Right to Financial Privacy Act: Notice, Motion to Quash, and Suits

A Right to Financial Privacy Act subpoena is a federal demand for your bank records that must follow specific procedures: the agency has to notify you on or before the day it serves the subpoena on your bank, and you get either 10 or 14 days to file a motion in court to stop the disclosure. If you miss that window, the bank turns over the records automatically. The Act only reaches federal agencies acting through certain kinds of subpoenas against certain kinds of institutions, and several major categories of government access, including grand jury subpoenas and IRS procedures, sit entirely outside its protection.¹

Does the Act Cover Your Situation

Three things have to line up before the RFPA gives you anything: you have to be a covered customer, the records have to sit at a covered institution, and the request has to come from a federal agency.

A “customer” under the Act means an individual or a partnership of five or fewer people who use a financial institution’s services.² Corporations and larger partnerships are not customers for RFPA purposes. If the records the government wants belong to your business rather than to you personally, the Act may not apply.

The covered institutions are banks, savings banks, credit unions, trust companies, savings associations, building and loan associations, industrial loan companies, and card issuers. Investment firms, cryptocurrency exchanges, and fintech platforms that do not fit those categories may fall outside the Act. Where the institution is covered, a “financial record” is broad: any original document, copy, or information derived from any record the institution holds about your relationship with it.²

Finally, the request has to come from a federal government authority, meaning an agency or department of the United States and its officers, employees, or agents.¹ State police, local prosecutors, and private civil litigants operate under different rules and get you no protection from this Act.

The Notice You Should Receive

For both administrative and judicial subpoenas, the government must serve a copy of the subpoena on you, or mail it to your last known address, on or before the date the subpoena is served on your bank.³ If the bank was served Monday, your notice cannot be dated Tuesday.

The notice has to explain, with reasonable specificity, the nature of the law enforcement inquiry and the purpose for seeking your records, and it must include instructions and blank forms telling you how to challenge the disclosure.³ Those forms are not paperwork clutter. They are the mechanism the Act uses to trigger your right to object, and their absence is itself a procedural violation you can raise in court.

The subpoena also has to describe the records with enough specificity for the bank to locate them. A blanket demand for “all records relating to John Smith” is potentially overbroad; a request for a specific account over a specific date range is not.

Underlying all of this is a substantive limit: the agency must have reason to believe the records are relevant to a legitimate law enforcement inquiry, and the subpoena has to be authorized by a specific provision of law.³ Judicial subpoenas carry the same relevance requirement but issue through a court.⁴

The Deadline to Challenge

How much time you have depends on how the notice reached you. Personal service gives you 10 days to file. Mailed notice gives you 14 days from the mailing date.⁵ Note that the mailed clock runs from the date the government put the letter in the mail, not from the date you opened it. If the envelope sits on a counter for four days, you already have less than half your window left.

Miss the deadline and the bank produces the records. There is no extension and no second chance: the challenge procedures under this section are the sole judicial remedy available to oppose disclosure.

How to File a Motion to Quash

The filing itself is called a motion to quash, whether the subpoena is administrative or judicial. Venue depends on the type. A motion to quash a judicial subpoena goes to the court that issued it. A motion to quash an administrative summons goes to the appropriate United States district court.⁵ After filing, you serve copies on the federal agency that issued the subpoena, typically at the office identified in the notice.

Your motion has to be accompanied by a sworn affidavit that says two things: that you are a customer of the institution whose records are being sought, and either that the records are not relevant to the law enforcement inquiry the notice describes, or that the government failed to substantially comply with the Act’s requirements.⁶ That second ground is worth taking seriously. Even where the underlying investigation is legitimate, late notice, a vague description of the inquiry, or missing challenge forms can be enough to quash a subpoena.

What the Court Decides

Once you file, the court checks that you followed the proper procedures and, if you did, orders the government to submit a sworn response explaining its justification. The government can file that response under seal if it argues that public disclosure would compromise the investigation.⁶ The court then rules within seven calendar days of receiving the response, usually on the papers alone.

To keep the records flowing, the government must show a demonstrable reason to believe its inquiry is legitimate and a reasonable belief that the records are relevant.⁶ If it meets that standard, the court denies your motion and orders production. If it fails, or if the court finds the government did not substantially comply with the Act’s procedures, the subpoena is quashed.

When You May Get No Notice at All

Several situations remove your right to advance notice, and some remove RFPA protection entirely.

Delayed Notice

A federal agency can ask a court to delay telling you about a subpoena.⁷ The court grants the delay only if it finds the investigation falls within the agency’s jurisdiction, the records are relevant to a legitimate inquiry, and notice would likely endanger someone’s safety, cause the target to flee, lead to destruction of evidence, result in witness intimidation, or otherwise seriously jeopardize the investigation.

These orders are issued without your knowledge. An initial delay can last up to 90 days, extensions of up to 90 days each can be granted on subsequent applications, and there is no cap on the number of extensions.⁷ The court can also order the bank to stay silent about the request. For certain national security matters, the delay can be indefinite where there is a danger to life or physical safety. You may not learn your records were accessed until long after the challenge window has closed.

Categories Outside the Act Entirely

Some kinds of federal access do not trigger the RFPA at all. Grand jury subpoenas are exempt, and much federal criminal investigative work runs through grand juries. Disclosures made under Internal Revenue Code procedures are exempt; the IRS operates on its own rules. Investigations targeting the bank itself can sweep in your records without RFPA notice even if you are also a subject. Regulatory and supervisory bank examinations bypass the procedures. If you applied for or received a federal loan, loan guarantee, or loan insurance, the administering agency can access your records in connection with that program. And an agency seeking only your name, address, account number, and type of account does not have to run the full notice process.⁸

A separate track exists for intelligence and counterterrorism work. Agencies conducting foreign counterintelligence, international terrorism investigations, or Secret Service protective functions can obtain records by presenting a certificate signed by a designated supervisory official, with no obligation to notify you.⁹ The bank can be ordered to stay silent about the request indefinitely.

The upshot is that the RFPA is most useful in routine federal investigations that proceed by subpoena rather than through a grand jury, the IRS, or a national security channel.

Suing for a Violation

If a federal agency or a financial institution obtains your records in violation of the Act, you can sue. The Act allows statutory damages of $100 per violation regardless of how many records were involved, actual damages for any financial harm you can prove, and punitive damages when the violation was willful or intentional in an amount the court considers appropriate.¹⁰ If you win, the court must also award the costs of the lawsuit and reasonable attorney’s fees. Injunctive relief is available to prevent ongoing or future unauthorized disclosures.

You have three years from the date the violation occurred, or three years from when you discovered the violation, whichever is later, to sue in any appropriate United States district court.¹¹ Because delayed-notice provisions can keep you unaware for months, the discovery rule matters: the clock does not start until you actually learn your records were improperly accessed. The remedies in the RFPA are the only judicial remedies available for violations of the Act.

1
Office of the Law Revision Counsel. 12 USC Ch. 35 – Right to Financial Privacy
2
Office of the Law Revision Counsel. 12 USC 3401 – Definitions
3
Office of the Law Revision Counsel. 12 USC 3405 – Administrative Subpena and Summons
4
Office of the Law Revision Counsel. 12 USC 3407 – Judicial Subpena
5
Office of the Law Revision Counsel. 12 USC 3410 – Customer Challenges
6
Office of the Law Revision Counsel. 12 USC 3410 – Customer Challenges
7
Office of the Law Revision Counsel. 12 USC 3409 – Delayed Notice
8
Office of the Law Revision Counsel. 12 USC 3413 – Exceptions
9
Office of the Law Revision Counsel. 12 USC 3414 – Special Procedures
10
Office of the Law Revision Counsel. 12 USC 3417 – Civil Penalties
11
Office of the Law Revision Counsel. 12 USC 3416 – Jurisdiction