What should lawyers know about ABA ethics when representing whistleblowers?

Representing a whistleblower can involve urgent choices: whether to report internally, approach a regulator, preserve documents or seek protection from retaliation. In anti-money laundering cases, those choices may also intersect with Suspicious Activity Reports (SARs), which are subject to strict legal confidentiality rules.

For lawyers, the challenge is to help a client understand those options without confusing the client’s interests with the interests of an employer, disclosing protected information or promising an award or a safe outcome. The American Bar Association (ABA) Model Rules of Professional Conduct offer a useful framework, but they are not law everywhere: the rules binding on a lawyer depend on the relevant jurisdiction and its adopted version.

This article focuses on United States whistleblower representation involving the Bank Secrecy Act (BSA). It is general information, not legal advice. The governing statute, regulations and professional-conduct rules should be checked for each matter.

Start with the client and the applicable ethics rules

A whistleblower’s lawyer should establish at the outset who the client is, what the engagement covers and which jurisdiction’s conduct rules apply. That sounds basic, but it matters when a person has worked with company counsel, spoken to compliance staff or received advice from a lawyer retained by an employer. The company’s lawyer generally represents the organisation, not an individual employee, unless the lawyer has clearly agreed otherwise.

Under ABA Model Rule 1.6, a lawyer generally must not reveal information relating to a client’s representation without the client’s informed consent, implied authorisation or an applicable exception. This duty is broader than the protection for confidential lawyer-client communications under the law of privilege. Information can fall within Rule 1.6 even if it is not privileged.

For whistleblower counsel, client confidentiality means taking care with intake notes, drafts, identifying details and communications with potential co-counsel or third parties. It also means being clear about what the lawyer can and cannot keep confidential. The lawyer should explain the limits of confidentiality, how information might be shared in a submission and what steps the client can take to avoid unnecessary disclosure.

Check whose information and documents are involved

A client may possess documents that support a report, but possession does not automatically mean the client is entitled to copy, keep or disclose them. Documents may contain trade secrets, personal data, privileged legal advice or information subject to statutory restrictions. A lawyer should assess the material’s origin and status before advising on its use.

ABA Model Rule 1.2(d) prohibits a lawyer from counselling or assisting conduct the lawyer knows is criminal or fraudulent. Model Rules 4.1 and 8.4 may also be relevant if a lawyer makes a false statement or engages in dishonest conduct. The client’s reporting objective does not make every method of obtaining or transmitting evidence permissible.

Particular care is needed with SARs. The BSA generally prohibits a financial institution and its officers, employees and agents from disclosing that a SAR has been filed, subject to statutory and regulatory exceptions. The rules can also restrict disclosure of a SAR or information that would reveal its existence. A whistleblower’s lawyer should not assume a client may attach, describe or discuss a SAR simply because it may support a concern about misconduct. Nor should counsel invite the client to obtain or transmit one. The precise restrictions and any applicable exception require specialist analysis.

Internal compliance channels and external regulator submissions are different routes

Internal reporting may alert a compliance department, board committee or other authorised person, and may allow an organisation to investigate and address a problem. But an internal report is not the same as a submission to a regulator. It may not satisfy the requirements for a statutory award or protection, and it may alert people who could identify or pressure the reporter.

An external submission may be made to a government authority with jurisdiction over the alleged conduct. For BSA matters, the relevant reporting route and eligibility requirements depend on the facts and the applicable programme. Counsel should verify where information must be sent, what form it must take and whether the client must provide original information or meet other conditions.. Exactly.

Neither route is automatically right for every client. A lawyer should discuss timing, the risk of evidence being lost or altered, the client’s employment position, confidentiality limits and the possibility of retaliation. A client may also need separate advice about employment rights, immigration status, contractual duties or other reporting obligations.

What changed in the BSA whistleblower programme?

The Anti-Money Laundering Act of 2020 amended the BSA’s whistleblower provisions. Further changes enacted in 2022 strengthened the programme, including by addressing the award structure and protections. The important practical point is that qualifying awards are now mandatory if statutory conditions are met; they are not simply a discretionary gratuity. That does not mean every person who reports misconduct will qualify or receive an award.

In broad terms, the programme covers qualifying original information about certain BSA violations and related misconduct that leads to successful enforcement action resulting in monetary sanctions above the statutory threshold. The details of eligibility, the meaning of original information, and the required connection between the information and the action are matters for careful legal review.

The $1 million sanctions trigger

The award framework applies where the relevant successful enforcement action results in monetary sanctions exceeding $1 million. This is a threshold for the award programme, not a promise that a particular report will produce sanctions, or that a reporter will receive a payment once an investigation starts. The outcome, amount collected and statutory eligibility all matter.

Lawyers should avoid treating the threshold as a simple prediction tool. Enforcement may take years, may not proceed, or may produce sanctions below the threshold. A submission can be valuable to a regulator and still fail to meet the conditions for an award.

What the 10 to 30 per cent range means

For a qualifying award, the statutory range is generally 10 to 30 per cent of monetary sanctions collected in the relevant action, subject to the programme’s rules. The percentage is not necessarily calculated on a headline penalty that has merely been announced: collection and the statutory definition of the relevant sanctions are important. The amount and percentage are determined through the programme, not negotiated as a guaranteed fee with the regulator.

The range describes the possible share, not an assured minimum payment to every reporter. Eligibility, the quality and significance of the information, the reporter’s role and other statutory factors can affect the award decision. Counsel should explain the distinction between a potential award and a reliable financial forecast.

Feature What it generally means What counsel should not promise Sanctions threshold Relevant monetary sanctions must exceed $1 million for the award framework to apply. That an investigation will reach the threshold. Award range A qualifying award is generally 10 to 30 per cent of sanctions collected, subject to statutory rules. A particular percentage or payment date. Reporting Information must meet programme requirements and contribute to a qualifying action. That any report, internal or external, guarantees eligibility.

Anti-retaliation rights do not remove practical risk

The amended BSA framework includes anti-retaliation protections and a federal cause of action for certain whistleblowers who suffer retaliation for protected activity. Depending on the facts and statutory requirements, available relief may include reinstatement, back pay and other remedies. The law’s protections should be assessed against the precise conduct, reporting route and timing at issue.

A federal cause of action is important, but it is not a guarantee that retaliation will not happen or that a claim will succeed. The client may face dismissal, demotion, exclusion from work, hostile treatment or pressure to withdraw a report. Pursuing a claim may require evidence, time and litigation, and deadlines or procedural requirements may apply.

I'll be honest with you: timing deserves special attention. A lawyer should document when the client reported, to whom, what was said, and when any adverse employment action occurred. The client should be advised to preserve relevant records lawfully and to avoid taking confidential company material without advice. If retaliation is feared, counsel can discuss protective steps before a report is made, while avoiding any suggestion that anonymity is absolute.

ABA ethics issues for counsel to work through

Keep the representation independent

Lawyers may encounter conflicts if they have advised the employer, represent other employees, or have a financial interest in a potential award. Model Rule 1.7 addresses conflicts involving current clients; Rule 1.9 covers duties to former clients. Rule 1.8(b) restricts use of information relating to a representation to a client’s disadvantage without consent or another applicable basis. Counsel should identify conflicts early and determine whether they can be resolved under the applicable rules.

Do not confuse a company lawyer’s duties with the client’s duties

Model Rule 1.13 sets out a lawyer’s duties when representing an organisation. In some circumstances, it permits or requires a lawyer for the organisation to take steps within the organisation, and may permit disclosure outside it to prevent substantial injury. Those provisions do not give an employee’s personal lawyer authority to speak for the company or to disclose company information. Nor should a whistleblower assume that a conversation with in-house counsel is protected as a personal legal consultation.

Explain the limits of confidentiality and privilege

Client confidentiality is a professional duty, but it does not make every fact or document privileged, and it cannot override a statutory prohibition such as SAR confidentiality. Counsel should distinguish carefully between the lawyer’s duty to protect information, evidentiary privilege and restrictions that apply to the underlying material. If information must be shared with a regulator, the client should understand lawyer-monthly.com what is being submitted and the possible consequences.

Be candid about uncertain outcomes

Model Rule 1.4 requires communication sufficient for a client to make informed decisions. In practice, that means explaining the trade-offs between internal and external reporting, the award conditions, possible delays, confidentiality limits and retaliation risk. Lawyers should not market a likely award, “full protection” or guaranteed anonymity where the law and facts do not support that assurance.

A practical checklist for whistleblower representation

1. Confirm the client and scope. I remember a project where was shocked by the final bill.. Identify the individual client, the issues covered and the applicable professional-conduct rules.

2. Map the reporting options. Compare internal channels with the appropriate external regulator route, including timing and eligibility requirements.

3. Screen documents carefully. Check for privilege, personal information, trade secrets and SAR-related restrictions before copying or transmitting material.

4. Assess award eligibility realistically. Review the statutory criteria, the $1 million sanctions trigger and the 10 to 30 per cent range without presenting a payment as certain.

5. Plan for retaliation risk. Discuss employment consequences, evidence preservation, reporting timing and any applicable filing deadlines.

6. Record informed decisions. Keep a clear record of the advice given, the client’s instructions and the information the client authorised counsel to submit.

Conclusion

Good whistleblower representation is not simply a matter of sending a report to a regulator. Lawyers must protect client confidentiality while recognising its limits, distinguish internal compliance reporting from external submissions, and handle sensitive material—including SAR-related information—with care. They should also explain the strengthened BSA award framework and anti-retaliation rights without overstating what either can deliver.

The central task is to help the client make an informed, properly timed choice. That requires jurisdiction-specific ethics advice, close attention to statutory requirements and an honest discussion of both potential protections and real-world risks.