On September 2, 2026, the Federal Reserve, FDIC, NCUA, OCC, and FinCEN issued a joint statement clarifying SAR confidentiality requirements when communicating with customers regarding potentially fraudulent transactions, other suspicious activity, or account closures. The agencies emphasized that while the Bank Secrecy Act prohibits the disclosure of a SAR or information that would reveal the existence of a SAR, banks may communicate with customers about suspicious or potentially fraudulent activity and may notify customers of account closure decisions, provided the communication does not reveal that a SAR has or has not been filed. A practical takeaway is that banks may discuss the underlying facts, transactions, or account restrictions with customers. Still, it should avoid communications that directly or indirectly reveal whether or not a SAR has been filed.

CCI recommends reviewing fraud investigation and account closure procedures to ensure employees understand how to communicate with customers without disclosing the existence of a SAR. The agencies noted that these situations should be evaluated on a case-by-case basis and handled carefully to avoid revealing SAR-related information.

This statement does not change existing SAR confidentiality requirements. SAR information may be shared internally with directors, officers, employees, and agents who have a legitimate business need to know the information to carry out their responsibilities. Access should be limited to those with a business need to know.

Boards of directors remain responsible for BSA oversight and should receive information necessary to fulfill those responsibilities. As a governance practice, many institutions provide SAR trend information, filing statistics, significant activity summaries, or similar reporting to the board or a designated committee to support BSA oversight activities. Board minutes should document oversight activities but generally should not include SAR narratives or information that could unnecessarily expand access to SAR-related information.

You can read the Joint Statement here.

CCI suggests sharing this update with your institution’s BSA Officer, Fraud Management Personnel, Operations Management, and employees involved in fraud investigations or account closures. If you have questions about this information, contact us at inquiries@completecompli.com.

Sarah Smith, CRCM, CAFP