ALEXANDRIA, Va. — The National Credit Union Administration has joined with other federal financial regulators and the Financial Crimes Enforcement Network in clarifying that credit unions and banks may discuss suspected fraud and other suspicious activity with customers/members without violating Suspicious Activity Report confidentiality rules, provided they do not reveal that a SAR has been or may be filed.
NCUA, the Federal Reserve, the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency and FinCEN issued the joint statement Wednesday addressing how financial institutions can communicate with customers about potentially fraudulent transactions, other suspicious activity and account closures.
The agencies said the guidance does not change existing requirements under the Bank Secrecy Act or establish new supervisory expectations.
Regulators Clarify What Institutions Can Tell Customers
Federal law prohibits financial institutions from disclosing a SAR or information that would reveal the existence of one, including to the customer/member or other person who is the subject of the report.
The agencies stressed, however, that those confidentiality requirements do not extend to the underlying facts, transactions and documents on which a SAR is based.
That means a credit union or bank generally may discuss potentially fraudulent transactions with a customer, including transaction dates, amounts and parties involved, as long as the institution does not disclose information revealing the existence of a SAR, according to the regulators.
What FIs Can Say
Financial institutions also may tell customers/members that an account is being restricted or closed because of suspected fraud or other suspicious activity, according to the statement.
The agencies said the clarification is intended in part to address concerns raised by financial institutions about balancing SAR confidentiality requirements with the need to communicate promptly and transparently with customers during fraud investigations.
Those concerns surfaced in comments responding to a June 2025 request for information from the Fed, FDIC and OCC examining ways to help consumers, businesses and financial institutions combat payments fraud, particularly check fraud.
The statement also cited President Donald Trump’s Executive Order 14331, Guaranteeing Fair Banking for All Americans. The agencies said greater transparency surrounding actions taken on customer accounts is intended to improve customer engagement and provide greater assurance of fair access to financial services.
Agencies Provide Examples
The regulators said financial institutions should evaluate customer/member communications on a case-by-case basis and take precautions to avoid revealing the existence of a SAR.
Among the communications generally permitted under the BSA, according to the agencies, are:
- Asking customers for information or documentation needed for customer due diligence.
- Telling customers that an account or service has been delayed, limited, restricted or closed because of suspected fraud or suspicious activity.
- Informing customers that a deposit was rejected because of suspected fraud, including altered or counterfeit checks.
- Asking about the purpose of a transaction or source of funds.
- Warning customers about fraud schemes, including situations in which they may knowingly or unknowingly be serving as a “money mule.”
- Explaining decisions to decline transactions or close accounts.
- Requesting information about the originator or beneficiary of a funds transfer.
What Could be Inferred
The agencies said a customer/member familiar with SAR requirements might infer from such discussions that a SAR has been or could be filed. That inference alone does not make discussion of the underlying transaction information a violation of SAR confidentiality requirements.
The regulators said the BSA does not prevent credit unions and banks from discussing suspected fraud or suspicious transactions with customers or informing them of plans to close their accounts, as long as the institutions do not reveal the existence of a SAR.
