FINCEN BREAKS SAR SILENCE: US BANKS CLEARED TO WARN CUSTOMERS ABOUT FRAUD

A long-standing compliance dilemma for US banks has been clarified after the Financial Crimes Enforcement Network, FinCEN, and the country’s major federal banking regulators confirmed that Suspicious Activity Report, SAR, confidentiality rules do not prevent banks from communicating with customers about potentially fraudulent transactions, suspicious activity or account closures.

In a joint statement issued on September 2, 2026, FinCEN, the Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration and Office of the Comptroller of the Currency said financial institutions can provide customers with transparent and timely information during fraud investigations without breaching SAR confidentiality requirements.

The clarification addresses a practical problem that has complicated fraud investigations. Financial institutions have often had to navigate a narrow line between protecting confidential SAR information and explaining to customers why a transaction has been blocked, an account restricted or a relationship terminated.

The regulators have now made clear that the confidentiality requirement attaches to the SAR itself and information that would reveal its existence. It does not prevent institutions from discussing the underlying facts of a transaction or suspected fraud, provided the communication does not disclose that a SAR has been filed or may be filed.

That means banks can discuss potentially fraudulent transactions with customers, seek information about the purpose of transactions or source of funds, request supporting documentation and warn customers about fraud schemes, including potential money mule activity.

Institutions can also explain that an account restriction, rejected transaction or account closure is connected to suspected fraud or other suspicious activity, subject to a case-by-case assessment designed to ensure that SAR confidentiality is preserved.

The significance for fraud and financial crime teams is considerable. The clarification removes uncertainty that could previously discourage frontline teams from engaging customers while an investigation was under way.

It also creates a clearer distinction between communicating about suspicious activity and disclosing a SAR. Banks remain prohibited from telling a person involved in a suspicious transaction that the transaction has been reported. That core confidentiality obligation remains intact.

FinCEN stressed that the joint statement does not change existing Bank Secrecy Act requirements or establish new supervisory expectations. Instead, it clarifies how institutions can comply with existing SAR confidentiality rules while communicating more effectively with customers.

For compliance departments, the message is straightforward. SAR confidentiality should not become a barrier to effective fraud intervention. Banks can investigate, challenge transactions, obtain additional information and protect customers while maintaining the statutory firewall around SAR reporting.

The development also comes against a broader effort by US regulators to make financial crime compliance more focused on outcomes rather than procedural exercises. FinCEN has previously moved to clarify SAR requirements so institutions can direct resources towards information that is more valuable to law enforcement and national security agencies.

Compliance takeaway

The regulatory clarification should prompt banks to review their fraud investigation scripts, customer communication protocols and account closure procedures. The key control is not silence. It is precision.

Customer facing teams need clear guidance on what can be disclosed about a suspicious transaction, what must remain confidential and how to explain restrictions or closures without inadvertently revealing the existence of a SAR.

For financial institutions outside the United States, the principle is equally relevant. Strong financial crime controls must balance confidentiality with effective customer communication. Overly restrictive interpretations can slow fraud response, while careless disclosures can compromise investigations and breach reporting obligations.