If I work at a bank, what records should I keep before reporting wrongdoing?

If you work at a bank and suspect that money-laundering controls are being ignored, your first instinct may be to save emails, reports or screenshots. Be careful. Keeping a clear record of what you personally observed can help you explain a concern. Copying customer files, taking restricted documents or disclosing a Suspicious Activity Report can create serious legal and employment risks.

This article concerns United States law. The Bank Secrecy Act (BSA) whistleblower programme is a US federal programme, and rules may differ if you work elsewhere. This is general information, not legal advice. Before making an external submission or collecting records, consider speaking confidentially with a lawyer experienced in whistleblower and financial-regulatory matters.

Start with what you know, not what you can take

A useful record is a careful account of facts, not a private archive of bank documents. Write down what you saw, heard or did as part of your work, and separate those observations from assumptions. For example, “The alert was https://bizzmarkblog.com/do-whistleblower-awards-pay-out-on-imposed-sanctions-or-collected-sanctions/ closed on 12 March without the additional review required by the procedure” is more useful than “The bank is laundering money” if the latter is only your https://dlf-ne.org/what-are-the-biggest-policy-gaps-in-the-bsa-whistleblower-programme-right-now/ conclusion.

Make notes promptly, while your memory is fresh. Include dates, approximate times, the relevant team or process, and how you came to know the information. If you do not know a detail, say so. Do not fill gaps with guesses or use a colleague’s account as if you witnessed the event yourself.

Records that may help explain a concern

• A chronology: when the events happened, when you raised concerns, and what responses followed.
• Specific process details: which control, review step or escalation appears to have been missed, and how the process normally works.
• Your own communications: dates and recipients of messages or meetings you participated in, recorded in a way you are authorised to retain.
• Relevant roles: job titles or teams involved, where this is necessary to explain the issue. Avoid collecting personal details that are not relevant.
• Policy references: the name, version or section of a policy you were entitled to access, rather than an unauthorised copy of a restricted policy.
• Follow-up: what you reported, through which channel, and any response, instruction or change in treatment that followed.

These notes can support whistleblower submission prep: organising a clear account of the concern before speaking with a lawyer or regulator. They are not a substitute for evidence the regulator may need to obtain through lawful processes.

Documenting non-public information without removing it

Documenting non-public information does not mean taking it out of the bank. Customer records, transaction data, alert histories, internal investigations and compliance files can be highly sensitive. Access at work does not necessarily give you permission to download, print, photograph, forward or store them for personal use. Do not use a personal email account, cloud drive, messaging app or USB device to make a private copy.

Instead, make a factual note that identifies the kind of information and where an authorised reviewer could locate it. For example, record the date range, system or case reference if you are permitted to note it, and the reason it matters. Do not include customer names or account details in your personal notes unless a lawyer advises you that doing so is lawful and necessary.

Never alter records, access material outside your role, encourage someone else to obtain it improperly, or delete information to conceal your own actions. Keep records you are already entitled to retain in the ordinary course of your work, subject to the bank’s policies and any legal hold. If you are unsure whether a document can be retained, ask a lawyer before acting.

SAR confidentiality needs special care

A Suspicious Activity Report (SAR) is a report that a financial institution files with the US government about suspected activity that may involve money laundering or other financial crime. Banks have obligations to identify and report certain suspicious activity. Those obligations do not give an employee permission to disclose a SAR or confirm that one exists.

Federal law generally protects the confidentiality of SARs and information that would reveal their existence. Do not copy, attach, quote from, or tell a regulator or colleague about a SAR unless an authorised legal adviser confirms that the disclosure is permitted. You can raise the underlying concern—such as a pattern of transactions, a control failure or an instruction to suppress escalation—without disclosing the SAR itself. When in doubt, describe the issue at a high level and get legal advice before sharing details.

Internal compliance reporting and external submissions are different

A bank may provide internal channels such as a compliance hotline, an ethics portal, a manager, an anti-money-laundering officer or the board’s audit committee. These routes can prompt a timely investigation and create a record that you raised the concern. Follow the channel’s instructions, keep a note of the date and reference number, and retain only material you are authorised to keep.

Internal reporting is not the same as an external submission to a regulator. Under the BSA whistleblower framework, a person may provide information to the US Department of the Treasury, including through the Financial Crimes Enforcement Network (FinCEN), which administers the programme. Whether to report internally, externally or both depends on the facts, urgency, confidentiality concerns and legal advice. Do not assume that making an internal report automatically counts as a submission to FinCEN, or that you must report internally first to qualify for a possible award.

There may be reasons to seek advice before using an internal channel—for example, if you believe a manager is involved, if records may be destroyed, or if you fear retaliation. There may also be reasons to report internally first. There is no single safe sequence for every case. An experienced lawyer can help assess the timing and the appropriate channel without promising a particular outcome.

What changed in the BSA whistleblower programme?

The Anti-Money Laundering Act of 2020 created a BSA whistleblower framework. Congress strengthened it in 2022 through the Anti-Money Laundering Whistleblower Improvement Act, enacted in December 2022. Among other changes, the revised law provides for mandatory awards when the statutory conditions are met, rather than leaving an award entirely to agency discretion.

The key threshold is generally a successful enforcement action resulting in monetary sanctions exceeding $1 million. If the legal requirements are satisfied, the award is set at between 10 and 30 per cent of the monetary sanctions collected in the covered action and related actions. “Mandatory” does not mean that every person who reports a concern will receive money. The information must meet the programme’s requirements, and an award depends on a qualifying enforcement outcome and collected sanctions.

Programme feature What it means in practice $1 million sanctions trigger A qualifying enforcement action must generally result in monetary sanctions exceeding $1 million for the award provisions to apply. 10–30 per cent range The award is calculated from qualifying monetary sanctions collected. The percentage is not a guaranteed share of any penalty announced in the news. Mandatory award If the statutory conditions are met, the award is not simply an optional payment. Eligibility and the amount still require an official assessment. Information must qualify The programme has rules about the information, the person reporting it and the enforcement action. A report alone does not establish eligibility.

The range matters, but it should not drive decisions about whether to report. Enforcement can take years, a matter may not produce collected sanctions, and the award percentage is not chosen by the whistleblower. Other eligibility rules and exclusions may apply. A lawyer can assess how those rules relate to your role and information.

Keep an accurate record of your reporting steps

For your own chronology, note when you contacted an internal channel or external authority, how you submitted the information, and any confirmation or reference number. Record what you provided in general terms, but do not keep a prohibited copy of the submission or attachments. If you used a lawyer, keep communications confidential and follow the lawyer’s instructions about preserving or sharing materials.

1. Write a dated account of the concern and distinguish direct observations from inference.
2. Identify the relevant process, control or decision and the basis for your understanding.
3. Note where supporting records may be found, without taking unauthorised copies.
4. Record internal and external reporting dates, channels and responses.
5. Before sharing customer, SAR or other restricted information, obtain legal advice.

Retaliation protections—and their limits

The BSA includes anti-retaliation protections for eligible whistleblowers. In general, an employer may not take specified adverse actions against an employee because the employee provided information to the government, or otherwise engaged in protected activity under the statute. The law provides a federal cause of action in defined circumstances.

These protections are important, but they are not a guarantee that retaliation will not occur, nor do they automatically resolve every workplace dispute. The law sets procedures and deadlines. A whistleblower generally must first file a complaint with the US Department of Labor within 180 days of the alleged retaliation. If the Department has not issued a final decision within 180 days, and the delay is not due to the employee’s bad faith, the employee may be able to bring an action in federal district court. Available remedies can include reinstatement, back pay with interest, and certain costs and fees.

Because timing matters, do not wait for an internal investigation to conclude before seeking advice if your employment is affected. Keep a separate, factual chronology of events such as changes to duties, exclusion from meetings, disciplinary action or termination. Note dates, decision-makers and stated reasons. Avoid secretly recording conversations or accessing personnel files unless a lawyer confirms that doing so is lawful.

Before you report

A strong report is specific, measured and honest. It identifies what may have gone wrong, how you know, when it happened and where authorised investigators could look. It does not require you to prove the entire case or remove evidence from the bank. Nor can anyone responsibly promise that a report will lead to an enforcement action, an award or protection from workplace consequences.

If you work at a bank, preserve your own lawful notes, protect customer and SAR confidentiality, and get advice early—especially where internal operations evidence is restricted or retaliation may be developing. The safest preparation is usually a clear timeline and a careful account of where relevant evidence exists, not a copied file of the bank’s records.