Five federal bank regulators said this week that a rule banks have long pointed to as a reason they can’t explain a frozen or closed account was never the roadblock it was treated as. In a joint statement issued September 2, the Financial Crimes Enforcement Network, the Federal Reserve, the FDIC, the National Credit Union Administration and the Office of the Comptroller of the Currency clarified that federal confidentiality law does not stop a bank from telling a customer why their account is being restricted, why a deposit bounced, or why the bank suspects fraud on the account.
For anyone who has had a debit card frozen mid-grocery-run or a deposit rejected with no real explanation, this is the regulatory fine print behind that silence. The banks weren’t necessarily lying when they said their hands were tied. They were reading a confidentiality rule more broadly than the law actually requires, and the customer paid the price in confusion and lost access to their own money.
The confidentiality rule banks have been citing
The root of the problem is a real, and serious, federal law. Under the Bank Secrecy Act, a bank that files a Suspicious Activity Report, or SAR, on a customer’s account is legally barred from telling that customer, or almost anyone else, that the report exists. The rule exists so a suspect under investigation can’t be tipped off, and it carries criminal exposure for bank employees who violate it. The regulation spelling this out sits at 31 CFR 1020.320, which flatly prohibits a bank, or any of its officers or employees, from disclosing a SAR or “any information that would reveal the existence of a SAR.”
That single sentence has functioned, in practice, as a wall. Compliance officers, wary of the criminal penalty for getting it wrong, have often told frontline staff to say as little as possible to a customer whose account is under review, even when the underlying facts of a suspicious transaction could be discussed without ever mentioning that a report was filed.
Free retirement updates: Want plain-English help keeping more of your money in retirement? The free Retirement Shield newsletter covers the benefits, deadlines, and money mistakes that cost retirees, a couple times a week. Subscribe free.
What the five agencies actually clarified
The new joint statement draws a line the agencies say was always there but got lost in practice. According to the full text of the statement, the confidentiality rule only bars a bank from revealing that a SAR itself exists or was filed. It does not bar the bank from discussing “the underlying facts, transactions, and documents upon which a SAR is based,” including transaction dates, amounts and the parties involved, as long as the conversation never confirms a SAR was filed.
In other words, a bank can tell a customer their account is restricted because of suspected fraud on a specific transaction. What it cannot do is say, or imply, that a formal Suspicious Activity Report was filed over it. The agencies stress in the accompanying news release that this is a clarification of existing law, not a new requirement: it “does not alter existing Bank Secrecy Act legal or regulatory requirements or establish new supervisory expectations.” No bank is now obligated to explain anything it wasn’t required to explain before. The change is that regulators are telling banks, in writing, that they were allowed to all along.
Where the pressure to fix this came from
The statement traces back to a 2025 request for public input from the Federal Reserve, FDIC and OCC on ways to curb payments fraud, with a particular focus on check fraud. Banking industry commenters flagged a specific problem: frontline staff couldn’t tell whether, or how much, they were legally permitted to say to a customer once a fraud investigation was underway, so many defaulted to silence rather than risk a confidentiality violation. That uncertainty is exactly what this week’s statement is meant to resolve, and the same reading was echoed in the American Bankers Association’s same-day writeup, which described the guidance as giving banks clearer footing to talk to customers during a fraud review.
What a bank can now say without breaking the law
The joint statement lists specific, non-exhaustive examples of communication that regulators say do not reveal a SAR’s existence and are therefore not prohibited. A bank can tell a customer that a delay, restriction or closure on their account may be related to suspected fraud or suspicious activity. It can explain that a deposit was rejected because of a suspected fraudulent or altered check. It can ask the customer directly about the purpose of a transaction or the source of funds, or request information about who sent or was meant to receive a wire. It can also give a customer general warnings or educational material about fraud schemes, including how “money mule” scams work, where someone unknowingly moves stolen funds through their own account.
What still isn’t allowed is any statement that confirms, even indirectly, that a SAR exists. A bank can describe the suspicious transaction. It cannot say “we filed a report on you.” That distinction is the entire hinge of the guidance, and it’s the one bank staff have to get right, because the underlying SAR confidentiality law and its penalties haven’t gone anywhere.
What this means the next time your account is frozen
If a bank restricts or closes an account and a customer asks why, this guidance gives the bank room to answer honestly about the transaction that triggered the review, even while a SAR investigation is ongoing. It does not force the bank to volunteer that information, and it does not shorten how long an account can stay frozen while a bank sorts out a suspected fraud case. Account holders who get stonewalled can point compliance staff to the September 2 joint statement and ask, specifically, whether the transaction details and the reason for the restriction can be shared under the guidance the regulators just issued, since that is exactly the kind of disclosure the five agencies said was never off-limits.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
