SAR Tipping-Off Prohibition: Allowed Disclosures and Penalties

The SAR tipping-off prohibition, set out at 31 U.S.C. § 5318(g)(2), makes it illegal to tell the subject of a Suspicious Activity Report, or anyone involved in the reported transaction, that a SAR has been filed, is being prepared, or even exists. The ban covers the report itself and any communication that would reveal or hint at it. Willful violations can bring fines up to $250,000 and five years in prison, doubling to $500,000 and ten years when the disclosure ties into other criminal conduct, plus civil penalties, removal from your position, and a permanent bar from the financial industry.

Who Is Bound by the Rule

The prohibition reaches every corner of the financial services industry. The statute names financial institutions along with their directors, officers, employees, and agents, and it extends to former employees and contractors after they leave. If you had access to reporting information during your time at a bank, brokerage, insurer, money services business, casino, mutual fund, or futures commission merchant, the confidentiality obligation follows you indefinitely.¹²

Government personnel are bound too. Current and former officers, employees, and contractors of federal, state, local, and tribal governments who learn about a SAR cannot disclose it to anyone involved in the reported transaction. The only carve-out is sharing that is necessary to perform official duties.¹

What Counts as Tipping Off

The rule is much broader than handing over the report. You cannot share any information that would reveal a SAR exists. That covers emails, phone calls, casual remarks, and any other communication suggesting an account is under review for suspicious activity or that a filing has been made. Telling a customer that their account is “flagged” or “being reviewed by compliance” can cross the line if a reasonable person would infer a SAR was filed or being considered.

The protection kicks in before a report is submitted. FinCEN’s final rule states that confidentiality extends to materials prepared as part of the detection and reporting process, whether or not a SAR is ultimately filed. Communications preparatory to a SAR, follow-up discussions after filing, and even oral conversations about suspected violations that never result in a written report all fall within the ban.²

Underlying Facts Are Different from the Report

The transactions that triggered a SAR are not themselves confidential under the SAR rules. A bank can discuss the details of a wire transfer, ask a customer to verify the source of a deposit, or request documentation for a large withdrawal. Those are ordinary business conversations.²

What you cannot do is discuss the underlying facts in a way that tips the customer off. Asking a customer to explain a $50,000 wire to an unfamiliar overseas account is fine. Asking them to explain it “because we had to report it” is a violation. If the underlying documents reference a previously filed SAR, or the framing of the conversation effectively reveals that a filing occurred, the disclosure is still prohibited.²

Disclosures That Are Allowed

The rule has several narrow exceptions. None of them ever permit disclosure to the person who is the subject of the report.

Regulators and Law Enforcement

Financial institutions may disclose SARs and related information to FinCEN, their appropriate federal banking regulator, and any federal, state, or local law enforcement agency. State regulatory authorities administering BSA-related laws can also receive the information. These are the intended recipients of the reporting system.³

Within the Corporate Family

An institution may share SAR information within its own corporate structure for purposes consistent with the BSA. A branch bank can share with its parent holding company, or a subsidiary with its head office. Every entity that receives the information stays bound by the same confidentiality rules.³

Section 314(b) Sharing Between Institutions

Under a program established by the USA PATRIOT Act, unaffiliated financial institutions can share information about suspected money laundering or terrorist financing with each other. Each institution must file a notice with FinCEN that remains effective for one year, and must verify that any institution it shares with has done the same. Information received through this program can only be used for identifying and reporting suspicious activity, making account decisions, or meeting BSA compliance obligations, and participants must maintain adequate security procedures.⁴

Employment References

Institutions can include the facts underlying a SAR in a written employment reference provided to another financial institution under the Federal Deposit Insurance Act’s reference-sharing framework, or in termination notices provided under self-regulatory organization rules. The reference can convey what happened; it cannot say that a SAR was filed about it.¹

Subpoenas and Civil Discovery

Private litigants sometimes try to obtain SARs through discovery or subpoenas. Refuse and report. If you receive a subpoena or other request for a SAR or information that would reveal its existence from anyone other than FinCEN or a law enforcement or regulatory agency, you must decline to produce it and notify FinCEN of the request and your response.⁵

This holds even when a court issues the subpoena. Cite 31 U.S.C. § 5318(g)(2) and the applicable regulation as grounds for refusal. FinCEN has stated that government authorities themselves cannot disclose SARs in response to requests for non-public information or for use in private legal proceedings, so even an agency holding a SAR cannot hand it to a civil litigant.²

Civil Penalties

Willful violations of the BSA, including the tipping-off prohibition, trigger civil monetary penalties under 31 U.S.C. § 5321. For an individual, the penalty for each violation is the greater of the amount involved in the transaction (capped at $100,000) or $25,000. The floor for any willful violation is therefore $25,000, and the ceiling per violation is $100,000 when the underlying transaction is large enough. Each separate disclosure can be a separate violation.⁶

Repeat violators face more. The Anti-Money Laundering Act of 2020 added 31 U.S.C. § 5321(f), which lets the Treasury Secretary impose additional penalties on anyone who has previously violated the BSA. The additional penalty can reach three times the profit gained or loss avoided from the violation, or twice the maximum penalty that would otherwise apply, whichever is greater. These enhanced amounts stack on top of the base penalty.⁶

Criminal Penalties

Criminal prosecution is reserved for willful violations. Under 31 U.S.C. § 5322(a), a person who willfully violates the BSA or its implementing regulations faces a fine of up to $250,000, imprisonment for up to five years, or both.⁷

The maximums roughly double when the tipping-off violation occurs alongside other criminal conduct. If the disclosure happens while the person is also violating another federal law, or as part of a pattern of illegal activity involving more than $100,000 over a 12-month period, the maximum fine rises to $500,000 and the maximum prison term to 10 years. This enhanced tier often applies in practice, because tipping off a SAR subject tends to coincide with money laundering, fraud, or related financial crimes.⁸

Removal and Permanent Industry Bar

Regulators can also end your career in financial services. Under 12 U.S.C. § 1818(e), federal banking agencies can remove any institution-affiliated party from their position and permanently prohibit them from participating in the affairs of any insured depository institution. The agency must show that the person violated a law or regulation, that the violation caused or will likely cause financial harm or prejudice to depositors, and that the conduct involved personal dishonesty or a willful disregard for the institution’s safety and soundness.⁹

A tipping-off violation typically fits all three elements: a clear regulatory breach, real risk of harm to the institution and to investigations, and conduct reflecting dishonesty or willful disregard. For a banker or compliance professional, the permanent bar can be the most consequential piece of the sanction stack.

Safe Harbor for Filers

The other side of the confidentiality regime is a strong legal shield for those who file. Under 31 U.S.C. § 5318(g)(3), a person who makes a SAR disclosure to a government agency cannot be sued for it. The safe harbor covers liability under federal law, any state law, and any private contract or arbitration agreement, and it protects the institution from liability for failing to notify the subject of the report.¹

The protection is broad. It covers voluntary disclosures of possible violations, mandatory filings under the BSA, and disclosures made under any other legal authority. It applies to the institution and to any director, officer, employee, or agent who makes or requires the filing, and extends to supporting documentation.¹⁰

One boundary matters. The safe harbor does not block enforcement actions by the government itself. If a regulator finds that a SAR was filed in bad faith or that the institution has separate compliance failures, civil or criminal action can still follow. The immunity is against private lawsuits, not against the agencies running the system.¹

1
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
2
Financial Crimes Enforcement Network. Suspicious Activity Report Confidentiality Final Rule
3
eCFR. 12 CFR 163.180 – Suspicious Activity Reports and Other Reports and Statements
4
eCFR. 31 CFR 1010.540 – Voluntary Information Sharing Among Financial Institutions
5
Financial Crimes Enforcement Network. Disclosure Prohibited
6
Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
7
Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
8
GovInfo. 31 USC 5322 – Criminal Penalties
9
Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution
10
eCFR. 12 CFR 208.62 – Suspicious Activity Reports