...he is asking for chapter and verse where it states specifically that we cannot share with an outside legal counsel.
You won't find anything like that in any official source. "SAR confidentiality" has taken on a life of its own in the minds of many bankers; it means far less than most bankers think it does.
Banks can set their SARs to music and sing them at their employee meetings if they want to. Yes, it would be both reckless and useless, but it is not prohibited.
The statute prohibits
notifying the subject of the SAR. The regulatory agencies regs merely say "SARs are confidential." There isn't anything official that says you cannot share SAR filings with employees and advisors; that type of sharing would still be confidential. (Proposed regulations on SAR confidentiality will not change this; they do not address how SARs are used within the depositary institution.)
Personal opinion very strongly held: The
real "safe harbor" isn't about the fact that you are
guaranteed to win a law suit instigated by the SAR subject. It's about not getting sued to begin with. The best way to avoid being sued is to make certain the subject never finds out about the filing. The best way to make certain the subject never finds out about the filing is to make certain that the smallest possible number of people know about the filing.
So far, the people with the really big mouths are those with law enforcement agencies. Maybe the proposed regulations will help them in zippering their lips.
As far as showing a SAR to outside legal counsel it's fine, but the overwhelming query should be a simple "Why?" As rlcarey notes, it has already been filed. There isn't one lawyer in 100 capable of rendering a competent legal opinion about whether the filing was required or voluntary, but either way it's already been filed so the point is moot. If the content portends some future legal problems for the bank, then it does make sense to let your legal counsel know what's going on. If it is handled correctly, it will be privileged communication and it will not be subject to disclosure.
...he said that we were doing the "cops jobs" and we should keep it short and sweet.
The FinCEN ppt presentation used at Top Gun is the most detailed description I know of regarding how specific you should be in describing supporting documentation. He should watch it. Give him some popcorn and a clue: Your bank is part of the law enforcement community in the United States. The fact that you were drafted rather than volunteered is of no consequence.