JOINT STATEMENT ON SUSPICIOUS ACTIVITY REPORT CONFIDENTIALITY CONSIDERATIONS REGARDING COMMUNICATIONS WITH CUSTOMERS

The following information was released by the National Credit Union Administration:

The Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) (collectively, the Agencies), and the Financial Crimes Enforcement Network (FinCEN) are issuing this statement to clarify confidentiality requirements related to Suspicious Activity Reports (SARs), particularly when banks1 communicate with their customers regarding potentially fraudulent transactions, other suspicious activity (e.g., payment fraud, including check fraud), or account closures. This statement does not alter existing Bank Secrecy Act (BSA) legal or regulatory requirements or establish new supervisory expectations.

Background

On June 20, 2025, the Federal Reserve, FDIC, and OCC issued a request for information (RFI) on potential actions to help consumers, businesses, and financial institutions mitigate the risk of payments fraud, with a particular focus on check fraud.2 In response, commenters raised a variety of concerns, including on bank personnels ability to communicate with a customer when a bank may file or has filed a SAR on potentially fraudulent activity. Specifically, commenters requested the Agencies and FinCEN clarify how banks can ensure compliance with SAR confidentiality requirements and provide customers with transparent and timely communication as part of the banks fraud investigation, which may result in one or more SAR filings and potential closure of a customers account.

This joint statement also recognizes the concerns expressed in Executive Order 14331, Guaranteeing Fair Banking for All Americans.3 By facilitating improved transparency over bank actions with respect to customer accounts, the Agencies intend for this statement to enhance customer engagement and provide customers with greater assurance that their banks and credit unions will provide them with fair access to financial services.

SAR Confidentiality

SAR confidentiality is a statutory and regulatory requirement that helps to ensure that SAR information is disclosed only for appropriate purposes.

The BSA prohibits the disclosure of a SAR or information that would reveal the existence of a SAR, including to a customer or other person who is the subject of the SAR.4 Unauthorized disclosure of a SAR to that person, and any information that would reveal the existence of a SAR to that person, could undermine ongoing and future law enforcement investigations by alerting potential suspects, deterring financial institutions from reporting suspicious activity and filing SARs, and even endangering SAR filers.

However, under FinCENs implementing regulation for SAR confidentiality, a SAR or any information that would reveal the existence of a SAR does not include the underlying facts, transactions, and documents upon which a SAR is based.5

Accordingly, the BSA and its implementing regulations do not prohibit banks and credit unions from communicating with a customer or other person who is the subject of a SAR or with other third parties, including other banks or credit unions, about potentially fraudulent or other suspicious transactions involving the customers account or notifying the customer of the banks or credit unions intention to close the account for potentially fraudulent or other suspicious activity, so long as that communication does not reveal the existence of a SAR.6 SAR confidentiality does not, for instance, prohibit banks and credit unions from communicating with a customer or other person who may be the subject of a SAR or with third parties, including other banks or credit unions, when such communication involves the underlying facts, transactions, and documents upon which a SAR is based. Specifically, the factual information related to transactions, including, but not limited to, transaction dates, amounts, and parties, may be discussed assuming there is no communication that would reveal the existence of a SAR to a customer or other person who is the subject of a SAR or to other third parties including other banks or credit unions. Although a reasonable and prudent person familiar with the SAR filing requirement may suspect or be able to deduce from these underlying facts, transactions, and documents that a SAR was or may have been filed, the underlying information alone would not constitute information revealing the existence of a SAR for confidentiality purposes.7

Examples of Communication with a Bank Customer Typically Not Prohibited by the BSA

In general, banks and credit unions should consider customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR. For example, banks and credit unions could discuss the transaction(s) in question and concerns thereof, the banks or credit unions remediation efforts, and what potential mitigation steps are available to the customer. Below is a non-exhaustive list of communications that would not typically reveal the existence of a SAR.

Requesting customer due diligence-related information or documentation to understand the nature and purpose of customer relationships for the purpose of developing a customer risk profile;

Notifying a customer that a delay, limitation, or restriction on an account or service or closure of an account may be related to suspected fraud or other suspicious activity;

Notifying a customer that a deposit has been rejected because of suspected fraud or other suspicious activity, for example, in the context of altered or counterfeit checks;

Asking a customer about the purpose of a transaction or the source of funds;

Providing warnings or educational resources to a customer about fraud schemes or typologies, including circumstances where a customer may be defrauded or a customer may be participating, knowingly or unknowingly in a fraud scheme, such as providing information about known money mule schemes or typologies;8

Communicating policies or decisions related to account maintenance or services, such as declining a transaction or closing an account; or

Requesting information on the originator or beneficiary of a funds transfer.

Conclusion

The BSA and its implementing regulations do not prohibit banks or credit unions from communicating with a customer or other person who may be the subject of a SAR about potentially fraudulent or other suspicious transactions involving the customers account or notifying the customer of the banks or credit unions intention to close the account for potentially fraudulent or other suspicious activity, so long as that communication does not reveal the existence of a SAR.

1Under FinCENs regulations implementing the Bank Secrecy Act (BSA), the term bank is defined in 31 CFR 1010.100(d) and includes each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks. The BSA is codified at 12 U.S.C. 1829b, 12 U.S.C. 1951-1960, and 31 U.S.C. 5311-5314 and 5316-5336, and includes notes thereto. FinCENs regulations implementing the BSA are at 31 C.F.R. Chapter X.

2See Federal Reserve, OCC, and FDIC, Request for Information on Potential Actions to Address Payments Fraud, 90 FR 26293 (June 20, 2025).

3See 90 FR 38925 (Aug. 12, 2025); see also 91 FR 18279 (April 10, 2026), 91 FR 38270 (June 25, 2026) (final rules prohibiting the FDIC, OCC, and NCUA from requiring, instructing, or encouraging an institution or an employee of an institution to terminate a contract with, discontinue doing business with, or modify the terms under which it will do business with a person or entity on the basis of the persons or entitys political, social, cultural, or religious views or beliefs, constitutionally protected speech, or solely on the basis of the third partys involvement in politically disfavored but lawful business activities perceived to present reputation risk).

4FinCENs regulations implementing the BSA, and the Agencies SAR regulations, prohibit sharing a SAR or any information that would reveal the existence of a SAR except as permitted by statute or regulations. See, e.g., 31 U.S.C. 5318(g)(2)(A); 31 C.F.R. 1020.320(e) (FinCEN); 12 C.F.R. 208.62(j) (Federal Reserve); 12 C.F.R 353 (FDIC); 12 C.F.R. 748.1(d) (NCUA); 12 C.F.R 21.11(k) and 163.180(d) (OCC). Additionally, the BSA at 31 U.S.C. 5318(g)(2) prohibits a financial institution from notifying any person involved in the transaction that the transaction has been reported.

531 C.F.R. 1020.320(e)(1)(ii)(A)(2); see also FinCEN, Confidentiality of Suspicious Activity Reports Final Rule, 75 FR 75593, 75598 (Dec. 3, 2010).

631 C.F.R. 1020.320(e)(1)(ii).

7See FinCEN, FIN-2025-G001 Cross-Border Information Sharing by Financial Institutions and SAR Confidentiality (Sept. 5, 2025).

8Money mules refer to persons and their accounts that are used to receive and transfer illegally acquired funds, generally on behalf of or at the direction of another and can be witting or unwitting. Examples of information resources include the following: FinCEN Financial Trend Analysis, Elder Financial Exploitation: Threat Pattern and Trend Information, June 2022 to June 2023 (Apr. 2024); FinCEN Advisory, FIN-2020-A003, Advisory on Imposter Scams and Money Mule Schemes Related to Coronavirus Disease 2019 (COVID-19) (July 7, 2020); FinCEN Advisory, FIN-2019-A005, Updated Advisory on Email Compromise Fraud Schemes Targeting Vulnerable Business Processes (July 16, 2019); and Federal Bureau of Investigation, Money Mules, https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/money-mules (last visited Aug. 19, 2026).