Where Do I File a BSA Whistleblower Complaint: FinCEN or DOJ?

If you suspect a bank, money services business or another covered institution has violated the Bank Secrecy Act (BSA), the right place to raise the concern depends on what you want to achieve. Are you reporting suspicious activity, providing information that may support a government investigation, or pursuing protection or compensation for retaliation? Those are related, but not identical, routes.

For a potential BSA whistleblower award, FinCEN is generally the practical starting point: it administers the US Treasury’s whistleblower programme. A disclosure to the Department of Justice (DOJ) may also be relevant, particularly where the facts suggest criminal conduct. But choosing an agency is only one part of the decision. The quality and timing of the evidence, your identity, and possible retaliation risks also matter.

This article is general information, not legal advice. BSA and whistleblower issues are fact-specific; consider speaking with a lawyer experienced in financial-crime reporting before making a disclosure.

First, distinguish the different kinds of report

“BSA complaint” can mean several things. A person who works at a bank may have noticed that customer due diligence checks were not completed. A former employee may have records suggesting that management deliberately ignored repeated warnings. A customer may want to report suspected money laundering. These situations do not automatically belong in the same reporting channel.

What you want to do Possible route Important distinction Provide information about a possible BSA violation for potential whistleblower protection or an award FinCEN’s whistleblower programme; a disclosure to DOJ may also be relevant FinCEN administers the Treasury programme. Eligibility and any award depend on statutory requirements, not simply on filing a report. Report suspected criminal conduct DOJ or an appropriate law-enforcement channel; FinCEN may also be relevant A criminal referral is not the same thing as a whistleblower award claim. Understand an institution’s BSA/AML examination framework FFIEC resources, including the BSA/AML Examination Manual The FFIEC is a useful reference for supervisory expectations, not a general whistleblower complaint office. Challenge retaliation, dismissal or another employment action Legal advice and the relevant statutory or court process Deadlines and procedures can differ from those for submitting information to an agency.

FinCEN or DOJ: how to think about agency selection

FinCEN and the Treasury whistleblower programme

FinCEN is part of the US Department of the Treasury and administers the BSA whistleblower programme established under the Anti-Money Laundering Act of 2020. The programme can provide awards to eligible whistleblowers whose original information leads to qualifying enforcement actions and monetary sanctions, subject to the law’s conditions.

That does not mean every report to FinCEN qualifies for an award, or that a person should expect payment simply for reporting a compliance failure. The statutory rules concerning original information, voluntary submission, the government’s use of the information and other eligibility conditions matter. Check FinCEN’s current official whistleblower guidance and submission instructions before filing.

DOJ and a possible criminal referral

DOJ may be an appropriate recipient where the evidence points to intentional fraud, concealment, obstruction, or other potentially criminal conduct. A DOJ referral can put information before law-enforcement authorities, but it is not a substitute for understanding the FinCEN-administered award process. If you want to preserve a potential whistleblower claim, do not assume that sending an email or complaint to one agency automatically satisfies every requirement of another process.

Agency selection is not always an either-or choice. The laws and procedures may allow information to reach more than one relevant authority, but parallel disclosures should be considered carefully. Inconsistent accounts, mishandled confidential information or an avoidable delay can create problems. A lawyer can help assess the best recipient and how to describe the matter without overstating what the evidence proves.

What the FFIEC can—and cannot—tell you

The Federal Financial Institutions Examination Council (FFIEC) website, ffiec.gov, is useful for understanding how regulators describe BSA/AML controls and examination expectations. Its BSA/AML Examination Manual can help you identify the control area involved—for example, suspicious activity monitoring, customer due diligence or recordkeeping.

However, the FFIEC is not the same as FinCEN, DOJ or an agency complaint portal. Use its material to frame and check your understanding of a possible control failure, not as a substitute for filing with an appropriate authority.

What counts as a BSA violation—and what may be a mistake?

The BSA imposes obligations on covered financial institutions, including requirements concerning records, reporting and anti-money-laundering programmes. A serious, repeated or deliberate failure may warrant investigation. But a control breakdown is not automatically proof of a statutory violation, and a violation is not automatically proof of a crime or of personal misconduct by a particular employee.

For instance, a single delayed review caused by a documented system outage, promptly identified and corrected, may be very different from managers repeatedly directing staff to close alerts without review. The first may indicate human error or a control weakness; the second may suggest knowing disregard or deliberate concealment, depending on the evidence.

When assessing the difference, focus on facts such as:

Frequency and duration: Was this one isolated incident, or did it continue over months or years?
Knowledge: Who knew about the issue, and when? Were warnings or audit findings received?
Response: Did the institution investigate and remediate the problem, or suppress alerts and prevent escalation?
Impact and scope: Which transactions, customers, accounts or reporting periods were affected?
Intent indicators: Are there reliable records of instructions to falsify, delete, bypass or conceal required processes?

A clear account separates what you personally observed from what you infer. “On 12 March, I saw 18 alerts closed with the same reviewer code despite missing case notes” is more useful than “management launders money”. The latter is a serious allegation, but without dates, transactions or supporting facts it is difficult for investigators to test.

Evidence and documentation that can hold up

A strong submission is organised, specific and honest about uncertainty. You do not need to conduct your own investigation or prove the entire case. Your goal is to explain what you know, how you know it, and where an authorised investigator might verify it.

Useful material may include dated audit findings, escalation emails, relevant policy versions, training records, system logs, transaction references, meeting notes, or evidence that a known control issue remained unresolved. A dated note made at the time of an event is generally more persuasive than a reconstruction written much later. Preserve original records and context; do not edit, annotate or selectively crop source documents in a way that could be misleading.

What to write down

The date, time and location of each key event, and whether the date is exact or approximate.
The institution, business unit, control or process involved.
Relevant transaction, alert, case or account identifiers, using only information you are authorised to access and disclose.
Who was involved, what each person said or did, and how you learned it.
When you raised the issue internally, to whom, and what response followed.
Any suspected alteration, deletion, suppression or reclassification of records—and the basis for that belief.
Which documents exist, where they are held, and whether you have lawful access to them.
Any employment consequences or threats, with dates and the names of witnesses.

Do not access systems without permission, take customer data you are not entitled to possess, or send confidential records to a personal account. Trade secrets, customer information, privacy rules and bank secrecy obligations may apply. Ask a lawyer how to preserve evidence lawfully. Whistleblower protections are not a blanket licence to remove or disclose every internal document.

Statute of limitations and timing pressure

There is no safe rule that says you can wait until you have a complete case. Different clocks may apply to government enforcement, award eligibility and retaliation claims. Some deadlines depend on the type of alleged conduct; others may run from a particular employment action or notice. A potential claim can be lost even while an agency is still investigating the underlying facts.

Timing can also affect whether information is considered voluntary or original under the applicable programme rules. Do not rely on an informal conversation, SAR vs CTR filing rules an internal complaint or a media report to preserve rights. If you have already reported internally or contacted an agency, record precisely when, how and to whom, and keep any confirmation or reference number.

If retaliation is possible, get advice promptly. Document each adverse action—such as a change in duties, a threat, a suspension or dismissal—with dates, decision-makers and supporting records. Reporting can carry real workplace risks; consider safe communication methods, access to legal support and a plan for protecting your livelihood. Do not confront suspected wrongdoers or announce a planned filing if doing so could expose you to pressure or compromise records.

Anonymous or identified submission?

Anonymous reporting may reduce immediate exposure, but it can make follow-up harder. Investigators may have questions, and a report without a way to contact the source can be difficult to verify. Also, anonymity at the initial stage does not necessarily mean the person’s identity can remain unknown for every later purpose, including an award claim.

Under the BSA whistleblower framework, an individual may in certain circumstances submit information anonymously through an attorney, subject to programme requirements. Identity and other information may have to be provided whistleblower retaliation protections through the required process before an award can be paid. Confirm the current FinCEN rules rather than assuming a name-free submission will preserve all rights.

An identified submission can make it easier for authorities to assess credibility and ask follow-up questions, but it may increase the risk of workplace exposure. Before choosing, discuss confidentiality, attorney representation, retaliation protections and the limits of agency secrecy with counsel. Never promise yourself absolute confidentiality: laws, investigative needs and later proceedings can affect what is disclosed.

How to prepare a focused disclosure

Make a factual chronology. Start with the earliest relevant event and identify dates, people, systems and transactions.
Separate fact from inference. Label what you directly saw, what a record shows, and what you suspect.
Identify the control issue. Use FFIEC materials as a reference where helpful, but do not treat an examination manual as a legal finding.
Preserve records lawfully. Keep a list of relevant evidence and its source; do not improperly access or remove it.
Check the recipient and process. Review FinCEN’s current whistleblower instructions and consider whether DOJ or another authority is also relevant.
Get advice on timing and exposure. Ask about award eligibility, anonymity, confidentiality, employment risk and any separate filing deadline.