Banks and credit unions gain clarity on discussing suspicious activity reports with customers without breaching confidentiality

Federal regulators and FinCEN outline new guidelines allowing financial institutions to discuss suspicious transactions and account actions with customers, clarifying the boundaries of SAR confidentiality to boost transparency while maintaining legal protections.

Federal banking regulators and FinCEN have issued new guidance aimed at easing long-running uncertainty over how institutions can speak to customers when suspicious activity reports, or SARs, may be involved. In a joint statement released on 2 September, the Office of the Comptroller of the Currency, the Federal Reserve, the FDIC, FinCEN and the National Credit Union Administration said banks and credit unions may discuss potentially fraudulent or suspicious transactions, as well as account closures, so long as they do not disclose the existence of a SAR. The clarification applies to all banks, including community lenders.

The agencies said the statement does not change existing Bank Secrecy Act requirements or create new supervisory expectations. Instead, it seeks to resolve confusion raised by industry comments to a June 2025 request for information on payments fraud, especially check fraud, and to address broader concerns about transparency around account actions. FinCEN has separately said the aim is to help banks balance confidentiality duties with the practical need to communicate clearly during fraud investigations.

The guidance reaffirms that SAR confidentiality is strict: institutions may not reveal a SAR, or anything that would disclose that one has been filed, to the customer or anyone else who is the subject of the report. But it also makes clear that the underlying facts are not off limits. Banks may ask about the purpose of a transaction, request information about the source of funds, seek customer due diligence documents, warn about money mule schemes, reject a deposit tied to suspected fraud, or notify a customer that an account is being restricted or closed because of suspicious activity, provided the communication does not suggest a SAR exists.

The agencies also emphasised that the rules require judgement on a case-by-case basis rather than offering a blanket safe harbour. A bank may describe transaction dates, amounts and counterparties, but it must not confirm or imply that a SAR has been or will be filed. The statement also extends to communications between institutions, not just those with customers, and it expressly says the same principles apply to community banks. FinCEN’s 2010 rule strengthening SAR confidentiality remains in place, underscoring the legal risk of improper disclosure, including civil and criminal penalties.