In a joint statement issued by the National Credit Union Administration (NCUA), Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), Financial Crimes Enforcement Network (FinCEN), and Federal Reserve, the regulators clarified what does and does not need to remain confidential when addressing Suspicious Activity Reports (SARs). Though the statement does not alter existing Bank Secrecy Act (BSA) requirements, it does work to inform financial institutions on what they can communicate with customers with respect to potentially fraudulent activity.
Of key importance is the fact that the BSA prohibits the disclosure of a SAR, or even information that would reveal the existence of one, “including to a customer or other person who is the subject of the SAR.” This is to ensure the information revealed would not undermine ongoing law enforcement and investigations. However, it does not prohibit disclosure of the underlying “facts, transactions, and documents upon which a SAR is based.”
As such, credit unions can communicate with a member about potentially fraudulent activity or their intention to close the member’s account on suspicion of fraudulent activity, provided nothing communicated indicates a SAR has been filed. The statement does recognize that “a reasonable and prudent person familiar with the SAR filing requirement may suspect or be able to deduce from these underlying facts, transactions, and documents that a SAR was or may have been filed,” it still does not change that a credit union can communicate those underlying details.
The statement goes on to provide examples of allowable communication, such as notifying a member of account/service limitation/closure due to suspected fraud; asking a member about the purpose of a transaction; educating members on types of fraud, including those in which they may be an unwitting partner; and requesting information on the individual requesting/receiving a funds transfer.
Credit unions should still use their best judgment in deciding when to provide details or ask questions, and to take precautions to ensure the existence of a SAR is not revealed.
For the full statement, visit the NCUA website.
