The Right to Financial Privacy Act and the Subpoena Requirement1
The records of a financial institution can be key for federal criminal fraud investigations. Bank records are sometimes the first records sought and can prove income, spending, location, monetary transfers, connections to other individuals or companies, and much more. The sheer amount of intelligence contained in financial records makes such information a primary focus for law enforcement and investigations of all types.
The Right to Financial Privacy Act2 (“RFPA”) protects all customer information by establishing requirements for the federal government to obtain a customer’s financial records. The RFPA states a financial institution shall not release any such information unless the documents are in response to a validly issued subpoena or court order:
No financial institution, or officer, employees, or agent of a financial institution, may provide to any Government authority access to or copies of, or the information contained in, the financial records of any customer except in accordance with the provisions of this chapter.3
The five types of valid requirements are:
- A customer authorized disclosure;
- An administrative subpoena or summons;
- A search warrant;
- A judicial subpoena; or
- A formal written request.4
Every financial institution should ensure that the release of any information is reviewed by a legal or compliance professional to ensure that the request meets the above requirements. This restriction on the release of information applies to any information derived from such information and can extend to any discussions of such information.5 However, any information not derived from such protected information can be freely disclosed by the financial institution.
Upon receipt of a subpoena or request which meets the requirements of the RFPA, a bank is required to turn over the records; there is no right of a bank to oppose or quash a validly issued subpoena or request:
Upon receipt of a request for financial records made by a Government authority under section 3405 or 3407 of this title, the financial institution shall, unless otherwise provided by law, proceed to assemble the records requested and must be prepared to deliver the records to the Government authority upon receipt of the certificate required under section 3403(b) of this title.6
Restrictions on Notification
Once a financial institution is served with a subpoena or other legal process, the financial institution may be restricted from notifying their customer that the customer’s records have been subpoenaed or may be part of a federal investigation. These restrictions automatically attach to any records which were requested with a grand jury subpoena. The statute specifically states:
No officer, director, partner, employee, or shareholder of, or agent or attorney for, a financial institution shall, directly or indirectly, notify any person named in a grand jury subpoena served on such institution in connection with an investigation relating to a possible –
(A) crime against any financial institution or supervisory agency or crime involving a violation of the Controlled Substance Act [21 U.S.C. 801 et seq.], the Controlled Substances Import and Export Act [21 U.S.C. 951 et seq.], section 1956, 1957, or 1960 of title 18, sections 5313, 5316, 5322, 5324, 5331, and 5332 of title 31, or section 6050I of title 26; or
(B) conspiracy to commit such a crime.7
The regulations also allow a requesting agency to seek a delay in the notification to the affected customer. The regulation provides that:
Nothing in this chapter … shall apply to any subpoena or court order issued in connection with proceedings before a grand jury, except that a court shall have authority to order a financial institution, on which a grand jury subpoena for customer records has been served, not to notify the customer of the existence of the subpoena or information that has been furnished to the grand jury, under the circumstances and for the period specified and pursuant to the procedures established in section 3409 of this title.8
Under Section 3409, a prosecutor can apply for a delay in the notification of the customer of the existence of the subpoena. The prosecution can ask for a delay of up to ninety (90) days9; and at the end of each ninety (90) day period the prosecution can request an extension of that non-disclosure order up to an additional ninety (90) days.10
When is a Subpoena Not Necessary
The Bank Secrecy Act (“BSA”), ironically, requires financial institutions to report suspicious activity to the federal government and requires the government to provide a means for such information to be reported:
Every bank shall file with the Treasury Department, to the extent and in the manner required by this section, a report of any suspicious transaction relevant to a possible violation of law or regulation.11
In response to the act, the Financial Crimes Enforcement Network (“FinCEN”) was established, which is responsible to collect reports and to create the network for the submission of the information.
The regulations issued pursuant to BSA require that financial institutions (1) shall file a Suspicious Activity Report (“SAR”), (2) in a location determined by FinCEN, (3) no later than thirty (30) calendar days after the date of initial detection.12 The regulations also require the retention of information, including a copy of the SAR and any supporting documentation for a period of five (5) years.13 Under this provision, the supporting documentation is considered to have been filed with the SAR, and thus is part of the SAR.
The financial institution is also required to make the supporting documentation available to any federal or state law enforcement or regulatory authority upon request.14
The request from a law enforcement authority or regulatory authority to review the supporting documentation is a regular request and a regular source of questions for banks. The requirements of requiring a subpoena, search warrant, or a summons seems to not be consistent with the requirement to share supporting information from a SAR with law enforcement. Due to the number of inquiries from law enforcement to review supporting documentation, FinCEN issued a memo to provide guidance15 (“Guidance”) to clarify what is and is not sharable with law enforcement and what is and is not considered supporting documentation.
The Guidance suggests that financial institutions should draft procedures for verifying that the requestor of the information is in fact a member of law enforcement. Once the requestor is verified,
Disclosure of SARs to appropriate law enforcement and supervisory agencies is protected by the safe harbor provisions applicable to both voluntary and mandatory suspicious activity reporting by financial institutions.16
The Guidance continues on to define the meaning of “supporting documentation” as “all documents or records that assisted a financial institution in making the determination that certain activity required a SAR filing.”17 This included any spreadsheets, statements, reports, recordings, email messages, or other information which is related to the conclusion that the transaction required a SAR filing. The documents do not have to be indicative of a crime or even related to the account or person who is the subject of the filing, but any information which may have led to the conclusion that the SAR was required.
The Guidance also notes that although the RFPA generally prohibits financial institutions from disclosing such information, there is no such prohibition in sharing such information with an agency exercising its “supervisory, regulatory or monetary functions”.18 The Guidance also states that FinCEN has interpreted these regulations under BSA to require financial institutions to provide supporting documentation “even in the absence of legal process”.
For more information, please contact Robert (Bob) Kardell, at 402.636.8313, bkardell@bairdholm.com, or visit bairdholm.com.
1 This article is only intended to cover the response of a bank to a federal grand jury subpoena. There are, of course, many other methods for law enforcement or regulatory agencies to seek access to information covered by the RFPA, such as intelligence requests, search warrants, regulatory requests, administrative requests, and many other such requests. Each type of request has its own unique legal requirements, disclosure or non-disclosure restrictions, exceptions, and compliance issues which should be discussed completely with your legal or compliance professional before a response is provided.
2 12 U.S. Code § 3401 et seq.
3 12 U.S. Code § 3403(a)
4 12 U.S. Code § 3402
5 “Financial records” are defined as “an original of, a copy of, or information known to have been derived from” a customer’s bank records. 12 U.S.C. § 3401(2). In Hunt v. SEC, 520 F. Supp. 580 (N.D.Tex.1981), the court held that the plain meaning of the language of § 3401(2) “clearly includes oral testimony relating to a customer’s relationship with a bank or financial institution.” Id. at 605. “We agree.”
Anderson v. La Junta State Bank, 115 F.3d 756, 759 (10th Cir. 1997)
6 12 U.S. Code § 3411
7 12 U.S. Code § 3420(b)
8 12 U.S. Code § 3413(i)
9 12 U.S. Code § 3409(b)(1)
10 12 U.S. Code § 3409(b)(2)
11 31 CFR § 1020.320(a)(1)
12 31 CFR § 1020.320(b)
13 31 CFR § 1020.320(d)
14 IBID
15 FIN-2007-G003, issued June 13, 2007, https://www.sec.gov/about/offices/ocie/amlmf/fin-2007-g003.pdf
16 ID at pg. 3
17 IBID
18 ID at pg. 3
