Regulators clarify what FIs can tell customers about SARs.

Federal regulators say financial institutions can explain suspected fraud and account restrictions without violating suspicious activity report confidentiality, as long as they do not disclose the existence of a SAR.

Federal banking and financial-crime regulators issued new guidance this week clarifying a longstanding tension in fraud investigations: Banks and credit unions generally cannot tell customers or members that a Suspicious Activity Report has been filed, but they can explain the underlying transactions and why an account may be restricted or closed.

The joint statement from the Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency and Financial Crimes Enforcement Network does not change existing law or create new supervisory expectations. Instead, the agencies said they were responding to questions about how financial institutions can communicate with customers while complying with SAR confidentiality rules.

The guidance could be particularly relevant as banks and credit unions confront payment fraud, including check fraud, and increasingly need to explain why transactions are delayed, rejected or investigated.

The issue arose after the Federal Reserve, FDIC and OCC sought public comment in June 2025 on ways to help consumers, businesses and financial institutions combat payments fraud. Commenters asked regulators to clarify what employees could tell customers or members when a potentially fraudulent transaction might result in a SAR filing or account closure.

The regulators’ answer preserves the central confidentiality rule: A bank or credit union cannot disclose a SAR, or information that would reveal that a SAR exists, to the customer or member who is the subject of the report.

That protection is intended to prevent financial institutions from alerting potential suspects, compromising law enforcement investigations or discouraging institutions from filing reports.

But the agencies emphasized an important distinction. The facts underlying a SAR are not themselves confidential in the same way.

Banks and credit unions may discuss transaction dates, amounts and parties involved, as long as they do not communicate that a SAR was filed or otherwise reveal its existence. They may also discuss concerns about potentially fraudulent activity, explain remediation efforts and tell customers or members what they can do to address the issue.

Story continued below…

Among the communications the agencies said would generally not be prohibited are requests for information about the purpose of an account or transaction, questions about the source of funds, warnings about fraud schemes and explanations that an account restriction or closure may be related to suspected fraud or other suspicious activity.

Banks and credit unions may also tell customers or members that a deposit was rejected because of suspected fraud, including an altered or counterfeit check.

The agencies said institutions should approach these conversations on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR.

For example, a bank or credit union could ask why a customer made a particular transaction or where the money came from. It could also explain that a transaction has been delayed or declined because of fraud concerns.

What it cannot do is tell the customer or member that a SAR was filed, or provide information that directly reveals that fact.

The regulators also addressed fraud warnings and customer education. Financial institutions may warn customers and members about known fraud schemes, including so-called money mule arrangements, even when the person may unknowingly be involved in one.

The guidance comes as regulators seek to balance two competing needs: preserving the effectiveness of the SAR system while allowing banks and credit unions to communicate more clearly with the people whose accounts they oversee.

SAR confidentiality has long been a core part of the Bank Secrecy Act framework. But uncertainty around customer communications can create practical problems when an institution is investigating suspicious activity while also explaining what a customer or member should expect.

The agencies said the statement is intended to improve transparency around actions affecting accounts while preserving the confidentiality requirement.

The NCUA’s inclusion is particularly relevant for credit unions because the guidance expressly covers them alongside banks. Credit unions can discuss underlying transactions and potential fraud concerns with members, provided those conversations do not reveal a SAR’s existence.

The agencies’ message is ultimately a narrow one: Confidentiality does not mean silence.

Banks and credit unions still have to protect SAR information, but they do not have to hide the underlying facts from customers or members. They can explain what happened, ask questions, discuss potential fraud and outline possible account actions.

For financial institutions dealing with increasingly complicated fraud cases, the distinction gives employees more room to communicate while keeping the SAR itself behind the legal wall.