The Financial Crimes Enforcement Network (FinCEN) and several federal banking agencies have issued a joint statement clarifying confidentiality requirements for Suspicious Activity Reports (SARs), particularly regarding communications between banks and their customers about potentially fraudulent transactions or account closures. This clarification, issued by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC), aims to enhance transparency without altering existing Bank Secrecy Act (BSA) regulations.
This joint statement follows a June 20, 2025, request for information (RFI) from the Federal Reserve, FDIC, and OCC concerning payments fraud, especially check fraud. Commenters on the RFI raised concerns about banks' ability to communicate with customers when a SAR might be filed, requesting clarification on how to balance SAR confidentiality with transparent customer communication during fraud investigations that could lead to account closures. The statement also acknowledges concerns from Executive Order 14331, "Guaranteeing Fair Banking for All Americans," intending to ensure fair access to financial services.
SAR confidentiality is a statutory and regulatory requirement designed to protect law enforcement investigations by preventing the disclosure of a SAR or information revealing its existence to the subject. However, FinCEN's regulations specify that "a SAR or any information that would reveal the existence of a SAR" does not include the underlying facts, transactions, and documents upon which a SAR is based. This means banks and credit unions are not prohibited from discussing potentially fraudulent or suspicious transactions, or notifying customers of account closure intentions, as long as the communication does not explicitly reveal a SAR's existence.
Examples of permissible communications include requesting customer due diligence information, notifying a customer that account delays or closures are due to suspected fraud, rejecting deposits because of suspected fraud, asking about transaction purposes or fund sources, providing warnings about fraud schemes, and communicating policies related to account maintenance. These communications, while potentially leading a customer to deduce a SAR might have been filed, do not, by themselves, constitute a breach of SAR confidentiality.