The SAR Confidentiality Rule: What Fintechs Must Know

The SAR confidentiality rule is one of the most strictly enforced and most operationally important compliance requirements associated with Suspicious Activity Report filing. Violating it is a separate federal offense — independent of any other BSA violation — and it creates significant operational training requirements for every fintech with SAR filing obligations.

What the SAR Confidentiality Rule Says

Federal law — specifically 31 U.S.C. § 5318(g)(2) — prohibits any covered financial institution or any director, officer, employee, or agent of a covered institution from notifying any person involved in a transaction that a SAR has been filed with respect to the transaction, or that a SAR is being considered.

The prohibition has two components. It covers both actual SAR filings and contemplated filings — the prohibition applies from the moment a SAR filing is under consideration, not just after it is submitted.

It applies to everyone in the organization — not just compliance staff. A customer service representative, an operations analyst, a product manager, or a founder who discloses SAR information is personally violating federal law.

What "Tipping Off" Means

"Tipping off" is the informal term for the conduct prohibited by the SAR confidentiality rule. It refers to any disclosure — direct or indirect — to the subject of a SAR or to any related party that a SAR has been filed or is being considered.

Tipping off does not require an explicit statement. Suggesting to a customer that their account is under compliance review because of unusual activity, hinting that a report may be filed, or providing any information that would allow a customer to infer that a SAR is involved all potentially constitute tipping off.

The most common tipping off scenario in fintech involves customer service staff. When a customer contacts support about why their account has been restricted or why a transaction has been delayed, customer service staff who attempt to explain the compliance reason may inadvertently tip off the customer. The correct response is to acknowledge the restriction without providing any explanation related to a compliance investigation.

Who the Rule Applies To

The SAR confidentiality rule applies to every person in the organization — directors, officers, employees, agents, and contractors. There are no exceptions based on seniority, job function, or lack of knowledge of compliance processes.

This is why SAR confidentiality training must extend beyond the compliance team to include customer service staff, operations teams, executives, and anyone else who interacts with customers or handles compliance-related information.

Safe Harbor for Good-Faith SAR Filers

The BSA provides safe harbor protections for financial institutions and their personnel who file SARs in good faith. The safe harbor protects filers from civil liability for the SAR filing itself — you cannot be sued by the subject of a SAR for filing one in good faith.

Importantly, the safe harbor does not protect against criminal liability for violations of the SAR confidentiality rule. Tipping off remains a federal offense even if the underlying SAR was filed in good faith.

Consequences of Violating the SAR Confidentiality Rule

Violations of the SAR confidentiality rule are criminal offenses. The statute provides for criminal penalties including fines and imprisonment for knowing violations. Civil penalties may also apply.

In practice, tipping off creates specific risks beyond the formal legal exposure. It can alert subjects to destroy evidence or move assets, compromising law enforcement investigations. It can expose the institution to liability if the tipping off led to concrete harm. And it creates a significant examination finding demonstrating that the institution's SAR program is not properly controlled.

How to Train Your Team

Every employee who might encounter a customer question about account restrictions, transaction delays, or compliance holds needs to be trained on the SAR confidentiality rule. The training should cover what the rule prohibits, the specific language to use when a customer asks about compliance-related account actions — acknowledging the issue without explaining the compliance reason — and how to escalate customer inquiries that touch on compliance matters to the compliance team.

Frequently Asked Questions

Can we tell a customer their account is restricted without explaining why?

Yes. You can acknowledge that an account has a restriction and that you are unable to provide further information about the reason. You cannot confirm or deny that a SAR is involved. Training staff on this specific language is one of the most important operational steps in building a SAR compliance program.

Does the confidentiality rule apply to law enforcement requests?

The SAR confidentiality rule includes an exception allowing disclosure to law enforcement agencies in response to an appropriate legal request. Institutions should have defined procedures for responding to law enforcement requests and should consult legal counsel when such requests arrive.

How ComplyOne Helps

ComplyOne helps fintechs build SAR programs that include proper confidentiality training and operational procedures — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.