The Case for Calibrated Transparency
The five-agency joint statement issued on September 2, 2026, answers a narrow but consequential question: how can a bank discuss suspicious activity with a customer without revealing a Suspicious Activity Report (SAR)? The final judgment of this series is that confidentiality and useful explanation are compatible when the bank keeps separate the underlying activity from the reporting event, then considers the whole exchange, its recipient, and its purpose. That model lets a reader evaluate unfamiliar conversations without mistaking an agency example for a universal safe harbor.
The distinction is easy to state and easy to lose. A customer may need to know why a check was rejected, why a transfer is delayed, what information the bank needs, or what steps could reduce the risk of fraud. The bank may also be investigating activity that could lead to a SAR, may already have filed one, or may be sharing information through an authorized reporting channel. Those facts can coexist. The customer-facing explanation must remain about what the customer is allowed to learn, not about confirming the protected reporting event.
A four-part boundary
The first part of the model is the object protected by SAR confidentiality. Under the Bank Secrecy Act and 31 CFR § 1020.320(e), a SAR and any information that would reveal its existence are confidential except as authorized. The prohibition is not limited to handing over the report. A statement can reveal the existence of a SAR through its meaning, even when the speaker avoids the acronym or describes the report indirectly.
The second part is the material that remains distinct from the report. The regulation identifies the underlying facts, transactions, and documents on which a SAR is based. The joint statement says that banks and credit unions may communicate about potentially fraudulent or suspicious transactions involving a customer’s account, including factual details such as dates, amounts, and parties, as long as the communication does not reveal the existence of a SAR. The bank can often discuss the observable event, the concern it raises, remediation, and possible mitigation.
The distinction is not between “secret information” and “everything else.” It is between two kinds of institutional knowledge. One kind concerns the transaction and the evidence: what happened, who was involved, what document is being examined, and what operational response is occurring. The other kind concerns the reporting signal: whether a SAR exists or whether a transaction was reported. The first can support a customer explanation. The second is protected from the customer or another person who is the subject of the report.
The third part is context. The agencies direct banks and credit unions to consider customer communication case by case and to take precautions when discussing information that could reveal the existence of a SAR. A transaction date may be an ordinary fact. The same date, introduced as the transaction the bank reported to the government, communicates something different. A notice that a deposit was rejected because of suspected fraud may describe an operational action. A notice that it was rejected because the bank filed a SAR would identify the reporting event.
The fourth part is recipient and purpose. The same underlying document does not carry one universal permission to disclose. A customer may receive a fact-based explanation. Another financial institution may receive underlying facts, transactions, and documents for preparation of a joint SAR, subject to the no-notification condition. FinCEN, a law-enforcement agency, or a BSA examining authority may receive a SAR or SAR-revealing information through a specified official route. Sharing within a bank’s corporate organizational structure depends on a purpose consistent with Title II of the BSA as determined by regulation or guidance. These are different routes, not interchangeable levels of openness.