What are the penalties for violating Section 5318(g)(2)? An employee told her husband about an internal investigation. The husband told his entire family who are friends with the suspects reported in the SAR. Of course, a family member then told the suspect. In order to convey the severity of the situation I want to state the penalties (civil or criminal?). Also I will let the Bank know that we may have waived our protection under the safe harbor from civil liability.

Did the employee tell them about the internal investigation or did the employee tell them the bank had filed a SAR on them? Was the employee aware that a SAR had been filed?

This is very serious offense if they were involved in an unauthorized disclosure that a SAR had been filed. Citing them the penalties in order to impress upon them the seriousness of what happened is not the proper action. This is a Federal offense and triggers the need for an additional SAR and you should call your regulatory agency.

While the answer to rlcarey's question is critical, I'll put up this link up to support some of his concerns. There is no specific penalty attached to disclosures related to SAR filing; a prosecutor would have to figure out where it "fit." However, it would undoubtedly be considered an intentional violation for the individual. (It might be for the bank as well.) Your safe harbor should be intact.

Loose lips sink ships, but they sink careers too. That should be the thing your employee should understand first; i.e. she's not waiting to find out what your regulators decide, she's waiting to find out what your bank decides.

This employee should not be enjoying her coffee-breaks at your establishment any longer. I would most certainly hope that part of your institution's new-hire orientation is a discussion of how critical confidentiality is to the bank. This woman should most assuredly be shown the door as a direct consequence of her gossip. That she only told her husband is no excuse.

It's unfortunate that this misstep should result in this employee's termination, but the bank should also take away a lesson -- investigations need to be done carefully, with as few people in the organization as possible privy to what is happening or the names of the targets of the investigation. Any employees not routinely involved in investigations that are brought in through necessity should be warned about the consequences of sharing information with others.