In 2025, the Federal Reserve, FDIC, National Credit Union Administration, and Office of the Comptroller of the Currency issued a joint statement. It clarifies that you can contact customers involved in suspicious activity without violating Bank Secrecy Act (BSA) confidentiality requirements. The key is discussing the underlying facts, transactions, and documents without revealing that you filed a Suspicious Activity Report (SAR).
This isn't new law. It's a regulatory clarification of what the BSA has always permitted, prompted by bank requests for guidance on handling fraud investigations while meeting confidentiality obligations.
Clarifying the Rules
The statement addresses a longstanding issue. The BSA prohibits disclosing a SAR or information that would reveal its existence. However, it allows banks to discuss "underlying facts, transactions, and documents upon which a SAR is based."
Banks sought clarity on this when investigating fraud. The agencies responded: talking to customers about suspicious transactions, requesting documentation, notifying them of account restrictions, asking about transaction purposes, or explaining account closures doesn't violate SAR confidentiality. Even if someone familiar with AML regulations could deduce that you filed a SAR, deduction isn't disclosure.
Key Insights
1. Broader Communication Scope
You can request documentation, notify customers of closures or restrictions, reject deposits with explanation, ask about transaction purposes, issue fraud advisories, and request information about transfer originators or recipients. These actions are protected as long as you don't mention the SAR itself.
2. Fact-Specific Standard
Each situation should be evaluated individually. There's no script or safe harbor language. Focus on whether your communication reveals the SAR's existence versus discussing the underlying activity that triggered your suspicion.
3. Supporting Fraud Investigations
The statement came after banks expressed the need for flexibility to investigate fraud effectively. With schemes like check fraud exploiting economic uncertainty, you need to gather information from customers quickly. Delaying communication until after account closure or restriction can slow your response and damage customer relationships.
4. Alignment with AML Overhaul
The agencies are moving toward risk-based resource allocation. A pending proposal would let you focus on higher-risk customers and activities while maintaining internal controls, independent testing, a U.S.-based AML officer, and ongoing training. This statement removes perceived barriers to practical fraud investigation.
5. Documentation Standards Remain
You still need to document your SAR filing decision and maintain confidentiality of the SAR itself. What's changed is your ability to communicate about the underlying activity during your investigation, not your obligation to protect the SAR filing from disclosure.
Implications for Your Team
Your fraud investigation and customer communication protocols need updating. Many compliance teams assumed that any contact with a customer about suspicious activity risks SAR confidentiality violations. That assumption was too conservative. Now you have explicit regulatory backing to adjust your approach.
This is crucial when investigating potential fraud rings, structuring patterns, or account takeover attempts where customer cooperation accelerates your analysis. You can ask about a wire transfer's purpose or request documentation about a check deposit without waiting for account closure, gathering intelligence faster and potentially stopping ongoing fraud.
The clarification also affects your account closure process. You've probably closed accounts with minimal explanation to avoid SAR disclosure concerns. Now you can explain that you're closing the account due to suspicious transaction patterns, provide specific examples of the concerning activity, and request information to complete your investigation, all without mentioning the SAR.
For your fraud operations team, this means you can involve customers earlier in your investigation workflow. If you see a pattern suggesting the customer is a fraud victim rather than a perpetrator, you can alert them and request information without waiting for the SAR filing to complete. This is particularly valuable for elder fraud, romance scams, and business email compromise where victim notification can stop additional losses.
Action Items by Priority
Immediate (this quarter):
Review your customer communication templates for fraud investigations and account closures. Identify where you've been overly restrictive due to SAR confidentiality concerns. Draft new templates that discuss underlying facts and transactions without referencing SAR filings.
Update your compliance training to reflect this guidance. Your frontline fraud investigators and account management teams need to understand the distinction between discussing underlying activity and revealing a SAR's existence.
Near-term (next two quarters):
Revise your fraud investigation workflow to incorporate earlier customer contact. Map out decision points where customer information would accelerate your analysis and build those touchpoints into your standard process.
Document your approach to fact-specific analysis. Create guidelines for your team on evaluating whether a particular communication crosses the line from discussing underlying facts to revealing SAR existence. Include examples of protected and prohibited communications.
Ongoing:
Monitor how this guidance affects your fraud detection outcomes. Track whether earlier customer contact improves your investigation speed, reduces false positives, or helps you identify fraud patterns faster. Adjust your workflows based on what you learn.
Stay current on the broader AML regulatory overhaul. The pending proposal on risk-based resource allocation will affect how you prioritize investigations and allocate compliance resources. This SAR communication guidance is one piece of a larger shift toward operational flexibility.
