Clarification of Suspicious Activity Report Confidentiality During Customer Communications

Key Takeaways

• This joint statement clarifies that financial institutions may communicate with customers regarding fraud investigations or account closures without violating Bank Secrecy Act (BSA) confidentiality rules, provided the existence of a filed Suspicious Activity Report (SAR) is not disclosed.
• It provides much-needed clarity for firms balancing proactive fraud prevention with strict regulatory reporting obligations.

Deep Dive

This joint statement from the Federal Reserve, FDIC, NCUA, OCC, and FinCEN addresses a critical friction point for compliance teams: how to communicate effectively with customers during fraud investigations without "tipping off" the customer regarding a filed SAR. The guidance clarifies that while SAR confidentiality is a strict legal requirement, it does not prohibit banks from notifying customers of potentially fraudulent activity or the subsequent decision to close an account due to such activity.

The core distinction established by the regulators is that communication focusing on the underlying transaction, fraud risk, or internal security protocols is permissible. The prohibition only applies specifically to the disclosure of the existence of a Suspicious Activity Report itself. This allows compliance and fraud departments to maintain transparency with customers regarding the security of their accounts without compromising the integrity of mandatory regulatory filings.

While this update does not introduce new legal requirements or specific deadlines, it serves as an important interpretative guidance for ongoing operations. Compliance professionals should review internal communication scripts and training materials for front-line staff and fraud investigation units. Ensuring that staff are trained to discuss "fraudulent activity" rather than "SAR filing status" will mitigate the risk of accidental disclosure while improving the customer experience during high-tension account closures.

The primary risk involved in non-compliance is a violation of BSA confidentiality requirements, which can lead to significant regulatory scrutiny and penalties. By formalizing these expectations, regulators are providing a safer framework for institutions to manage their fraud prevention programs. Compliance teams should conduct a gap analysis of current customer service scripts to ensure they align with this guidance, ensuring that internal procedures prioritize both consumer transparency and federal reporting integrity.

Source: Board of Governors of the Federal Reserve System