SAR confidentiality, and where a SAR's existence leaks in bank records

A Suspicious Activity Report, and any information that would reveal that one exists, is confidential under the Bank Secrecy Act. A bank that is subpoenaed or otherwise asked for either must decline, cite the rule and tell FinCEN about the request. The facts, transactions and documents behind a SAR aren't confidential, so a bank can still produce the account statement or the wire record, as long as nothing on it shows that a SAR was filed.

The line is clear in the rule. In real records it runs through the middle of a page, where a margin note, a case-system comment or a file name can give the SAR away.

What the rule protects, and what it doesn't

The bank rule is 31 CFR 1020.320(e), which carries out 31 U.S.C. 5318(g)(2). FinCEN's 2010 final rule explains where the line falls.

Information	Confidential?
The SAR itself	Yes
A document stating that a SAR was filed, or that one wasn't	Yes
Material prepared to detect and report suspicious activity, such as drafts and case memos	Yes, in appropriate circumstances, whether or not a SAR was filed
Account statements, wire records and other business records the SAR is based on	No
A fraudulent check, or a cash log showing a clear pattern of structured deposits	No, even if it suggests a SAR is likely
Statistics and general discussion of suspicious activity	Generally not

Business records can go out for any purpose, FinCEN says, provided no one involved in the transaction is notified and nothing in them reveals a SAR. They may be discoverable in civil litigation; documents that show a SAR exists are not.

Who may be told, and who may not

The rule allows a short list of disclosures, all on the condition that no one involved in the transaction learns of the report:

FinCEN, law enforcement and examiners. Federal, state and local law enforcement, and the federal and state regulators that examine the bank for Bank Secrecy Act compliance.
Another financial institution, for a joint SAR. The underlying facts and documents may be shared to prepare one.
The bank's own organization. Under FinCEN's 2010 guidance, a U.S. bank may share a SAR with its controlling company, and a U.S. branch of a foreign bank with its head office. Affiliates may receive one only if they are subject to a SAR rule themselves, and may not pass it to affiliates of their own.
Employment references. A written reference requested by another financial institution, or a termination notice under securities or futures industry rules, may include the underlying information, but the statute forbids saying that it was in a SAR or that one was filed.

Everyone else gets a refusal. A bank asked for a SAR, or for anything that would reveal one, must decline, citing the rule and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and its response. The OCC, Federal Reserve, FDIC and NCUA rules add notice to the regulator.

The duty doesn't end with employment: the statute also covers former directors, officers, employees and contractors. The rule binds a bank's agents too, and FinCEN's final rule reminds institutions that they remain responsible, through reasonable controls or agreements, for SAR confidentiality at auditors, outside counsel and other service providers. FinCEN's SAR rules for broker-dealers, money services businesses, casinos, insurers and other institutions carry a matching confidentiality paragraph.

Where SAR references leak in produced records

The SAR itself sits in the BSA team's files and rarely goes out by mistake. The references to it are another matter. Every system and person that worked the case leaves a trace, and those traces sit in the files that discovery, an audit or a buyer's due diligence reaches.

Case notes and alert reviews

Monitoring alerts are reviewed, escalated and closed with a note: "Alert 88213 escalated; SAR filed 4/2/2026, see case 2026-117." An export from the case system puts that note beside the transactions that triggered it. A note reading "no SAR warranted" is confidential too, because FinCEN treats a statement that no SAR was filed the same way.

Email threads

Investigators ask the relationship manager about the customer, and the replies carry the answer: "BSA is filing on the Lindqvists, don't mention it to them." In a production of the relationship manager's mailbox, that line reveals the SAR even when every attachment is a producible statement.

Annotated statements and scanned copies

An investigator prints a statement, circles the cash deposits and writes "SAR 4/2" in the margin. The statement is a business record; the annotated copy, scanned into the case file, reveals the filing. The note is handwriting in an image, so a text search of the production never finds it.

Account closure memos and letters

A memo recommending closure may give the reason: "Exit relationship following SAR filing." The letter to the customer can't say so, and the memo can't go out with the account file.

Board and committee reports

The banking agencies' rules require management to notify the board, or a designated committee, of SAR filings. FinCEN's final rule cautions banks about producing board minutes and similar records, since a subpoena for them can reach those summaries. A count of SARs filed in a quarter is one thing; a list naming the subjects is another.

File names, folders and properties

A file named SAR_support_Lindqvist_2026-117.pdf reveals the filing before anyone opens it. So do folder paths in a load file, document titles, author fields and comments. The rule requires a bank to identify supporting documentation and keep it as such, so these labels are all over a BSA team's files.

A checklist before records leave the bank

No SAR, draft or filing decision is in the set, unless it's going to FinCEN, law enforcement or an examiner.
Case-system notes and alert reviews are out, including ones that say no SAR was filed.
Email threads have been read for mentions of a SAR, a filing or the BSA team's decision.
Scanned and annotated copies have been read by OCR and checked by a person for handwritten notes.
Board and committee materials name no SAR subjects.
File names, folder paths, document properties and comments carry no SAR labels.
Statements and wire records go out as business records, with only the references removed.
Redacted text is removed, not covered.
Any request for a SAR has been declined, and FinCEN and the bank's regulator told.

Where DocArmor fits

DocArmor's Financial Identifiers (PCI / GLBA) template already finds account holders' names, account and loan numbers, balances and income. A plain-English instruction such as "remove any mention of a SAR, its filing or a decision not to file" adds what a production needs. OCR reads scanned pages, handwritten notes included, and every finding goes to a reviewer before export, because whether a case note reveals a SAR or only describes a transaction is a judgment a person has to make. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped.

This post is general information about the Bank Secrecy Act's SAR rules, not legal advice. Check the SAR rule for your type of institution and your regulator's own rule, and take questions about a specific request to counsel or to FinCEN.

Frequently asked questions

Can a bank produce SAR supporting documents in discovery?

Generally yes, if they are business records created in the ordinary course, such as account statements and wire records. FinCEN treats the facts, transactions and documents a SAR is based on as outside its confidentiality rule, and courts have ordered them produced. What must be withheld is anything that would reveal the SAR exists, such as the report, drafts of it and notes about the filing.

Can a bank tell a customer a SAR was filed on them?

No. The Bank Secrecy Act bars a bank and its current and former directors, officers, employees, agents and contractors from telling anyone involved in a reported transaction that it was reported, or revealing information that would show it. That includes indirect signals, such as a closure letter that cites the filing.

What should a bank do if it is subpoenaed for a SAR?

Decline to produce the SAR or any information that would reveal it, citing 31 CFR 1020.320(e) and 31 U.S.C. 5318(g)(2)(A)(i), and notify FinCEN of the request and the response. The banking agencies' own SAR rules also require notice to the bank's regulator. Business records responsive to the subpoena can still be produced, as long as they don't reveal the SAR.

Can a bank share a SAR with its parent company?

Yes. Under guidance from FinCEN and the federal banking agencies, a U.S. bank may share a SAR with its controlling company, in the U.S. or abroad, and a U.S. branch of a foreign bank may share one with its head office. A bank may also share a SAR with an affiliate that is itself subject to a SAR rule, but the affiliate may not pass it on, and a U.S. bank's foreign branches don't qualify.