue. The timing of a report, the employee’s records and the employer’s stated reasons may all matter. A person who waits too long to understand filing requirements could also lose options.

Policy guidance should therefore do more than list available remedies. It should explain, in plain language, who is covered, which disclosures are protected, what conduct may count as retaliation and what time limits apply to bringing a claim. It should also make clear that a whistleblower may need to act promptly and preserve relevant records lawfully.

Employers have a role too. A written non-retaliation policy is not enough if managers are not trained to handle reports, preserve confidentiality and separate an investigation from performance management. Internal reporting systems should provide safe ways to raise concerns and should not imply that employees must stay inside the organisation when they have a lawful external reporting option.

What a stronger programme would look like

Closing the gaps does not require promising faster investigations or larger awards. It requires making the programme easier to understand and easier to evaluate.

• Publish regular aggregate program data. Report tip volumes, award applications and decisions, payments and processing times where disclosure would not compromise confidentiality or enforcement.
• Explain the awards process. Set out how the 10 to 30 per cent range is applied, what counts towards the sanctions threshold and how multiple contributors are treated.
• Give applicants process updates. Confirm receipt and explain stages, likely points of contact and review options without revealing investigative information.
• Clarify reporting routes. Explain the difference between internal compliance channels and external submissions, including the limits on disclosing SAR information.
• Make retaliation guidance usable. State the protections, remedies and deadlines clearly, while being candid that a claim’s success depends on its facts and the law.

Policy issue Why it matters Practical improvement Limited program data Potential sources cannot readily judge how the programme performs. Publish regular, privacy-protective aggregate statistics. Unclear award decisions The statutory range does not explain the likely award in an individual case. Provide detailed guidance on eligibility, calculations and review. Reporting-route uncertainty Employees may confuse internal reports with external submissions or mishandle SAR material. Explain the routes and confidentiality limits in plain English. Retaliation risk Legal remedies do not prevent every adverse workplace consequence. Clarify protections, deadlines and practical steps for raising concerns.

The bottom line

The BSA whistleblower programme now has a more credible statutory offer: qualifying awards are mandatory, the award range is 10 to 30 per cent, and the law provides anti-retaliation protections with a federal cause of action. Those are significant changes, not guarantees of payment or protection from every workplace consequence.

The biggest policy gaps are operational. The public needs better program data, clearer explanations of the awards process and more useful guidance on how internal reporting relates to external submissions. Whistleblowers also need direct, practical information about retaliation risk and timing. Improving those areas would let people make informed choices without overstating what the programme can deliver.

This article is general information, not legal advice. The rules and procedures may change; potential whistleblowers should check current official guidance and consider speaking with a qualified lawyer.