The cost sits exactly where it did before. The agencies say the statement creates no new formal regulation [6], which means it hands out no safe harbor either, and they add that firms should judge these instances on a fact-specific basis [5], so the officer who calls a customer about a wire still owns the wording and the bank still owns the file if an examiner reads that call differently two years later. What moved is the availability of a defence, not the law.
The load-bearing sentence is the concession about deduction. The Bank Secrecy Act bars disclosing a SAR and also bars information revealing that one exists, while permitting discussion of the underlying facts, transactions and documents on which it is based [4], and the agencies have now written down that although a reasonable and prudent person familiar with the filing requirement may suspect or deduce a SAR from those facts, the underlying information alone does not constitute information revealing its existence [3]. The statement puts five contact types on the safe side [1]: document requests, notice of a closure or restriction or a rejected deposit, questions about a transaction's purpose, fraud advisories, and questions about who originated or received a transfer [5].
Two constituencies get served by one document. The agencies asked banks in June 2025 what more could be done about check fraud, and commenters asked for leeway to talk to customers during an investigation [7]; the statement also says it recognises the concerns of President Trump's debanking executive order, on the grounds that it widens the channels between customer and bank [8]. Fraud teams wanted permission to warn people. The White House wanted fewer silent exits.
The pending piece is where budget actually moves. Under the proposal, banks could narrow their resources to higher-risk customers and activities while keeping risk-based internal controls, independent testing, a US-based AML officer in regulator contact and ongoing training [10], which is the flexibility the agencies have been signalling as part of the administration's compliance overhaul [12]. Note the two-part standard, which makes having a programme and implementing it separate obligations, or rather two separate ways to fail the same exam [2]. And the FDIC would have to notify FinCEN 30 days or more before a significant AML action, with banks putting their side to FinCEN in that window [11], a floor with no stated ceiling, so the bank-side lobbying period before an action begins at a month and can only run longer [3].
This is probably wrong, but I think the behavioural change is smaller than the wording suggests, because the constraint on talking to a flagged customer was never only SAR confidentiality: it was civil exposure and the arithmetic of staffing conversations, which is why anti-fraud spending has gone into technology, where spend has soared in recent years according to American Banker research [9], rather than into people who pick up phones. Software scales per transaction, while a fact-specific judgement has to be made case by case, one call at a time. If closure notices start explaining themselves and fraud-warning contact volumes climb, I had that backwards.
