Can in-house counsel represent a whistleblower without conflicts?

Sometimes—but it is a question to resolve before counsel gives advice, shares information or agrees to act. In-house lawyers sit close to a company’s people, records and compliance systems. That position can help an employee understand what happened. It can also leave the lawyer owing duties to the company, holding protected information, or becoming a potential witness.

The issue matters particularly in financial crime cases. An employee may be weighing whether to use an internal compliance reporting channel, make an external submission to a regulator, or do both. The company may also have separate obligations, including whether it must file a Suspicious Activity Report (SAR). Those are related issues, but they are not interchangeable.

For a prospective whistleblower, a useful first step is an independent ethics conflict check: identify whom the lawyer represents, what information the lawyer has already received, and whether confidentiality duties restrict its use or disclosure. This article explains the United States Bank Secrecy Act (BSA) whistleblower framework. It is general information, not legal advice about an individual case.

Start with the client: the company, or the employee?

An in-house lawyer ordinarily represents the organisation, not each employee who speaks with them. A conversation that feels private to an employee may therefore be treated as a communication made to the company’s lawyer for the company’s benefit. The lawyer should explain who the client is and clarify whether the employee needs separate counsel.

That distinction is especially important if an employee reports suspected misconduct to the legal department. The lawyer may be gathering facts to advise the company, investigate a concern or assess regulatory obligations. That does not, by itself, make the lawyer the employee’s personal whistleblower counsel.

Before taking on an individual, a lawyer should consider whether their duties to the employer could materially limit their advice or advocacy. They should also consider whether the company has a claim against the employee, whether the lawyer has helped design or oversee the relevant controls, and whether the lawyer may be called as a witness.

What changed in the BSA whistleblower programme?

The Anti-Money Laundering Act of 2020 created a modernised BSA whistleblower programme. Congress strengthened it in 2022 through the Anti-Money Laundering Whistleblower Improvement Act, enacted as part of the National Defense Authorization Act for Fiscal Year 2023. The changes addressed weaknesses in the original programme, including how awards would be funded and paid.

Under the amended law, qualifying whistleblowers may be entitled to an award when their original information leads to a successful enforcement action with more than $1 million in monetary sanctions. The statute provides for an award of 10 to 30 per cent of the monetary sanctions collected in the relevant action or related actions, subject to the statutory rules and the circumstances of the case.

The $1 million figure is a threshold, not a promise of payment. It concerns monetary sanctions in a successful action, rather than simply the value of suspicious activity reported or the size of a company. The award is not a fixed percentage: the responsible authorities determine the amount within the statutory range. The significance of the information, the assistance provided and other statutory considerations can matter.

Feature What it means in practice Sanctions threshold The relevant successful action must involve more than $1 million in monetary sanctions for the award provisions to apply. Award range An eligible award is generally 10–30 per cent of monetary sanctions collected, subject to the law and the decision-maker’s assessment. Source of information The information must satisfy the programme’s requirements, including requirements concerning originality and assistance. Outcome A report, investigation or enforcement action alone does not guarantee an award. Eligibility and the result must be assessed under the statute.

The word “mandatory” needs care. The 2022 overhaul strengthened the statutory award framework: when the legal conditions are met, an award is to be paid within the prescribed range. It did not make every tip eligible, guarantee that a regulator will bring a case, or ensure a particular award percentage. A lawyer should not sell the programme as a predictable recovery.

Internal reporting and external submissions are different routes

An employee may raise a concern through an employer’s compliance hotline, a manager, an ethics function or the legal department. Internal reporting can give the organisation a chance to investigate and address a problem. It may also create a record of when the employee raised the concern and what response followed.

An external submission is different. The BSA programme concerns information provided to the relevant federal authorities, including the Department of the Treasury or the Department of Justice, under the statutory process. A person considering an external report should get advice on how to submit information properly, preserve evidence lawfully and protect their own position. Internal reporting does not automatically amount to an external submission for an award, and an external submission does not remove every risk associated with an internal report.

There is no one-size-fits-all sequence. Whether to report internally first can depend on the facts, the risk of evidence being destroyed, the employee’s role and any applicable reporting requirements. Counsel should discuss timing and retaliation risk without assuming that internal escalation is always safe or always required.

SAR obligations are not a whistleblower shortcut

A financial institution’s obligation to consider and, where required, file a SAR is separate from an employee’s decision to report suspected misconduct. SARs are subject to strict confidentiality rules. A person should not take, forward or disclose a SAR—or confirm its existence—because they believe it will support a whistleblower complaint. A whistleblower submission is not a substitute for the institution’s own SAR analysis or filing duty.

In-house counsel should take particular care not to blur these channels. Internal compliance reporting, regulatory submissions and SAR processes may involve overlapping facts, but they have different purposes, recipients and legal restrictions. An employee should obtain independent advice before handling material that may be protected or restricted.

Can the in-house lawyer personally disclose what they know?

Often, this is the hardest question. Lawyers owe confidentiality duties to clients. In the United States, professional conduct rules governing confidentiality and conflicts vary by jurisdiction, although many draw on the American Bar Association Model Rules. Those rules are not a universal permission slip for a lawyer to disclose client information to regulators.

Model Rule 1.6, for example, generally restricts a lawyer from revealing information relating to a client’s representation unless the client gives informed consent, the disclosure is impliedly authorised, or an exception applies. The exceptions differ across jurisdictions and can be narrow. Model Rule 1.13 addresses a lawyer’s responsibilities when representing an organisation, including certain “reporting up” steps within the organisation. Whether external disclosure is permitted requires a separate, fact-specific analysis.

The BSA whistleblower statute also contains restrictions relevant to information obtained through attorney-client communications. In general, an attorney cannot use information obtained in that way as the basis for a whistleblower submission unless disclosure is authorised under applicable federal or state law or professional rules. The precise facts and the source of the information matter. Labelling a report “personal knowledge” does not cure a disclosure that is actually based on protected client information.

Nor does a lawyer’s access to company records mean they may copy them for personal use. Confidentiality, privilege, privacy, data-protection, employment and evidence-preservation rules may all be relevant. Counsel should not encourage an employee to remove documents, access systems without authority or breach duties in order to strengthen a possible claim.

When is an ethics conflict check enough?

A conventional conflict search checks names against a firm’s current and former clients. That is necessary, but it may not be sufficient for a proposed representation involving in-house counsel or an employee who has already reported concerns.

A careful ethics conflict check should also ask:

• Does the lawyer represent, or recently represent, the employer or an affiliate?
• Has the employee already spoken to the lawyer in the lawyer’s company role?
• Could the lawyer’s knowledge be confidential company information or privileged communication?
• Did the lawyer advise on the activity, control, investigation or decision now in question?
• Could the lawyer or another lawyer in the firm become a material witness?
• Do the employee and company have, or are they likely to have, directly adverse interests?
• Does an applicable professional rule restrict a lawyer from acting against a current client?

Consent does not automatically solve the problem. Some conflicts may be consentable if the applicable rules permit it and each affected client gives informed consent, often confirmed in writing. Other conflicts cannot be waived, or consent may not be realistic where the lawyer’s loyalty, judgment or ability to use information is impaired.

Where the lawyer’s current client is the employer, representing an employee against that employer may be prohibited or impracticable. A lawyer who has received confidential information from the company may also be unable to use it for the employee. The safer https://www.lawyer-monthly.com/2026/10/bsa-whistleblower-program-policies-for-2027/ course is often for the employee to consult independent counsel who has no duties to the employer and has not been involved in the internal response.

Retaliation protection—and its limits

The BSA provides anti-retaliation protections for covered whistleblowers. In broad terms, an employer may not discharge, demote, suspend, threaten, harass or otherwise discriminate against an employee because of protected whistleblowing activity. The statute covers qualifying disclosures to the authorities and certain internal disclosures to a supervisor or a person with authority to investigate, discover or terminate misconduct.

A worker who believes they have suffered prohibited retaliation may have a federal cause of action in a United States district court. The statute sets a filing period: generally, a civil action must be brought within two years after the date the violation occurred. Available relief can include reinstatement, double back pay with interest, special damages, and costs and reasonable legal fees. The precise remedy and procedure depend on the facts and the applicable statutory requirements.

Protection is not immunity from every workplace consequence. It does not necessarily prevent an employer from taking a legitimate action for reasons unrelated to protected reporting. Nor does it guarantee that the employee will prevail. Records of performance, the reporting timeline, the employer’s stated reasons and the employee’s communications may all become important.

Timing matters. An employee who sees adverse treatment should document dates and events, keep lawful records of relevant communications and seek advice promptly. They should not secretly collect restricted files or make recordings without checking the law. A whistleblower lawyer can assess the limitation period, available evidence and practical retaliation risks; no lawyer can promise that retaliation will not occur.

Practical steps for in-house teams and employees

1. Clarify the lawyer’s role. The company’s counsel should say plainly whether they represent the organisation or the employee, and recommend independent advice where interests may diverge.
2. Separate channels. Explain how internal compliance reporting works, who receives reports and how they are handled. Do not suggest that an internal report automatically satisfies an external regulator process.
3. Protect restricted information. Treat SAR material, privileged communications and confidential client information with care. Do not invite employees to disclose or remove material they are not authorised to share.
4. Assess conflicts before acting. Check current and former clients, prior advice, confidential information and the possibility that the lawyer will be a witness.
5. Address timing and retaliation. Record the reporting chronology, explain that statutory deadlines may apply and avoid promising protection from workplace consequences.
6. Use independent counsel where needed. A lawyer whose duties run to the employer should not be presented as the employee’s personal advocate.

The bottom line

In-house counsel may be able to provide useful information about reporting channels and the company’s response. Representing an individual whistleblower is a separate question. Company-client duties, attorney-client privilege, confidentiality duties, statutory limits on attorney-derived information and professional conduct rules can prevent the lawyer from acting—or from making a disclosure the employee wants them to make.

The BSA’s strengthened award framework makes independent advice more important, not less. The 2022 overhaul provides for awards in qualifying cases involving more than $1 million in monetary sanctions, generally within a 10–30 per cent range. It does not guarantee an investigation, an award or a safe path through workplace retaliation. A sound conflict assessment, careful handling of SAR-related information and prompt advice from independent whistleblower counsel can help an employee understand the available routes without confusing the company’s obligations with their own.