Overview
On April 1, 2026, the Financial Crimes Enforcement Network (“FinCEN”) issued a notice of proposed rulemaking (“NPRM”) that would operationalize the whistleblower program Congress created in 2021 and expanded in 2022. The proposal would establish the procedures for submitting tips, seeking awards, and invoking statutory protections, while bringing a broader set of anti-money laundering and sanctions-related matters squarely within FinCEN's whistleblower authorities. For companies subject to the Bank Secrecy Act (“BSA”) and for businesses that operate in sanctions-sensitive sectors, the proposal is significant not simply because it promises monetary awards, but because it is designed to encourage earlier, better-documented, and potentially more frequent reporting of suspected misconduct.
What the Proposed Rule Would Do
The proposed rule would replace FinCEN's existing informant-reward regulation at 31 C.F.R. § 1010.930 with a more comprehensive “Whistleblower Incentives and Protections” regime. As FinCEN explains, the new framework is intended to govern the entire life cycle of a whistleblower submission, including: the submission of “original information”; eligibility requirements; award applications; award adjudication; confidentiality protections; and appeals, among other provisions. In other words, FinCEN is not merely creating a tip line. It is building, as required by statute, a formal program that mirrors the structure of more mature federal whistleblower regimes, which is expressly tied to Treasury and Department of Justice enforcement activity.
Covered Conduct and the Expansion Beyond Traditional AML Issues
Congress originally enhanced the BSA whistleblower provisions in the Anti-Money Laundering Act of 2020, but the Anti-Money Laundering Whistleblower Improvement Act later expanded the program to cover not only BSA violations, but also certain violations of the International Emergency Economic Powers Act (“IEEPA”), the Trading With the Enemy Act (“TWEA”), and the Foreign Narcotics Kingpin Designation Act (“Kingpin Act”). FinCEN underscores that this expansion means the program reaches beyond traditional AML reporting failures and into the sanctions and national security arena more broadly. The inclusion of IEEPA is important because IEEPA underpins a broad range of national security regulatory regimes, including many US sanctions regimes and regulations such as the Outbound Investment Security Program, the Data Security Program, and Information and Communications Technology and Services Rules, among others.
Eligibility, Covered Actions, and Award Structure
Among other factors, eligibility will turn on whether a whistleblower voluntarily provides “original information” that leads to the successful enforcement of a “covered action” or certain “related action.” Covered actions are judicial or administrative actions brought by Treasury or the Department of Justice that result in monetary sanctions exceeding $1 million.
Eligible whistleblowers may receive up to 30 percent of monetary sanctions collected, and are entitled to not less than 10 percent of collected monetary sanctions in qualifying matters. FinCEN also notes that the 2022 legislation established a revolving fund so that awards may be paid from collected penalties without the need for further appropriations, a feature that should make the program more credible in practice than the earlier, appropriation-dependent framework.
The program is likely to lead to a substantial increase in whistleblowers incentivized by the potentially significant awards available.
Original Information
Among other requirements, an eligible whistleblower must submit “original information.” Such original information can be based on either “independent knowledge” or “independent analysis.”
Independent knowledge refers to factual information known to the whistleblower that is not exclusively obtained from publicly available sources. FinCEN explains that this does not require direct, first-hand observation of the misconduct. Instead, the knowledge may come from the whistleblower’s own experiences, work activities, or information learned from other people, so long as it is not merely copied from public materials such as press reports, public filings, or internet sources.
By contrast, independent analysis refers to the whistleblower’s evaluation of information that yields material insights or interpretations that are not generally known or available to the public. In other words, even if some of the underlying facts are publicly available, a whistleblower may still contribute “original information” if the whistleblower connects those facts, interprets them, or identifies their significance in a way that materially advances understanding of a potential violation.
The inclusion of “independent analysis” is particularly interesting as it may incentivize actors with no connection to the company in question to search for potential violations in publicly available information. For example, an actor might sift through publicly available blockchain data looking for violations by a digital asset company or might look for evidence that a company’s products were being used by a sanctioned person or in a comprehensively sanctioned jurisdiction.
Potential Impact on Corporate Compliance Programs
The NPRM also contains numerous features that will be important for how companies structure their compliance program and their procedures for handling internal complaints and reports of potential misconduct.
For example, the NPRM would impose a 120-day waiting period for certain company insiders before they make a reward-eligible report to FinCEN. The waiting period would apply to certain personnel who learn of potential misconduct through internal audit, compliance, or internal-control functions and to officers, directors, trustees, and partners. FinCEN explains that this waiting period is intended to provide companies “the opportunity to review and assess information that could relate to a violation of a covered statute and, where they deem it appropriate, address and/or voluntarily disclose the information to the government.” This is likely to put pressure on companies to move quickly to investigate, remediate, and, where appropriate, disclose misconduct that is identified internally, and makes having a well-developed process for receiving and acting on reports of potential misconduct critical.
Similarly, whistleblowers will generally not be eligible for an award if the relevant information they receive is subject to attorney-client privilege. This may impact how companies structure their internal legal and compliance functions and how they choose to respond when potential red flags or similar concerns appear, such as by shortening the escalation timeline for internal reports or involving legal counsel earlier than they might have otherwise.
These are just a few examples of ways that companies may wish to update their internal reporting and investigation procedures and related compliance programs more generally.
Next Steps
The immediate next step is the comment process. FinCEN has invited public comment on all aspects of the proposed rule, including specific questions raised in the preamble; comments are due by June 1, 2026. Companies, trade associations, and other stakeholders may wish to comment on issues such as the definition of “original information,” the mechanics and timing of award applications, confidentiality safeguards, treatment of internal reporting, and the interaction between the new program and existing compliance obligations.
Companies should also consider taking steps to pressure-test their internal reporting, investigation, and remediation frameworks.
Conclusion
In short, FinCEN's proposal is a consequential step toward making the AML and sanctions whistleblower framework real. If adopted substantially as proposed, the rule would create a more predictable pathway for whistleblowers, increase pressure on companies to respond effectively to internal complaints, and potentially expand the government's access to information in some of its highest-priority financial crime and national security matters.
***
For additional information regarding this action or assistance in preparing a comment please contact a member of Steptoe’s Anti-Money Laundering Practice, Economic Sanctions Practice, or National Security & Cross-Border Transactions Practice.
