Can I Get in Trouble for Taking Documents When Preparing a Whistleblower Report?

Yes, you can. Reporting suspected financial misconduct does not automatically give you permission to copy, remove, download, or disclose your employer’s documents. A document may help explain a concern, but taking it improperly can create separate risks involving confidentiality agreements, trade secret obligations, privacy rules, computer access, and—especially in banking—Suspicious Activity Report confidentiality.

There may be lawful ways to report what you know and provide supporting information. The safest approach is usually to preserve your own recollection, avoid collecting or moving company records, and speak openclassactions promptly with an attorney experienced in whistleblower matters before sharing anything confidential. This article is general information, not legal advice for your situation.

What Is the AML/BSA Whistleblower Program?

The Bank Secrecy Act (BSA) is a federal law that requires financial institutions to maintain anti-money-laundering controls and report certain suspicious activity. The Anti-Money Laundering (AML) whistleblower program is a federal program administered by the U.S. Department of the Treasury, with the Financial Crimes Enforcement Network (FinCEN) playing a central role.

The program is intended to encourage people to provide original information about certain BSA violations and violations of U.S. sanctions laws. Depending on the case and applicable requirements, eligible whistleblowers may qualify for a monetary award when enforcement results in significant monetary sanctions. Awards are not guaranteed, and eligibility depends on the facts, the information provided, and the law.

FinCEN’s website, fincen.gov, is the official place to check current program information, submission instructions, and notices. A lawyer can help assess whether to submit information through the program and how to handle sensitive records.

Legal Origin and Timeline

Congress created an AML whistleblower framework in the Anti-Money Laundering Act of 2020, which was part of the National Defense Authorization Act for Fiscal Year 2021. Congress later changed and expanded aspects of the framework in the National Defense Authorization Act for Fiscal Year 2023, signed on December 23, 2022.

The 2022 law strengthened the program’s potential awards and anti-retaliation protections and clarified aspects of coverage, including its relationship to certain sanctions violations. The details matter: a worker should not assume that every report about a bank’s conduct qualifies, that every form of retaliation is automatically covered, or that the program protects every way of obtaining evidence.

In particular, whistleblower protections do not generally operate as a blanket defense to unlawful access, theft, unauthorized disclosure, or mishandling protected data. The rules governing a report and the rules governing how documents were obtained are related, but they are not the same question.

Who May Be Eligible, and What Counts as “Original Information”?

Eligibility can depend on the person’s role, the source and quality of the information, how it is submitted, and whether the information leads to a qualifying enforcement action. Employees and other people with relevant knowledge may be potential sources, but no one should rely on job title alone to determine eligibility. The program’s current requirements should be checked directly, ideally with counsel.

“Original information” generally means information derived from a person’s independent knowledge or analysis that is not already known to the government from another source. It may include specific facts about transactions, controls, decisions, or patterns that help authorities identify or investigate a violation. Simply repeating a public news report, or providing information already known to the government, may not meet the standard.

You may have useful original information without taking files. For example, you might know that a manager repeatedly directed staff to override a customer-risk alert, that a branch processed a series of cash transactions just below reporting thresholds, or that a team was told to delay filing a report while an investigation was underway. Your own firsthand observations, dates, names of relevant departments, and a clear description of what you saw can help an attorney assess the matter.

What Conduct May Qualify?

The program can cover certain violations of the BSA and specified U.S. sanctions laws. Examples of issues that may be relevant include:

Suspicious Activity Reports (SARs): A financial institution may be required to file a SAR when it knows, suspects, or has reason to suspect activity meeting regulatory criteria. Possible concerns include a failure to file when required, improper handling of SAR processes, or interference with reporting. The specific legal duty depends on the institution, facts, and applicable regulations.
Structuring: This involves breaking up transactions to evade currency-reporting requirements. For example, a person might make repeated cash deposits below the reporting threshold to avoid triggering a report. A pattern alone does not prove a violation; context and evidence matter.
Customer due diligence (CDD): CDD generally involves understanding customers and assessing risk, including identifying beneficial owners where required. Concerns may involve deliberate failures in required controls or efforts to conceal a customer’s identity or activity.
Records and reporting: The BSA requires covered institutions to maintain certain records and comply with reporting obligations. Destruction, falsification, or knowing failures involving required records may raise serious concerns, depending on the circumstances.
Sanctions: Transactions involving blocked persons, restricted jurisdictions, or other prohibited activity may implicate sanctions laws administered by the Treasury Department. A sanctions concern is not automatically an AML program claim, so confirm which reporting channel and legal requirements apply.

Why Taking Documents Can Create Separate Legal Problems

Even if the underlying concern is real, how you obtain and handle evidence can affect your legal exposure. A confidentiality agreement may restrict disclosure of certain business information. Trade secret obligations may apply to valuable, nonpublic information protected through reasonable secrecy measures. Other rules may protect customer data, employee records, account details, or internal investigations.

There can also be risks if you access systems outside your authorization, bypass controls, use someone else’s credentials, remove originals, alter records, forward files to a personal account, or keep materials after leaving your job. The legal analysis is fact-specific and may depend on your job duties, the type of information, the method of access, and the purpose and destination of the disclosure.

There is a particularly important rule for SARs. Federal law generally prohibits a financial institution and its current or former employees, officers, and directors from disclosing a SAR or information that would reveal the existence of a SAR, subject to limited exceptions. That means a person working with SAR materials should not assume that sending a report to a regulator, lawyer, or another person is automatically permitted. The law’s application can be technical, and the consequences of an improper disclosure can be serious. Do not copy, attach, quote, or describe a SAR itself without legal guidance.

Possible action Why it may be risky Safer next step Emailing work files to a personal account May violate policy, confidentiality duties, privacy rules, or access restrictions Do not forward files; ask counsel how to describe the information lawfully Taking a SAR or material that reveals one exists SAR confidentiality rules may restrict disclosure Do not copy or share it; get advice before reporting details Downloading additional records after concerns arise May look like unauthorized collection or access beyond job duties Stop collecting; write down your independent recollection instead Deleting, editing, or moving records May compromise evidence and create additional employment or legal issues Do not alter or conceal records; seek legal advice promptly

Confidentiality Agreements and Whistleblower Rights

A confidentiality agreement does not necessarily prevent a person from communicating lawfully with government authorities. Some federal laws and agency rules limit how employers may use confidentiality provisions to obstruct protected reporting. But that does not mean every disclosure is protected, every document can be taken, or every agreement is unenforceable.

For example, an agreement might not bar a protected report while still imposing duties about customer information, trade secrets, or the method of accessing records. Separate laws may also restrict disclosure of SARs or personal financial information. The answer can turn on precisely what was shared, with whom, and how it was obtained.

Anti-retaliation provisions may protect eligible whistleblowers from certain adverse employment actions, but they are not a guarantee against discipline, litigation, or other disputes. If you are worried about retaliation, discuss reporting options and documentation with counsel before making an internal or external disclosure. Do not assume that a particular channel or sequence of steps preserves every possible protection.

What to Do Before Preparing a Report

Stop collecting records. Do not take originals, make new downloads, bypass access controls, or forward work documents to personal devices.
Do not destroy or alter anything. Avoid deleting messages, editing files, or changing records to “clean up” your own actions.
Write a factual timeline from memory. Note dates, roles, transactions or control failures you personally observed, and how you learned about them. Separate what you saw from what you heard or infer.
Protect SAR confidentiality. Do not attach, quote, or circulate a SAR or information that may reveal one exists. Ask an attorney how to communicate the concern without disclosing protected material.
Speak with a whistleblower attorney. Look for counsel familiar with the BSA, FinCEN, sanctions, and employee confidentiality issues. Ask how privilege works before sending documents or detailed facts; an initial conversation is not automatically privileged in every circumstance.
Use a personal device and account for your own legal communications. Do not use a work laptop, work email, or employer-managed phone to seek legal advice about a sensitive report.
Check FinCEN’s current instructions. Review the official information at fincen.gov, but avoid submitting restricted records until you understand the applicable rules.

What If You Already Took or Shared Documents?

Do not panic, and do not try to conceal what happened by deleting files or changing records. Stop further copying or distribution. Preserve relevant communications and make a private, accurate note of what you accessed, when, how, and where it went. Do not send the material to additional people or return, destroy, or alter it without legal advice—each step can have consequences.

Contact an attorney promptly and explain the full circumstances, including whether any material involved a SAR, customer information, trade secrets, or records obtained through a work system. A lawyer can help evaluate reporting options, obligations to preserve evidence, and whether corrective steps are appropriate.

The Bottom Line

You may be able to report suspected BSA or sanctions violations without taking company documents. Your firsthand knowledge and careful, contemporaneous notes can be valuable. But confidentiality agreements, trade secret obligations, secure records, privacy rules, and SAR restrictions can make document handling legally sensitive. Get advice before copying or disclosing records, and use FinCEN’s official website to confirm current program procedures. A credible report should protect both the integrity of the evidence and your own legal position.