The Financial Crimes Enforcement Network (FinCEN) recently published a notice of proposed rulemaking (NPRM) titled “Whistleblower Incentives and Protections.” The proposal implements 31 USC § 5323 as amended by the Anti-Money Laundering Act of 2020 (AML Act) and the AML Whistleblower Improvement Act of 2022, establishing procedures for submitting tips, applying for awards and obtaining confidentiality and anti-retaliation protections. The NPRM represents a significant step toward operationalizing a program that Congress authorized over five years ago, and it carries meaningful practical implications for financial institutions.
Highlights of the proposal
Scope: Beyond the BSA
The proposed program would cover potential violations of the Bank Secrecy Act (BSA) and certain sanctions-related statutes – including the International Emergency Economic Powers Act, the Trading with the Enemy Act and the Foreign Narcotics Kingpin Designation Act (the Kingpin Act). FinCEN also positions the program as supporting enforcement of the US Department of the Treasury’s (Treasury) Outbound Investment Security Program and the US Department of Justice’s (DOJ) Data Security Program where those matters fall within the scope of the covered statutes. The broad statutory reach means that potential whistleblowers are not limited to traditional AML scenarios – sanctions compliance failures and related conduct are squarely within scope.
Awards: 10-30%, with a presumption of maximum for smaller cases
A “covered action” is defined in the NPRM as a Treasury or DOJ judicial or administrative action that is successfully enforced and results in monetary sanctions exceeding $1 million. Awards would be paid within a statutory range of 10-30% of collected monetary sanctions in covered and related actions, with awards paid from the Financial Integrity Fund.
Notably, FinCEN proposes a presumption that the award will be the maximum of 30% in cases where 30% of collected sanctions is $15 million or less – unless paying the maximum would undermine the integrity or objectives of the program. This default-to-maximum approach for smaller cases is designed to incentivize reporting of conduct that might not otherwise attract enforcement attention.
Award-percentage factors would include the significance of the information, the degree of assistance provided (including by counsel), programmatic deterrence interests, the whistleblower’s culpability, any unreasonable delay in reporting and the whistleblower’s relationship to internal compliance and reporting systems – including whether the whistleblower undermined those systems.
A key tension: The 120-day waiting period for compliance and audit personnel
One of the most consequential provisions for financial institutions is the proposed 120-day waiting period. Certain individuals – including officers, directors and partners who learned information through internal reporting processes, and employees whose principal duties involve audit or compliance (including those at firms retained to perform audit or compliance functions) – would be required to wait at least 120 days after obtaining the information before submitting it to FinCEN to remain award-eligible. FinCEN’s stated rationale is to preserve incentives for robust internal compliance programs and to give entities time to review, remediate and voluntarily disclose issues, while minimizing harm from delayed reporting.
For institutions, this window creates both an opportunity and an obligation. Companies should anticipate how their internal reporting, triage and escalation processes will operate within that 120-day period, and should ensure that appropriate remediation and voluntary disclosure mechanisms are in place to take advantage of it.
Reporting process: Form TCR and a secure portal
Under the NPRM, whistleblowers would generally need to submit tips using FinCEN’s Tip, Complaint or Referral form (Form TCR), through a secure online portal with each submission assigned a unique tracking reference number. Whistleblowers could submit information anonymously – including without an attorney – at the tip stage. If a whistleblower first reports to DOJ, another Treasury component (such as the Office of Foreign Assets Control) or their employer, they would still need to submit the same information to FinCEN “within a reasonable time” to remain eligible for an award, though FinCEN would credit the date of the first submission for timing purposes.
Award applications: Watch the calendar
Award applications would be triggered by FinCEN publishing a “notice of covered action” on a Treasury website. Whistleblowers would have 90 days to apply for an award based on a covered action, and 180 days to apply for a related-action award (measured from the later of the covered-action notice date or the successful enforcement of the related action). Importantly, Treasury and DOJ would not be required to notify whistleblowers directly, meaning whistleblowers and their counsel would be responsible for monitoring for published notices.
Protections: Anti-Retaliation, confidentiality and a ‘no impediments’ rule
Employers would be prohibited from retaliating against whistleblowers for lawful acts covered by 31 USC § 5323(g)(1), with retaliation claims available through the Department of Labor’s complaint process and, in some circumstances, in a federal district court.
FinCEN also proposes that no person may impede an individual from communicating directly with Treasury or DOJ about possible violations, including by discouraging, hindering or delaying such communications.
Rights and remedies under the proposed rule would be nonwaivable – including through pre-dispute arbitration agreements, which would be invalid and unenforceable to the extent they require arbitration of a dispute arising under 31 USC § 5323 or the implementing regulation.
On confidentiality, FinCEN would generally not disclose information that could reasonably be expected to reveal a whistleblower’s identity, but subject to important exceptions, including where disclosure is required in a public proceeding, necessary for law enforcement or covered-statute purposes, or made to foreign law enforcement.
Key takeaways
The FinCEN NPRM is a detailed, Dodd-Frank-inspired framework that will reshape how compliance failures under the BSA and sanctions statutes surface and are reported. For financial institutions and their counsel, several action items stand out:
- Review internal compliance and reporting programs against the proposed 120-day waiting period framework, and consider whether current policies create the kind of robust internal process that FinCEN intends to protect.
- Audit employment agreements, confidentiality provisions and internal reporting policies for any provisions that could be construed as impeding direct communications with Treasury or DOJ.
- Understand the award process and calendar, particularly the obligation to monitor FinCEN’s published notices of covered actions and the hard 90- and 180-day application deadlines.
- Consider the interplay with voluntary disclosure programs, the 120-day window for compliance and audit insiders creates a meaningful incentive for proactive self-reporting and remediation.
- Counsel representing potential whistleblowers should note that anonymous submissions are permitted without an attorney at the tip stage, but that award applications require submission on Form WB-APP through a secure portal and involve certifications of truthfulness and completeness – making early legal guidance important.
Comments on the NPRM are due by June 1, 2026. Covered entities and other interested parties should consider submitting comments to help shape the final rule.