Facing a case where we have filed an SAR involving a bank officer and now an FBI agent has requested a meeting to discuss the issue. Concerned that he will ask for other customer's information since the bank officer used valid customer accounts in his scheme. Any thoughts on disclosing these records?

You should have compiled a file of information documenting your research and what you used as the basis for filing the SAR. This file is the property of FinCEN once the SAR has been filed. It is my understanding that you can discuss anything in this file with law enforcement. Anything else should require a subpoena for records.

Get the sub poena first. In the SAR, you probably stated that the suspect used customer accounts. Now it is up to the FBI to request any such records using proper procedures. Do not simply hand stuff over.

Also, make sure your subpoena contains the RFPA certification. In their haste to get to the bank with the subpoena, I think they sometimes fail to get the certification. We were presented a subpoena by an agent recently and it did not have the RFPA. As far as I know, the FBI is subject to RFPA requirements.

Absolutely, yes, and you bet they are! Great suggestion, Brenda!

As Brenda notes, in Part V (a) of the SAR you described your supporting documentation, every document you used to complete the SAR. I suggest you pull those documents together before your meeting, not in the heat of the moment. Make certain you have everything before you sit down. If the agent wants something and it is not in your stack, then you know you need a summons or some form of legal compulsion before you can deliver it. You don't have to think or make excuses, you just say that you did not use that document to complete the SAR.

Some smaller institutions that do not file large volumes of SARs put copies of all their supporting documentation in a sealed envelope with their file copy SAR. If they get a later request for documentation from law enforcement even someone unconnected with the orignal filing knows anything in the envelope is fair game. If its not there, they know they need to ask for some form of legal compulsion.

As internal controls go, you can't get much more basic than this, but it does work.

Personal opinion: Be willing to reconsider the completeness of your SAR in the judgment someone who is attempting to enforce the law. If you come to believe your filing was not complete or it did not list all the supporting documentation you actually used, be willing to both file an amendment and notify the agent that you have done so.

Thankfully I've had little practical experience with this, but some. When you want the subpoena for those records, don't take, "what, I've done this hundreds of times and you are the ONLY bank that ever wanted this. Do you know what I'll have to do to get that...". If you get gruff, I suggest you get counsel.