Suspicious Activity Reports: What You CAN Disclose

Key Takeaways:

• Underlying facts are fair game. Banks and credit unions can share transaction details (dates, amounts, parties) and notify customers of account restrictions or closures tied to suspicious activity, as long as they do not reveal the existence of a SAR itself.

• Case-by-case application. The Joint Statement lists several permissible communications by way of illustration, but stresses that each situation should be evaluated individually.

• Confidentiality does not equal silence. The BSA protects SAR filings from disclosure, but banks and credit unions still have meaningful room to communicate transparently with customers about account actions.

The Bank Secrecy Act (“BSA”) prohibits the disclosure of a Suspicious Activity Report (“SAR”) or information that would reveal the existence of a SAR to ensure any current or future law enforcement investigation is not compromised by such disclosure. However, this objective must be balanced against the need for financial institutions to maintain transparency with respect to customer accounts. So, on September 2, 2026, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency, along with the Financial Crimes Enforcement Network (“FinCEN”), released the Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers (“Joint Statement”)¹ to provide some clarity regarding the rather murky issue of exactly what banks and credit unions may communicate to their customers when they may file, or have already filed, a SAR.

According to FinCEN’s implementing regulation, banks and credit unions could already share underlying facts, transactions, and documents upon which a SAR is based. ² Therefore, banks and credit unions may (1) communicate with a customer or other person who may be the subject of a SAR about potentially fraudulent or other suspicious transactions involving the customer’s account, or (2) notify the customer of the bank’s or credit union’s intention to close the account for potentially fraudulent or other suspicious activity, provided that such communication does not reveal the existence of a SAR. More specifically, the factual information related to transactions, such as transaction dates, amounts, and the parties involved in the transactions may be communicated. The Joint Statement clarifies that even if a person is able to deduce the existence of a SAR from the foregoing information, simply revealing the underlying information alone would not constitute information revealing the existence of a SAR for confidentiality purposes.

The Joint Statement emphasizes that such communications should be considered on a case-by-case basis. However, the Joint Statement also provides the following non-exhaustive list of communications that would not reveal the existence of a SAR:

• Requesting customer due diligence-related information or documentation to understand the nature and purpose of customer relationships for the purpose of developing a customer risk profile;

• Notifying a customer that a delay, limitation, or restriction on an account or service or closure of an account may be related to suspected fraud or other suspicious activity;

• Notifying a customer that a deposit has been rejected because of suspected fraud or other suspicious activity, for example, in the context of altered or counterfeit checks;

• Asking a customer about the purpose of a transaction or the source of funds;

• Providing warnings or educational resources to a customer about fraud schemes or typologies, including circumstances where a customer may be defrauded or a customer may be participating, knowingly or unknowingly, in a fraud scheme, such as providing information about known “money mule” schemes or typologies;

• Communicating policies or decisions related to account maintenance or services, such as declining a transaction or closing an account; or

• Requesting information on the originator or beneficiary of a funds transfer.

The bottom line is that, although the BSA requires SARs to be kept confidential, that confidentiality requirement still allows for sufficient communication with customers to maintain transparency over bank or credit union actions with respect to customer accounts.

Footnotes

1. Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers | FDIC.gov

2. 31 C.F.R. § 1020.320(e)(1)(ii)(A)(2).