What Is Tipping Off? AML Prohibitions, Penalties, and Safe Harbor

In anti-money-laundering law, tipping off AML rules refers to revealing — to the person whose transaction was flagged — that a Suspicious Activity Report has been filed, or letting slip anything that would let them figure it out. Federal law makes that disclosure a crime. Under 31 U.S.C. § 5318(g)(2), a willful violation can bring up to five years in prison and a fine of up to $250,000 for each disclosure.¹ The rule exists so investigations aren’t blown and suspects don’t move money before law enforcement can reach it.

What the Statute Actually Prohibits

The Bank Secrecy Act bars a financial institution, and every director, officer, employee, or agent, from notifying any person involved in a reported transaction that the transaction has been reported to a government agency. The prohibition also reaches indirect disclosure: revealing information that would expose the report’s existence is treated the same as naming it outright.¹

The confidentiality rule is two-sided. Current and former government employees who learn of a SAR filing are also forbidden from telling anyone involved in the reported transaction, except as necessary to carry out their official duties.¹ The implementing regulation, 31 CFR 1020.320(e), goes further and declares the SAR itself and any information revealing its existence confidential, disclosable only through narrow authorized channels.²

Who Is Covered

Everyone with a SAR filing obligation under the Bank Secrecy Act is bound by the tipping off prohibition. That means commercial banks, credit unions, broker-dealers, insurance companies, money services businesses, casinos, and dealers in precious metals and stones. Inside those institutions, the duty runs from the teller to the chief compliance officer. It attaches to the individual, not just the corporate employer.

What Crosses the Line

Any communication that alerts the subject to the report qualifies, whether spoken, written, or electronic. Telling a customer their account has been flagged is the clearest case. Forwarding an internal email that references a SAR review, or sharing a compliance memo outside the review chain, works the same way. The test isn’t whether you meant to help the suspect. It’s whether your disclosure revealed the report or could reasonably lead the subject to piece it together.

How you explain routine friction matters. Saying “we need more information about this transfer” is fine. Saying “the government asked us to look at your account” is not. Language that ties a delay, freeze, or documentation request back to a report is enough.

There is a common overlap worth flagging. Advising a customer to break deposits into smaller amounts to avoid reporting is itself a separate federal crime — structuring under 31 U.S.C. § 5324.³ If the same advice reveals a SAR (“your last deposit got reported, so split it next time”), the speaker is exposed under both statutes.

Third-party demands for the report get their own rule. If a bank receives a subpoena or other request from anyone other than FinCEN, a federal banking regulator, or law enforcement, it must refuse to produce the SAR or any information revealing its existence, and it must notify FinCEN and its federal regulator of the request.²

When Disclosure Is Allowed

The wall isn’t absolute. The regulation carves out specific channels where sharing SAR-related information is permitted.

Law Enforcement and Regulators

A bank may disclose a SAR, or information that would reveal one exists, to FinCEN, any federal, state, or local law enforcement agency, or any federal or state regulator that examines it for BSA compliance.² Qualifying agencies include the FBI, DEA, IRS, state and local police, U.S. Attorney’s offices, and state attorneys general, among others.⁴

Internal Review and Corporate Affiliates

Sharing SAR information within a bank for BSA-compliance purposes is allowed. A compliance officer discussing a filing decision with the general counsel or senior management is the system working as designed.²

A depository institution that has filed a SAR may share it with a domestic affiliate, but only if that affiliate is itself subject to SAR reporting requirements, and the affiliate cannot then pass it further down the chain. A U.S. bank may share a SAR with its controlling company, domestic or foreign. Foreign branches of U.S. banks are treated as foreign banks for BSA purposes and are not considered subject to SAR rules, so sharing with a foreign branch is generally prohibited.⁵

Joint Filings and Employment References

Banks may share the underlying facts, transactions, and documents behind a SAR with another financial institution to prepare a joint SAR. They may also share SAR-related information in connection with employment references or termination notices, as the statute specifically permits.² Through all of it, the overriding condition holds: the person involved in the suspicious activity is never notified that the transaction was reported.

Criminal Penalties

A willful violation of the confidentiality provisions can result in a fine of up to $250,000 and up to five years in prison. If the tipping off happened alongside another federal crime, or as part of a pattern of illegal activity involving more than $100,000 in a twelve-month period, the maximums rise to $500,000 and ten years.⁶

On top of the statutory fine, a convicted person forfeits any profit gained from the violation. If the person was a partner, director, officer, or employee of a financial institution when the violation occurred, they must also repay any bonus received during the calendar year of the violation or the year that followed.⁶ Prosecutors can charge the specific employee who made the disclosure; corporate employment is not a shield.

Civil Penalties

Even without a criminal case, FinCEN can impose civil money penalties. For a willful violation, the penalty can reach the greater of the transaction amount (capped at $100,000) or $25,000.⁷ Each act of disclosure counts separately, so multiple recipients or multiple occasions produce stacking penalties.

For negligent violations — an employee carelessly letting SAR information slip without intent to tip anyone off — the penalty is up to $500 per incident. Where a financial institution shows a pattern of negligent violations, FinCEN can add a penalty of up to $50,000.⁷ Institutions may also face separate penalties for the underlying AML program failures — internal controls, training — that let the disclosure happen.

Federal banking regulators have more than fines available. Under 12 U.S.C. § 1818, they can issue cease-and-desist orders against institutions or against individual employees who violate BSA requirements. Such orders can end a banking career, and consent orders entered against institutions become public records that draw heightened scrutiny for years.⁸

Safe Harbor for the Filing Itself

A separate provision protects the institution and its people for the act of filing. Under 31 U.S.C. § 5318(g)(3), a financial institution that discloses a possible violation of law to a government agency — voluntarily or as required — cannot be held liable under federal or state law, or under any contract, for making the disclosure. The same immunity extends to any director, officer, employee, or agent who makes or requires it, and to the failure to notify the subject that the report was filed.⁹

Most courts have read the safe harbor as broad and unqualified. A minority require a showing of good faith, particularly where a bank may have misrepresented material facts to law enforcement.¹⁰ The safe harbor covers private civil claims only. It does not block enforcement actions brought by the government.⁹

Reporting a Tip-Off: Whistleblower Route

The Anti-Money Laundering Act of 2020 created a whistleblower program for BSA violations, including tipping off. Under 31 U.S.C. § 5323, a whistleblower who provides original information leading to a successful enforcement action with monetary sanctions exceeding $1 million can receive an award of between 10 and 30 percent of what the government collects.¹¹

Employers cannot fire, demote, suspend, blacklist, harass, or otherwise discriminate against an employee for reporting violations to the Treasury Department, the Attorney General, federal regulators, law enforcement, Congress, or a supervisor. A whistleblower facing retaliation may file a complaint with the Secretary of Labor; if no final decision issues within 180 days, they can bring a federal lawsuit directly. Available remedies include reinstatement, double back pay with interest, compensatory damages, and attorney’s fees. Predispute arbitration agreements that would force the claim out of court are void, so the whistleblower can insist on a jury trial. The statute of limitations runs six years from the violation, or three years from when the employee knew or should have known the relevant facts, with an absolute cap of ten years.¹¹

1
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
2
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
3
Office of the Law Revision Counsel. 31 USC 5324 – Structuring Transactions to Evade Reporting Requirement
4
FFIEC BSA/AML InfoBase. Assessing Compliance with BSA Regulatory Requirements – Suspicious Activity Reporting
5
Financial Crimes Enforcement Network (FinCEN). Sharing Suspicious Activity Reports by Depository Institutions with Certain U.S. Affiliates
6
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
7
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
8
Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution
9
Office of the Law Revision Counsel. 31 U.S. Code 5318 – Compliance, Exemptions, and Summons Authority
10
Financial Crimes Enforcement Network (FinCEN). Federal Court Reaffirms Protections for Financial Institutions Filing Suspicious Activity Reports
11
Office of the Law Revision Counsel. 31 USC 5323 – Whistleblower Incentives and Protections