Credit Union Exam Solutions Presents With Flying Colors

www.marktreichel.com

https://www.linkedin.com/in/mark-treichel/

On September 2, five agencies signed a joint statement on suspicious activity report (SAR) confidentiality: the Federal Reserve, the FDIC, the OCC, the NCUA, and the Financial Crimes Enforcement Network (FinCEN). Every prudential regulator plus the Bank Secrecy Act (BSA) rule maker on the same page. That is not one agency freelancing.

The subject is narrow and the headline is simple. SAR confidentiality rules do not prevent a credit union from communicating with a member about a potentially fraudulent transaction, or about an action taken on their account — a hold, a closure. What stays confidential is the existence of the SAR itself and its contents. Two different things, and for years a lot of compliance programs have treated them as one.

Mark Treichel, former NCUA Executive Director, walks through the operative sentence in the statement — a SAR, or information that would reveal a SAR exists, does not include the underlying facts, transactions, and documents that the SAR is based on — and explains why that is a legal test rather than a question of institutional risk tolerance.

He then takes it where it actually lands: on the CEO's desk. Internal guidance written more restrictively than the rule requires is not a safe harbor. It is a credit union's own policy manufacturing member service and complaint handling exposure, and it gets asked about under the consumer compliance side of the exam, separate and apart from the BSA/AML module. Examiners will ask how you communicate with members during a fraud hold. "We say nothing, ever" is a harder answer to defend than it was a week ago.

The episode closes with a three-step gap analysis a BSA officer can finish this week, and a broader question worth sitting with: where else in the program did the safe answer quietly become the house rule?