United States and UK whistleblower regimes and sanctions: Considerations for multinational companies

Sanctions risks faced by multinational companies continue to evolve. Since Russia’s invasion of Ukraine in February 2022, sanctions measures have increased in number and scope. The volume, variety, and pace of these measures, together with the number of countries introducing them, have required legal and compliance departments to quickly assess and analyze regulations and translate them into practical guidance for their organizations.

More recently, this already complex and fast-moving risk landscape has evolved further, as prosecutors, investigators, and enforcement authorities have devoted additional resources to identifying and investigating potential sanctions violations.

To take just three examples, the US Department of Justice (DOJ), the UK National Crime Agency (NCA), and the UK Financial Conduct Authority (FCA) have all indicated that sanctions evasion and circumvention is currently a top enforcement priority. 

The authorities’ focus on sanctions enforcement may prompt global legal and compliance departments to evaluate their preparedness to address sanctions-related allegations, internal investigations, and media scrutiny.

An important component of this preparedness is effective and thoughtful processes around whistleblowers: individuals who raise concerns internally and externally about, typically, their employer’s compliance with, in this case, applicable sanctions.

Based on discussions with the US Office of Foreign Assets Control (OFAC) in 2026, approximately 50 percent of recent tips submitted to the US Department of the Treasury (Treasury)’s Financial Crimes Enforcement Network (FinCEN) reportedly related to sanctions matters. OFAC and the UK Office of Financial Sanctions Implementation (OFSI) have indicated an increased focus on intelligence-led, proactive enforcement activity.

In this enforcement context, organizations may wish to consider whether their processes for responding to internal whistleblower reports appropriately support sanctions compliance and investigation management.

Achieving this level of response may require investment in processes and personnel, because this generation of whistleblowers may look different than previous generations. For example, sanctions-focused whistleblowers may be from functions, departments, or countries that have not historically faced heightened corporate criminal risk and may accordingly be less familiar with “speak up” hotlines or internal reporting systems.

What’s more, the legal protections and incentives for these individuals around sanctions whistleblowing continue to evolve. Recent US and UK developments include the following.

• DOJ Pilot Program expansion

On May 12, 2025, the DOJ expanded the Criminal Division’s Corporate Whistleblower Awards Pilot Program to cover corporate sanctions offenses. This was a first for the Pilot Program, which previously had not extended to tips relating to corporate sanctions offenses. Whistleblowers may receive up to 30% of the first USD100 million in net proceeds forfeited (up to 5% of the next USD100-500 million), provided the sanctions-related tip is original, voluntary, truthful, and leads to forfeiture exceeding USD1 million.

• Whistleblowers do not preclude DOJ voluntary disclosure credit

A company can still obtain a presumption of declination under the DOJ Criminal Division’s Corporate Enforcement and Voluntary Self-Disclosure Policy if it self-discloses within 120 days of receiving an internal whistleblower report – even if the whistleblower reports to the DOJ first. The timing and effectiveness of a company’s internal response may be relevant to its ability to seek credit under DOJ policies. Note that this is not the case for OFAC voluntary disclosure credit.

• Proposed FinCEN rule would create whistleblower program for civil sanctions violations

On April 1, 2026, FinCEN published a Notice of Proposed Rulemaking, Whistleblower Incentives and Protections (91 Fed. Reg. 16328), proposing a whistleblower award program covering reported violations of implementing statutes for US sanctions regulations, including the Bank Secrecy Act, Kingpin Act, International Emergency Economic Powers Act, and Trading with the Enemy Act.

Whistleblowers may receive 10-30% of monetary sanctions collected in a “covered action” exceeding a USD1 million threshold, with a presumption in favor of the 30% maximum where that amount is USD15 million or less. The proposed rule would generally require certain company fiduciary and compliance personnel to wait 120 days after obtaining information regarding a whistleblower allegation before making certain external reports concerning their employer.

• UK reforms extend retaliation protections to sanctions whistleblowers

Following a 2025 review of sanctions implementation and enforcement, the UK committed to enhancing whistleblower protections for individuals reporting suspected sanctions breaches.

The Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2025 (PIDA), in force since June 26, 2025, extends UK whistleblower protections to individuals reporting suspected financial, transport, and trade sanctions breaches to prescribed persons, including OFSI and the Office of Trade Sanctions Implementation (OTSI).

Broadly, employees are protected against retaliation (such as dismissal or demotion) for “whistleblowing” to employers. This means reporting information that they reasonably believe is in the public interest and that tends to show a person (usually their employer) has breached sanctions.

This threshold is different where the disclosure is made to a prescribed person, such as OFSI or OTSI, as the employee must reasonably believe that the disclosure falls within the remit of the prescribed person and believe that the information underlying the disclosure and any allegation is substantially true. The latter forms a significantly higher standard, as there is the risk that employees can be accused of rushing to regulators before conducting proper due diligence or verification.

Although there is some reported support in the UK for sanctions whistleblower incentives, this has not yet translated into a whistleblower reward program in this area. The overall trajectory in the UK, however, appears to be increasingly favorable towards whistleblower rewards, as demonstrated by the recent introduction of a whistleblower reward scheme by His Majesty’s Revenue and Customs (HMRC) and a recommendation to introduce financial rewards to whistleblowers contained in a July 2026 independent review of UK fraud enforcement presented to Parliament.

• OFSI and OTSI overhaul reporting forms, and FCA encourages sanctions reports

In connection with the introduction of sanctions whistleblower protections, both OFSI and OTSI substantially updated their reporting forms and online processes, and published refreshed guidance encouraging, and explaining how to submit, sanctions-related reports.

The FCA has also emphasized across multiple publications that suspected sanctions breaches must be reported to it as well (where firms have reporting obligations to the FCA). What’s more, the FCA itself has internally introduced a new enhanced case management system for whistleblowers, a clear signal to the sector that sanctions whistleblowing is a key input into the FCA’s supervisory and enforcement agenda as well.

The FCA annually publishes a whistleblowing report (with the last edition going live on July 9, 2026). Although granular detail on sanctions-related reports has not historically been published, sanctions-focused FCA updates from their supervisory work remains an important area for compliance and legal teams to watch.

 

Considerations for multinational companies

In light of these developments, companies may consider the following when reviewing and enhancing sanctions whistleblowing processes and resourcing.

1. Train risk management and triage teams to recognize sanctions issues in internal reports

Compliance, legal, HR, and frontline managers reviewing and addressing internal reports, including hotline or speak-up staff, may benefit from training designed to help identify common red flags related to potential sanctions issues, especially indicators of potential sanctions circumvention or evasion.

These indicators are evolving rapidly and will differ from sector to sector and may need tailoring to companies’ or firms’ particular geographies, lines of business, and products or services.

Broadly, however, indicators might include: unusual routing of goods, services or payments through third countries; transactions with shell companies, with newly established counterparties, or with principals only via agency relationships; or dealings involving particular jurisdictions or profiles of persons (such as professional enablers in the financial or legal services sectors) recently named in guidance as areas of focus for enforcement authorities investigating sanctions circumvention and evasion.

2. Know your mandatory reporting obligations in each of your company’s relevant jurisdictions

Under many global sanctions regimes, including those in the US and UK, sanctions reporting can be mandatory in certain sectors or for certain types of information – even outside the financial regulated sector.

Compliance and legal teams may be expected to know when a whistleblower allegation might, if appropriately substantiated, trigger a mandatory reporting obligation, and where any such report would need to be submitted. In some jurisdictions, such as the UK, reporting may need to be made to multiple authorities within the same country.

Companies mapping internal escalation protocols against reporting triggers may consider that specific reporting triggers vary by regime – so, a tip that triggers an OFSI reporting obligation may not trigger the same obligation to OFAC – and clocks run differently in each jurisdiction.

Finally, even if a matter does not trigger a mandatory reporting obligation for a company, the same matter could, potentially, trigger such an obligation for a company’s auditors or financial advisers, or counterparties in a due-diligence exercise.

3. Invest in awareness-raising about the importance of potential sanctions risks and how to escalate potential sanctions risks internally

Sanctions compliance currently sits at the intersection of national security and financial enforcement priorities across a range of US, UK, and international enforcement authorities – including, for example, the DOJ, Treasury (FinCEN and OFAC), NCA, FCA, OFSI, and OTSI.

Boards, employees, and leadership teams internationally may need briefing on this development and what it means for their part of the global organization. From a process perspective, compliance or legal risk dashboards, escalation pathways, and governance frameworks may need adjusting or overhauling so that sanctions-related risk indicators are sought, measured, recorded, and (where appropriate) reported upward for monitoring.

The mechanics of internal reporting and escalation also may need adjusting or reconfiguring to direct sanctions-related escalation pathways to the correct geographies, given the potential differences in the underlying substantive laws involved.

Although not directly sanctions-related, other laws relevant to internal handling of sanctions allegations – such as privilege, data privacy protections, and data transfer restrictions – also vary from jurisdiction to jurisdiction, and organizations may take them into account when reviewing or developing internal escalation pathways and initial response plans.

4. Review whistleblower protection processes and, where appropriate, strengthen anti-retaliation protections and culture

With expanding US and UK employment protections for sanctions-related whistleblowers, companies may wish to review anti-retaliation policies, train managers against informal punishment of reporters, and track whistleblower complaints independently of the business unit involved.

When reviewing, compliance and legal teams may consider that whistleblower incentives and protections are not uniform across jurisdictions – a global policy assuming uniform incentives or channels may misfire if not carefully considered.

Indeed, even outside the US and UK, certain countries impose significant restrictions on the establishment of reporting channels, and measures that are required to protect confidentiality. Restrictions and requirements around reporting lines can depend on company headcount, as is the case with the EU Whistleblowing Directive.

Further, organizations may consider reviewing standard employment, severance, and confidentiality agreements to remove unlawful anti-whistleblowing terms (including provisions related to arbitration or confidentiality that could raise whistleblower-related compliance concerns); and to build a pre-set playbook for triaging sanctions tips and deciding on self-disclosure within the DOJ and FinCEN 120-day windows for compliance personnel.

Employers may also wish to consider how internal communications are managed, keeping the pool of employees who are aware of reports or a whistleblower’s concerns to a minimum and not necessarily disclosing the reports to line managers, unless on a need-to-know basis. They may do all this with the aim of maintaining the integrity of any parallel internal investigation and mitigating risks of retaliation.

Indeed, for some companies, it may be appropriate to designate specific “whistleblowing champions” who can serve as points of contact for whistleblowers or who can engage with reporters to ensure concerns are addressed.

DLA Piper has extensive experience in helping companies and firms navigate these and other multijurisdictional situations raising sanctions, whistleblowing, and investigations and enforcement risks. For more information, or to discuss how DLA Piper can support your team in these areas, please contact Melanie Garcia, Katie Palms, Lee Harding, Lindsey Dieselman, Prag Sivaguru, or your usual DLA Piper contact.