FinCEN Issues SAR Confidentiality Advisory

There are consequences for failing to maintain SAR confidentiality.

May 22, 2012

The Financial Crimes Enforcement Network (FinCEN) issued an advisory reminding financial institutions “and their current and former directors, officers, employees, agents, and contractors” that they’re prohibited from disclosing suspicious activity reports (SAR), or any information revealing the existence of SARs.

The consequences for failing to maintain SAR confidentiality include:

♦ Civil penalties of up to $100,000 for each violation;

♦ Criminal penalties of up to $250,000 and/or imprisonment not to exceed five years; and/or

♦ Civil penalties resulting from anti-money laundering program deficiencies (i.e., internal controls, training, etc.) leading to the SAR disclosure. Such penalties could be up to $25,000 per day for each day the violation continues.

Why the warning? An increasing number of private parties, who aren’t authorized to know about filed SARs, have been seeking SARs from financial institutions for use in civil litigation and other matters. So credit unions must be vigilant in maintaining the confidentiality of SARs.

FinCEN offers this advice:

 Inform all credit union employees, agents, and individuals appropriately entrusted with information in a SAR of their individual obligations to maintain SAR confidentiality.

♦ Regularly train staff on the importance of SAR confidentiality.

A credit union also might want to remind counsel of the strict requirements of SAR confidentiality.

♦ Consider additional risk-based measures to enhance the confidentiality of SARs, including limiting access on a “need-to-know” basis; restricting SARs viewing areas; logging access to the reports; using cover sheets for SARs or information that reveals the existence of a SAR; or providing electronic notices that highlight confidentiality concerns before a person may access or disseminate the information.

Contact FinCEN if you receive a subpoena or other requests for a SAR from anyone other than authorized government authorities (such as law enforcement agencies or regulators), or if you become aware of an unauthorized SAR disclosure.

Call the FinCEN Regulatory Helpline at 800-949-2732 with questions on the advisory (FIN-2012-A002).