FinCEN issues proposed rule to enhance whistleblower incentives and protections

Proposed framework

The Whistleblower Program applies to information relating to potential violations of the Bank Secrecy Act of 1970 (BSA), the International Emergency Economic Powers Act of 1977, the Trading with the Enemy Act of 1917, and the Foreign Narcotics Kingpin Designation Act of 1999 (collectively, Covered Statutes). The Covered Statutes underpin a range of AML, economic and trade sanctions, and national security programs, including the sanctions administered by the Office of Foreign Assets Control, the US Department of Justice’s (DOJ) Data Security Program, and Treasury’s Outbound Investment Security Program.

Under the NPRM, to qualify for an award, the whistleblower must i) voluntarily provide “original information” in accordance with prescribed procedures, derived from independent knowledge or analysis; ii) be the original source of the information; iii) provide information that leads to a successful enforcement action; and iv) provide Treasury and the DOJ with additional information if requested.

Importantly, the NPRM defines “original information” as information that is not already known to Treasury or the DOJ from another source. The NPRM also provides that FinCEN will determine whether original information has “led to” a successful enforcement action based on whether the information i) caused an appropriate agency or authority to initiate the relevant examination or investigation or ii) significantly contributed to a successful enforcement action concerning conduct that was already under investigation or examination.

The NPRM also proposes a requirement that internal personnel serving in certain roles must wait at least 120 days from the date they obtained the information before submitting a whistleblower tip to FinCEN concerning their organization or employer. This would allow individuals to report misconduct internally to their organization and still be eligible for a whistleblower award if the organization declines to self-disclose the apparent violations to the government. The rationale for this provision is to “provide entities that invest in strong internal audit and compliance programs the opportunity to benefit from such programs” and to discourage whistleblowers from undermining their employer’s internal compliance processes or its decision to self-disclose to the government.

Certain individuals would be ineligible for whistleblower awards under the proposed rule, including government personnel acting within the scope of their duties, individuals convicted of related criminal conduct, those who obtained information through privileged communications or unlawful means, and those who make false or misleading statements to FinCEN, the DOJ, or another agency in connection with a related enforcement action.

Potential awards

The NPRM would create an award structure for eligible whistleblowers, pursuant to the statutorily mandated range. Awards would range from 10% to 30% of monetary penalties collected in enforcement actions that result in penalties exceeding $1,000,000. Monetary penalties include fines, settlement payments, disgorgement, and interest but exclude forfeiture, restitution, and victim compensation. Enforcement actions under the Covered Statutes that result in monetary penalties of less than $1,000,000 do not qualify for the new award structure, although penalties may be aggregated from related actions arising out of substantially the same facts in order to reach this threshold.

To determine the size of the award within the statutory range, FinCEN will consider several factors: significance of the information, degree of assistance provided by the whistleblower, Treasury’s or DOJ’s programmatic interest in deterring the conduct identified by the whistleblower, the whistleblower’s culpability or involvement in the reported conduct, unreasonable delay in reporting the conduct, and whether or to what extent the whistleblower “utilized an entity’s internal compliance or reporting systems” and whether the whistleblower undermined those systems. In situations where 30% of collected money penalties equals $15 million or less, FinCEN would generally award the statutory maximum unless it determines that the maximum award presumption should not apply in consideration of negative factors, such as that the whistleblower undermined the relevant organization’s compliance procedures. The presumptive maximum would provide a strong incentive for would-be whistleblowers to report potential violations of AML, sanctions, and national security laws.

To receive an award, the whistleblower must submit an application within 90 calendar days after publication of the notice of the relevant enforcement action or 180 calendar days for related actions brought by other federal or state agencies based on the same information. Final determinations (other than award amounts) may be appealed to the appropriate Court of Appeals of the United States within 30 calendar days after FinCEN issues its determination. FinCEN may permanently bar individuals who make three or more frivolous or abusive submissions.

Whistleblower protections

The NPRM would implement the statutory protections against retaliation against whistleblowers provided for under the BSA and expand procedural safeguards. Specifically, it prohibits employers from retaliating against individuals for taking lawful action covered under the Whistleblower Program, prohibits actions that impede reporting possible violations of a Covered Statute to FinCEN or the DOJ, invalidates predispute arbitration agreements covering whistleblower retaliation claims, and provides remedies – including reinstatement, double backpay, and recovery of litigation costs and attorneys’ fees – for whistleblowers who face discharge or discrimination by their employer. The antiretaliation protections apply even if the whistleblower’s complaint does not result in a successful enforcement action.

The NPRM also includes confidentiality provisions restricting disclosure of information that could reasonably reveal a whistleblower’s identity, subject to limited exceptions necessary for enforcement or legal proceedings.

The NPRM does not provide amnesty for whistleblowers. Individuals involved in underlying misconduct remain subject to civil or criminal liability, and culpability may affect award determinations. For example, the NPRM provides that FinCEN would exclude amounts attributable to the whistleblower’s own misconduct when calculating a potential base award and would be permitted to make further reductions based on culpability, delay, or interference with internal compliance processes.

Takeaways

The NPRM represents a significant milestone in the years-long rollout of the Whistleblower Program, and FinCEN expects that the enhanced incentives for eligible whistleblowers could more than double the tip submissions within a short period after the final rule’s implementation. If adopted as proposed, the mandatory award framework set forth in the NPRM would create strong financial incentives for early reporting, including by employees who might have otherwise raised concerns internally. As regulators begin receiving more detailed, insider-generated tips earlier in the investigative life cycle, organizations may have less of an opportunity to identify and remediate issues internally, or to submit a voluntary self-disclosure, before government scrutiny begins.

Additionally, a separate notice of proposed rulemaking to formalize and update the AML and countering of financing terrorism requirements for financial institutions signals that FinCEN is shifting its enforcement focus from “check the box” compliance to egregious violations. In light of both rulemakings, organizations subject to AML and sanctions requirements should assess their compliance programs. Organizations should consider evaluating their exposure under the Covered Statutes, reviewing relevant internal reporting and investigation processes, and assessing the effectiveness of antiretaliation controls.

FinCEN is inviting comments from the public on “all aspects of the proposed rule,” including the clarity of defined terms, eligibility criteria, award amounts, and timing requirements, among other aspects of the proposed regulations. Organizations with exposure to the Covered Statutes should carefully assess the consequences and burdens for their compliance departments created by the Whistleblower Program and consider whether submitting a public comment to help shape these new regulations could be beneficial. Comments are due by June 1, 2026.

McDermott Will & Schulte lawyers are available to assist with evaluating the consequences to your organization if the NPRM is finalized as proposed and to submit comments to FinCEN on your organization’s behalf. Please contact your usual firm representative or any of the authors listed below.