March 5, 2012 –
Increased use of Suspicious Activity Reports in private litigation raises confidentiality concerns

Due to its continuing concern with the confidentiality of Suspicious Activity Reports (SARs) and the prohibition from disclosing SARs, on March 2, 2012, FinCEN issued an Advisory to remind financial institutions and, in particular, the lawyers that advise them, of the requirement to maintain the confidentiality of SARs (“Advisory”).

In the Advisory, FinCEN recognizes that there has been escalation in the number of requests for the use of SARs in private litigation. As a result, FinCEN is concerned that external counsel of financial institutions may be unfamiliar with the regulations covering SAR confidentiality. FinCEN reemphasizes in the Advisory that current and former directors, officers, employees, agents, and contractors of financial institutions are prohibited from disclosing SARs, or any information that would disclose the existence of a SAR, and would be subject to civil and criminal penalties for any unauthorized disclosure of a SAR. FinCEN recommends in the Advisory that financial institutions ensure that all employees, agents and individuals appropriately entrusted with information pertaining to a SAR, or any information that would disclose the existence of a SAR, be clearly informed of the individual obligation to maintain SAR confidentiality. Likewise, such person(s) should be informed of the consequences for failing to maintain such confidentiality.

FinCEN also recommends the need for ongoing training of all employees on SAR confidentiality. In addition, FinCEN recommends risk-based measures to enhance SAR confidentiality including, among other appropriate security measures, limitting access on a “need- to- know” basis, restricting areas for reviewing SARs, logging of access to SARs, using cover sheets for SARs or any information that reveals the existence of a SAR, or providing electronic notices that highlight confidentiality concerns before a person may access or disseminate the information.

Finally, FinCEN restates the provisions of the FinCEN SAR Rule which requires that financial institutions immediately contact FinCEN if the former become aware of an unauthorized disclosure of a SAR, or if the institution receives a subpoena or other request for a SAR from other than an authorized governmental authority or self-regulatory organization, as defined in the applicable SAR regulations. In addition, financial institutions may also be required in such instances to contact their primary federal regulator, as may be required in the corresponding Bank Regulator SAR Rule.

Read a complete copy of the Advisory.

Authors: Clemente Vazquez-Bello, Andres A. Fernandez and Gabriel Caballero