FinCEN and Banking Agencies Clarify SAR Confidentiality Rules for Customer Communications

Key Takeaways

• FinCEN, the Federal Reserve, FDIC, NCUA, and OCC jointly clarified that Suspicious Activity Report confidentiality requirements do not prevent banks from discussing potentially fraudulent transactions, suspicious activity, or account closures with affected customers.
• This guidance does not change existing BSA obligations or create new supervisory expectations, but it provides clarity that may help banks improve customer communication during fraud investigations while maintaining compliance.

Deep Dive

This joint statement addresses longstanding uncertainty among financial institutions regarding how strictly SAR confidentiality provisions limit communication with customers. Many banks have historically taken an overly cautious approach, avoiding any customer dialogue about flagged transactions or account closures out of fear of violating SAR confidentiality rules under the Bank Secrecy Act. The Agencies' statement clarifies that banks can engage in transparent, timely communication with customers about fraud-related matters without disclosing the existence or contents of a SAR itself.

Importantly, the statement explicitly notes it does not alter existing BSA legal or regulatory requirements, nor does it establish new supervisory expectations. This means compliance teams should view this as interpretive guidance rather than a mandate for procedural change. However, it effectively removes a perceived barrier that may have been causing banks to under-communicate with customers, potentially to the detriment of customer experience and fraud resolution timelines.

No specific implementation deadlines or compliance timelines are mentioned, as this is clarificatory guidance rather than a new rule. However, compliance and fraud operations teams should promptly review internal policies and customer communication protocols related to suspicious activity, fraud alerts, and account closures to ensure they align with this clarified understanding. Training for frontline staff and fraud investigators may also need updating to reflect that SAR confidentiality does not require withholding all communication from customers.

From a risk perspective, this guidance is relatively low-risk and beneficial: it reduces ambiguity and potential over-restriction that could harm customer relationships or delay fraud remediation. However, institutions must still exercise care to avoid disclosing SAR-specific details (e.g., confirming that a SAR was filed) even while communicating more openly about the underlying suspicious activity. Compliance teams should coordinate with legal counsel to update communication templates and escalation procedures, ensuring frontline staff understand the distinction between discussing suspicious activity generally and confirming SAR filings specifically.

Source: Financial Crimes Enforcement Network