SAR Confidentiality Under the BSA: What You Can Tell Customers

Scope - What This Guide Covers

This guide addresses the Bank Secrecy Act's confidentiality provisions as they apply to Suspicious Activity Reports (SARs) filed by financial institutions. It's for compliance officers, BSA officers, and legal teams who need to understand when they can discuss SARs with the customers who are the subjects of those reports.

A recent statement from U.S. financial regulators clarifies that the BSA doesn't prevent financial institutions from discussing certain aspects with customers who are SAR subjects. This guide explains what that means for your disclosure decisions, customer communication protocols, and compliance program documentation.

Key Concepts and Definitions

Bank Secrecy Act (BSA): The federal anti-money laundering law requiring financial institutions to assist government agencies in detecting and preventing money laundering. Administered by FinCEN, the BSA establishes reporting requirements including SARs.

Suspicious Activity Report (SAR): A regulatory filing required when a financial institution detects transactions that may indicate money laundering, fraud, terrorist financing, or other criminal activity. Filed through FinCEN's BSA E-Filing System.

SAR Subject: The individual or entity whose activity is being reported. This differs from the SAR filer (the institution submitting the report).

Confidentiality Provisions: BSA regulations at 31 CFR § 1020.320(e) restrict unauthorized disclosure of SAR filings. These provisions prohibit disclosing that a SAR has been filed, but they don't create a blanket prohibition on discussing the underlying suspicious activity.

Requirements Breakdown

What the BSA Actually Prohibits

The confidentiality rule prevents you from disclosing "the fact that a SAR has been filed." This means:

• You can't tell a customer "We filed a SAR about your transactions."
• You can't reference the SAR filing in account closure letters.
• You can't use SAR-filing as justification when explaining account decisions to customers.

What the BSA Does Not Prohibit

The regulatory clarification confirms you can:

• Discuss the underlying suspicious activity patterns you observed.
• Explain why certain transactions raised concerns under your transaction monitoring program.
• Describe the account review process that led to relationship termination.
• Answer customer questions about why their account was frozen or closed.

The distinction matters: you're prohibited from referencing the regulatory filing itself, not from discussing the facts that prompted it.

Documentation Requirements

Your BSA compliance program should document:

• Customer communication protocols that avoid SAR-filing disclosure.
• Training materials explaining the confidentiality boundary.
• Scripts or templates for discussing suspicious activity without referencing SARs.
• Escalation procedures when customers specifically ask about regulatory filings.

Implementation Guidance

Designing Customer Communication Protocols

When discussing suspicious activity with a customer, focus on observable facts:

Instead of: "We're closing your account because we filed a SAR."

Use: "Our transaction monitoring identified patterns inconsistent with the stated business purpose of your account. After review, we've determined we can't continue the banking relationship."

You're describing what you observed and what decision you made based on your risk assessment. You're not referencing the regulatory filing.

Training Your Customer-Facing Teams

Your front-line staff need clear guidance on this boundary. Consider a scenario where a customer whose account was closed demands to know why. Your representative should be trained to:

1. Acknowledge the customer's frustration.
2. Explain that the decision resulted from a risk-based review.
3. Reference observable transaction patterns if appropriate.
4. Avoid any mention of SARs, regulatory filings, or government reporting.

Document these scenarios in your training materials with approved response language.

Integrating With Your AML Program

Your AML compliance program likely already includes procedures for account monitoring, investigation, and decision-making separate from SAR filing. The regulatory clarification reinforces that these are distinct processes:

• Transaction monitoring flags unusual activity.
• Investigation determines whether the activity has a legitimate explanation.
• Risk-based decision-making leads to account actions (closure, enhanced due diligence, transaction restrictions).
• SAR filing occurs as a separate regulatory obligation.

You can discuss the first three steps. You can't discuss the fourth.

Coordination With Legal Counsel

Your legal team should review customer communication templates to ensure they don't inadvertently disclose SAR filings. Pay particular attention to:

• Account closure letters.
• Responses to customer complaints.
• Discovery responses in litigation.
• Regulatory examination documentation.

Common Pitfalls

Pitfall 1: Assuming All Suspicious Activity Is Confidential

Some compliance teams interpret the SAR confidentiality rule as prohibiting any discussion of suspicious activity. This overcorrection damages customer relationships unnecessarily. You can discuss the facts; you just can't reference the regulatory filing.

Pitfall 2: Using SAR-Filing as Decision Justification

Don't structure your account closure decisions around "we filed a SAR, therefore we're closing the account." Structure them around "our risk assessment identified concerns we can't mitigate, therefore we're closing the account." The SAR filing is a regulatory obligation, not a business decision driver.

Pitfall 3: Inconsistent Application Across Channels

If your branch staff can discuss suspicious activity patterns but your call center representatives refuse to engage, you've created an inconsistent customer experience. Ensure all customer-facing teams understand the same boundaries.

Pitfall 4: Inadequate Documentation of Non-SAR Rationale

When you close an account based on suspicious activity, document your risk-based reasoning independent of the SAR filing. If the customer challenges the closure, you need to demonstrate a legitimate business rationale that doesn't reference regulatory reporting.

Quick Reference Table

Your compliance program should treat this clarification as an opportunity to improve customer transparency while maintaining regulatory obligations. The boundary is clear: discuss the facts, not the filing.