When a Bank Can Explain a Suspicious Transaction

The subject of this series is the five-agency joint statement issued on September 2, 2026, about Suspicious Activity Report (SAR) confidentiality and customer communications. This opening chapter focuses on the practical question behind that statement: how can a bank explain a potentially fraudulent transaction or an account action without revealing that a SAR exists? The answer gives readers a starting model for understanding the rule, its limits, and the judgment required in real conversations.

Imagine that a small business deposits a check and the bank detects signs that it may be altered. The bank might delay the deposit, ask where the check came from, warn the customer about a fraud pattern, or decide that the account needs a restriction. Separately, the bank may determine that the activity warrants a SAR—a confidential report used in the suspicious-activity reporting system. The customer may reasonably want to know what happened and what can be done next. The bank, however, cannot simply confirm the report or reveal information that tells the customer it was filed.

That situation can look like a choice between two bad options. Either the bank says nothing useful, leaving the customer unable to understand a rejected deposit or account restriction, or it explains too much and alerts the person involved to a protected reporting event. The joint statement says the choice is not that stark. A bank can often discuss the transaction and its concerns while protecting the existence of the SAR.

flowchart LR A["Underlying transaction and documents"] --> B["Bank investigates concern"] B --> C["Possible or filed SAR"] B --> D["Customer-facing facts and operational action"] C -. "confidentiality boundary" .-> E["Do not reveal the SAR's existence"] D --> E

The practical tension behind the statement

The Office of the Comptroller of the Currency described the joint statement as a clarification of existing confidentiality requirements. The statement was issued by the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the OCC, and the Financial Crimes Enforcement Network. It addresses communications with customers about potentially fraudulent transactions, other suspicious activity, and account closures. The OCC says the statement applies to community banks, and the statement itself discusses banks and credit unions.

That status matters. The agencies did not announce a new exception to the Bank Secrecy Act (BSA), rewrite the reporting rule, or establish new supervisory expectations. They explained how existing requirements operate in a setting where banks are expected to investigate fraud and customers reasonably expect some explanation of what is happening to their money or access to services. The statement grew out of concerns raised during work on payment fraud, including check fraud, where a bank’s investigation may lead to one or more SAR filings and a possible account closure.

The subject is therefore narrower than “bank transparency” in general. The agencies did not say that customers are entitled to every investigative record, that every account closure must be explained in full, or that a bank must keep an account open while it investigates. They clarified one important communication boundary: a bank may discuss underlying activity, but it must not reveal the existence of a SAR.

This distinction also explains why the issue matters beyond a single conversation. SAR confidentiality is intended to protect investigations, prevent potential suspects from being alerted, preserve institutions’ willingness to report suspicious activity, and protect people who file reports. At the same time, unexplained restrictions and closures can leave customers unable to distinguish a fraud concern from an ordinary service problem. The agencies’ clarification tries to preserve both interests without treating either one as absolute permission to override the other.

The two interests involve different questions. Inside the institution, investigators may be asking whether a pattern warrants a report and what records should support that decision. In the customer conversation, the immediate questions may be more concrete: Which transaction is delayed? What information does the bank need? What can the customer do to protect an account or recover from a fraud? The joint statement does not require the bank to disclose its internal reporting analysis in order to answer those practical questions. It identifies room to discuss the transaction and the response, while leaving the reporting event protected.

This is also why “possible or filed SAR” should not be read as a customer-facing status label. A bank may investigate activity before it knows what reporting action, if any, is appropriate. Later, a filing may exist, but the customer-facing distinction remains the same: the bank can address the underlying activity and its operational consequences only without revealing the report’s existence. An account delay, a request for documents, or a fraud warning may be part of sound risk management whether or not a particular communication can establish what happened internally. The authorities supplied here do not let an outside reader work backward from one of those actions to a definitive conclusion about filing.

For the customer, the practical value of a careful explanation is not merely courtesy. Specific facts can help the person locate a mistake, identify an unauthorized payment, stop sending funds to a fraudster, or provide records that clarify a legitimate transaction. For the institution, a fact-based exchange can improve the information available to the investigation and make a necessary operational decision more understandable. Those benefits do not cancel the confidentiality rule; they show why the rule preserves a category of communication instead of banning all discussion related to suspicious activity.

Two different things can be confused

A SAR is not simply another name for the transaction that caused concern. It is the reporting event and the information that identifies or reveals that event. Under the BSA and its implementing rules, a bank may not disclose a SAR or information that would reveal that a SAR exists to the customer or another person who is the subject of the report, except through authorized routes.

The implementing regulation draws a separate line around “the underlying facts, transactions, and documents upon which a SAR is based.” Those materials can include what happened in an account, when a transaction occurred, how much money was involved, who the parties were, and what records describe the activity. The joint statement relies on this distinction when it says that confidentiality does not prohibit a bank or credit union from communicating with a customer about potentially fraudulent or suspicious transactions involving the customer’s account.

Return to the altered-check example. The bank could potentially discuss the date and amount of the deposit, explain that the item raised concerns about alteration or fraud, request information about its source, and describe what mitigation steps are available. Those are statements about the transaction and the bank’s operational response. They do not automatically state that a SAR was filed.

The fact that a customer might suspect a report exists does not by itself erase the distinction. The joint statement acknowledges that a reasonable person familiar with SAR requirements may infer from the underlying facts that a SAR was or may have been filed. It nevertheless says that the underlying information alone is not information revealing the existence of a SAR for confidentiality purposes. The point is not to make the bank’s explanation deliberately vague. The point is to distinguish the activity from the protected reporting signal.

That is why the short phrase “we cannot discuss SARs” can be misleading if it is understood as “we cannot discuss the transaction.” The authorities support a more precise statement: the bank cannot reveal the report or confirm its existence, but the bank is not automatically barred from discussing the facts that led to concern. The difference is central to every application that follows.

A boundary that depends on the whole exchange

The agencies do not offer a magic sentence that makes every conversation permissible. They say banks and credit unions should consider customer communication on a case-by-case basis and take precautions when discussing information that could reveal the existence of a SAR. That instruction makes the complete exchange important.

A transaction date may be an ordinary fact. A transaction date combined with language such as “this is the transaction we reported to the government” would be something else entirely. Likewise, a bank may explain that a deposit was rejected because of suspected fraud. It may not use the explanation as a roundabout way to tell the customer that a report was filed. The concern is not limited to the acronym. A communication can reveal the protected event through its meaning, even if the speaker never says “SAR.”

Context does not mean that every customer question becomes dangerous. It means that the bank must consider what it is trying to communicate, who will receive it, and what the communication would allow that person to conclude about the reporting event. The same underlying document may be relevant to a customer explanation, an internal review, a joint filing with another institution, or an official request, but those settings are not interchangeable. Recipient and purpose become important dimensions of the analysis.

The statement gives several kinds of customer communication that would not typically reveal the existence of a SAR. They include asking for due-diligence information, asking about a transaction’s purpose or source of funds, requesting information about the originator or beneficiary of a transfer, warning about fraud schemes, and discussing policies or decisions about account services. It also includes notifying a customer that a delay, restriction, rejected deposit, or closure may relate to suspected fraud or other suspicious activity.

“Typically” does important work in that list. The examples are non-exhaustive, and the agencies pair them with case-by-case review and precautions. They are useful because they show that fact gathering, fraud education, and operational explanation are not inherently prohibited. They are not a universal script or a promise that every wording, timing, or combination of facts is safe.

The rest of this series develops that distinction from several angles. It will examine what the confidentiality rule protects and why, place the communication question within the reporting lifecycle, and apply the model to fraud investigations, rejected deposits, restrictions, and closures. It will also consider questions, documents, and warnings that can help a customer, then distinguish customer conversations from sharing with another financial institution, an authority, or an internal organizational unit.

The opening conclusion is straightforward but deliberately limited: a bank does not have to choose between confirming a SAR and saying nothing about a suspicious transaction. It can often explain observable facts and operational consequences. What it cannot do is turn that explanation into a notification that the transaction was reported or that a SAR exists. Understanding exactly where that line comes from is the next step.

References