Source: https://www.fdic.gov/news/news/financial/2006/fil06005a.html
Timestamp: 2019-04-26 14:06:50+00:00

Document:
The Financial Crimes Enforcement Network, along with the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision (collectively, the "Federal Banking Agencies") is issuing this guidance to confirm that under the Bank Secrecy Act and its implementing regulations (and parallel provisions issued by the Federal Banking Agencies): 1 a U.S. branch or agency of a foreign bank may disclose a Suspicious Activity Report to its head office outside the United States; and 2 a U.S. bank or savings association ("depository institution") may disclose a Suspicious Activity Report to controlling companies whether domestic or foreign. This guidance does not address the applicability of any other Federal or state laws.
A depository institution that files a Suspicious Activity Report may disclose to entities within its organization information underlying the filing (that is, information about the customer/suspect and transaction(s) reported). However, neither the Financial Crimes Enforcement Network nor the Federal Banking Agencies have taken a definitive position concerning whether a depository institution is permitted under the Bank Secrecy Act and Federal Banking Agency regulations to share or disclose to entities within its corporate structure, the Suspicious Activity Report itself or the fact that a Suspicious Activity Report was filed.5 The answer to this question has become a critical issue, particularly in a global context.
There may be circumstances under which a depository institution would be liable for direct or indirect disclosure by its controlling company or head office of a Suspicious Activity Report or the fact that a Suspicious Activity Report was filed. Therefore, the depository institution, as part of its anti-money laundering program, must have written confidentiality agreements or arrangements in place specifying that the head office or controlling company must protect the confidentiality of the Suspicious Activity Reports through appropriate internal controls.
The sharing of a Suspicious Activity Report with a non-U.S. entity raises additional concerns about the ability of the foreign entity to protect the Suspicious Activity Report in light of possible requests for disclosure abroad that may be subject to foreign law. These concerns will need to be addressed in the confidentiality agreements or arrangements. The recipient head office, controlling entities or parties may not disclose further any Suspicious Activity Report, or the fact that such report has been filed; however, the institution may disclose without permission underlying information (that is, information about the customer and transaction(s) reported) that does not explicitly reveal that a Suspicious Activity Report was filed and that is not otherwise subject to disclosure restrictions.
The Financial Crimes Enforcement Network and the Federal Banking Agencies are considering whether a depository institution may share a Suspicious Activity Report with an affiliate other than a controlling company or head office, both in instances where the affiliate is located inside the United States and where the affiliate is located abroad. We expect to issue guidance on this issue shortly; but, until such time, depository institutions should not share Suspicious Activity Reports with such affiliates.
b) a savings and loan holding company, as defined in Section 10(a) of the Home Owners’ Loan Act.
For purposes of this guidance, a controlling company also includes a company having the power directly or indirectly, to direct the management or policies of an industrial loan company or a parent company or to vote 25% or more of any class of voting shares of an industrial loan company or a parent company.
See 31 U.S.C. 5318(g)(2) and 31 C.F.R. § 103.18(e).
See 31 C.F.R. § 103.18(e).
See 12 C.F.R. § 353.3(g) [Federal Deposit Insurance Corporation]; 12 C.F.R. § 208.62(j) [Board of Governors of the Federal Reserve System]; 12 C.F.R. § 21.11(k) [Office of the Comptroller of the Currency]; 12. C.F.R. § 563.180(b)(12) [Office of Thrift Supervision].
However, the Federal Banking Agencies’ regulations require notification of the filing of Suspicious Activity Reports to boards of directors, whether domestic or global. See 12 C.F.R. § 353.3(f) [Federal Deposit Insurance Corporation]; 12. C.F.R. § 208.62(h) [Board of Governors of the Federal Reserve System]; 12 C.F.R. § 21.11(h) [Office of the Comptroller of the Currency]; 12 C.F.R. § 563.180(b)(9) [Office of Thrift Supervision].
It should be noted that the requirement that knowledge of a Suspicious Activity Report’s filing may not be disclosed to the controlling entity or party remains, even under this guidance, if there is a reason to believe it may be disclosed to any person involved in the suspicious activity that is the subject of the Suspicious Activity Report.

References: § 103
 § 103
 § 353
 § 208
 § 21
 § 563
 § 353
 § 208
 § 21
 § 563