The Bank Secrecy Act: Scope Of The SAR “Privilege”

The 1970 Bank Secrecy Act (the “BSA”), as amended from time to time by laws such as the Annunzio-Wylie Anti-Money Laundering Act and the USA PATRIOT Act, was designed to require financial institutions to assist the government in detecting and preventing criminal activity such as money laundering, drug trafficking and terrorist financing. To accomplish its purpose, the BSA requires banks “to report any suspicious transaction relevant to a possible violation of law or regulation.” 31 U.S.C. § 5318(g). More specifically, regulations implemented by the Office of the Comptroller of the Currency (“OCC”) and the United States Department of the Treasury Financial Crimes Enforcement Network (“FinCEN”), for example, require banks to complete a Suspicious Activity Report (“SAR”) “when they detect a known or suspected violation of Federal law or a suspicious transaction related to a money laundering activity or a violation of the Bank Secrecy Act.” 12 C.F.R. § 21.11 (2011). All SARs must be provided to the appropriate federal law enforcement agencies and the Treasury Department (FinCEN).

Importantly, to facilitate the government’s ability to investigate “suspicious activity,” the BSA imposes a near-blanket prohibition on disclosing information relating to a SAR. Specifically, a bank—including its directors, officers, employees or agents—may not disclose the SAR itself or even “any information that would reveal the existence of a SAR.” 12 C.F.R. § 21.11(k). In addition to serving the interests of law enforcement, the prohibition on disclosing SARs also preserves the privacy interests of individuals whose names may appear in the SAR.

Although the BSA and its implementing regulations do not use the word “privilege,” the prohibition on disclosure has been construed by courts as an evidentiary privilege. The SAR “privilege” is unqualified and may not be waived by the bank. Weil v. Long Island Sav. Bank, 195 F. Supp. 2d 383, 389-90 (E.D.N.Y. 2001). Courts have refused to order an exception to the SAR privilege, even when necessary to establish an affirmative defense. Gregory v. Bank One, Indiana, N.A., 200 F. Supp. 2d 1000, 1003 (S.D. Ind. 2002).

The potential penalties for disclosing the existence of a SAR are severe. Civil penalties include fines of up to $100,000 per violation, and additional penalties for each day the violation continues. 31 U.S.C. § 5321. Criminal penalties for a willful violation could result in a fine of not more than $250,000 and a prison term of not more than five years, or both. 31 U.S.C. § 5322. In March 2012, FinCEN issued an advisory reminding banks—and their attorneys—that SAR confidentiality is critical to the goals of the BSA and emphasized the heavy penalties for disclosing SAR material.

The potential consequences of disclosing SAR materials underscores the importance of protecting SAR confidentiality when responding to subpoenas or discovery in a civil matter. Because a SAR contains detailed information about bank customers and also reflects the fact that the bank has made some determination about suspect banking activity, opposing parties are likely to seek SAR materials to establish liability against the customer, a third party or the bank itself. For this reason, it is important to understand what information and materials fall within the SAR privilege. Of course, this may be easier said than done.

In 2010, FinCEN offered its own guidance to bring some clarity to the scope of the SAR privilege. In addition to the SAR itself, and any documents affirmatively stating that a SAR was filed, FinCEN explained that confidentiality should be extended to “any document stating that a SAR has not been filed.” The reason behind this conclusion should be obvious: “Were FinCEN to allow disclosure of information when a SAR is not filed, institutions would implicitly reveal the existence of a SAR any time they were unable to produce records because a SAR was filed.” 75 Fed. Reg. 232, p. 75595 (Dec. 3, 2010).

In addition to FinCEN’s guidance, a number of courts have tackled the issue of the scope of the SAR privilege. Although the determinations made by courts across the country are not always consistent in their view of the scope of the privilege, they do provide guidance that banks and their counsel must take into consideration.

In Cotton v. PrivateBank & Trust Co., 235 F. Supp. 2d 809 (N.D. Ill. 2002), the court addressed whether documents and information supporting a SAR must be produced during civil discovery. At the core of the court’s opinion was its attempt to classify supporting materials into two categories: (1) the factual documents that give rise to the suspicious conduct and (2) “drafts of SARs or other work product or privileged communications that relate to the SAR itself.” Id. at 815. The court held that while the former are discoverable, the latter are not “because they would disclose whether a SAR has been prepared or filed.” Id.

Following in the footsteps of Cotton, the court in Union Bank of California, N.A. v. Super. Ct., 130 Cal. App. 4th 378 (2005), expanded the scope of the privilege to include “internal memorandum prepared as part of a financial institution’s process for complying with federal reporting requirements.” Id. at 391. At issue were specific internal forms used by the bank in its internal reporting process. The court held that such forms were covered by the privilege, and it did not matter that the forms were not ultimately “communicated to federal authorities.” Id. at 392. Importantly, the Union Bank court observed that the OCC has consistently interpreted the SAR privilege broadly, and reminded us that the OCC is entitled to Chevron deference in interpreting its own regulation. Id.

Similar to Cotton and Union Bank, the court in U.S. v. LaCost, 2011 WL 1542072 (C.D. Ill. Apr. 22, 2011), held that documents such as “deposit slips and CTRs, which are the factual, transactional documents made in the ordinary course of business” were discoverable. Id. at *8. However, the bank’s internal “incident reports” required by the bank’s training manuals “to inform management of suspicious activities” were not. Id.

In Whitney Nat. Bank v. Karam, 306 F. Supp. 2d 678 (S.D. Tex. 2004), the court held that communications between the bank and “law enforcement or governmental officials or agencies pertaining to suspected illegal activities” were covered by the SAR privilege. Id. at 680. And building on Whitney, the court in Wiand v. Wells Fargo Bank, N.A., 981 F. Supp. 2d 1214 (M.D. Fla. 2013), extended the privilege to cover a bank’s emails with another financial institution that were of an “evaluative nature [and] intended to comply with federal reporting requirements.” Id. at 1218.

The court in Norton v. U.S. Bank Nat’l Ass’n, 179 Wash. App. 450 (Wash. Ct. App. 2014) (review denied 180 Wash. 2d 1023), gave the privilege its most expansive interpretation to date. The plaintiff sought broad discovery from the bank about its “methods and policies for monitoring suspicious activity and detecting money laundering,” including “the names of bank employees who were in charge of or involved in any internal investigation” and “the details of the system of alerts it uses to track its customers’ banking activities.” Id. at 461. The court held that the bank’s internal system for detecting and investigating suspicious activity is so intertwined with its reporting obligations that nothing could be produced. Id. at 462-63.

In Regions Bank v. Allen, 33 So. 3d 72 (Fla. Dist. Ct. App. 2010), the court considered whether appropriate redactions could address concerns about confidentiality. Id. at 77. Recognizing, as it should, that the privilege includes supporting documentation that could reveal whether or not a SAR was filed, the court held that “redaction will not be adequate to protect the confidentiality of a SAR investigation or the fact of a SAR’s preparation. Redaction of a document does not change its character.” Id.

However, many courts have interpreted the SAR privilege more narrowly than the Cotton or Union Bank courts. One example is Freedman & Gersten, LLP v. Bank of America, N.A., 2010 WL 5139874 (D. N.J. Dec. 8, 2010). Acknowledging its own “liberal pretrial discovery standard” and view that Rule 26(b) “creat[ed] a broad vista for discovery,” the court ordered the production of the bank’s investigation file and related policies and procedures. Id. at *1-3. The court reasoned that in the absence of binding precedent, it is “a standard business practice for banks to investigate suspicious activity,” and therefore investigation files and related policies and procedures fell outside the scope of the privilege. Id. However, the court did hold that the privilege covered the bank’s policies and procedures for filing SARs—the court recognized that “knowledge of what [the bank’s] policies are for SARs could implicate [the bank] and its right to keep its decision to file a SAR out of the public eye by exposing its decision-making process.” Id. at *4.

Similar to Freedman, the court in In re Mongelluzzi, 2015 WL 5093789 (Bankr. M.D. Fla. Aug. 27, 2015), ordered the bank to produce “all documents generated or received in the ordinary course of its business, which were part of its standard practice of investigating suspicious activity.” Id. at *1. The court specified that this included “Investigatory Documents and Reports concerning the Debtors’ account activities,” “Computer Generated Account Monitoring Reports or Alerts concerning the Debtors’ account activities,” “Internal Bank E–Mails and Reports Concerning the Debtors’ Account Activities” and “Policies and Procedures.” Id. at *2.

What is clear is that there are serious penalties for disclosing SAR materials. What is not so clear is what materials are covered by the privilege. Although the scope of the privilege will vary based on the judge and jurisdiction, it is reasonable to conclude that the privilege includes not only the SAR itself, but also internal and external correspondence and internal reports/memoranda that contain opinions or evaluations about whether to file a SAR, as well as policies and procedures for filing a SAR. It is critical that a bank and its counsel understand the scope of the SAR privilege and consider whether the privilege covers certain materials before responding to subpoenas or other civil discovery.

For further information about the SAR requirements or responding to civil discovery relating to SARs, please contact Mark I. Wraight at miw@severson.com.