What does the $1 million sanctions rule mean for whistleblower awards?

A whistleblower who reports suspected money laundering or other Bank Secrecy Act (BSA) violations may qualify for a financial award if the information helps the government bring a successful enforcement action. The headline threshold is straightforward: the action must result in monetary sanctions exceeding $1 million.

The practical rules are less simple. A report is not automatically eligible because it concerns a large case, and the whistleblower does not receive a fixed share of a penalty. The law sets an award range, but eligibility depends on the information supplied, the enforcement outcome and other statutory conditions. Timing matters, too—particularly for employees who report concerns through their employer’s compliance channels before contacting regulators.

This article explains the BSA whistleblower programme after the 2022 legislative changes, how the sanctions threshold works, and what protections may apply if an employer retaliates.

What changed in the BSA whistleblower programme?

The BSA requires financial institutions and other covered businesses to maintain controls against money laundering and to report certain suspicious activity to the government. Those reports are known as Suspicious Activity Reports (SARs). The system also provides a route for people with relevant information to report possible violations to authorities.

Congress overhauled the programme through the Anti-Money Laundering Whistleblower Improvement Act, enacted in 2022. The changes strengthened the award framework and added or expanded protections for people who report BSA-related misconduct. In particular, the legislation replaced the former low statutory ceiling on awards with a percentage-based range and made awards mandatory when the legal conditions are met.

That does not mean every person who reports a concern receives money. The person must meet the programme’s eligibility rules, and the information must contribute to a qualifying enforcement result. The law is an incentive and protection mechanism—not a guarantee of an investigation, prosecution or payment.

How the $1 million sanctions trigger works

The threshold is tied to the result of a qualifying enforcement action. In general, the action must produce monetary sanctions of more than $1 million. The statutory test is therefore about the enforcement outcome, not simply the seriousness of the alleged conduct or the amount a whistleblower believes may be involved.

A report about a substantial suspected scheme may not lead to a qualifying award if the authorities do not bring a covered action, if the action does not produce sanctions above the threshold, or if the person’s information does not meet the programme’s requirements. Conversely, the person need not necessarily know in advance that the government will recover more than $1 million. That is determined by what happens in the case.

“Exceeding” means more than $1 million

The wording matters: the trigger is sanctions exceeding $1 million. A result of exactly $1 million is not the same sanctions over $1 million as a result above that amount. Whether sanctions from related proceedings or multiple components count together can depend on the statutory definition and the facts of the enforcement matter. A potential claimant should not assume that separate penalties will automatically be aggregated.

The trigger also concerns monetary sanctions, not every consequence of an enforcement action. An order requiring a business to improve its controls, for example, is not itself a cash recovery. The relevant authorities assess whether the action and resulting monetary sanctions fall within the programme.

Question What it means in practice Must the case result in sanctions above $1 million? Yes, the statutory award trigger is based on monetary sanctions exceeding that amount in a qualifying action. Does a large allegation guarantee an award? No. The government must take qualifying action, and the person must satisfy the information and eligibility rules. Is the award a percentage of the alleged loss? No. The percentage range applies to monetary sanctions collected, subject to the programme’s rules. Does filing an internal report alone secure an award? No. Internal reporting can matter, but the programme’s submission and timing requirements still need attention.

Mandatory awards: what the law does—and does not—promise

When the statutory conditions are satisfied, the award is mandatory. That is an important change from a system in which a whistleblower could meet the threshold yet have no clear entitlement to an award. But “mandatory” does not mean automatic or immediate.

The authorities must first determine whether the information qualifies, whether it helped produce a successful action, whether the sanctions threshold has been crossed and what amount has been collected. They must also assess the appropriate percentage within the legal range. Disputes about eligibility, contribution or the amount can affect the process.

In other words, the law creates a right to an award when its requirements are met. It does not promise that a report will lead to enforcement, that the enforcement action will exceed $1 million, or that a particular percentage will be paid.

What the 10 to 30 per cent range means

For a qualifying action, the award is generally set at between 10 and 30 per cent of the monetary sanctions collected. The percentage is not calculated on the suspected value of the misconduct, the business’s total revenue or an uncollected penalty. It is linked to money collected in the qualifying action, subject to the statute and any applicable award determinations.

The range gives the government room to assess the value of the information and the circumstances of the report. Information that is original, specific and useful in uncovering or proving a violation may carry different weight from information that is already known or contributes little to the action. The law does not provide a simple formula that lets a whistleblower predict the final percentage.

For illustration only, if $5 million in qualifying monetary sanctions were collected, a 10 per cent award would be $500,000 and a 30 per cent award would be $1.5 million. Those figures are not a forecast: the actual award depends on the case, the amount collected and the applicable programme rules. An award may also be paid later than the initial enforcement announcement because collection and award decisions take time.

Who may qualify for an award?

The programme focuses on people who voluntarily provide original information about possible BSA violations. “Original information” generally means information based on the person’s independent knowledge or analysis that is not already known to the government and is not merely drawn from a public source. The precise statutory tests and exclusions matter.

For a person considering a report, useful questions include:

• Is the information based on first-hand knowledge, documents or analysis, rather than rumour?
• Has it already been reported to, or become known by, the relevant authorities?
• Could the information help identify a violation, explain how it operated or establish who was responsible?
• Does a statutory exclusion apply to the person’s role or the source of the information?
• Has the information been submitted through the required route and within the relevant timeframe?

These are not questions a person can always answer alone. A lawyer familiar with the programme can help assess the rules without assuming that a report will produce an award.

Internal compliance channels and external reporting

Internal compliance channels and external submissions to regulators serve different purposes. A company’s hotline, compliance team or legal department may be able to investigate and address a concern. A report to the government, by contrast, can put information before authorities that may pursue a BSA enforcement action.

Under the 2022 changes, internal reporting can be relevant to award eligibility. In certain circumstances, a person who first reports to an employer may preserve the benefit of the earlier disclosure date by submitting the information to the Treasury Department within the statutory 120-day period. The conditions are specific, so an internal report should not be treated as a substitute for checking the external filing requirements and deadline.

Nor should employees assume that a company’s response will protect their position indefinitely. If a concern involves senior management, a conflict of interest or a risk that records may be altered, the decision about where and when to report deserves careful attention. The choice may also affect the person’s safety at work and the evidence available later.

SAR duties are not the same as whistleblower submissions

A SAR is generally a filing obligation for a covered institution, not a personal award claim by an employee. A staff member who identifies suspicious transactions should follow applicable internal procedures, but should not assume that the institution’s SAR process is the only route for reporting suspected wrongdoing to the government.

Equally, whistleblower reporting does not authorise someone to disclose confidential customer information or reveal that a SAR has been filed. SAR confidentiality rules are important. Anyone handling SAR-related material should avoid tipping off a customer or sharing protected information outside authorised channels, and should obtain legal advice before transmitting sensitive records.

Anti-retaliation protections and a federal cause of action

The BSA whistleblower provisions prohibit covered retaliation against people who engage in protected reporting activity. Prohibited conduct can include dismissal, demotion, suspension, threats, harassment or other discrimination connected to the report. The protections are intended to address workplace consequences—not to eliminate the personal or professional risks of reporting.

The statute provides a federal cause of action for a whistleblower who experiences prohibited retaliation. A claim may be brought in federal district court, subject to the law’s procedures and deadlines. The statute includes a two-year period for bringing an action, so someone facing retaliation should not wait to get advice about when the clock starts or what steps are required.

Potential remedies can include reinstatement, double back pay with interest, special damages and reasonable legal fees and costs. These remedies are not automatic: the person must establish a qualifying claim, and the outcome depends on the evidence and legal process. A protection on paper cannot guarantee that an employer will not retaliate or that a court will order a particular remedy.

Keep timing and evidence in view

Retaliation can be difficult to prove, especially where an employer gives a performance-related explanation for a decision. A person who is concerned about adverse treatment may wish to preserve relevant records lawfully, make a clear timeline and note who knew about the report and when. They should not remove confidential business or customer information in breach of law or policy.

Timing matters in more than one way. A person may need to meet the deadline for an external submission after reporting internally, and a retaliation claim has its own time limit. Seeking confidential legal advice early can help clarify both issues https://dlf-ne.org/when-did-the-new-bsa-whistleblower-rules-start/ and reduce the risk of relying on an incorrect assumption.

What the rule means for potential whistleblowers

The $1 million trigger makes the award programme more meaningful, but it is only one part of the test. A person’s information must qualify, contribute to a successful covered action and meet the programme’s procedural requirements. Any award is based on sanctions collected, falls within a 10 to 30 per cent range and is determined through a process that may take time.

1. Document what you know. Separate first-hand facts from assumptions, and identify where relevant records may be held.
2. Understand the reporting route. Consider internal compliance channels and external submissions as distinct options, with different consequences and requirements.
3. Check deadlines promptly. The 120-day rule associated with certain internal reports and the deadline for a retaliation claim should not be left to guesswork.
4. Protect confidential information. SAR rules and customer confidentiality obligations may restrict what can be shared and how.
5. Do not rely on an award forecast. The sanctions trigger and percentage range do not guarantee that authorities will act or that a particular payment will follow.

The programme offers a potential financial award and a federal route to challenge retaliation. It does not remove the need to make careful decisions about evidence, confidentiality and timing. For anyone weighing an internal report against an external submission, tailored legal advice can help explain the available options without promising an outcome.