What you can tell a customer about fraud without breaching SAR confidentiality

On 2 September 2026 the Federal Reserve, the FDIC, FinCEN, the NCUA and the OCC put out a joint statement on SAR confidentiality and talking to customers. It's short, and it doesn't change anything on paper. The agencies say so directly: "This statement does not alter existing Bank Secrecy Act (BSA) legal or regulatory requirements" or "establish new supervisory expectations."

So why write about it? Because the confusion it addresses is real. Plenty of tellers and call-centre staff have been trained to say nothing at all once fraud comes up, in case they tip someone off. Customers whose card gets blocked or whose deposit gets bounced then hear a script that explains nothing, and they leave angry.

What stays off limits

The line hasn't moved. An institution can't disclose "a SAR or information that would reveal the existence of a SAR." And the statute, 31 U.S.C. § 5318(g)(2), bars notifying "any person involved in the transaction that the transaction has been reported."

The statement points to the confidentiality rule for each regulator: 31 CFR 1020.320(e) at FinCEN, 12 CFR 208.62(j) at the Fed, 12 CFR part 353 at the FDIC, 12 CFR 748.1(d) at the NCUA, and 12 CFR 21.11(k) and 163.180(d) at the OCC. None of them changes.

What the agencies say is usually fine

The useful part is a list of things that are "typically not prohibited." Paraphrased, they are:

• asking for customer due diligence information to understand a relationship and build a risk profile
• telling a customer that a delay, limit or restriction on an account, or a closure, "may be related to suspected fraud or other suspicious activity"
• telling a customer a deposit was rejected for suspected fraud, for example "altered or counterfeit checks"
• "Asking a customer about the purpose of a transaction or the source of funds"
• warning customers about fraud schemes, including "money mule" schemes, whether the customer is a victim or taking part "knowingly or unknowingly"
• explaining decisions on account services, such as declining a transaction or closing an account
• "Requesting information on the originator or beneficiary of a funds transfer"

The statement also covers the facts underneath. Staff can discuss the dates, amounts and parties to a transaction. The agencies accept that a customer might guess a report was filed from those facts, but say the facts alone don't reveal that a SAR exists. They still expect each conversation to be judged case by case.

Who it reaches

Every bank and credit union that files SARs, which is all of them. The NCUA signed it, so credit unions can rely on it as much as banks can.

What it could mean

We think the main job here is rewriting scripts, not procedures. If your branch and call-centre guidance says "we can't discuss why your account was restricted," it's stricter than the agencies now say it needs to be. A better line tells the customer their account was limited because of suspected fraud, tells them what you need from them, and stops there.

Our guess is this will matter most for elder fraud and scam victims. A customer who is being coached by a scammer needs to hear plainly that the bank thinks something is wrong, and the money mule bullet makes clear that warning them is allowed even when they may be part of it.

The one thing we wouldn't loosen is who can see the SAR file itself. The statement gives front-line staff more room to talk because they don't know whether a SAR was filed. Keep it that way, and keep the BSA officer's notes out of the systems tellers can see.