From $150,000 to a share of the penalty

For years, FinCEN’s whistleblower authority was largely theoretical. The maximum award was capped at $150,000 — meaningful money to an individual, but nowhere near enough to offset the career risk of reporting misconduct at your own employer. The program existed. The incentive did not.

That has now changed completely. Under the framework Congress built through the Anti-Money Laundering Act and FinCEN proposed to operationalize on March 30, 2026, a whistleblower whose original information leads to a successful enforcement action with monetary sanctions above $1 million is eligible for 10 to 30 percent of what is collected — paid from a $300 million revolving fund. FinCEN opened its whistleblower portal in February 2026 and is already accepting tips; the comment period on the implementing rule closed June 1.

This is the same architecture that made the SEC and CFTC whistleblower programs so consequential. Those programs did not just generate tips; they reshaped how companies handled internal reports, because leadership understood that an employee who felt ignored now had a well-paid alternative.

Wider than banks

Two features make this broader than most compliance leaders assume. First, the covered conduct is not limited to the Bank Secrecy Act — it extends to U.S. sanctions authorities including IEEPA, the Trading with the Enemy Act, and the Kingpin Act, and to conspiracies to violate them. Second, and consequently, the program reaches well beyond BSA-covered financial institutions to any company with sanctions exposure. A manufacturer, a logistics firm, a technology company with export-touching operations — all are now inside the aperture.

Tips submitted to FinCEN can support enforcement actions brought by Treasury, including OFAC, and by the Department of Justice. And tips may be submitted anonymously, though an anonymous award claim must run through an attorney.

This is not a threat to manage

The instinctive response in some boardrooms will be defensive: tighten confidentiality language, remind people about internal channels, treat the program as a legal exposure to be contained. That reaction misreads the situation, and the anti-retaliation protections built into the program make the defensive posture legally hazardous besides.

Here is the more useful way to see it. A whistleblower program does not create problems inside an institution — it changes what happens to problems that already exist. If your controls work and your people trust that raising a concern leads to action, the program is a non-event. If concerns get raised and quietly go nowhere, the program is now the mechanism by which that failure becomes an enforcement action with a percentage attached.

Your internal escalation culture is now a financial control

The practical effect is that something historically treated as soft — whether people feel heard when they raise concerns — is now a hard risk variable. In an effectiveness-based supervisory regime, a compliance analyst who flags a systemic problem and watches it get deprioritized is not just a morale issue. That person now has a credible, well-compensated external channel.

Which means the institutions best positioned are the ones where escalation actually functions: where raising a concern is safe, where issues get triaged and resolved, and where the whole loop leaves a documented trail.

1. Make internal channels genuinely credible. Not just posted, but demonstrably safe and effective. If your people cannot name a time a concern led to a change, your channel is decorative.
2. Close every loop. The failure mode is not that concerns go unraised — it is that they go unanswered. Track each one to a resolution and tell the person what happened.
3. Document the response, not just the report. Under an effectiveness standard, what matters is the evidence you investigated, decided, and acted. That record is your best defense and it can only be built contemporaneously.
4. Fix root causes, not symptoms. A resolved individual complaint that leaves the underlying weakness in place simply postpones the tip — and enlarges it.
5. Broaden the aperture. If you have sanctions exposure anywhere in the enterprise, extend this thinking beyond the compliance function to operations, trade, and vendor management.

The best answer is a program that works

Every path through this leads back to the same place: an institution whose controls genuinely work has very little to fear from a well-funded whistleblower program, because there is nothing to report that is not already being found and fixed internally. The exposure is not the program. The exposure is the gap between what your controls detect and what is actually happening in your book of business.