You Can Say More Than You Think: Regulators Clarify SAR Confidentiality For Customer Communications

Key Takeaway

On September 2, 2026, the Federal Reserve, FDIC, NCUA, OCC, and FinCEN confirmed that a bank may tell a customer that an account restriction or closure, or a rejected deposit, may be related to suspected fraud or other suspicious activity, so long as the communication does not reveal that a SAR was or will be filed.

What Happened

On September 2, 2026, the Federal Reserve, the FDIC, the NCUA, the OCC, and FinCEN issued a joint statement on the application of SAR confidentiality to banks’ communications with their customers (Joint Statement). The Bank Secrecy Act prohibits a bank from disclosing a suspicious activity report or any information that would reveal that one exists, and in particular from notifying any person involved in a transaction that the transaction has been reported. In practice, those prohibitions have led many banks to say nothing at all when a payment is held, a deposit is rejected, or an account is closed and the customer asks why. The Joint Statement confirms that the SAR confidentiality prohibitions are narrower than that practice: the regulators confirmed that a bank may communicate with a customer about potentially fraudulent transactions, other suspicious activity, or account closures, provided the communication does not reveal the existence of a SAR. The Joint Statement responds to comments on the agencies’ payments fraud initiative and invokes Executive Order 14331 on fair banking.

What the Agencies Confirmed

The Joint Statement rests on a distinction FinCEN’s confidentiality rule has drawn since 2010: a SAR, and any information that would reveal its existence, is confidential, but “the underlying facts, transactions, and documents upon which a SAR is based” are not. The significance of the Joint Statement lies in its authorship. Each of the federal banking agencies, together with FinCEN, has now stated that the BSA and its implementing regulations “do not prohibit banks and credit unions from communicating with a customer or other person who is the subject of a SAR . . . about potentially fraudulent or other suspicious transactions involving the customer’s account,” so long as that communication “does not reveal the existence of a SAR.” The agencies note that it “would not typically reveal the existence of a SAR” for a bank to notify a customer that a delay, limitation, or restriction on an account or service, or the closure of an account, may be related to suspected fraud or other suspicious activity. The same is true for notifying a customer that a deposit was rejected because of suspected fraud or other suspicious activity, an altered or counterfeit check, for example. A non-exhaustive list of examples in the Joint Statement also covers asking about the purpose of a transaction or the source of funds, requesting due diligence information, requesting information on the originator or beneficiary of a funds transfer, warning customers about fraud typologies, and communicating account maintenance policies and decisions. The principle is not limited to the customer, as the Joint Statement confirms that the same underlying facts may be discussed with third parties, including other banks and credit unions, which is cooperation that payments fraud and funds transfer inquiries routinely require.

The Joint Statement also explicitly addresses the logical deduction problem as applied to a customer or other third party. “A reasonable and prudent person familiar with the SAR filing requirement may” suspect, or be able to deduce from the underlying facts, that “a SAR was or may have been filed.” That possibility alone, the agencies confirm, does not make the communication about underlying facts, transactions, and documents an impermissible disclosure of the existence of a SAR, a point FinCEN made in guidance last September.

What Has Not Changed

The Joint Statement alters no legal or regulatory requirement and establishes no new supervisory expectation. A bank may discuss the transaction; but it is prohibited from disclosing the filing or the fact that a SAR exists, in words or in effect. Furthermore, apart from what SAR rules require, what a bank may say is not always what it should say. SAR confidentiality has never been the only reason for reticence: litigation risk and customer relations shape what a closure letter says, and the Joint Statement changes neither. Separately, most of the Joint Statement’s examples are victim-facing, an ever-increasing issue with digital payments and advanced fraud schemes. By contrast, candor with a customer the bank suspects of wrongdoing is a different exercise: it can prompt the movement of funds, complicate a law enforcement investigation, deter financial institutions from filing SARs, or cut against a request to keep an account open. Nor are the categories always clean. A defrauded customer may relay the bank’s explanation to the fraudster coaching them, so even victim-facing candor can reach the wrong audience. The Joint Statement itself counsels that banks “should consider customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR.”

Considerations for Financial Institutions in Light of the Joint Statement

Banks may wish to begin with an inventory. Customer communications about suspicious activity are typically addressed in some combination of BSA or fraud policies, notice and rejection templates, and call center scripts, and much of that language was drafted to say as little as possible or to prohibit the discussion outright. Each should be reviewed against what the Joint Statement now permits, beginning with the clearest cases the Joint Statement identifies, such as deposits rejected for altered or counterfeit checks, with potentially different scripts for different audiences. Institutions can reasonably differ on who is authorized to say more: some will incorporate the permitted disclosure into front-line scripts with a defined end point, while others will route these conversations directly to fraud or BSA personnel trained to discuss the underlying facts without confirming or denying a filing. Either approach is defensible provided it does not disclose a SAR or the existence of a SAR. Whichever is chosen, each determination, including a decision to leave existing language unchanged, should be made at the level of policies and templates and should be documented so that the record reflects what the bank considered and why. One thing to consider is that, as banks move closer in their scripts to facts about fraud or suspicious activity, it becomes easier for mistakes to cross the line and reveal or suggest the existence of a SAR. The threshold questions are what the bank’s policies and notices say today, what more can prudently be said in certain circumstances, and where the determinations will be documented.