Can a bank or its fintech partner tell a customer that a SAR was filed?

No. A bank may not tell a customer, or anyone involved in the transaction, that a SAR was filed, and the ban also covers the bank's directors, officers, employees and agents. A fintech partner that acts as the bank's agent is within the bank rule, and a fintech that is itself a financial institution, or a contractor of one, is within the statutory ban.

What the rule says:

• No bank, and no director, officer, employee or agent of a bank, may disclose a SAR or any information that would reveal that a SAR exists (31 CFR 1020.320(e)(1)(i)).
• If a financial institution reports a suspicious transaction to a government agency, whether voluntarily or under a requirement, neither it nor its directors, officers, employees or agents (whether or not still employed), nor any other current or former director, officer or employee of, or contractor for, the institution or other reporting person, may notify any person involved that the transaction has been reported or otherwise reveal information that would reveal that (31 U.S.C. 5318(g)(2)(A)(i)).
• A bank subpoenaed or otherwise asked to disclose a SAR or such information must decline, citing 31 CFR 1020.320 and 31 U.S.C. 5318(g)(2)(A)(i), and must notify FinCEN of the request and the response (31 CFR 1020.320(e)(1)(i)).

What to do:

• Do not confirm or hint at a SAR to a customer. None of the permitted disclosures allows telling the customer.
• Share a SAR only through the permitted channels, and only if no person involved in the reported transaction is notified (31 CFR 1020.320(e)(1)(ii)). These are FinCEN, law enforcement, the bank's Federal BSA examiner, or a State authority overseeing BSA compliance. The underlying facts, transactions and documents may also be shared, including with another financial institution for a joint SAR. A SAR may be shared within the bank's corporate organizational structure for purposes consistent with Title II of the BSA, as determined by regulation or guidance.
• Check whether each fintech partner is the bank's agent or is itself a financial institution, and confirm which SAR confidentiality rule applies to it. Set out its confidentiality duties in the partner agreement.

Sources

1. 31 CFR § 1020.320(e)(1)(i): https://www.law.cornell.edu/cfr/text/31/1020.320
2. 31 U.S.C. § 5318(g)(2)(A)(i): https://www.law.cornell.edu/uscode/text/31/5318
3. 31 CFR 1020.320 (eCFR): https://www.ecfr.gov/current/title-31/section-1020.320

This answer is general information, not legal advice. Forteris is not a law firm.