In ABA’s Risk News yesterday under "Making Permitted SAR Disclosures", they listed the following as part of the process for disclosure of SAR information to appropriate agencies:

Notify your bank regulatory agency and FinCEN, if they are not the requestors.

The FFIEC BSA Exam Manual states:

“Thus, any person subpoenaed or otherwise requested to disclose a SAR or the information contained in a SAR, except when such disclosure is requested by FinCEN or an appropriate law enforcement or federal banking agency, shall decline to produce the SAR or to provide any information that would disclose that a SAR has been prepared or filed, citing 31 CFR 103.18(e) and 31 USC 5318(g)(2). FinCEN and the bank’s federal banking agency should be notified of any such request and of the bank’s response.”

I interpreted what is in the FFIEC manual to mean you must notify FinCEN and your regulator if someone who is not authorized makes the request.

Please clarify: Must the bank notify FinCEN and the bank's regulator if the requester is an appropriate law enforcement agency?

If so, must the notification be made before the supporting documentation is released?

How do you notify them (by phone, email, letter)?

Also, if the agent asks questions about what is in your narrative, can you discuss it with them on the phone or can you only provide copies of supporting documents?

Thanks in advance – I received a phone call yesterday from an appropriate agency and need to know how to proceed.

I once had this happen. What I did was to follow the FFIEC guidance as you quoted. I did not notify my regulator. Unless you place the call, I would be careful talking with anyone over the phone, because obviously you can never be sure with whom you are speaking. Even through the agent that contacted me had details from the SAR that I had filed, I insisted that the agent come to my office before I would even acknowledge the existence of the SAR.
I let him look at the file and take copies of the documents.

Thanks for the reply, USA Banker. We've only had one request prior to this one and we required they put the request for supporting docs in writing, verified the caller's identity by contacting the field office where they work, viewed their badge and had them sign when they picked up the supporting docs.

Anyone else have input on whether they contact FinCEN and their regulator? Or if/how much you discuss via phone?

The requirement that you contact FinCEN and your regulator only kicks in if you are subpoenaed or requested by someone not authorized by law to have access to the SAR. That would include a subpoena from a divorce lawyer, for example.