Cybersecurity Policy Report, FinCEN guidance addresses voluntary cross-border information sharing, SAR confidentiality, (Sep 8, 2025)

By Shashi Kant, BALLB, LLM.

The guidance outlines permissible information exchanges, distinguishes SAR confidentiality limits, and highlights institutions’ obligations under U.S. and foreign laws.

The Financial Crimes Enforcement Network (FinCEN), in consultation with the Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), and National Credit Union Administration (NCUA), has issued guidance addressing voluntary cross-border information sharing among financial institutions and confidentiality requirements related to Suspicious Activity Reports (SARs). The guidance clarifies that the Bank Secrecy Act (BSA) and its implementing regulations generally do not prohibit cross-border information sharing. It also provides examples of information that may be shared without violating SAR confidentiality provisions. The guidance does not alter existing legal obligations, impose new requirements, or establish compliance standards.

Cross-border information sharing. FinCEN stated that financial institutions may voluntarily share transaction records, customer and account data, and investigative materials with U.S. and foreign financial institutions, including affiliates and correspondent banks. Such sharing can help institutions develop a more complete understanding of risks from money laundering, terrorist financing, drug trafficking organizations, foreign terrorist organizations, and fraud. FinCEN indicated that information sharing can strengthen anti-money laundering/countering the financing of terrorism (AML/CFT) programs and improve reporting to law enforcement and national security agencies.

Institutions considering cross-border information sharing should assess their risk profile, their relationship with the foreign institution, and obligations under other U.S. legal authorities such as the Right to Financial Privacy Act and the Gramm-Leach-Bliley Act, as well as applicable foreign laws.

SAR confidentiality. The BSA prohibits disclosure of SARs or any information that would reveal the existence or non-existence of a SAR, except as specifically permitted by regulation. The BSA does not prohibit sharing the underlying facts, transactions, and documents on which a SAR is based. While a reasonable and prudent person familiar with SAR requirements may infer from such information that a SAR was filed, sharing the underlying information itself does not constitute disclosure of a SAR. Institutions must take measures, such as redaction, to ensure SAR confidentiality is maintained.

Examples of shareable information. FinCEN listed categories of underlying information that do not fall within the prohibition on SAR disclosure:

• Transaction information: Wire transfer and payment details, records of cash deposits and withdrawals, monetary instrument logs, and transaction logs reflecting counterparties in certain jurisdictions.

• Customer/account information: Beneficial ownership data, account products and services, business activities of legal entity customers, and occupation or source of funds/wealth information provided to institutions.

• Investigative or related materials: Alerts from monitoring systems, information in investigation files, due diligence research and adverse media checks, analytic materials not related to the SAR decision process, and cyber data such as IP addresses, geolocation, or device identifiers.

Handling requests for SARs. FinCEN reminded institutions of their obligation to notify FinCEN and their primary federal regulator, if applicable, when they receive a subpoena or other request for SARs or related information. SARs and information revealing their existence may not be disclosed in response to such requests. FinCEN’s 2012 SAR Confidentiality Reminder directed institutions to immediately contact FinCEN’s Office of Chief Counsel if they receive unauthorized requests. Institutions should also consult prior guidance, including recommendations to describe responsive documents as “nonpublic supervisory information” in privilege logs rather than identifying a SAR.

Section 314(b) safe harbor. The guidance does not affect the availability or scope of the safe harbor under Section 314(b) of the USA PATRIOT Act, which protects financial institutions from liability when information is shared under certain conditions. The new guidance applies only to information that institutions may choose to share outside of the safe harbor framework.

MainStory: TopStory BankingFinance BankingOperations BankSecrecyAct CrimesOffenses CyberPrivacyFeed DataPrivacy GCNNews DataSecurity