On September 2, the OCC, the Fed, the FDIC, FinCEN, and the NCUA issued a joint statement clarifying that the BSA’s SAR confidentiality requirements do not prohibit banks and credit unions from communicating with customers about potentially fraudulent transactions, other suspicious activity, or account closures, which may be necessary in order to provide customers with transparent and timely information regarding their accounts or the bank’s internal fraud investigation, provided that the communication does not reveal the existence of a SAR or information that would reveal its existence. The statement, issued in response to concerns raised in a June 2025 request for information on payments fraud, noted that while the BSA prohibits the disclosure of a SAR or information that would reveal its existence, it does not prohibit the disclosure of the underlying facts, transactions, and documents upon which a SAR is based. The agencies stated that factual information related to transactions — including transaction dates, amounts, and parties — may be discussed so long as the communication does not reveal the existence of a SAR, even if a “reasonable and prudent person” familiar with SAR filing requirements might suspect or deduce that a SAR was or may have been filed.

The joint statement provided a non-exhaustive list of communications that would not typically reveal the existence of a SAR, including: (i) requesting customer due diligence information; (ii) notifying a customer of a delay or restriction on an account related to suspected fraud; (iii) notifying a customer that a deposit has been rejected because of suspected fraud; (iv) asking a customer about the purpose of a transaction or source of funds; (v) providing warnings about fraud schemes or money mule typologies; and (vi) communicating decisions related to account maintenance such as declining a transaction or closing an account.