If there is a request from a law enforcement agency for supporting documentation relating to a SAR that you filed, what procedures would you follow and what would you require of the agency before sharing the supporting documentation with them?

Ask for confirming identification, and make a careful note of everything on the ID (don't accept a business card). Then ask them to identify the SAR in question, so that you can pull the correct files.

Provide no more than a copy of the SAR and any documents in the file that support the filing. Do not include any documents you may have that might support a follow-up filing, unless you complete the filing first. If the representative asks for anything that's not in the file, require a subpoena before retrieving it.

Thanks for your reply John!

As I understand the SAR confidentiality rules, Banks are not prohibited from sharing with or disclosing to law enforcement agencies SAR information which includes the actual SAR and any SAR supporting documentation (as this is considered part of the SAR). In fact, law enforcment agencies are allowed access to this information without having to provide a subpoena or other "legal" tool to retrieve such information and Banks are encouraged to share this information with them.

With that said, it is also my understanding that the Bank's responsibility with respect to disclosure of SAR information to law enforcement agencies, is to verify the validity and legitimacy that the request is indeed coming from an actual law enforcement agency.

Now, as part of the Bank's responsibility to verify the validity and legitimacy of the request, the Bank requires the law enforcement agency to formalize their request by providing it in writing on agency letterhead so that the Bank can document it's verification of the request from an appropriate requestor. In other words, the Bank will not provide or release this information simply upon oral request. To clarify, the Bank isn't requiring a subpoena or summons or other "legal" document before it would release this information in this instance. Instead, it is simply requiring the request in writing on agency letterhead to document our verification of the agencies identity and request.

If the agent of the agency gives you grief over having to request the information in writing by arguing that they are not required to do so, how would you handle this?

I would point out to them that if the bank requires it they are indeed required to do so.

I went through a similar situation with a testy Dectective once. He thought simply flashing his badge was more then enough information to take whatever he wanted. Simply put, make him put it in writing. His potential possible threats to you and/or the bank are meaningless.