FinCEN's Whistleblower Program Takes Shape: What Companies Need to Know

On April 1, 2026, the Financial Crimes Enforcement Network (FinCEN) published a Notice of Proposed Rulemaking (NPRM) in the Federal Register, marking a long-awaited milestone in the operationalization of the federal AML whistleblower framework. The 60-day public comment window closed last week on June 1, 2026 — making it more important than ever before for regulated entities to understand what the proposed framework could mean for them.

Key takeaways

• The proposed rule implements the FinCEN Whistleblower Program under 31 U.S.C. § 5323, covering violations of anti-money laundering and sanctions statutes, with potential reach across approximately 1.8 million entities in 20 industries.
• Awards are mandatory — not discretionary — once eligibility thresholds are met, making qualified whistleblowers eligible for awards amounting to 10%–30% of collected monetary sanctions exceeding $1 million.
• A rebuttable presumption of the maximum 30% award applies where that share equals $15 million or less, creating a meaningful incentive for reporting conduct that might otherwise escape regulatory attention.
• Officers, directors, and compliance and audit personnel face a 120-day waiting period before submitting tips to FinCEN — a window that creates both an opportunity and real operational pressure for institutions , particularly when employees may opt for external reporting if internal concerns are not addressed promptly.
• Anti-retaliation protections are broad and non-waivable; employment and separation agreements with provisions that could impede disclosures to Treasury or DOJ warrant immediate review.
• With the comment period now closed, companies should focus on preparing for the rule's finalization and ensuring their compliance frameworks are ready.
• The program is likely to increase parallel reporting risk across FinCEN, DOJ, the SEC and CFTC, reinforcing the importance of rapid internal escalation and coordinated response strategies.

Legislative Background 

The statutory foundation for this program has been in place for years. 31 U.S.C. § 5323 was enacted as part of the Anti-Money Laundering Act of 2020 (AMLA) — embedded within the National Defense Authorization Act for Fiscal Year 2021 — and was subsequently fortified by the Anti-Money Laundering Whistleblower Improvement Act of 2022. Throughout that period, FinCEN accepted tips through its existing channels, but without a finalized rule, no awards could be processed or paid. The February 2026 launch of a dedicated FinCEN whistleblower webpage was widely read as a signal that formal rulemaking was imminent, which the April 1 NPRM confirmed.

The proposed rule extends considerably further than its AML label might suggest. It covers potential violations of four statutes — the Bank Secrecy Act (BSA), the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA), and the Foreign Narcotics Kingpin Designation Act — and is structured to support enforcement of Treasury's Outbound Investment Security Program (OISP) and DOJ's Data Security Program (DSP) as well. FinCEN estimates that roughly 1.8 million entities across 20 industries carry BSA obligations alone, and that figure does not capture the full population of companies with sanctions, OISP, or DSP exposure. Any individual, regardless of nationality or employment status, may qualify as a whistleblower by reporting a possible violation to Treasury, DOJ, or even their own employer.

The Award Incentive

One of the most consequential features of the proposed rule is that awards are mandatory rather than discretionary. When monetary sanctions in a single covered action exceed $1 million, a qualifying whistleblower is entitled to between 10% and 30% of the amount collected. “Monetary sanctions" encompasses civil and criminal penalties, fines, settlement payments, disgorgement, and interest — but excludes forfeiture, blocked property, restitution, and victim compensation funds, an exclusion worth bearing in mind, particularly in matters in which forfeiture historically constitutes a significant portion of resolution value including many BSA and AML enforcement outcomes.

To incentivize reporting of misconduct that might not independently attract regulatory attention, the rule establishes a rebuttable presumption of the maximum 30% award when that amount does not exceed $15 million. Awards are funded through the Financial Integrity Fund, a revolving fund capped at $300 million that requires no annual appropriation, and are subject to upward or downward adjustment based on factors such as the significance of the information provided, the whistleblower's degree of assistance, deterrence value, culpability, any unreasonable delay in reporting, and the whistleblower's relationship to the institution's internal compliance program.

Submission Process

To qualify, a submission must be both “original" and voluntary. Original information is derived from the whistleblower's independent knowledge or analysis — it cannot already be known to Treasury or DOJ, nor drawn exclusively from public sources, though analysis of publicly available information can qualify if it generates non-public insights. Voluntary means the submission precedes certain forms of formal government inquiry or Congressional request, consistent with other federal whistleblower regimes. Certain categories are excluded outright: government and regulatory employees acting within their normal duties, foreign government officials, those who obtained information through attorney-client privilege or work product, and individuals whose information was obtained by criminal means. Importantly, personal involvement in the underlying misconduct does not automatically foreclose a claim — a criminal conviction, rather than mere exposure or involvement, is what triggers disqualification.

Tips are submitted via FinCEN's Form TCR through a secure online portal, and anonymous submissions are permitted at the tip stage without counsel — though anonymity at the award stage requires legal representation. Timing matters greatly: award claims must be filed within 90 calendar days of FinCEN publishing a notice of covered action, or 180 days for related actions, further reinforcing the importance of timely internal escalation before external reporting pathways are pursued. Because Treasury and DOJ bear no obligation to notify whistleblowers directly, the burden of monitoring FinCEN's published notices falls squarely on claimants and their counsel — a missed deadline forfeits the award claim entirely.

Compliance Considerations for Institutions 

• Internal reporting channels must be credible and well-resourced. Employees who trust that internal reports will be taken seriously are less likely to go directly to regulators. And effective internal reporting channels will help preserve the employer’s ability to take advantage of self-disclosure programs if appropriate. Escalation procedures, investigation protocols, and whistleblower policies should be reviewed and strengthened now, before the rule is finalized.
• Employment and separation agreements warrant immediate attention. Critically, pre-dispute arbitration agreements cannot be used to foreclose claims arising under § 5323, and no person — not only employers — may impede an individual's direct communication with Treasury or DOJ. Broad confidentiality provisions that could be read to discourage or prohibit regulator contact may themselves constitute a violation.
• Retaliation is strictly prohibited. Employers are prohibited from discharging, demoting, suspending, threatening, blacklisting, or otherwise taking adverse employment action against an individual for any lawful act the statute covers — and that protection applies even where the underlying allegation is ultimately unsubstantiated, so long as the employee held a reasonable belief that a violation had occurred.
• A single set of facts can trigger multiple frameworks simultaneously. The intersection of the FinCEN program with SEC, CFTC, and DOJ whistleblower programs, as well as parallel voluntary disclosure regimes, creates real complexity around timing, privilege, and sequencing. Early engagement with experienced counsel could be beneficial to navigate this new landscape.

For companies and financial institutions, the practical imperatives are clear. Internal reporting channels and anti-retaliation frameworks should be stress-tested and strengthened where necessary. Employment and separation agreements should be reviewed for confidentiality language that could inadvertently run afoul of the statute. Once fully operational, the FinCEN Whistleblower Program will represent a structural shift in how AML and sanctions violations come to light. With the closing of the comment period, the time to prepare is now.