AML Whistleblower Awards After Bank of America’s $1.21 Billion Penalty

Can I receive an AML whistleblower award for reporting money laundering or sanctions violations at a bank? Federal law provides a potential award of 10% to 30% of qualifying monetary sanctions collected when voluntary, original information leads to a successful covered enforcement action exceeding $1 million. Bank of America’s newly announced penalties show the scale: a hypothetical $1.2 billion qualifying award base would produce $120 million to $360 million in aggregate awards. That calculation comes with important conditions. [6]

On October 13, 2026, Treasury announced more than $1.21 billion in coordinated anti-money laundering and sanctions penalties against Bank of America. Treasury’s announcement expressly invited whistleblower tips. [1]

For the AML investigator, sanctions analyst, compliance officer, payment-system employee, or relationship manager who has raised concerns and watched nothing change, this deserves a close look. The strongest information may concern the system itself: which transactions bypassed review, which warnings reached management, and which decisions allowed the problem to continue.

No whistleblower award is identified in the Bank of America announcements reviewed for this article. The calculations below illustrate potential award economics; they do not establish an award in this case or eligibility for someone reporting the already-public conduct today.

Program status: FinCEN is accepting whistleblower tips. As of October 14, 2026, its website says it will begin processing and paying awards after its implementing regulation is finalized. The April 1, 2026 whistleblower rule remains a proposal on that page. The statutory program exists, but proposed procedural rules must be distinguished from rules already in force. [7]

What Did Bank of America Agree to Pay?

The financial components need to be read together. FinCEN’s consent order imposes $1.2 billion, credits the $750 million OCC payment, and requires $450 million paid separately under the FinCEN resolution. OFAC announced an additional $11,662,930 settlement. [2][3][4]

Bank of America admitted the facts and BSA violations in FinCEN’s consent order. OFAC described its separate matter as 475 apparent sanctions violations, classified as non-egregious and largely not voluntarily self-disclosed. OFAC identified sanctions programs involving Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. [2][4]

One point deserves emphasis because it explains the size of the OCC penalty. Bank of America was already operating under a December 2024 OCC cease-and-desist order requiring it to correct this program. The OCC found that more than a year after agreeing to that order, the bank still failed to escalate potentially suspicious activity to investigators, and that a systemic transaction-monitoring gap continued. A prior order that did not produce a fix is exactly the chronology an insider may be able to describe from the inside. [3]

In its public response, reported by the Associated Press, Bank of America said it had worked with regulators, invested billions in technology, and dedicated thousands of employees to combating financial crime. It said it was committed to completing the required remediation. [17]

How Large Could an AML Whistleblower Award Be?

The arithmetic is powerful once the legally eligible collection amount is established. These examples assume that the entire amount in the first column qualifies, is collected, and supports an eligible award. They show aggregate gross awards, before allocation among multiple eligible whistleblowers, legal fees, expenses, or taxes.

The $450 million and $1.2 billion rows are alternative illustrations, not two awards to add together. Neither amount is established here as the correct award base in the Bank of America case. Counsel would need to analyze the treatment of the OCC payment, the FinCEN credit, any qualifying related action, and the collections attributable to the covered proceedings.

The statutory definition of monetary sanctions excludes forfeiture, restitution, and victim compensation. The statute separately provides that amounts deposited into the U.S. Victims of State Sponsored Terrorism Fund or the Crime Victims Fund are not credited to the fund from which awards are paid, and FinCEN’s proposed rule would also address blocked property. A dollar frozen in an account is not automatically a dollar available for an award. [6][9]

The standalone OFAC figure also shows how a smaller resolution can be substantial. Applying 10% to 30% to $11,662,930 produces $1,166,293 to $3,498,879. That is conditional arithmetic only: all of that amount would have to qualify and be collected, with no applicable exclusions.

A nine-figure potential award deserves attention. It also deserves a lawyer who will read the payment provisions before multiplying the headline.

Why Sanctions Violations Can Qualify Under the AML Whistleblower Program

The FinCEN whistleblower program covers more than a completed criminal money-laundering scheme. Its listed authorities include the Bank Secrecy Act, International Emergency Economic Powers Act, Trading With the Enemy Act, and Foreign Narcotics Kingpin Designation Act, together with their implementing regulations and covered conspiracies. [7]

That puts BSA compliance failures and qualifying OFAC sanctions violations within the same award framework. The legal analysis may concern deficient monitoring, missed reporting obligations, inadequate due diligence, or prohibited dealings with blocked persons. Each allegation still needs the applicable legal requirement and supporting facts.

An insider therefore should not assume that they must personally trace drug proceeds or prove a criminal conspiracy before speaking with an AML whistleblower lawyer. A sanctions analyst who understands a defective screening process may hold useful information. So may a systems employee who knows that a category of transactions never entered the monitoring engine. If you want the statutory framework in one place first, our explainer on how the FinCEN whistleblower program works sets out eligibility and the reporting path.

The precise statute matters. A suspicious transaction, an unhappy customer, or a general accusation of “bank fraud” does not by itself establish an award-eligible violation. Counsel must identify the conduct Treasury or the DOJ could enforce under the covered laws.

The Compliance Failures Bank Insiders Should Recognize

Monitoring that depends on someone outside the bank finding the problem

Treasury said Bank of America depended heavily on law-enforcement inquiries, other financial institutions, and similar outside interventions to identify suspicious activity. It also said more than $5 billion in suspicious transactions were not reported timely, including over $1 billion implicating national-security or other priority illicit-finance risks. [1]

Those are suspicious-activity figures, not findings that every dollar was criminal proceeds. For an insider evaluating a comparable situation, the useful questions are concrete: Which monitoring rules failed? What testing demonstrated the gap? Who received the results? How long did the problem remain unresolved?

Management warnings followed by inadequate action

FinCEN’s order describes management’s response to testing and compliance concerns, including a test repeated after an unfavorable result and high-risk customer relationships that continued after internal escalations. [2]

This is the type of chronology I would examine closely. A source who can distinguish an initial defect from management’s later response can materially improve an investigation. Identify the warning, its recipient, the decision, and what happened next. Preserve that chronology without copying protected bank records into a personal account.

Sanctions screening that misses exact matches

OFAC said the bank’s screening system assigned insufficient priority to customers whose names and dates of birth exactly matched blocked persons. It also described payments involving blocked banks, delayed watchlist updates, and two mishandled business accounts. [4]

A sanctions-screening whistleblower should be prepared to explain how a match was scored, routed, reviewed, and resolved. A common-name false positive presents a different question from an exact match that was repeatedly deprioritized.

Alert suppression and an incomplete historical review

OFAC’s enforcement release describes payments released under an alert-suppression rule and a narrowly scoped lookback before later government demands produced a fuller review. [5]

In a comparable institution, a knowledgeable employee may be able to identify which transactions a lookback omitted, why the chosen date range mattered, or whether a supposed fix addressed only one payment channel. That explanation can be more useful than thousands of unexplained screenshots.

Weak foreign-correspondent due diligence

FinCEN’s resolution also addressed due diligence for foreign financial-institution correspondent accounts. The OCC’s order described broader monitoring, staffing, training, and audit deficiencies. [2][3]

For a correspondent-banking or customer-due-diligence whistleblower, the key is to connect the customer’s actual activity to the risk assessment and controls the bank applied. Large international transactions alone do not establish wrongdoing. A documented mismatch that persisted after escalation is a more useful starting point.

Can a Compliance Officer or BSA Employee Receive an Award?

Potentially. Section 5323’s whistleblower definition expressly includes information provided as part of an individual’s job duties. Compliance responsibilities do not create a blanket statutory exclusion from awards. [6]

However, FinCEN’s April 2026 proposal would impose a 120-day waiting requirement on certain information obtained through internal audit or compliance functions and certain leadership roles. That is a proposed eligibility restriction, not a universal instruction for bank employees to wait 120 days. [9]

A BSA officer, internal auditor, outside consultant, or sanctions specialist should have counsel evaluate their role, information source, and reporting sequence promptly. The analysis should include any earlier internal reports and any communications already received from government investigators.

Do not borrow an SEC, CFTC, or DOJ pilot deadline and assume it applies to a FinCEN submission. These programs have different rules. A checklist written for one can mislead a whistleblower using another. Our page on the SEC whistleblower program sets out how different that framework is.

What Makes a Bank AML Whistleblower Submission Valuable?

For an initial review, I would want a clear account of five things:

The control failure. Explain the rule, system, report, customer review, screening process, or payment restriction that failed. Identify the business line and relevant period.

The scope. Was the issue limited to one transaction, or did it affect a product, channel, customer category, or monitoring model? Separate a supported estimate from a guess.

The internal knowledge. Identify testing, warnings, escalation meetings, rejected remediation proposals, or instructions you know about. Tell counsel how you learned those facts.

The evidence location. Identify the system, custodian, process owner, or witness who can corroborate the account. An evidence map can be useful before any documents are transferred.

Your contribution. Explain what your account adds beyond public consent orders or an investigation already underway. Identify any previous reports and your own role candidly.

FinCEN’s submission guidance asks for detailed facts, involved individuals and entities, how the source learned the information, and supporting evidence. It also says the Office of the Whistleblower confirms receipt and provides a reference number. [10]

A useful first call: “I worked on the monitoring system for this business line. I can identify the data source that was excluded, when testing exposed it, who received the findings, and which transactions the remediation review did not examine.” This is a hypothetical illustration, not an allegation about Bank of America or a guarantee of eligibility.

Stronger Facts Versus Concerns That Need More Development

The following examples are hypothetical. They illustrate what counsel would investigate, not predetermined outcomes.

Potentially stronger AML case: A model-validation employee identifies a data-feed defect excluding a substantial category of transactions. Testing confirms the defect. The employee can describe repeated escalations and the decision to defer remediation. Counsel can investigate the applicable monitoring obligation, scope, and government knowledge.

Potentially stronger sanctions case: An analyst identifies a persistent delay between sanctions designations and operational watchlist updates. The source can connect the delay to specific prohibited transactions and explain why the controls did not stop them.

Needs more development: An employee believes the compliance department is understaffed but cannot identify a missed obligation, defective process, unaddressed warning, or affected activity. Staffing concerns can be relevant, but the submission needs facts showing their consequences.

Needs more development: A customer believes any payment involving a foreign bank violates U.S. sanctions. The country, counterparty, ownership, applicable prohibition, licenses, and actual U.S. connection all need review before counsel can assess the allegation.

Can I Claim a Reward After Reading the Bank of America News?

Repeating the public announcement does not create original information. The statute distinguishes independent knowledge or analysis from information already known to Treasury or the DOJ and information derived exclusively from specified public sources, subject to original-source exceptions. [6]

A current or former employee may nevertheless know about different conduct, continuing failures, omitted business lines, or facts that materially assist an unresolved investigation. FinCEN’s proposed rule expressly contemplates original information that significantly contributes to an investigation already underway. [9]

For an existing whistleblower, the immediate task is to preserve the reporting history and obtain advice about the award process. For a new source, the question is what genuinely new information the person can provide. No one should assume that filing after yesterday’s settlement creates a right to yesterday’s penalty.

The Sar Confidentiality Trap: Speak With Counsel Before Sending Bank Documents

This deserves its own warning. Do not email Suspicious Activity Reports, SAR drafts, SAR-identifying information, or protected supervisory materials through an ordinary law-firm intake form.

Under 31 C.F.R. § 1020.320(e), banks and their personnel generally cannot disclose a SAR or information revealing its existence, subject to specified exceptions. Authorized disclosures to FinCEN and law enforcement are treated differently from disclosures to private counsel. The regulation separately addresses underlying facts, transactions, and documents. [12]

Start with a non-SAR, nonprivileged summary. Ask counsel to establish what may lawfully be shared and through which channel. A transaction record does not automatically become a SAR merely because it underlies one, but other privacy, access, privilege, and confidentiality restrictions may still matter.

Do not access accounts outside your responsibilities, remove restricted customer files, destroy records, or tell a customer that a SAR exists. Your knowledge of where the evidence is located may allow the government to obtain it lawfully without exposing you to an avoidable document-handling problem.

Can I Report Anonymously, and What Happens if the Bank Retaliates?

FinCEN currently accepts anonymous tips, including through attorneys. An anonymous award claimant who submitted anonymously must have counsel, and identity must be disclosed before payment. Confidentiality is subject to legal exceptions; no lawyer should promise permanent anonymity in every proceeding. [6][10]

Bank employees also need a separate retaliation analysis. Section 5323(g)(6) excludes employers covered by specified banking and credit-union whistleblower laws from that subsection’s protections. For employees of insured depository institutions, 12 U.S.C. § 1831j may be central. It identifies protected disclosures to a federal banking agency or the Attorney General, requires the civil action to be brought within two years of the date of the discharge or discrimination, and requires the complainant to file a copy of the complaint with the appropriate federal banking agency. Internal reporting alone should not be assumed sufficient under that provision. [6][13]

Other protections may apply depending on the employer, report, and facts, and they can carry different deadlines. Tell counsel immediately about termination, demotion, threats, a sudden performance plan, or a severance deadline. A potential government award and a personal whistleblower retaliation claim require their own legal evaluations.

One wrinkle is worth flagging, because it catches people out. Section 1831j defines a federal banking agency as the FDIC, the Federal Reserve Board, the Federal Housing Finance Agency, and the Comptroller of the Currency. FinCEN is not on that list. The route that makes an employee award-eligible and the route that protects the employee’s job are therefore not automatically the same route, which is a reason to discuss sequencing with counsel before anything is sent. [13]

How to Report Money Laundering or Sanctions Violations Through FinCEN

Begin with the current FinCEN whistleblower submission process. Its dedicated reporting webpage launched on February 13, 2026. Treasury encourages prompt, specific reporting. [11]

Before submitting, a serious FinCEN whistleblower attorney should assess the covered violation, originality, earlier government contacts, reporting history, your role, and lawful handling of the evidence. An employee who helped approve the transactions needs candid advice about personal exposure as well as award eligibility. A whistleblower submission supplies no immunity agreement.

Maintain the submission reference number and a record of authorized supplements. Counsel should also monitor the final regulation and the eventual award-application procedure. The April proposal includes a 90-day award-application period after a notice of covered action; it should not be advertised as an already-operative deadline merely because a penalty was announced. [9]

FinCEN, OFAC, and the DOJ make enforcement decisions. This is an agency award process, not a private lawsuit in which the whistleblower takes over Treasury’s prosecution.

AML and Sanctions Whistleblowers Are an Enforcement Priority

Treasury placed a whistleblower invitation in the Bank of America announcement itself. [1] FinCEN also issued a September 2026 bulletin soliciting information about Iran-related illicit finance, including overseas proxies and facilitators involved in covered BSA or sanctions violations. [14]

That should interest people working beyond a U.S. bank’s headquarters: correspondent-banking teams, payment processors, foreign branches, sanctions vendors, and businesses with information about prohibited transactions. Location alone does not answer the eligibility question. The U.S. legal connection and the information’s contribution still must be established.

A bank may have sophisticated software and extensive policies. A person who understands an unresolved defect can explain what the reports and dashboards obscure. That is where a well-placed whistleblower can add real value.

Speak With Brown, LLC About a Substantial AML or Sanctions Whistleblower Matter

Brown, LLC represents whistleblowers in anti-money laundering and sanctions matters. The firm is led by Jason T. Brown, a former FBI Special Agent and Legal Advisor. [15][16]

For this kind of case, I want to understand what you personally know, how widespread the problem is, what the government may already know, and how investigators could verify your account. That review should occur before anyone promises you a percentage of a headline.

Our evaluation should address the reporting path, the potential award base, confidentiality, retaliation, your own involvement, and the evidence that can lawfully be provided. Counsel should also identify any overlap with another whistleblower program, such as the SEC whistleblower rewards and rules, without assuming the same dollars can produce duplicate awards.

Request a confidential review with Brown, LLC at (877) 561-0000. Use a personal device and begin with a nonrestricted description. Do not attach SARs, protected supervisory material, privileged communications, or customer records to the initial inquiry. [15]

Frequently Asked Questions

How much can I receive for reporting a bank’s AML violations?

The statutory framework generally provides aggregate awards of 10% to 30% of qualifying collected monetary sanctions. Originality, voluntariness, contribution, exclusions, and any allocation among eligible whistleblowers affect the result. A large penalty does not guarantee a payment to any particular source. [6]

Can an OFAC sanctions whistleblower receive a reward?

Potentially. FinCEN’s program covers specified sanctions authorities as well as the Bank Secrecy Act. The information must satisfy the program’s requirements and lead to successful covered enforcement. [7]

Did Bank of America’s whistleblowers receive $360 million?

The reviewed public announcements identify no such award. That number is 30% of a hypothetical $1.2 billion eligible collection base, not an announced whistleblower payment.

Can a BSA officer or compliance employee qualify?

Potentially. Job-duty reporting is included in the statute. The April 2026 proposal would introduce special timing restrictions for certain audit, compliance, and leadership information. Obtain advice on the current rules rather than assuming automatic eligibility or disqualification. [6][9]

Is FinCEN already paying awards?

As of this article’s review date, FinCEN says it is accepting tips and will begin processing and paying awards after its implementing regulation is finalized. Recheck the program page before relying on any later procedural guidance. [7]

Should I send my lawyer the SARs that prove the problem?

Begin with a non-SAR summary. SAR confidentiality has specific legal restrictions. Counsel should establish an authorized evidence-handling process before receiving restricted materials. [12]

The Opportunity Is Substantial. The First Disclosure Deserves Care

The Bank of America resolutions demonstrate how expensive systemic BSA and sanctions failures can become. At that scale, an eligible whistleblower’s share could be extraordinary.

The strongest prospective client brings more than the penalty announcement. Bring a clear account of the failure, the people who knew, the scope, and the evidence investigators can obtain. Protect your credibility. Handle the records lawfully. Have the award rules and retaliation risks reviewed before making the first disclosure.

Attorney advertising. General information only; not legal advice. No outcome, award, or confidentiality result is guaranteed. The Bank of America matter is discussed as a public enforcement example, not as a Brown, LLC representation or result. Contacting the firm does not establish an attorney-client relationship.

Sources and Authorities

[1] U.S. Treasury, “U.S. Treasury Announces Record Enforcement Actions Against Bank of America,” October 13, 2026.

[2] FinCEN, In the Matter of Bank of America, N.A., No. 2026-03, Consent Order, October 2026, especially pp. 1, 63–67.

[3] OCC, Bank of America, N.A., Consent Order for a Civil Money Penalty, AA-ENF-2026-41, October 13, 2026, Articles II–III.

[4] OFAC, “Settlement Agreement … and Bank of America, N.A.,” October 13, 2026.

[5] OFAC, Bank of America Enforcement Release, October 13, 2026, pp. 1–4.

[6] 31 U.S.C. § 5323, Whistleblower incentives and protections, especially (a), (b), (c), (d), and (g)(6).

[7] FinCEN, Whistleblower Program, accessed October 14, 2026.

[8] FinCEN, “FinCEN Proposes Rule to Pay Whistleblowers,” March 30, 2026.

[9] FinCEN, “Whistleblower Incentives and Protections,” 91 Fed. Reg. 16335, April 1, 2026 (proposed rule), proposed 31 C.F.R. § 1010.930.

[10] FinCEN, Submitting a Tip, accessed October 14, 2026.

[11] FinCEN, “FinCEN Launches Webpage for Whistleblower Tips on Fraud, Money Laundering, Sanctions Violations,” February 13, 2026.

[12] 31 C.F.R. § 1020.320(e), Confidentiality of Suspicious Activity Reports.

[13] 12 U.S.C. § 1831j, Depository institution employee protection remedy.

[14] FinCEN, “FinCEN Issues Whistleblower Bulletin on Iran-Related Illicit Finance,” September 10, 2026.

[15] Brown, LLC, Anti-Money Laundering (AML) Lawyers / Money Laundering Whistleblowers.

[16] Brown, LLC, Jason T. Brown attorney biography.

[17] Associated Press, “US hits Bank of America with $1.2 billion fine …,” carried by U.S. News, October 13, 2026.