I have a situation where we believe a customer has passed away and someone else may have stolen his identity. Under this suspicion, can we notify law enforcement of the situation? And, are we restricted in what we can tell them from a confidentiality standpoint?

That's a little vague, but if you have the basis for filing a SAR (voluntary or mandatory) you have a safe harbor for discussing the situation with law enforcement once the SAR is filed. Don't delay.