Can a Bank Disclose Customer Information to Third Parties?

Yes, a bank can disclose customer information to third parties, and it happens routinely. Federal law, principally the Gramm-Leach-Bliley Act (GLBA), sets the rules: some sharing you can block by opting out, some you cannot block but the bank must disclose in advance, and some disclosures are mandatory to the government regardless of what you want. Knowing which category a given disclosure falls into is how you figure out what control you actually have.

What Information Is Protected

The GLBA protects “nonpublic personal information,” or NPI. This is personally identifiable financial information that is not publicly available and that a bank collects while providing you a financial product or service.¹

NPI covers three kinds of data. Information you hand over to open an account or apply for a product, like your name, address, Social Security number, and income. Information generated by your account activity: account numbers, payment history, card purchases, and loan balances. And information the bank pulls about you from outside sources, such as data from a credit report.²

One boundary matters up front. The GLBA protects individuals who use financial products for personal, family, or household purposes. Business accounts fall outside these privacy protections, and that includes sole proprietors’ business banking.² If you run a small business, your bank has significantly more freedom to share information about those accounts.

Sharing You Can Block

Every bank must send you a privacy notice describing what NPI it collects, the categories of third parties it shares with, and how it protects the data. A bank that hasn’t changed its sharing practices and only shares data as permitted by law is not required to send the notice every year.³

The notice also explains your opt-out rights. If your bank plans to share NPI with unaffiliated third parties for purposes like marketing, you can tell it not to. You must be given a reasonable window before any sharing begins, generally at least 30 days, through methods like a reply form, a toll-free number, or an online portal.²

Two details are easy to miss. Your opt-out stays in effect after you close the account, until you cancel it in writing or electronically. But if you open a new account with the same bank later, you have to opt out again for that new relationship.² And the opt-out reaches only unaffiliated companies. Sharing within the bank’s own corporate family runs on a separate set of rules.

One thing banks can’t do, opt-out or not: share your account numbers, credit card numbers, or access codes with unaffiliated third parties for use in telemarketing, direct mail, or email marketing. That’s flatly prohibited.⁴

Your own actions can also open the door. Telling your bank to send statements to your mortgage lender is explicit consent. Opening a joint account carries implicit consent that all account holders can see the account.

Sharing You Can’t Block

Several kinds of sharing are simply built into how banking works. The bank must disclose that it does them, but you don’t get to say no.

Service Providers

Banks contract with outside companies to print checks, process data, and mail statements. A bank can share NPI with these vendors so long as its privacy notice discloses the practice and it has a contract requiring the vendor to keep the data confidential and use it only for the assigned purpose.¹

Joint Marketing Partners

A bank can share NPI with another financial company to jointly offer a product, like a co-branded credit card. No opt-out is required, but there must be a written contract restricting the partner’s use of the data to the joint arrangement.⁵

Credit Bureaus

Banks report your loan, credit card, and line-of-credit activity to Equifax, Experian, and TransUnion. That includes payment history, balances, and credit limits.⁶ The Fair Credit Reporting Act requires the reporting be accurate, and you can dispute errors.⁷

Sharing With the Government

Some disclosures are mandatory, and your consent is irrelevant.

Court Orders, Subpoenas, and Warrants

When a bank receives a valid court order, subpoena, or search warrant, it has to comply. The legal duty to respond overrides its privacy obligations. For most administrative subpoenas and formal written requests, the government must notify you first under the Right to Financial Privacy Act (see below).

Currency Transaction Reports

The Bank Secrecy Act requires banks to file a Currency Transaction Report with the Financial Crimes Enforcement Network for every cash transaction over $10,000, whether it’s a deposit, withdrawal, or currency exchange.⁸ The bank doesn’t ask you and doesn’t have to tell you the report was filed.

Suspicious Activity Reports

If a bank suspects a transaction involves money laundering, fraud, or other illegal activity, it files a Suspicious Activity Report (SAR) with FinCEN. Federal law prohibits the bank from telling you a SAR has been filed. No bank employee, officer, or contractor may reveal it, and no government employee who learns of it may either.⁹ If your account is frozen or closed and the bank won’t say why, a SAR is often the reason. The bank is legally barred from confirming that.

IRS Reporting

Banks report interest income of $10 or more to the IRS on Form 1099-INT.¹⁰ You get a copy, but the data goes to the IRS whether you like it or not.¹¹

Sharing Within the Bank’s Corporate Family

The GLBA opt-out covers unaffiliated companies. Sharing between a bank and its own affiliates, such as an in-house brokerage or insurance arm, runs under the Fair Credit Reporting Act instead.

Affiliates can generally share information with each other for everyday business. But when an affiliate wants to use certain data about you, specifically information bearing on your creditworthiness, credit standing, or financial capacity, to send you marketing offers, an additional protection applies. Before using that “eligibility information” for marketing, the affiliate has to clearly disclose the practice, give you a simple way to opt out, and honor your opt-out.¹²

Exceptions exist. The affiliate marketing opt-out doesn’t apply if the affiliate already has a pre-existing business relationship with you, if you started the communication, or if you specifically authorized the solicitations.¹² So if your bank’s investment affiliate already manages your IRA, it can market other products to you without triggering the opt-out.

How to Fight a Government Request

The Right to Financial Privacy Act (RFPA) gives you a process to challenge federal agency access to your bank records. For most requests, including administrative subpoenas, judicial subpoenas, and formal written requests, the government must notify you before accessing the records.¹³

Once notified, you have 10 days from the date of service (or 14 days from mailing) to file a motion to quash or an application to block the request. Your filing needs a sworn statement explaining why the records aren’t relevant to a legitimate law enforcement inquiry or why the government failed to follow proper procedure. The court then orders the government to respond, and the matter must be decided within seven calendar days of that response.¹³

The government can ask a court to delay notice to you for up to 90 days if early notice would endanger someone, prompt flight, lead to destruction of evidence, or seriously jeopardize an investigation.¹⁴ Search warrants can also proceed with delayed notice on the same standard. In those cases your records may already have been reviewed by the time you find out, and the RFPA challenge process is the sole judicial remedy.¹³

When a Breach Exposes Your Information

Federal banking regulators require banks to have response programs for unauthorized access to customer data. If a bank finds that someone has gained unauthorized access to sensitive information, such as your name paired with your Social Security number, account number, or login credentials, it must investigate promptly and figure out whether misuse has happened or is reasonably possible. If misuse is likely, the bank must notify you as soon as possible.¹⁵

Law enforcement can ask the bank to hold off on customer notice if it would interfere with a criminal investigation.¹⁵ Many states also have their own breach notification laws with stricter timelines. The GLBA acts as a federal floor, so states can layer additional protections on top of it, and the notification rules that apply to you depend partly on where you live.

If You Think Your Bank Disclosed Improperly

Start with the bank. Contact customer service or the privacy officer, describe what you think happened, and ask for an explanation. Many complaints turn out to involve routine sharing that was in the privacy notice all along, and a direct conversation resolves them.

If that doesn’t fix it, file a complaint with the Consumer Financial Protection Bureau through its website.¹⁶ The CFPB forwards the complaint to the bank, which generally responds within 15 days, with up to 60 days on more complex matters. You then have 60 days to review the response and provide feedback.¹⁷

If none of that resolves the issue, an attorney who handles consumer financial privacy can evaluate whether the bank’s conduct violated the GLBA or another law. Because state laws may go further than the federal floor, someone familiar with your state’s privacy framework can identify remedies federal law alone wouldn’t provide.

1
FDIC. VIII-1 Gramm-Leach-Bliley Act (Privacy of Consumer Financial Information)
2
Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
3
eCFR. 12 CFR 1016.5 – Annual Privacy Notice Requirement for Institutions That Do Not Disclose
4
eCFR. 12 CFR 1016.12 – Limits on Sharing Account Number Information for Marketing Purposes
5
eCFR. 16 CFR 313.13 – Exception to Opt Out Requirements for Service Providers and Joint Marketing
6
OCC (Office of the Comptroller of the Currency). Credit Reporting
7
Consumer Financial Protection Bureau. List of Consumer Reporting Companies
8
FFIEC BSA/AML Manual. Assessing Compliance with BSA Regulatory Requirements – Currency Transaction Reporting
9
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
10
Internal Revenue Service. About Form 1099-INT, Interest Income
11
Internal Revenue Service. Topic No. 403, Interest Received
12
eCFR. 16 CFR 680.21 – Affiliate Marketing Opt-Out and Exceptions
13
Office of the Law Revision Counsel. 12 USC Chapter 35 – Right to Financial Privacy
14
Federal Reserve. Right to Financial Privacy Act – Compliance Handbook
15
Board of Governors of the Federal Reserve System. Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice
16
Consumer Financial Protection Bureau. Submit a Complaint
17
Consumer Financial Protection Bureau. Learn How the Complaint Process Works