SAR Confidentiality: What Staff Can and Cannot Disclose

10/12/2026

Most SAR confidentiality failures are not leaks of the report itself. Nobody photocopies a SAR and hands it to a customer. What actually happens is smaller and more human: a teller tells a regular customer that "compliance flagged your deposits," a branch manager tells a business owner the account is being closed "because of a report we had to file," or a loan officer mentions to a colleague at another bank that a mutual customer "has a SAR on him." Each of those sentences reveals the existence of a SAR, and each one is a violation.

This guide is written for the people most likely to say one of those sentences without realizing it: frontline and operations staff. It explains what the prohibition covers, the narrow list of people who may see a SAR or learn of one, the difference between the SAR and the facts underneath it, how section 314(b) sharing fits in, and what to actually say when a customer asks why something is happening.

The rule in one sentence

For banks, the rule is in 31 CFR 1020.320(e): a SAR, and any information that would reveal the existence of a SAR, are confidential and may not be disclosed except as the regulation authorizes. The banking agencies carry parallel provisions in their own SAR rules (for national banks, 12 CFR 21.11(k)), and the statutory source is 31 U.S.C. 5318(g)(2).

Two things in that sentence matter more than anything else.

It covers information that would reveal a SAR, not just the form. You do not have to show anyone the report to violate the rule. Confirming that a report was filed, hinting that one was, or saying something from which a listener could fairly conclude one exists all fall inside it.

It applies to every director, officer, employee and agent. The prohibition is personal as well as institutional. The regulation names the bank and "any director, officer, employee, or agent of any bank." A contractor working on the bank's monitoring system is inside the rule just as much as the BSA officer.

FinCEN has also made clear that confidentiality runs in both directions. In its 2010 rule on SAR confidentiality, FinCEN said institutions should also protect documents stating that a SAR has not been filed, because if a bank could freely disclose non-filings, the gaps would reveal the filings. FinCEN's 2025 cross-border sharing guidance restates the point: the BSA prohibits disclosing information that would reveal "the existence or non-existence of a SAR." So "don't worry, we didn't file anything on you" is also off-limits.

Who may see a SAR or learn that one exists

The regulation allows disclosure of the SAR itself, or information revealing its existence, to a short list of recipients, provided no person involved in the reported activity is notified:

FinCEN
Federal, state or local law enforcement agencies
The federal regulator that examines the bank for BSA compliance, and state regulators administering a state law that requires or authorizes BSA compliance oversight
Within the bank's corporate organizational structure, for purposes consistent with the BSA, as determined by regulation or guidance

That last category is where most of the practical questions sit, and FinCEN has addressed it in guidance rather than in the regulation text.

Inside your own bank

Sharing within the bank is permitted for BSA purposes, which in practice means on a need-to-know basis. The BSA officer, investigators, the SAR decision committee, internal audit testing the SAR process, and the board or the board committee designated to receive SAR notifications all have a legitimate reason to know. Management is in fact required to tell the board: the OCC rule, for example, requires management to promptly notify the board of directors, or a designated committee, whenever the bank files a SAR. If the suspect is a director or executive officer, the bank may not notify that person and must notify the directors who are not suspects.

The teller who made the referral is a harder case, and banks handle it differently. Many institutions deliberately do not tell the referring employee whether a SAR was filed. The employee needs to know the referral was received and that they should keep escalating anything new, not how the case ended. Telling them adds one more person who knows, and frontline staff are the people closest to the customer.

Head offices and controlling companies

A 2006 interagency guidance document from FinCEN and the federal banking agencies permits a U.S. branch or agency of a foreign bank to share a SAR with its head office outside the United States, and permits a U.S. bank to share a SAR with its controlling company, whether domestic or foreign. The purpose is to let the parent discharge its oversight responsibilities, including enterprise-wide risk management. The bank must have written confidentiality agreements or arrangements in place, and the head office or controlling company must protect the SAR.

Affiliates

FinCEN guidance issued in November 2010 (FIN-2010-G006) allows a depository institution to share a SAR with U.S. affiliates that are themselves subject to a SAR rule, under policies that protect confidentiality. Two limits catch people out. First, foreign branches of U.S. banks are treated as foreign banks for BSA purposes and cannot receive SARs under this guidance. Second, an affiliate that receives a SAR may not pass it on to an affiliate of its own.

FinCEN's April 2026 proposed AML/CFT program rule states that it would not change the existing rules and guidance that generally prohibit sharing SARs with personnel located outside the United States, other than in limited circumstances such as sharing with a foreign head office or controlling company. A separate pilot program for sharing SARs with foreign branches, subsidiaries and affiliates was proposed by FinCEN in 2022 under the Anti-Money Laundering Act of 2020. Check FinCEN's website for its current status before relying on it.

The SAR versus the facts underneath it

This is the distinction that unlocks most practical questions. The regulation prohibits disclosing the SAR and information revealing its existence. It expressly does not prohibit disclosing "the underlying facts, transactions, and documents upon which a SAR is based," including to another financial institution preparing a joint SAR, and in certain employment references and termination notices to the extent 31 U.S.C. 5318(g)(2)(B) allows.

FinCEN's guidance FIN-2025-G001, issued September 5, 2025, spelled this out with examples. Information that would not typically reveal a SAR includes:

Wire and payment details: counterparties, amounts, account numbers, dates and times
Cash deposit and withdrawal records, monetary instrument logs, deposit and withdrawal slips
Customer and beneficial ownership information, the products a customer uses, the business type the customer described, and stated occupation, source of funds and source of wealth

The guidance acknowledges that someone familiar with SAR rules might deduce from those facts that a SAR was filed, and says that the underlying information alone still does not count as information revealing a SAR. It also warns that when sharing, banks must take appropriate measures, such as redaction, to make sure nothing that would reveal a SAR goes along with it. A transaction export that includes an internal column labeled "SAR filed: Y" is no longer just underlying facts.

For staff, the translation is simple. Customer records are customer records. A subpoena or a legitimate request for account statements gets account statements. What never travels with them is the SAR, the SAR decision memo, the case file labeled as a SAR investigation, or a sentence that says a report was filed.

Subpoenas, lawsuits and outside requests

The regulation tells banks exactly what to do when someone asks for a SAR or information revealing one: decline to produce it, cite 31 CFR 1020.320(e) and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and the response. National banks must also notify the OCC's Litigation Division under 12 CFR 21.11(k); other charters should check their own agency's rule.

Requests come from more directions than staff expect:

Civil litigation. A party to a divorce, a business dispute or a lawsuit against the bank subpoenas "all reports filed regarding" the customer.
The customer's lawyer asking whether the bank has "reported" the client.
Auditors and consultants doing due diligence on an acquisition, or vendors who want sample case files for a system implementation.
Other banks asking informally whether you have "had problems" with a customer.

The safe pattern is the same in every case: route the request to the BSA officer or legal, produce ordinary business records where the law requires it, and never confirm or deny a SAR. Staff should not try to judge whether a request is legitimate. Their job is to recognize it and hand it off.

The safe harbor, and what it does not do

The safe harbor in 31 U.S.C. 5318(g)(3), reflected in 31 CFR 1020.320(f), protects a bank and its directors, officers, employees and agents from liability to any person for making a disclosure of a possible violation to a government agency, including a SAR, and for failing to notify the person named in it. It is the reason a customer cannot successfully sue the bank or the analyst for filing a SAR that turned out to be unfounded.

Staff need to understand two limits:

The safe harbor protects reporting to the government, not talking to the customer. Telling a customer about a SAR is not protected. It is the violation.
It is not permission to file defensively. The safe harbor means a good-faith filing on genuine suspicion is protected. It does not make SARs a substitute for investigation.

Section 314(b): sharing information without sharing the SAR

Section 314(b) of the USA PATRIOT Act, implemented at 31 CFR 1010.540, lets eligible financial institutions share information with each other about individuals, entities, organizations and countries to identify and, where appropriate, report possible terrorist activity or money laundering, with a safe harbor from liability for the sharing.

The conditions are specific:

The institution files a notice with FinCEN. Each notice is effective for one year, so the registration must be renewed to keep sharing.
Before sharing, take reasonable steps to confirm the other institution is also registered, for example by checking FinCEN's list of participants.
Limit use and protect the information. Shared information may be used only to identify and report money laundering or terrorist activity, to decide whether to open or keep an account or conduct a transaction, or to help comply with BSA requirements. Each participant must keep procedures to protect its security and confidentiality.

FinCEN's updated Section 314(b) Fact Sheet, issued June 12, 2026, replaced the December 2020 version and made several points that matter to frontline fraud and deposit operations teams:

Fraud counts. Fraud offenses are specified unlawful activities for money laundering purposes, so information about suspected fraud and scams can be shared under the safe harbor, without first identifying specific laundered proceeds.
Sharing can be in real time, verbally, in writing or through electronic platforms.
Attempted transactions, and attempts to recruit others into transactions such as money mule schemes, can be shared.
Registration and the participant directory now run through FinCEN's Financial Industry Portal.

And the point that matters most for this article: section 314(b) does not authorize sharing a SAR or revealing that one exists. The fact sheet says so directly. Two 314(b) participants may share the facts behind a case, and if they decide to file a joint SAR they may discuss it and share its contents between themselves. Outside a joint filing, a call to another bank sounds like "we are seeing these wires from your customer to this beneficiary and would like to compare notes," never "we filed a SAR on this person."

Who at your bank may make those calls is a policy decision. FinCEN requires at least one registered point of contact and allows other employees to participate under the institution's policies. Most banks keep 314(b) contact with the BSA or fraud team rather than branch staff, which is the sensible default.

What frontline staff should actually say

Most confidentiality training fails because it stops at "don't tell the customer." Staff then improvise when a customer asks a direct question, and improvisation is where disclosures happen. Give them language.

Situation	Avoid	Use instead
Customer asks why a deposit is being reviewed	"Compliance flagged it." / "We have to report this."	"We review transactions as part of our normal account procedures."
Customer asks if they have been "reported"	Any yes, no or hint	"I can't discuss internal reviews. Is there something about your account I can help with?"
Account is being closed	"Because of the report."	"The bank has made a decision on the relationship. Here is what happens to your balance."
Colleague at another bank asks about a mutual customer	"Yes, we have a SAR on him."	Refer the caller to your BSA team, which can use 314(b) if both banks are registered.
Customer reduces a cash deposit after asking about reporting	Explaining how to stay under the threshold	Complete the transaction as presented and escalate it internally.

Two notes on that table. First, the CTR is not confidential in the way a SAR is. Staff may explain that cash transactions over $10,000 are reported, and that explanation is often what prompts the customer to split the deposit, which is itself the reason to escalate. Our guide to currency transaction reports covers that side. Second, staff should never tell a customer that their questions or behavior will be escalated. Escalate quietly and keep serving the customer normally.

Where SAR files live

Physical and system controls are half of confidentiality. The regulation requires the bank to keep a copy of each SAR and the original or business-record equivalent of supporting documentation for five years from filing, and says supporting documentation is "deemed to have been filed with the SAR." That deeming clause is why the supporting file deserves the same protection as the report itself.

Practical controls examiners look for:

SARs and investigation files stored separately from the customer's ordinary account file, with access limited to named roles
Case management notes that do not leak into systems frontline staff can see, such as comment fields in the core system or CRM
Account-closing letters and internal memos reviewed for SAR references before they go out
E-filing access restricted to people who need it, and removed promptly when staff change roles
A log of subpoenas and outside requests for SARs, with the FinCEN notification recorded

The last line of defense is training. The SARs and Information Sharing course is built around exactly this combination of suspicious activity reporting and information sharing, and the suspicious activity reporting training page lists related options.

Building it into the program

Confidentiality is not a separate policy. It belongs in the SAR procedures, the 314(b) procedures, the subpoena response procedure and the training plan. A short checklist for the BSA officer:

Procedures name who may know about a SAR, by role, and say that referring employees are not told outcomes unless policy says otherwise
The subpoena procedure covers SAR requests explicitly, including the FinCEN notification and any agency notification your charter requires
Head office, controlling company and affiliate sharing, if used, is documented with the written arrangements the guidance expects
The 314(b) registration is current, renewed before the one-year notice lapses, with named contacts and a verification step
Frontline training includes scripts for customer questions, not just the rule
Account-closure and adverse-action templates are reviewed so they never cite a report

The BSA officer responsibilities guide covers where these sit in the officer's wider role, and the step-by-step guide on how to file a SAR covers the filing process this confidentiality protects.

Train the people closest to the customer

The employees most likely to breach SAR confidentiality are the ones with the least formal BSA training and the most customer contact. Give tellers, personal bankers and branch managers the rule, the reasons and the scripts, and test them on scenarios rather than definitions. The SARs and Information Sharing course is the natural starting point for staff who need both halves of this topic: when activity is reported, and what may and may not be shared afterward.

Frequently Asked Questions

Can I tell a customer that their account was reported?

No. Telling a customer that a SAR was filed, or saying anything that would reveal one exists, is prohibited under 31 CFR 1020.320(e) and the parallel banking agency rules. The prohibition covers hints and implications as well as direct statements. You can tell a customer that the bank reviews transactions as part of normal procedures, and you can answer ordinary account questions. If the customer presses, decline to discuss internal reviews and refer the matter to your BSA officer. Never confirm that no report was filed either, because denials reveal information too.

Can a bank share a SAR with another bank?

Generally no. A SAR may be shared with FinCEN, law enforcement and the bank's BSA examiners, and within the bank's own organization for BSA purposes. Two institutions can share the underlying facts and documents, and they can discuss a joint SAR they are preparing or have filed together. Section 314(b) lets registered institutions share information about suspected money laundering, terrorist financing and fraud under a safe harbor, but FinCEN's 314(b) Fact Sheet states plainly that 314(b) does not authorize sharing SARs or revealing their existence.

What is 314(b) information sharing?

Section 314(b) of the USA PATRIOT Act, implemented at 31 CFR 1010.540, allows financial institutions that register with FinCEN to share information with each other to identify and report possible money laundering or terrorist activity, with protection from liability for the sharing. Registration lasts one year and must be renewed. Before sharing, the bank must verify the other institution is registered. Shared information may be used only for the purposes the rule lists and must be protected. FinCEN's June 2026 fact sheet confirms fraud information qualifies and that sharing can happen in real time.

What should we do if we receive a subpoena for a SAR?

Decline to produce the SAR or any information that would reveal its existence, cite 31 CFR 1020.320(e) and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and your response. National banks must also notify the OCC's Litigation Division; other charters should check their regulator's rule. The underlying business records, such as statements and transaction records, may still have to be produced if the subpoena is otherwise valid. Route every such request through the BSA officer or legal counsel rather than handling it at the branch.

Does the SAR safe harbor protect employees personally?

Yes. The safe harbor in 31 U.S.C. 5318(g)(3), reflected in 31 CFR 1020.320(f), protects the bank and its directors, officers, employees and agents from liability to any person for disclosing a possible violation to a government agency, including through a SAR, and for not notifying the person named. It protects reporting to the government. It does not protect telling the customer or anyone else about the SAR, which remains a violation of the confidentiality rule.

Should the employee who referred the activity be told whether a SAR was filed?

The regulation does not require it, and many banks choose not to. Internal sharing is permitted for BSA purposes, so the question is whether the referring employee has a real need to know. Usually they do not. They need confirmation that the referral was received and an instruction to keep escalating anything new. Limiting knowledge of outcomes to the BSA team reduces the chance of an accidental disclosure by the people who see the customer most often. Whatever your bank decides, write it into the SAR procedures so it is applied consistently.