Our customer (soon to be X) appears to be involved in multiple fraudulent ACH deposits and IRS deposits. We will file a SAR and have frozen the funds in the account. The bank has suffered no loss. My question, do we have any right OR responsiblity to retain the funds remaining in the account? thank you.

From IRS FAQ.

If suspicious or fraudulent activity is suspected on a refund received, who should an RDFI contact?
The RDFI could contact IRS at 1-800-829-1040 to report the questionable payment. As a general rule, when an RDFI is in doubt, it should return any refunds to the Treasury Fiscal Service. Additionally, if the financial institution suspects that a refund payment or payments is associated with fraud, the institution could use IRS’ External Leads Program by emailing information about the questionable refund to efleads@irs.gov. IRS will perform additional research into the refund payment or payments.

As you believe fraud is involved, you will need to file a SAR if the activity exceeds the threshold amount. Personally, I would return the funds, file the SAR ASAP, then contact the "eleads" address with the DCN of the SAR and my phone number.