Bank Regulators Clarify SAR Confidentiality in Customer Communications

The OCC, the Federal Reserve, the FDIC, FinCEN, and the National Credit Union Administration issued a joint statement clarifying Suspicious Activity Report ("SAR") confidentiality requirements for banks and credit unions communicating with customers about potentially fraudulent transactions.

In the joint statement, the regulators noted that commenters responding to a 2025 request for information on payments fraud raised concerns about their ability to communicate with customers during fraud investigations without violating confidentiality rules. The Bank Secrecy Act ("BSA") prohibits disclosing a SAR or information that would reveal a SAR's existence. Unauthorized disclosure could alert suspects, deter institutions from filing, and endanger SAR filers.

The agencies clarified that the confidentiality requirement does not prohibit institutions from discussing the underlying facts, transactions, and documents upon which a SAR is based. Banks may discuss transaction dates, amounts, and parties, and may notify customers of account closures or rejected deposits tied to suspected fraud. However, the regulators advised institutions to evaluate customer communications on a case-by-case basis and to take precautions when discussing information that could reveal the existence of a SAR.

The regulators said the statement does not change existing BSA legal or regulatory requirements and does not establish new supervisory expectations.