On September 1, 2020, the Financial Crimes Network (“FinCEN”) issued a statement regarding various media outlets’ intent to publish Suspicious Activity Reports (“SARs”) and “other sensitive government documents”.   The full statement may be found here. The release offers no changes regarding  the unauthorized disclosure of SARs,  and serves to remind everyone, including media outlets,  that publishing unlawfully disclosed information is a crime.  FinCEN has referred the matter to both the Department of Justice and the Department of the Treasury’s Office of Inspector General for further enforcement.

Generally, under the Bank Secrecy Act (“BSA”), U.S. financial institutions are required to file a SAR with FinCEN within 30 days if suspicious activity is detected in an account related to things like money laundering, fraud or terrorist financing. However, the BSA and other federal regulations specifically prohibit the unauthorized disclosure of the SAR, or any information that may reveal the existence of the SAR. This confidentiality requirement is taken seriously by the Government, and disclosure of the contents in (or mere existence of) a SAR is viewed by law enforcement to be a serious matter. Accordingly, the penalties can be severe.  Federal law provides for civil penalties of up to $100,000 for each violation, and criminal penalties including fines of up to $250,000 and/or imprisonment of up to 5 years. 31 U.S.C. § 5322 and 31 U.S.C. § 1010.840. Further, enforcement actions for sub-standard AML compliance on the part of the filing institution can go hand-in-hand with charges of an unauthorized SAR disclosure-- once the SAR is in the public eye and no longer confidential.

The key is always to err on the side of non-disclosure.  Once a SAR is disclosed, it can’t be undone, and if disclosure was improper, penalties will no doubt follow. Further, the conduct of the institution in connection with the leak of the SAR, as well as in the underlying handling of the transactions at issue, create significant risk to the company and its employees.  Simply put, make certain that you have a valid reason to disclose any SAR-related information, and seek legal guidance if there is any uncertainty whatsoever.