On March 30, 2026, FinCEN submitted a Notice of Proposed Rulemaking to fully implement its whistleblower program, offering 10 to 30 percent of collected penalties to individuals who report BSA violations, sanctions breaches, and other financial crimes. This is the most significant shift in AML enforcement incentives in years. Here's what it means for everyone.
FinCEN's March 30, 2026 NPRM proposes 10 to 30 percent awards for tips leading to successful enforcement actions by Treasury or DOJ
On March 30, 2026, the U.S. Department of the Treasury's Financial Crimes Enforcement Network submitted a Notice of Proposed Rulemaking to the Federal Register that will, when finalized, fully implement FinCEN's whistleblower program. The NPRM establishes a formal framework for offering financial incentives and legal protections to individuals who report violations of the Bank Secrecy Act, U.S. sanctions programs administered by OFAC, and several other laws critical to the integrity of the U.S. financial system. The public comment period runs 60 days from the NPRM's Federal Register publication date.
The program covers BSA violations, OFAC sanctions breaches, and other laws critical to the U.S. financial system
The headline number is 10 to 30 percent. Under the proposed rule, individuals whose tips lead to a successful enforcement action by Treasury or the Department of Justice would be eligible for awards ranging from 10 to 30 percent of the monetary sanctions collected. This is not a token gesture. It is a meaningful financial incentive modeled on the SEC and CFTC whistleblower programs, which have paid out hundreds of millions of dollars to tipsters and generated billions in enforcement recoveries. FinCEN is explicitly signaling that it intends to use the same playbook.
Anti-retaliation protections prohibit employers from firing or demoting employees who report to FinCEN's program
The statutory foundation for this program is not new. FinCEN's whistleblower authority was codified by the Anti-Money Laundering Act of 2020 and strengthened by the Anti-Money Laundering Whistleblower Improvement Act of 2022. The program has technically been accepting tips since those statutes were enacted. What the March 2026 NPRM does is build the full regulatory infrastructure around that authority: the procedures for submitting tips, the eligibility criteria for awards, the adjudication process for award applications, and the formal protections for whistleblowers who come forward. This is the difference between a program that exists on paper and one that functions in practice.
The program has been accepting tips since 2020. The NPRM builds the full regulatory infrastructure to make it fully operational
Who can be a whistleblower under the proposed rule? The NPRM is designed to be broad. Any individual with original information about a potential violation - an employee, a contractor, a former employee, a business partner, or even a customer - can submit a tip. The program is not limited to insiders. The key eligibility criteria are that the information must be original (not already known to FinCEN), specific enough to be actionable, and submitted through the designated portal. FinCEN recently launched a dedicated whistleblower portal, and the agency is actively encouraging individuals to submit information as soon as possible with detailed, specific documentation.
Every employee who observes a compliance failure is now a potential enforcement trigger. The risk calculus for non-compliant institutions has changed
The scope of covered violations is broader than many compliance professionals realize. The proposed rule covers violations of the Bank Secrecy Act - which includes failures to file SARs, CTR filing deficiencies, inadequate AML programs, and structuring - but it also covers violations of U.S. sanctions programs administered by OFAC. OFAC sanctions violations can carry penalties in the tens of millions of dollars, which means the 10 to 30 percent award range translates to very large potential payouts for tipsters with credible information about sanctions evasion. The rule also covers several other laws critical to national security and the integrity of the financial system, though the NPRM's specific enumeration of those laws will be detailed in the final rule.
Businesses with genuine compliance programs and strong internal reporting cultures are not the target. The target is institutions where compliance is suppressed or ignored
The protections for whistleblowers are as important as the incentives. The proposed rule includes anti-retaliation provisions that prohibit employers from firing, demoting, harassing, or otherwise retaliating against employees who report information to FinCEN's whistleblower program. These protections are modeled on the SEC's Dodd-Frank whistleblower protections, which have been tested extensively in federal courts and provide meaningful legal recourse for employees who face retaliation. For compliance officers and employees at financial institutions, this means that reporting concerns to FinCEN, even over the objection of management, carries legal protection.
The public comment period runs 60 days from Federal Register publication. Compliance professionals should engage
What does this mean for financial institutions and businesses with AML obligations? The most direct implication is that the internal compliance environment at every covered institution just changed. Employees who observe compliance failures - inadequate SAR filing, weak transaction monitoring, management pressure to ignore red flags, or outright sanctions evasion - now have a financially meaningful and legally protected path to report those failures externally. The 10 to 30 percent award structure means that a significant enforcement action generating $10 million in penalties could produce a $1 to $3 million award for the tipster. That is a number that changes behavior.
For businesses with genuine compliance programs, this development is not a threat. It is a validation. A well-designed AML program with strong internal reporting channels, a culture that takes compliance seriously, and management that responds appropriately to employee concerns is not the target of a whistleblower program. The target is the institution where management ignores red flags, where SAR filing is suppressed to protect customer relationships, or where compliance is treated as a cost center to be minimized rather than a function to be resourced. If your program is real, the whistleblower rule is not your problem.
For businesses with compliance gaps, the calculus has changed materially. The risk of a regulatory examination finding has always been real, but examinations are periodic and resource-constrained. The whistleblower program creates a continuous, distributed enforcement mechanism. Every employee who observes a compliance failure is now a potential enforcement trigger. The combination of financial incentive and legal protection means that employees who previously might have stayed silent out of loyalty, fear, or uncertainty now have strong reasons to come forward. Businesses that have been relying on the low probability of examination to avoid investing in compliance should reconsider that calculation.
The practical steps for compliance officers and business owners are clear. First, review your internal reporting channels. If your employees don't have a clear, accessible, and genuinely safe way to raise compliance concerns internally, they are more likely to go directly to FinCEN. A robust internal reporting mechanism, one that employees actually trust, is your first line of defense against external whistleblower reports. Second, review your AML program for the gaps most likely to generate employee concern: SAR filing discipline, transaction monitoring coverage, management override of compliance decisions, and the treatment of high-risk customers. Third, ensure your compliance culture is real. Employees know the difference between a compliance program that management takes seriously and one that exists on paper. The whistleblower rule rewards the former and punishes the latter.
The comment period on the NPRM closes 60 days after Federal Register publication. Financial institutions, trade associations, and compliance professionals who want to shape the final rule - on award eligibility criteria, adjudication procedures, or the scope of covered violations - should submit comments during this window. FinCEN is required to consider all substantive comments before finalizing the rule, and the final rule will reflect the input received. This is a meaningful opportunity to influence how the program operates in practice.
Further Reading
What Happens If Your Company Fails an AML Audit?
The enforcement consequences of AML program failures, now amplified by the new whistleblower incentive structure.
What Is a Suspicious Activity Report (SAR)?
SAR filing discipline is one of the most common compliance failures and one of the most likely whistleblower triggers.
What Is a FinCEN Gap Analysis?
The fastest way to identify the compliance gaps most likely to generate employee concern, before a whistleblower does.
Tags
FinCEN WhistleblowerNPRM 2026BSA EnforcementOFAC SanctionsAML ComplianceWhistleblower ProgramFinCEN 2026
SC
Soflo Consulting Team
AML/BSA Compliance Insights Team · Soflo Consulting
110 more articles
Soflo Consulting
Soflo Consulting Team publishes BSA/AML compliance analysis for regulated businesses across the United States. The team covers regulatory enforcement actions, FinCEN guidance, risk assessment, and emerging compliance obligations for banks, money services businesses, mortgage lenders, fintechs, and other covered institutions.
BSA/AML ProgramsRegulatory Enforcement AnalysisRisk AssessmentCompliance Training
View author profile & all articlesFinCEN & Regulation
In This Article
7 sections
Key Takeaways
- 1FinCEN's March 30, 2026 NPRM proposes 10 to 30 percent awards for tips leading to successful enforcement actions by Treasury or DOJ
- 2The program covers BSA violations, OFAC sanctions breaches, and other laws critical to the U.S. financial system
- 3Anti-retaliation protections prohibit employers from firing or demoting employees who report to FinCEN's program
- 4The program has been accepting tips since 2020. The NPRM builds the full regulatory infrastructure to make it fully operational
- 5Every employee who observes a compliance failure is now a potential enforcement trigger. The risk calculus for non-compliant institutions has changed
- 6Businesses with genuine compliance programs and strong internal reporting cultures are not the target. The target is institutions where compliance is suppressed or ignored
- 7The public comment period runs 60 days from Federal Register publication. Compliance professionals should engage
Need Expert Guidance?
Put these insights into action. Talk to a compliance professional at Soflo Consulting compliance specialist.
Stay Ahead of Compliance
Get FinCEN updates, BSA/AML guidance, and federal compliance news delivered to your inbox - no fluff.
