Banking confidentiality rules in the United States rest on three federal statutes that pull in different directions. The Gramm-Leach-Bliley Act obligates your bank to protect and limit sharing of your personal financial information. The Right to Financial Privacy Act restricts when government agencies can look at your records. And the Bank Secrecy Act requires your bank to report certain transactions to federal authorities without telling you. Your information is confidential in most day-to-day situations, but each of these laws carves out specific exceptions, and those exceptions are where most disclosures actually happen.
What Information Your Bank Must Keep Confidential
The protected category is broad. Under the Gramm-Leach-Bliley Act, anything that qualifies as “nonpublic personal information” is covered: your name, address, Social Security number, income, account balances, transaction history, loan applications, and payment records. Even the fact that you are a customer of a particular bank is protected.1Office of the Law Revision Counsel. United States Code Title 15 Section 6802 – Obligations With Respect to Disclosures of Personal Information
The duty of confidentiality also has roots in common law and in your account agreement. Courts have long treated the bank-customer relationship as one of trust, and account contracts typically include a privacy commitment. The result is that a bank cannot release your information simply because someone asks. A specific legal basis has to apply.
Your Opt-Out Rights Under the Gramm-Leach-Bliley Act
The Gramm-Leach-Bliley Act is the primary federal law controlling how banks handle your data.2Federal Trade Commission. Gramm-Leach-Bliley Act Its Privacy Rule bars a financial institution from disclosing your nonpublic personal information to a nonaffiliated third party unless it first gives you a privacy notice and a chance to opt out. The notice has to explain what data the bank collects, who it shares that data with, and how you can say no.1Office of the Law Revision Counsel. United States Code Title 15 Section 6802 – Obligations With Respect to Disclosures of Personal Information
You get this notice when you open an account. Annual updates used to be required across the board, but the FAST Act of 2015 eliminated that mailing when a bank shares information only in ways that do not trigger opt-out rights and has not changed its practices since the last notice.3Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act Regulation P
Where the Opt-Out Does Not Apply
The exceptions are the important part, because a great deal of routine data-sharing falls inside them. Your bank can share your information without letting you opt out when it is:
- Servicing your account or processing a transaction you requested.
- Jointly marketing financial products with another company under a contract that restricts how the data is used.
- Preventing fraud, unauthorized transactions, or other liability.
- Reporting to or receiving data from a credit bureau under the Fair Credit Reporting Act.
- Complying with federal, state, or local law, or responding to a subpoena, court order, or regulatory investigation.
These exceptions are set out in 15 U.S.C. § 6802(e).1Office of the Law Revision Counsel. United States Code Title 15 Section 6802 – Obligations With Respect to Disclosures of Personal Information One firm limit runs through all of them: your bank still cannot share account numbers with unaffiliated companies for telemarketing or direct mail purposes, even when another exception would otherwise allow disclosure.
The Safeguards Rule
The other half of GLBA is the Safeguards Rule, which requires banks to maintain an information security program with administrative, technical, and physical protections.4Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know When a breach affects at least 500 consumers, the institution must notify the FTC within 30 days of discovering the unauthorized access.5Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect Direct notification to affected customers is governed by state law, and most states require it within 30 to 60 days.
When the Government Can Access Your Bank Records
The Right to Financial Privacy Act (RFPA) controls government access. Under the RFPA, no government authority can reach your financial records unless one of five things happens: you authorize the disclosure, the government obtains an administrative subpoena or summons, a search warrant is issued, a judicial subpoena is served, or a formal written request meeting specific statutory requirements is submitted.6Office of the Law Revision Counsel. United States Code Title 12 Section 3402 – Access to Financial Records by Government Authorities
The government cannot simply walk into a bank and demand records. It has to use legal process, and when it does, you generally have the right to be notified and to challenge the request in court before the bank hands anything over.
The RFPA has significant exceptions. It does not apply when a banking supervisory agency examines records as part of its regulatory work, when records are sought under federal tax procedures, when the government and the customer are on opposite sides of the same lawsuit, or when law enforcement is asking only for basic identifying information such as your name, address, and account type.7Office of the Law Revision Counsel. United States Code Title 12 Chapter 35 – Right to Financial Privacy The supervisory exception is wide. Agencies like the OCC, FDIC, and Federal Reserve can review account records in the course of ordinary examinations without triggering the notice-and-challenge procedure.
The IRS operates under its own authority. Under 26 U.S.C. § 7602, it can summon anyone with custody of relevant records, including your bank, and generally must notify you at least 45 days before contacting a third party. Exceptions apply when you authorized the contact, when notice would jeopardize collection, or when a criminal investigation is pending.8Office of the Law Revision Counsel. United States Code Title 26 Section 7602 – Examination of Books and Witnesses
Reports Your Bank Files Without Telling You
The Bank Secrecy Act reverses the confidentiality rule for certain transactions. Rather than protecting your data, it requires the bank to report specific activity to the federal government, and those mandatory filings override the general duty of secrecy.
Currency Transaction Reports
Banks file a Currency Transaction Report (CTR) with the Financial Crimes Enforcement Network (FinCEN) for any cash transaction over $10,000 in a single day. That includes deposits, withdrawals, currency exchanges, and other cash transfers at that threshold.9FinCEN. The Bank Secrecy Act The CTR is routine and automatic. A filing does not by itself mean you are suspected of anything. Deliberately breaking transactions into smaller amounts to stay under the threshold is called structuring, and it is a separate federal crime.
Suspicious Activity Reports
Suspicious Activity Reports (SARs) apply when the bank detects transactions that may involve money laundering, terrorism financing, tax evasion, or other illegal activity. Thresholds vary. Insider abuse in any amount triggers a filing; other suspicious activity generally requires transactions of $5,000 or more when a suspect can be identified, or $25,000 or more regardless of whether a suspect is known.10FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Suspicious Activity Reporting
Federal law flatly bars anyone at the bank from telling you a SAR has been filed. No director, officer, employee, or agent may notify a person involved in the transaction that a report has been made, or disclose any information indicating one exists. Government employees who know about the SAR are held to the same rule. This is the “no-tipping-off” rule, and it applies specifically to SARs, not to CTRs.11Office of the Law Revision Counsel. United States Code Title 31 Section 5318 – Compliance, Exemptions, and Summons Authority
A Note on Foreign Accounts
Domestic banking privacy rules do not cover foreign account reporting, and readers sometimes assume they do. If the combined value of your foreign financial accounts exceeds $10,000 at any point during the year, you personally must file a Report of Foreign Bank and Financial Accounts (FBAR) with FinCEN, due April 15 with an automatic extension to October 15.12Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR) A separate filing on IRS Form 8938 is required under FATCA when foreign financial assets exceed thresholds that vary by filing status and residence.13Internal Revenue Service. Summary of FATCA Reporting for US Taxpayers These obligations sit on you as the account holder, not on your bank.
What to Do If Your Bank Improperly Discloses Your Information
Start with a written complaint to the bank’s compliance department. Describe what was disclosed, when you found out, and what harm resulted. The bank is required to investigate and respond.
If that response is inadequate, take it to a federal regulator. The Consumer Financial Protection Bureau accepts complaints online and by phone, forwards them to the institution, and tracks the response. Companies generally must respond within 15 days, with a final response due within 60 days in more complex cases.14Consumer Financial Protection Bureau. Submit a Complaint Depending on the bank’s charter, you can also file with the OCC (national banks), the FDIC (state-chartered banks that are not Federal Reserve members), or your state banking regulator.
Civil litigation is possible when a disclosure causes real financial harm or identity theft. Common theories include breach of contract, negligence in protecting nonpublic personal information, and violations of specific statutes. The difficult part is proving that the bank’s disclosure, and not some other source of compromise, caused your loss.
If the bank suffers a data breach exposing unencrypted customer information, state notification laws require it to tell you directly, usually within 30 to 60 days of discovery. The notice should describe what happened, what information was exposed, and what the bank is doing about it.
Penalties for Violating Banking Confidentiality
GLBA violations carry real consequences. Institutions face fines of up to $100,000 per violation. Officers and directors personally responsible for a violation can be fined up to $10,000 and sentenced to up to five years in prison. Anyone who obtains customer financial information through fraud or deception, a practice known as pretexting, faces up to five years’ imprisonment, or up to ten years when the conduct is part of a pattern of illegal activity involving more than $100,000 in a 12-month period.15Office of the Law Revision Counsel. United States Code Title 15 Section 6823 – Criminal Penalty These criminal penalties reach people who fraudulently obtain records, not only banks that improperly release them.