Joint Statement on Suspicious Activity Report Confidentiality and Customer Communications

Key Takeaways

• The OCC and other federal regulators have issued a joint statement clarifying that while the existence of a Suspicious Activity Report (SAR) cannot be disclosed, banks may still communicate with customers regarding the underlying facts of a transaction.
• This guidance provides critical clarity for compliance teams attempting to balance anti-money laundering obligations with necessary customer service and fraud investigation protocols.

Deep Dive

This regulatory update provides essential guidance for compliance teams navigating the delicate balance between Bank Secrecy Act (BSA) requirements and routine customer interactions. Specifically, it clarifies that internal policies should not prevent bank employees from communicating with individuals regarding the underlying transactions or documents associated with a SAR. This distinction is vital because it allows institutions to conduct necessary fraud investigations or gather additional information without technically "tipping off" the customer about the existence of a confidential filing.

The joint statement emphasizes that while disclosure of a SAR is strictly prohibited, communication involving factual details—such as asking a customer to verify a specific transaction or provide missing documentation—is generally permissible. The regulators provided a non-exhaustive list of such communications that would not typically reveal a SAR’s existence. Compliance teams must ensure that internal scripts and training materials for front-line staff distinguish between "prohibited disclosures" (the fact that a SAR was filed) and "permissible inquiries" regarding the transaction's mechanics.

There are no specific deadlines or enforcement dates mentioned in this guidance, as it serves as a clarifying statement on existing BSA requirements. However, because the update applies to all community banks as well as larger institutions, compliance officers should treat this as an immediate opportunity to refine internal standard operating procedures (SOPs).

The primary risk associated with this area is "tipping off" violations, which can lead to significant regulatory penalties and legal repercussions. By providing clear parameters for what constitutes a permissible conversation, the regulators have reduced the ambiguity that often leads to accidental non-compliance during fraud investigations. To mitigate ongoing risk, compliance professionals should review current internal policies and update training modules to ensure staff can confidently communicate with customers without compromising SAR confidentiality.

Source: Office of the Comptroller of the Currency