A Working Test for Customer Conversations

The joint statement on Suspicious Activity Report (SAR) confidentiality and 31 CFR § 1020.320 establish a useful judgment problem: a bank may need to make suspicious activity understandable without telling the customer that a transaction was reported. This checkpoint connects the protected reporting event, the underlying facts, and the reporting lifecycle into one test for a proposed exchange. The practical result is not a script; it is a way to decide what a conversation is about, what it implies, and where the supplied authorities leave the answer dependent on context.

The test begins with a distinction already visible in the altered-check example. A customer may need to know why a deposit is delayed, what information the bank needs, or what steps can reduce the risk of fraud. Those are questions about an account event and an operational response. They are different from the question of whether a SAR exists or whether the transaction was reported. The confidentiality rule protects the second question even when the first must be discussed.

Start with the subject of the conversation

The first task is classification. A proposed statement usually has a subject, even if the speaker does not name it explicitly. Is the bank describing an underlying transaction? Is it explaining an operational decision? Is it asking for information that could clarify the activity? Or is it communicating something about the existence or status of a SAR?

An underlying fact is something about what happened or what evidence the bank is examining. The regulation identifies underlying facts, transactions, and documents as a category distinct from the SAR. The joint statement gives familiar examples: transaction dates, amounts, and parties, along with the concerns raised by potentially fraudulent or suspicious activity. A question about the source of funds or the purpose of a transfer is directed toward that factual layer. So is a request for information about the originator or beneficiary of a funds transfer.

An operational explanation concerns what the institution is doing in response. The agencies say a bank or credit union may discuss remediation efforts and potential mitigation steps, and their examples include communicating policies or decisions about account maintenance or services. A notice that a deposit has been rejected because of suspected fraud, or that a delay, limitation, restriction, or closure may relate to suspected fraud or other suspicious activity, is described as a type of communication that would not typically reveal a SAR’s existence.

A reporting-event statement is different. It tells the recipient that the bank filed a SAR, that the transaction was reported, or that information being discussed is being disclosed because of a report. The regulation prohibits disclosure of a SAR and information that would reveal its existence, except through authorized routes. It also says that the underlying-facts provision must not be construed to notify a person involved in a reported suspicious transaction that the transaction has been reported.

The classification is useful because one message can contain more than one layer. Suppose the bank says, “The check deposited on Tuesday is being held because we have concerns about possible alteration.” The statement identifies a transaction, a concern, and an operational action. It does not necessarily address whether a SAR exists. If the bank adds, “We filed a SAR about that check,” the message changes category. It now identifies the protected reporting event. The difference is not that one message contains facts and the other does not.