Balancing Secrecy and Transparency: Interagency Clarification on Customer Fraud Communications

For decades, compliance teams at commercial banks and credit unions have navigated a painful friction point between customer relationship management and Bank Secrecy Act (BSA) compliance. When a financial institution detects suspicious wire activity or account takeover indicators, customer-facing staff need to communicate account restrictions or transaction holds. However, strict legal prohibitions against disclosing Suspicious Activity Reports (SARs)—or revealing that a SAR is under consideration—frequently resulted in banks giving opaque, frustrating answers to legitimate business clients.

On September 2, 2026, federal financial regulators released joint guidance designed to eliminate this operational ambiguity without compromising federal law enforcement secrecy.

Regulatory Background & Friction Points

The core issue stems from Section 5318(g)(2) of the Bank Secrecy Act, which imposes strict criminal and civil penalties on any institution or employee who discloses a SAR or its existence. In practice, risk managers often over-corrected by instructing client operations teams to provide zero explanation when restricting accounts associated with fraudulent activity.

Core Agency Clarifications

1. Factual Separation: The Bank Secrecy Act strictly forbids revealing the existence or narrative content of a SAR. However, regulators clarified that BSA law does not prohibit institutions from communicating the underlying facts, transactional discrepancies, unverified documentation, or security red flags that prompted internal review.
2. Transparent Adverse Action Disclosures: Banks are fully authorized to inform customers of account closures, wire rejections, or debit holds based on objective fraud triggers—such as mismatched beneficiary names or unverified IP logins—provided the communication refrains from mentioning SAR filings.
3. Case-by-Case Operational Flexibility: Regulators encouraged institutions to move away from rigid, uninformative automated disclaimers and empower trained compliance managers to handle sensitive customer inquiries with objective factual clarity.

Actionable Operational Controls

• Revise Frontline Escalation Protocols: Update customer call center scripts and relationship manager playbooks so staff understand what information can be shared during active fraud inquiries.
• Audit Communications vs. SAR Files: Conduct periodic quality assurance reviews to verify that customer explanation letters remain completely decoupled from confidential SAR files in core banking systems.
• Integrate Real-Time Fraud & AML Systems: Ensure case management platforms automatically tag client-facing factual notes separately from SAR filing notes.