Interagency Advisory on Safe Harbor and the Filing of Suspicious-Activity Reports

Banks, thrift institutions, bank holding companies and non-bank subsidiaries, credit unions, the U.S. branches and agencies of foreign banks, and certain other financial institutions are required to file Suspicious Activity Reports (SARs) pursuant to regulations issued by the five federal financial institutions supervisory agencies and the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN). The agencies’ SAR rules are authorized by various federal laws, including the Bank Secrecy Act, and generally require these financial institutions to file SARs with law enforcement and bank supervisory authorities whenever they know or suspect suspicious or potential criminal activity. The Bank Secrecy Act and the agencies’ SAR regulations also provide protection to financial institutions and their employees from civil liability for filing a SAR or for making disclosures in a SAR. The purpose of this advisory is to tell financial institutions about a recent federal court case, Whitney Nat’l Bank v. Karam, 306 F. Supp.2d 678 (S.D. Tex. 2004), that reaffirms the scope of that statutory protection, generally referred to as a “safe harbor.”Interagency Advisory on Safe Harbor and the Filing of Suspicious-Activity Reports

In 1992, Congress passed the Annunzio-Wylie Anti-Money Laundering Act and provided a safe harbor for financial institutions and their employees from civil liability for reporting known or suspected criminal offenses or suspicious activity by filing a SAR. This law is codified at 31 U.S.C. 5318(g)(3) [see 3-1776.7]. Each of the federal financial institutions supervisory agencies and FinCEN incorporated the safe harbor provisions of the 1992 law into its suspicious activity reporting regulations.

In recent years, several courts have disagreed about the scope of the protection afforded by this safe harbor provision. Some courts have limited the safe harbor protection to disclosures based on a good faith belief that a violation has occurred, or have declined to extend the protection to financial institutions that may have misrepresented material facts to law enforcement.¹ However, the majority of courts have ruled that the safe harbor provision provides unqualified protection to financial institutions and their employees from civil liability for filing a SAR.²

The federal district court in Whitney sided with the majority of courts that have interpreted the safe harbor provision to afford unqualified protection to financial institutions and their employees from civil suit. In the Whitney case, individuals filed a defamation suit against a bank, claiming that the bank wrongfully accused them of illegal lending activity when it filed a SAR. In the suit, the individuals sought discovery of any oral or written communications the bank may have had with law enforcement concerning their suspected illegal conduct. The individuals did not seek a copy of the SAR because a clear provision of the Bank Secrecy Act prohibits such disclosure to the people who are reported in the SAR, so instead they sought information from the bank about any disclosures it may have made to law enforcement surrounding the possible filing of a SAR. Several of the federal financial institutions supervisory agencies jointly filed a brief with the court arguing that a financial institution that reports suspected crimes should not be subject to discovery of its communications with law enforcement.

The Whitney court ruled that a bank may not produce documents in discovery evidencing:

The court noted, however, that the safe harbor protections do not apply to documents upon which a SAR was based that a bank may have generated or received in its ordinary course of business, unless producing these documents would confirm the existence of a SAR.

While the Whitney court ruled in a case involving a national bank and the rules and regulations of the Office of the Comptroller of the Currency, the five federal financial institutions supervisory agencies and FinCEN believe that the court’s rulings apply to all financial institutions that file SARs in accordance with suspicious activity reporting rules.

In light of the Whitney decision, the agencies remain confident that financial institutions and their employees that follow the prescribed agency regulations and SAR filing instructions should be fully protected by the safe harbor provisions of the law. The staffs of the agencies want to emphasize that all financial institutions covered by the agencies’ SAR reporting rules should have internal processes to handle the filing of SARs as well as requests for sensitive information from law enforcement authorities and from litigants in private lawsuits regarding suspicious activities and reporting to law enforcement. Communicating with law enforcement authorities through these processes, or in response to a subpoena from federal, state, or local law enforcement agencies or other forms of compulsory process, such as a request from FinCEN pursuant to section 314(a) of the USA PATRIOT Act or the reporting of a blocked transaction to the U.S. Department of the Treasury’s Office of Foreign Assets Control, will provide maximum legal protection for financial institutions.