On September 2, 2026, FinCEN, together with the Federal Reserve, FDIC, NCUA, and OCC, issued a joint statement to clarify that confidentiality requirements related to Suspicious Activity Reports (SARs) do not preclude banks from communicating with their customers regarding potentially fraudulent transactions and other suspicious activity or account closures. The statement does not alter existing Bank Secrecy Act (BSA) legal or regulatory requirements or establish new supervisory expectations.
The joint statement clarifies how banks can ensure compliance with SAR confidentiality requirements and provide customers with transparent and timely communication as part of the bank’s fraud investigation. Key clarifications include the following:
The BSA prohibits financial institutions from disclosing a SAR, or information that would reveal that a SAR has been filed, to a customer or other person who is the subject of the SAR.
SAR confidentiality does not prohibit institutions from discussing the underlying facts, transactions, and documents on which a SAR is based, including transaction dates, amounts, parties, and other relevant details;
Banks and credit unions may communicate with customers or third parties about potentially fraudulent or suspicious transactions, provided the communication does not reveal the existence of a SAR;
Institutions may notify customers that an account or service is being delayed, restricted, or closed because of suspected fraud or other suspicious activity, without disclosing that a SAR was filed;
Institutions may ask customers about the purpose of a transaction, source of funds, or the originator or beneficiary of a funds transfer as part of their normal due diligence or transaction review;
Institutions may warn customers about fraud schemes and typologies, including money mule schemes, even when the warning relates to circumstances underlying suspicious activity;
Institutions can request customer information and documentation needed to understand the nature and purpose of a relationship and develop a customer risk profile, even when the relationship involves suspicious activity; and
Institutions should take care when communicating about suspicious activity and ensure that discussions of the underlying facts do not inadvertently disclose the existence of a SAR.
FinCEN’s press release can be found here.
The full statement can be found here.