FinCEN Proposes Rule on AML Whistleblower Program

On April 1, 2026, the Financial Crimes Enforcement Network (FinCEN) published a Notice of Proposed Rulemaking (NPRM) to establish a comprehensive framework for its whistleblower award and protection program (Whistleblower Program), as mandated under the Anti‑Money Laundering Act of 2020 (AMLA) and the Anti‑Money Laundering Whistleblower Improvement Act of 2022 (Whistleblower Improvement Act). The proposed rule, when finalized, would formalize incentives and anti‑retaliation safeguards intended to encourage individuals to submit whistleblower tips on money laundering, sanctions violations, and other illicit activity.

Given the heightened incentives for external reporting under the proposed rule, financial institutions should reassess and strengthen their whistleblower policies, escalation frameworks, and training to promote internal escalation of potential issues through established reporting channels, thereby reducing the risk that such issues are first disclosed outside the institution.

Background

In January 2021, Congress enacted the AMLA, which significantly revised the existing whistleblower provisions under the Bank Secrecy Act (BSA). In December 2022, Congress enacted the Whistleblower Improvement Act, which, among other things, established a minimum award for a qualifying whistleblower report and expanded the reportable activity qualifying for an award to include violations of U.S. sanctions.¹

The proposed rule would fully implement the enhanced whistleblower program codified under the AMLA and the Whistleblower Improvement Act, including:

• Procedures for whistleblowers to share information about potential violations in a timely and secure manner
• Eligibility criteria for whistleblower awards
• Awards of 10% to 30% of collected monetary penalties for individuals whose tip leads to a successful enforcement action
• Protections for whistleblowers

The proposed rule also follows FinCEN’s launch of the new whistleblower webpage in February 2026, which provides a centralized, user-friendly interface for individuals to confidentially submit whistleblower tips.

What Financial Services Companies Are Covered by the Proposed Rule?

The proposed rule is intended to facilitate whistleblower reporting of potential violations of “covered statutes,” which include the BSA, International Emergency Economic Powers Act (IEEPA), Trading with the Enemy Act (TWEA), and Foreign Narcotics Kingpin Designation Act (Kingpin Act). Accordingly, any entity with obligations under the covered statutes may be subject to the proposed rule.

The primary population of covered entities are those subject to the BSA, including banks, money services businesses, broker-dealers, digital asset firms, insurance companies, and other financial institutions. In addition, entities with obligations under IEEPA, TWEA, and the Kingpin Act could be subject to the proposed rule if suspected of a violation by a whistleblower. According to the NPRM, approximately 1.8 million entities across 20 different industries may ultimately be subject to the proposed rule.

Key Definitions

Generally, a whistleblower is eligible for an award under the proposed rule if the whistleblower voluntarily provides original information to the employer of the whistleblower, the U.S. Department of the Treasury (Treasury), or the U.S. Department of Justice (DOJ) that leads to the successful enforcement of a covered action or related action.

What Information Is Eligible for an Award?

The term “original information” is defined to include information that is (1) derived from the independent knowledge or independent analysis of a whistleblower; (2) not already known to the Treasury or DOJ from any other source; (3) not exclusively derived from publicly available sources; and (4) provided to the Treasury or DOJ for the first time.

“Independent knowledge” means any factual information that is not exclusively obtained from publicly available sources. “Independent analysis” is also broadly defined to include the evaluation of information, including information that may be generally known or available to the public, by the whistleblower in a manner that results in material insights into or interpretations of the significance of such information that are not generally known or available to the public.

This expansive scope increases the likelihood that a wide range of internal observations, analytical insights, and non‑public assessments may qualify for awards.

Who Can Be a Whistleblower?

Under the proposed rule, the term “whistleblower” means any individual who provides information relating to a violation of a covered statute to the Treasury, DOJ, or to the employer of the individual, including as part of the job duties of the individual.

It should be noted that the proposed rule recognizes individuals as whistleblowers even when their disclosures are made to their employer, including as part of the job duties, rather than directly to FinCEN. According to the NPRM, if a whistleblower first submits original information to their employer and later reports that same information within a “reasonable time” to FinCEN, FinCEN will consider the original information to have been reported by the whistleblower, even if the employer provides the whistleblower’s information to the Treasury or DOJ. Moreover, the NPRM notes that, for certain roles within an organization, the individual must wait 120 days from when they obtained the original information before providing it to FinCEN in order to be eligible for an award, which is designed to encourage strong internal audit and compliance programs. These individuals include, among others, individuals who obtained the original information because they principally perform audit or compliance responsibilities. The definition of whistleblower reinforces that whistleblowing can — and often should — begin internally, underscoring the importance of maintaining effective reporting channels and escalation process.

Takeaways

In light of the proposed rule, financial institutions — and other institutions with obligations under the BSA and other covered statutes — should reassess and, if necessary, strengthen their existing policies, procedures and reporting frameworks related to whistleblowers and internal reporting. This is especially critical now as strengthening these processes may help an organization avoid or reduce a potential award under the FinCEN whistleblower program.

For example, financial institutions and other entities should:

• Prepare for heightened regulatory scrutiny. As FinCEN and DOJ may increasingly rely on whistleblower‑generated leads, institutions should anticipate greater visibility by banking and non-banking authorities into their AML and sanctions compliance operations. This shift underscores the importance of ensuring that existing controls, documentation practices, and investigative processes are robust and capable of withstanding regulatory inquiry. Institutions may also wish to proactively evaluate whether potential gaps or longstanding compliance issues could attract renewed attention in an environment driven by external tips.
• Review and update internal whistleblower policies and procedures. Given the nature of the proposed rule, it is important to ensure financial institutions encourage employees to report internally before those employees report information externally. Clear communications from senior executives of reporting channels, protections, and anti‑retaliation measures can promote better compliance cultures, encourage timely internal escalation, and reduce external reporting. Institutions should also periodically test anonymous reporting tools and ensure all internal reports are properly captured and evaluated.
• Prioritize comprehensive training. Employees should receive periodic, role‑specific training on how to handle whistleblower reports and the anti‑retaliation protections available to whistleblowers. Legal, human resources, anti-money laundering teams, and any individuals who may ultimately receive whistleblower reports (such as top executives or board members) should also be trained on ambiguities in the new framework and how to avoid common pitfalls. Middle management, who are often the first recipients of employee concerns, should be equipped to recognize internal reports and ensure they are escalated through the proper channels.
• Avoid taking actions that might be deemed to impede an individual from reporting. The proposed rule notifies employers and other individuals that they cannot take any action to impede an individual from communicating directly with Treasury or DOJ about potential violations. Organizations may want to consider confidentiality language in standard template separation and other agreements with employees, as well as training on how to avoid concerns about impeding communications.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.