Congress enacted the safe harbor provision of the Bank Secrecy Act (BSA), codified at 31 U.S.C. §5318(g)(3)(A), to shield financial institutions, their officers and employees from civil liability for reporting known or suspected criminal offenses or suspicious activity by filing a Suspicious Activity Report, or SAR. More particularly, the safe harbor provides immunity to any “financial institution that makes a voluntary disclosure of any possible violation of law or regulation to a government agency.” This comprehensive protection precludes liability under any federal, state or local law or regulation or under any contract. Nonetheless, despite the broad wording of this provision, courts have disagreed about the scope of the protection it affords.

Specifically, federal courts have disagreed about whether a bank and its officers and employees must have a “good faith” belief that a possible violation of law occurred before filing a SAR. Some courts, particularly those in the 11^th Circuit (which covers Alabama, Florida and Georgia), have provided immunity only when the financial institution has a “good faith suspicion that a law or regulation may have been violated.” However, the majority of courts have found that the safe harbor provision provides unqualified protection to financial institutions and their employees from civil liability for filing a SAR.

A recent case from the District of Massachusetts, AER Advisors Inc. v. Fidelity Brokerage Services, LLC , demonstrates just how unqualified that protection is. AER Advisors Inc. (AER) filed a complaint alleging that Fidelity Brokerage Services, LLC (Fidelity) falsely implicated them in a SAR, a SAR that was filed in bad faith. As a result, AER claimed it was subject to multiple investigations by state and federal agencies. Fidelity sought to dismiss the complaint, arguing that it had complete immunity from any liability for any SARs it filed. The court agreed.

The court noted that the extent of immunity varied from circuit to circuit, but in the 1^st Circuit where it sits (which covers Maine, Massachusetts, New Hampshire, Puerto Rico and Rhode Island), financial institutions are afforded immunity under Stoutt v. Banco Popular de Puerto Rico, even when disclosures are fabricated, unfounded, incomplete or malicious. The sweeping coverage is based on the court’s reasoning that “Congress did not intend to include a good faith qualification to immunity because (1) it easily could have written the requirement into the statute; (2) it removed a good faith requirement from an earlier draft of the provision; and (3) any limitation on immunity would discourage disclosure.”

AER also argued that Fidelity should not be granted immunity, because by knowingly reporting false information, it had not actually reported a “possible violation of law.” The court rejected this argument as well, saying that, regardless of what Fidelity actually believed, the SAR, on its face, reported a possible violation of law.

Finally, AER argued that fraudulent SARs should not insulate financial institutions from civil liability. The court rejected this argument as well, finding that financial institutions could be prosecuted criminally for knowingly filing false reports.

So just how safe is the safe harbor provision? It depends on where you sit. For most of the country, the safe harbor affords a financial institution total immunity, even if it maliciously files a false SAR. And, as we have blogged, Congress is contemplating codifying this authority by amending 31 U.S.C. § 5318(g)(3)(B) to provide that the safe harbor provision does not create “any duty or requirement of a financial institution or any director, officer, employee, or agent of such institution to demonstrate to any person . . . that a disclosure . . . is made in good faith.”

So keep filing those SARs. And no matter where you sit, it is obviously best to ensure that the SARs you file are factually supported.