On September 2, 2026, Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Financial Crimes Enforcement Network (FinCEN) issued a joint statement clarifying Suspicious Activity Report (SAR) confidentiality rules under the Bank Secrecy Act (BSA). The statement confirms that banks and credit unions (financial institutions) may discuss the underlying facts of suspicious or fraudulent account activity with customers and third parties, including notifying customers that their accounts are being closed due to such activity. Institutions must not, however, reveal the existence of a SAR. The statement does not introduce new legal or regulatory requirements or create new supervisory expectations. Rather, it provides additional guidance for customer-facing fraud communications, an area where many institutions have historically been overly restrictive out of caution around SAR confidentiality.
Key Legal Clarification
Under the BSA, financial institutions are prohibited from disclosing a SAR or any information that would reveal its existence. This rule safeguards law enforcement investigations, prevents tipping off potential suspects, and encourages the filing of SARs. However, the BSA expressly states that SAR confidentiality does not prohibit the disclosure of the underlying facts, transactions, and documents on which a SAR is based. The joint statement reinforces this point, confirming that institutions may discuss transaction-level details with customers and third parties, including dates, amounts, and parties involved, without violating SAR confidentiality, provided the communication does not reveal the existence of a SAR.
Notably, even if a reasonable and prudent person familiar with the SAR filing requirement could suspect or deduce that a SAR was or may have been filed, the underlying information alone does not constitute a disclosure of the SAR’s existence. The test is whether the communication directly reveals the SAR’s existence, not whether someone could infer it.
In practice, the joint statement offers guidance on the types of communications that fall within this framework. The following are examples of communications that would not typically reveal the existence of a SAR:
- Informing a customer that a delay, restriction, or account closure is related to suspected fraud or suspicious activity.
- Notifying a customer that a deposit was rejected due to suspected fraud, such as altered or counterfeit checks.
- Explaining account-related decisions, such as declining a transaction or closing an account, without referencing SAR filings.
These examples illustrate the types of customer communications that institutions can make while maintaining SAR confidentiality.
Broader Implications of the Joint Statement
The joint statement responds in part to feedback received in connection with a June 20, 2025, request for information issued by the Federal Reserve, FDIC, and OCC on payments fraud, with a particular focus on check fraud. Commenters sought guidance on how to balance transparency with SAR confidentiality during fraud investigations that could result in account closures. The statement also addresses concerns reflected in Executive Order 14331, “Guaranteeing Fair Banking for All Americans,” which focuses on ensuring fair access to financial services. By promoting transparency in account-related decisions, the statement aims to bolster customer confidence and connect SAR confidentiality guidance to the broader “debanking” and fair-access debate, particularly the concern that institutions may terminate customer relationships based on political, social, or religious views, or involvement in lawful but disfavored activities.
What This Means for You
The joint statement provides financial institutions with additional guidance for communicating with customers about suspected fraud, account restrictions, declined transactions, rejected deposits, and account closures. Although the statement imposes no new supervisory requirements, institutions should expect continued regulatory scrutiny of account actions that lack a clearly documented basis, particularly given the current administration’s focus on “debanking.”
Institutions should evaluate customer communications on a case-by-case basis and take precautions to avoid inadvertently revealing the existence of a SAR. This includes carefully framing discussions about suspicious transactions, remediation efforts, and steps customers can take to address issues. Institutions may share the underlying facts and rationale for account decisions with customers, even if the customer could infer that a SAR may have been filed, so long as the communication does not disclose or confirm the SAR’s existence.
To align with this guidance, institutions should review their policies and customer communications to ensure they are not overly restrictive. Key steps include:
- Reviewing SAR confidentiality, fraud-response, account-restriction, and account-closure policies to confirm they do not unnecessarily prohibit factual customer communications;
- Revising notices, scripts, and escalation procedures to allow clear explanations based on documented facts while avoiding references to SARs, SAR filings, or internal SAR processes;
- Ensuring the factual basis for account decisions is documented independently of any SAR so that customer-facing explanations can be supported without relying on SAR-related information; and
- Training frontline, fraud, BSA/AML, and legal or compliance personnel on permissible communications and when proposed disclosures should be escalated for review.
Contact Us
If you have questions on how the SAR clarifications will impact your organization, please contact Leslie Sowers, Max Earp-Thomas, Shelby Lomax, or your Husch Blackwell attorney.