You've just filed a Suspicious Activity Report (SAR) on a customer account showing signs of structuring. The next morning, that same customer calls asking why their wire transfer was delayed. Can you tell them? Should you? Until recently, most BSA officers would hang up and say nothing, fearing any discussion would violate SAR confidentiality rules.
The Federal Reserve, FDIC, OCC, and NCUA have clarified this situation. Their joint statement explains that you can discuss the underlying facts, transactions, and documents that prompted your SAR without disclosing the SAR's existence. This isn't a new rule, but an interpretation of existing Bank Secrecy Act requirements. It fundamentally shifts how you can manage fraud investigations and high-risk customer relationships.
Here's how to decide when and how to communicate.
The Decision You're Facing
After filing a SAR, you need to decide whether to contact the customer about the suspicious activity. Your choice affects fraud recovery speed, customer retention, regulatory risk, and investigative integrity. The wrong move could expose you to BSA violations or let fraud continue unchecked.
This decision isn't binary. You're choosing between three operational paths, each with distinct triggers and risk profiles.
Key Factors That Affect Your Choice
Nature of the suspicious activity. Is this potential fraud against the customer (unauthorized transactions, account takeover) or fraud by the customer (check kiting, structuring, Professional Money Laundering)? Victim-based fraud often requires immediate customer contact. Perpetrator-based schemes demand silence.
Immediate harm or loss. Can customer communication stop ongoing fraud or recover funds? If a wire transfer is still reversible or a check hasn't cleared, speed matters more than confidentiality concerns.
Regulatory disclosure requirements. Some communications are already mandated. Regulation E requires you to notify customers of unauthorized electronic fund transfers. Regulation CC governs hold notices on deposited checks. These obligations don't disappear because you filed a SAR.
Investigation status. Are law enforcement or other agencies actively investigating? Coordination with external investigators may limit what you can disclose, even if the BSA technically allows it.
Customer sophistication. As the interagency statement notes, "a reasonable and prudent person familiar with the Suspicious Activity Report requirement may suspect or be able to deduce" that a SAR was filed based on your questions. That deduction doesn't violate confidentiality, but it does shape how the conversation unfolds.
Path A: Communicate Actively About Underlying Facts
Choose this path when:
- The customer appears to be a fraud victim, not a perpetrator
- You need documentation or clarification to complete your investigation
- You're closing the account or restricting services based on suspicious activity
- You're rejecting deposits, blocking transactions, or imposing holds
- You're issuing a fraud advisory or requesting information about transaction counterparties
What you can say:
You may discuss the specific transactions, ask about the purpose of transfers, request supporting documentation, and explain why you're taking protective action. You can say, "We noticed three wire transfers totaling $47,000 sent to overseas accounts in the past week. Can you provide invoices or contracts supporting these payments?" You cannot say, "We filed a Suspicious Activity Report on your account."
Operational requirements:
Document every customer interaction in your case file. Script your initial outreach to avoid accidentally referencing the SAR. Train frontline staff on the distinction between discussing facts (permitted) and revealing the SAR's existence (prohibited). If the customer asks directly whether you filed a SAR, your response is, "I can't discuss whether a SAR has been filed, but I can explain the transactions we're reviewing."
Risk profile:
Low BSA violation risk if you stick to underlying facts. Moderate tipping off risk if your phrasing is too specific. The customer will likely deduce that something formal happened, but deduction isn't disclosure.
Path B: Maintain Silence and Monitor
Choose this path when:
- The customer appears to be directing or benefiting from the suspicious activity
- Law enforcement has requested you not contact the subject
- The activity involves professional money laundering or organized schemes where customer contact would compromise an investigation
- You're filing a Continuing Activity SAR and the pattern is ongoing
- The suspicious activity is subtle enough that customer contact would educate the perpetrator about your detection methods
What you do instead:
Escalate to your MLRO if the activity continues. Coordinate with law enforcement if they're involved. Enhance transaction monitoring rules to capture similar patterns. Consider account closure without detailed explanation if the relationship is no longer tenable, but recognize that abrupt closure without communication may trigger customer complaints or legal action.
Operational requirements:
Your silence must be defensible. If the customer later claims you should have warned them about fraud, your case file needs to show why communication would have undermined the investigation. This path requires stronger documentation of your decision-making rationale.
Risk profile:
High customer relationship risk. Moderate litigation risk if the customer suffers losses you could have prevented. Low BSA violation risk, but you're not using the flexibility the regulators just granted you.
Path C: Hybrid Approach With Controlled Disclosure
Choose this path when:
- You need to close the account but want to preserve the customer relationship if they can explain the activity
- The suspicious activity is ambiguous, you filed the SAR out of abundance of caution, and customer input might clarify legitimate business purposes
- You're dealing with a long-term customer whose recent behavior is inconsistent with their historical profile
How it works:
Reach out with specific, fact-based questions. Frame your inquiry as routine account review or enhanced due diligence. If the customer provides documentation that resolves your concerns, you've improved your Customer Risk Profile without compromising the SAR. If they can't explain the activity, you proceed to account closure or further restrictions.
Example approach:
"As part of our periodic review process, we're updating documentation for business accounts with international wire activity. Can you provide updated beneficial ownership information and invoices for your recent transfers to [jurisdiction]?" This is a legitimate enhanced due diligence request. It doesn't reference the SAR, but it gathers information that may resolve your suspicion or confirm it.
Risk profile:
Moderate across all dimensions. You're balancing investigative needs against relationship preservation. Requires experienced judgment to execute properly.
Summary Matrix
| Factor | Path A: Communicate | Path B: Silence | Path C: Hybrid |
|---|---|---|---|
| Customer role | Likely victim | Likely perpetrator | Ambiguous |
| Urgency | High (ongoing fraud) | Low (historical pattern) | Medium (clarification needed) |
| Law enforcement involvement | None or cooperative | Active investigation | None |
| Communication content | Specific transaction questions, fraud warnings, account restrictions | None | Enhanced due diligence requests |
| BSA risk | Low (if you avoid SAR reference) | Low | Low to moderate |
| Customer relationship impact | Neutral to positive | Negative | Neutral |
The interagency statement doesn't require you to contact customers after filing a SAR. It permits you to do so when operationally necessary. Your decision should be fact-specific, documented, and aligned with whether communication advances or undermines your investigation. The flexibility is real, but it's not a mandate to change your entire fraud response protocol.
If your current practice is to file and stay silent, revisit that default. You may be missing opportunities to stop fraud faster, gather better evidence, and preserve legitimate customer relationships. But if you're investigating structured transactions or suspected money laundering, silence remains your strongest tool.
The line is clearer than it was. You can discuss what happened without disclosing what you filed. Use that clarity to make better decisions, not just different ones.
