On September 2, 2026, the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the Office of the Comptroller of the Currency (OCC), and the Financial Crimes Enforcement Network (FinCEN) issued a Joint Statement on Suspicious Activity Report (SAR) Confidentiality Considerations Regarding Communications with Customers. The statement addresses a question that has vexed compliance teams and frontline bank personnel for years: What can a bank say to a customer when fraud is suspected, a SAR has been filed, or an account is being closed? For compliance officers, in-house counsel, and senior executives at financial institutions of all sizes, the practical significance of this guidance is straightforward, and the time to operationalize it is now.
What the Joint Statement Says and Why It Matters
The joint statement clarifies the scope of SAR confidentiality requirements under the Bank Secrecy Act (BSA), particularly as they apply to customer communications involving potentially fraudulent transactions, suspicious activity, and account closures. The five agencies make explicit what the statutory framework has always permitted: Banks and credit unions can communicate with customers about the underlying facts, transactions, and documents upon which a SAR is based, so long as that communication does not reveal the existence of a SAR itself.
This is a critical distinction. The BSA prohibits the disclosure of a SAR or information that would reveal the existence of a SAR, including to the person who is the subject of the report. Unauthorized disclosure can undermine ongoing law enforcement investigations, deter future SAR filings, and even endanger the individuals who file them. However, FinCEN’s implementing regulation at 31 C.F.R. § 1020.320(e)(1)(ii)(A)(2) expressly carves out the “underlying facts, transactions, and documents upon which a SAR is based” from the definition of what constitutes a SAR or information that would reveal its existence.
The genesis of this statement traces to a June 2025 Request for Information (RFI) issued by the Federal Reserve, FDIC, and OCC seeking input on potential actions to mitigate payments fraud, with a particular focus on check fraud. Commenters raised pointed concerns about bank personnel’s ability to communicate transparently with customers when an SAR had been filed regarding potentially fraudulent activity. The joint statement also recognizes the concerns expressed in Executive Order 14331, Guaranteeing Fair Banking for All Americans, and the final rules prohibiting federal banking agencies from requiring or encouraging institutions to terminate customer relationships based on political views, constitutionally protected speech, or involvement in lawful but disfavored business activities.
The agencies’ guidance is clear: The statement does not alter existing BSA legal or regulatory requirements or establish new supervisory expectations. It is clarification, not rulemaking. But for institutions that have erred on the side of silence — declining to tell customers virtually anything when fraud is suspected — this guidance provides a concrete framework for more transparent, customer-facing communication.
Practical Guidance for Banks: Communicating Without Tipping Off
For compliance officers and BSA/AML teams, the near-term implications are concrete. The joint statement provides a non-exhaustive list of communications that would not typically reveal the existence of a SAR, and institutions should integrate these examples into their policies, procedures, and training programs.
Banks and credit unions can, for example, request customer due diligence-related information or documentation to understand the nature and purpose of a customer relationship. They can notify a customer that a delay, limitation, restriction, or closure of an account may be related to suspected fraud or other suspicious activity. They can notify a customer that a deposit has been rejected due to suspected fraud — for example, when checks are altered or counterfeit. They can ask a customer about the purpose of a transaction or the source of funds. They can provide warnings or educational resources on fraud schemes and typologies, including situations in which a customer may unknowingly be participating in a “money mule” scheme. And they can communicate policies or decisions related to account maintenance, such as declining a transaction or closing an account.
The practical challenge has always been where, exactly, the line falls between discussing “underlying facts” and revealing the existence of a SAR. The statement acknowledges this directly: Although a reasonable and prudent person familiar with the SAR filing requirement might suspect or deduce from these underlying facts that a SAR was filed, the underlying information alone does not constitute information revealing the existence of a SAR for confidentiality purposes.
What should institutions do now? Review your current customer communication policies and procedures to ensure they reflect this clarification. Train frontline staff, branch managers, and fraud investigation teams on the distinction between permissible discussion of underlying facts and impermissible disclosure of SAR existence. Update internal scripts and communication templates for account restrictions, closures, and fraud notifications. Ensure that legal and compliance personnel are available to advise on case-by-case determinations, as the agencies recommend that banks evaluate customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR. Document your decision-making processes; while the compliance case for transparency is strong, so is the need for a well-documented trail demonstrating that each communication was evaluated for SAR confidentiality risk.
Account Closure Decisions Remain Risk-Based and Independent
One of the most significant aspects of the joint statement is what it does not change: a financial institution’s independent, risk-based authority to close or restrict customer accounts.
The statement reinforces that banks and credit unions may notify customers of their intent to close an account due to potentially fraudulent or other suspicious activity, provided the communication does not reveal the existence of a SAR. This is consistent with existing supervisory expectations and the broader regulatory framework, including the final rules implementing Executive Order 14331 that prohibit banking agencies from directing institutions to terminate customer relationships based on a person’s political views, speech, or involvement in lawful business activities.
This is a critical point. The joint statement enhances transparency around customer communication, and it does not limit an institution’s discretion to make account-level decisions based on its own risk assessment. Banks retain full authority to close accounts, decline transactions, restrict services, and manage their customer portfolios based on internal risk tolerances, suspicious activity patterns, or any other legitimate, risk-based criteria. The prohibition runs in one direction only; regulators cannot force de-banking based on disfavored but lawful activity. It does not restrict an institution from making its own independent judgment that a customer relationship presents unacceptable risk.
FinCEN’s BSA Program Reform NPRM: The Broader Compliance Landscape
The joint statement on SAR confidentiality does not exist in a vacuum. It arrives against the backdrop of the most significant proposed overhaul of BSA/AML program requirements in over two decades.
On April 7, 2026, FinCEN issued a Notice of Proposed Rulemaking (NPRM) intended to fundamentally reform financial institutions’ anti-money laundering and counter the financing of terrorism (AML/CFT) programs under the BSA. The OCC, FDIC, and NCUA issued a corresponding joint NPRM to align their supervisory frameworks with FinCEN’s proposal. Notably, the Federal Reserve did not join the banking agency NPRM. Public comments on these proposals closed on June 9, 2026.
The NPRM’s core shift is from process-driven, “check-the-box” compliance to an outcomes-based, risk-focused framework. Under the proposed rule, regulators would evaluate not just whether a financial institution has an AML/CFT program in place, as documented by written policies, a designated BSA officer, independent testing, and employee training, but whether those program components produce effective results. Risk assessment would become a formal regulatory requirement, codifying what has long been a supervisory expectation. The proposed rule would also elevate FinCEN’s role in AML/CFT supervision by introducing a notice-and-consultation framework that requires federal banking regulators to notify and consult with FinCEN before initiating significant BSA-related supervisory actions. FinCEN expressly acknowledges that no program can eliminate all illicit activity; the standard is whether the program is reasonably designed to ensure BSA compliance, mitigate actual illicit finance risks, and generate information that is highly useful to law enforcement and national security agencies.
There is a direct connection between the SAR confidentiality statement and the program reform NPRM. Both reflect a regulatory philosophy that values effectiveness and risk-based decision-making over rigid, paperwork-heavy compliance. Institutions that build robust, risk-calibrated AML/CFT programs — and communicate transparently with their customers — will be best positioned for the next chapter of BSA supervision and enforcement.
The Bottom Line
The joint agency statement provides welcome clarity on a question that has generated unnecessary confusion and overly cautious silence across the industry. Banks and credit unions can and should communicate with their customers about suspected fraud, suspicious transactions, and account actions, so long as those communications do not reveal the existence of a SAR. This guidance, paired with FinCEN’s sweeping BSA program reform proposal, signals a regulatory environment that rewards proactive, risk-based compliance programs and transparent customer engagement.
Review your SAR communication policies now. Train your teams on the permissible scope of customer communication. Document your risk-based account closure decisions. And prepare your AML/CFT program for the upcoming outcomes-focused framework. The institutions that treat this statement as an opportunity to strengthen both their compliance posture and their customer relationships will be the ones best positioned when the next examination cycle begins.