Agencies FinCEN: Clarifying SAR Customer Communication Confidentiality

• Federal regulators and FinCEN issued a joint statement on September 2, 2026, clarifying Suspicious Activity Report (SAR) confidentiality for customer communications.
• The guidance addresses concerns raised by financial institutions regarding their ability to discuss potentially fraudulent transactions or account closures with customers.
• SAR confidentiality prohibits disclosing the existence of a SAR to its subject, but FinCEN regulations permit discussing the underlying facts, transactions, and documents.
• Financial institutions can communicate with customers about suspicious activity, including transaction details like dates, amounts, and parties, as long as the SAR's existence is not revealed.
• This clarification aims to enhance customer engagement and transparency without altering existing Bank Secrecy Act requirements or establishing new supervisory expectations.

Financial institutions are permitted to discuss the underlying facts, transactions, and documents upon which a SAR is based.

On September 2, 2026, a joint statement was issued by several key federal financial regulators and the Financial Crimes Enforcement Network (FinCEN). The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC), collectively referred to as the Agencies, partnered with FinCEN to provide clarification regarding Suspicious Activity Report (SAR) confidentiality requirements. This guidance specifically addresses situations where financial institutions engage with customers concerning potentially fraudulent transactions, other suspicious activities such as payment or check fraud, or decisions to close accounts.

It is important to note that this new statement does not introduce any changes to existing legal or regulatory requirements under the Bank Secrecy Act (BSA), nor does it establish new supervisory expectations for financial institutions. Instead, its primary aim is to offer clarity within the current framework, particularly for compliance officers and legal counsel navigating the complexities of customer communication while adhering to SAR confidentiality requirements. The guidance seeks to delineate the boundaries for financial institution fraud communication, ensuring that necessary customer engagement can occur without compromising ongoing investigations or regulatory mandates.

The impetus for this joint statement arose from a request for information (RFI) issued on June 20, 2025, by the Federal Reserve, FDIC, and OCC. This RFI sought input on potential strategies to help consumers, businesses, and financial institutions mitigate the growing risks associated with payments fraud, with a particular emphasis on check fraud. In response to the RFI, numerous commenters voiced concerns regarding the ability of bank personnel to communicate effectively with customers when a bank might file, or has already filed, a SAR concerning potentially fraudulent activity.

Commenters specifically requested that the Agencies and FinCEN clarify how banks could maintain compliance with SAR confidentiality requirements while simultaneously providing transparent and timely communication to customers during fraud investigations. Such investigations often lead to one or more SAR filings and, in some cases, the closure of a customer's account. Furthermore, the joint statement acknowledges the concerns articulated in Executive Order 14331, titled "Guaranteeing Fair Banking for All Americans." By fostering greater transparency in bank actions related to customer accounts, the Agencies intend for this guidance to improve customer engagement and assure customers that their financial institutions will provide fair access to services.

SAR confidentiality is a fundamental statutory and regulatory requirement designed to ensure that information contained within SARs is disclosed only for appropriate purposes. The BSA explicitly prohibits the disclosure of a SAR, or any information that would reveal its existence, to the individual or entity that is the subject of the report. Unauthorized disclosure of a SAR, or any information indicating its presence, carries significant risks, including potentially undermining ongoing and future law enforcement investigations by alerting suspects, discouraging financial institutions from reporting suspicious activity, and even endangering those who file SARs.

However, FinCEN's implementing regulation for SAR confidentiality provides a crucial distinction. It clarifies that the prohibition on disclosing a SAR or information revealing its existence does not extend to "the underlying facts, transactions, and documents upon which a SAR is based." This specific FinCEN SAR guidance is critical for financial institutions seeking to balance their obligation to maintain confidentiality with the need for effective customer communication. It creates a pathway for financial institutions to engage with customers about suspicious activities without violating the core confidentiality mandate.

Given this regulatory distinction, the BSA and its implementing regulations do not prevent banks and credit unions from communicating with a customer, or other individuals who are the subject of a SAR, or with third parties, including other financial institutions. These communications can pertain to potentially fraudulent or other suspicious transactions involving the customer's account. Financial institutions are also permitted to inform customers of their intention to close an account due to potentially fraudulent or suspicious activity.

The critical condition for such communication is that it must not reveal the existence of a SAR. This means that financial institutions can discuss the underlying facts, transactions, and documents upon which a SAR is based. For instance, communication can include specific factual information related to transactions, such as transaction dates, amounts, and the parties involved. This clarification on underlying facts SAR disclosure empowers financial institutions to conduct necessary fraud communication and manage customer relations more effectively, ensuring that customers can receive explanations for account actions without compromising the integrity of SAR filings.

Compliance officers and legal counsel for financial institutions should review this joint statement to understand the clarified boundaries for communicating with customers about suspicious activity or account closures. It provides guidance on how to disclose underlying facts without violating SAR confidentiality, thereby managing fraud investigations and customer relations more effectively.

Source: Original guidance from federal financial regulators and FinCEN