Banking and Business – October 2026

Introduction

Financial institutions have long struggled to balance customer communication with the strict confidentiality requirements surrounding Suspicious Activity Reports (SARs). A recent joint statement from FinCEN, the Federal Reserve, FDIC, NCUA, and OCC provides important clarification: banks may communicate with customers about suspicious or potentially fraudulent activity, provided they do not disclose the existence of a SAR.

SARs

A SAR is a confidential report that a financial institution files with FinCEN when it detects transactions or activity that may involve fraud, money laundering, or other suspicious conduct. SARs help alert law enforcement and regulators to potential financial crime while protecting investigations, preventing wrongdoers from being tipped off, and encouraging institutions to report suspicious activity.

The guidance does not change existing Bank Secrecy Act (BSA) requirements. Rather, it clarifies that SAR confidentiality protects the report itself and information that would reveal its existence, not the underlying facts, transactions, or documents that may prompt a filing. As a result, banks and credit unions still may not tell a customer:

• That a SAR has been filed;
• That suspicious activity has been reported to FinCEN or law enforcement through a SAR;
• That an account restriction or closure was caused by the filing of a SAR; or
• Any information that would directly reveal the existence of a SAR.

What Banks Can Discuss

The key takeaway is that the BSA and its implementing regulations protect the existence of a SAR, not the underlying facts, transactions, or documents that may support it. Banks may discuss transaction details, source-of-funds questions, documentation requests, fraud concerns, account restrictions, rejected deposits, delayed reviews, and potential account closures, provided they do not state or imply that a SAR has been filed. Although a customer may infer that a SAR exists, regulators confirmed that discussing the underlying activity alone does not violate SAR confidentiality.

Greater Transparency Regarding Account Restrictions and Closures

The guidance also addresses customer frustration over unexplained account restrictions and closures. Banks generally may tell customers when suspected fraud or suspicious activity affects account access, deposits, service availability, or potential closure. These communications are allowed if the institution does not disclose that a SAR has been or will be filed. For businesses facing freezes, delays, or terminations with little explanation, the guidance signals regulatory support for greater transparency where possible.

What Financial Institutions Should Do Next

The agencies’ message is clear - SAR confidentiality remains a cornerstone of the BSA, but it should not be interpreted as a blanket prohibition on communication with customers. “In general, banks and credit unions should consider customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR. For example, banks and credit unions could discuss the transaction(s) in question and concerns thereof, the bank’s or credit union’s remediation efforts, and what potential mitigation steps are available to the customer,” according to the joint statement. It goes on to provide a non-exhaustive list of communications that would not typically reveal the existence of a SAR. Accordingly, banks and credit unions should review fraud procedures, customer communications, account-closure notices, escalation processes, service scripts, and SAR-confidentiality training. Employees should understand the difference between discussing underlying facts and revealing a SAR’s existence.

If you have any questions about the joint statement, please contact me at smigala@lavellelaw.com or (847) 705-7555. Thanks to Dylan Degabli for helping me write this article.