Overview of the Joint Statement
On September 2, 2026, the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the Financial Crimes Enforcement Network (FinCEN), and the National Credit Union Administration (NCUA) jointly released a statement addressing confidentiality considerations surrounding Suspicious Activity Reports (SARs), particularly the communication banks have with their customers when suspicious or potentially fraudulent transactions arise.
SAR Confidentiality Requirements Under the Bank Secrecy Act
The statement reiterates that the Bank Secrecy Act strictly prohibits any disclosure of a SAR or information that directly or indirectly reveals the existence of a SAR. This longstanding confidentiality obligation is critical to protect the effectiveness of SAR filings and investigations and to ensure cooperation from financial institutions without subjecting customers or subjects to undue disclosure risks.
Permissible Customer Communications
Importantly, the joint statement clarifies that communicating with customers about the underlying facts, transactions, or documents upon which a SAR is based does not inherently violate SAR confidentiality provisions. That is, banks are not precluded from discussing factual transactional information even if related to a suspicious activity, provided that they do not reveal that a SAR has been filed or exists.
Case-by-Case Assessment and Precautions
The guidance advises banks to consider customer communications on a case-by-case basis, exercising caution to avoid inadvertently disclosing the SAR’s existence. The agencies emphasize prudence in discussing information that could implicitly indicate a SAR has been filed.
Application to Community Banks
The statement explicitly notes that these confidentiality considerations and guidance apply to all community banks, extending clarity and ensuring these institutions understand their boundaries regarding SAR-related communications.
Examples of Non-Disclosive Communications
While not exhaustive, the statement includes a list of examples where customer communication typically would not reveal the existence of a SAR. These examples provide practical reference points to assist banks in navigating permissible dialogue with customers.
Contact and Further Resources
For additional information or questions, the statement directs institutions to contact the Compliance and Operational Risk Division of the OCC. The full statement is publicly available through the OCC bulletin page and related agency communications.