Where Should I Store Evidence So It Is Not on My Employer’s Systems?

If you are considering reporting suspected financial misconduct, it is reasonable to ask where your notes or other evidence can be kept without leaving them on an employer’s computer, phone, email, or cloud account. The safest answer is usually not “copy everything to a personal device.” Employer records may contain customer information, restricted investigative material, or legally protected reports. Taking them without authorization can create privacy, employment, and legal problems—and may complicate a later report.

A more careful approach is to keep a private record of what you personally observed, preserve materials you are authorized to possess, and speak with a lawyer before moving or sharing company documents. Last month, I was working with a client who wished they had known this beforehand.. This guide explains practical storage choices and how they relate to the U.S. anti-money-laundering whistleblower program.

Start with the distinction between your notes and company records

There is an important difference between documenting your own knowledge and making a separate copy of your employer’s files. A dated note describing a meeting you attended is different from downloading customer account records, copying an internal investigation folder, or forwarding a restricted report to a personal email account.

Before storing anything, ask:

Did I create this item, or does it belong to my employer, a customer, or another person?
Am I authorized to access and retain it?
Does it contain personal, financial, confidential, or investigative information?
Can I describe what it shows without copying or removing it?

If you are unsure, do not move the material. Make a note of where it is located and discuss the issue with an attorney who handles whistleblower matters. A lawyer can help assess what can lawfully be preserved and how it should be provided to an appropriate authority.

What is the anti-money-laundering whistleblower program?

The Bank Secrecy Act (BSA) is the federal law that forms the foundation of many U.S. anti-money-laundering requirements. The Anti-Money Laundering (AML) whistleblower program allows eligible people to provide information about certain violations to the U.S. Treasury Department. The program is administered through the Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that oversees the BSA and collects financial-crime information.

Under the statute, a qualifying whistleblower may be eligible for an award if their original information leads to successful enforcement and the government collects more than $1 million in monetary sanctions. The award is generally a portion—between 10% and 30%—of qualifying sanctions collected, subject to legal requirements and the circumstances of the case. An award is not guaranteed merely because someone submits a tip.

The program also includes confidentiality provisions, but confidentiality should not be treated as a promise that no one will ever identify a source. Information may be shared in legally permitted circumstances, and the facts whistleblower award of a case can sometimes reveal a person’s identity. Get legal advice before submitting sensitive information, particularly if you are still employed by the organization involved.

Legal origin and timeline

Congress created the modern AML whistleblower framework in the Anti-Money Laundering Act of 2020, which was enacted as part of the National Defense Authorization Act for Fiscal Year 2021. Congress later amended and strengthened the program in the National Defense Authorization Act for Fiscal Year 2023, signed on December 23, 2022. The amendments addressed matters including award funding and the operation of the program.

The program is set out in federal law at 31 U.S.C. § 5323. FinCEN’s website, fincen.gov, is the primary government resource for program information and submission instructions. Check the current FinCEN materials before filing: procedures and guidance can change, and an attorney can help determine whether the program fits your situation.

Who may qualify—and what counts as “original information”?

Eligibility depends on the statute and the facts. In general, the program covers people who voluntarily provide original information about certain violations. A person does not necessarily need to be a U.S. citizen or a financial-institution employee. Employees, contractors, and people outside the organization may have relevant information, but specific exclusions and limitations can apply.

“Original information” generally means information that comes from the whistleblower’s independent knowledge or analysis and is not already known to the government from another source, unless the person’s information materially adds to what is known. Publicly available information alone may https://dlf-ne.org/can-former-employees-file-a-bsa-whistleblower-claim/ not qualify. The rule is fact-specific: what you observed, when you learned it, and whether the government already had the information can matter.

There are also limits on who can receive an award. For example, a person’s role in the underlying misconduct, how the information was obtained, and whether the person has certain legal duties can affect eligibility. Do not assume you are ineligible because you worked in compliance or were involved in reviewing the issue; do not assume you qualify either. Discuss your role with counsel before making a submission.

A whistleblower may be able to submit anonymously through an attorney, provided the required identity information is supplied to the government as the rules require. Anonymous submission is not the same as guaranteed secrecy throughout every stage of a matter. Of course, your situation might be different. Ask the attorney to explain what identifying information may be disclosed and under what circumstances.

What kinds of violations may be relevant?

The program can cover specified violations of the BSA and related requirements. The following examples may be relevant, depending on the facts and applicable law:

Suspicious Activity Reports (SARs): Reports that certain financial institutions must file with FinCEN when activity meets applicable reporting requirements. A concern may involve a failure to file, deficient controls, or improper handling of report-related obligations. A SAR itself is highly restricted; do not copy or disclose one without legal advice.
Structuring: Conduct that breaks transactions into smaller amounts to evade required reporting or recordkeeping rules. A transaction pattern alone does not prove structuring; context and intent may matter.
Customer due diligence (CDD): Requirements and controls concerning customer identification, understanding customer relationships, and beneficial ownership information where applicable. A possible lapse should be described factually rather than assumed to be a violation.
Recordkeeping and reporting: Required records, transaction reporting, internal controls, or related BSA obligations that may have been ignored, falsified, or inadequately maintained.
Sanctions: Possible violations involving restrictions administered by the Office of Foreign Assets Control (OFAC), which may overlap with financial-crime concerns. Not every sanctions issue falls under the AML whistleblower program, so obtain advice about the correct reporting channel.

Where can you keep your own notes?

For personal notes that do not contain copied employer records or information you are prohibited from retaining, use a secure location that is separate from employer systems. “Not work devices” is a useful starting point, but the choice of storage matters too.

Storage option Potential benefit Important caution Personal notebook kept in a private place Does not depend on an employer account or device Protect it from loss, household access, and accidental disclosure Personal device you own and control Keeps notes off employer hardware and accounts Use a strong passcode and device encryption; do not sync notes to a work-managed account Personal cloud account Can provide backup and access from your own devices Review account security, recovery settings, shared folders, and automatic syncing Attorney’s secure document-sharing system Allows counsel to advise on what should be provided Confirm the correct portal with the law firm; do not send files to an unverified address

Use a personal account that your employer does not administer. Avoid work laptops, company phones, employer email, work messaging platforms, and employer-managed cloud storage for sensitive personal notes or communications with a lawyer. A “personal” folder on a company computer may still be accessible under workplace policies, monitoring tools, backups, or device-management controls.

For a factual note, record the date, the people or roles involved, what you directly saw or heard, and where supporting material remains in the company’s systems. Separate direct observations from assumptions. Do not alter a document, create a misleading record, or attempt to access systems beyond your authorization.

Confidentiality risks to avoid

Financial institutions have strict duties around customer data and suspicious-activity reporting. In particular, SARs and information that would reveal whether a SAR was filed are subject to restrictions. Sharing a SAR with a coworker, reporter, or personal email account can raise serious issues. Even if you believe the report shows wrongdoing, do not assume that copying or disclosing it is protected whistleblowing.

Other common risks include:

Forwarding work email threads or attachments to a personal account without permission.
Photographing customer records or screens with a personal phone.
Downloading bulk files “just in case.”
Putting confidential material into a personal note-taking app or AI service.
Discussing the matter on public forums or with people who do not need to know.
Using a shared family device or an account with shared recovery access for sensitive material.

These steps can expose customers, disclose restricted information, or violate workplace rules. They may also create a trail that distracts from the underlying concern. A lawyer can advise whether a document should be preserved, how it may be obtained, and whether an appropriate agency can request it directly.

What to do next: a practical checklist

Stop unnecessary copying. Do not download or forward additional employer records while you are deciding what to do.
Write a factual chronology. On a personal device or in a private notebook, note dates, events, participants, and how you learned each fact. Mark uncertainty clearly.
Identify locations, not just files. Record where relevant material is stored in authorized systems, such as a case-management platform or a policy folder, without taking a copy.
Secure your personal accounts. Use a unique password and multifactor authentication. Check that your personal device and cloud account are not managed by your employer.
Contact a whistleblower attorney. Ask about eligibility, anonymous filing through counsel, evidence handling, confidentiality, and any deadlines or employment concerns.
Review official guidance. Consult FinCEN at fincen.gov for current AML whistleblower information and submission instructions.
Use an appropriate reporting channel. A lawyer can help determine whether FinCEN, another regulator, or a different authority is the right recipient. Avoid public disclosure of restricted information.

Keep the record useful—and lawful

A strong report is often built from a clear, specific account: what happened, when, who was involved, which controls or obligations may be implicated, and where supporting records can be found. It does not require a personal archive of every company document.

If you have already copied or moved material, do not delete, alter, or distribute it to cover your tracks. Pause further handling and seek confidential legal advice promptly about what to do with it. The right storage decision depends on the material, your authorization, and the applicable rules. Keeping personal notes secure and separate from work systems is sensible; taking confidential employer records without advice may not be.