SAR Privilege Protects U.S. Bank’s Internal Investigation Policies and Procedures

In a broad interpretation of the Suspicious Activity Report (SAR) privilege, a Washington state appellate court ruled that the privilege precludes disclosures of a bank’s policies and procedures for investigating suspicious activity. The privilege also precludes disclosure of the bank’s specific internal investigations into wrongful conduct. Norton v. U.S. Bank Nat’l Ass’n, 324 P.3d 693 (WaSAR Reportsh. Ct. App. 2014). You may read the opinion here.

Ponzi Scheme

A U.S. Bank employee left to start an investment company, which later turned out to be a Ponzi scheme using several accounts at U.S. Bank. The plaintiffs invested in the Ponzi scheme, lost $11 million, and later sued U.S. Bank for breaches of fiduciary duty, fraud, and several other causes of action.

In discovery, the plaintiffs sought all documents related to U.S. Bank’s internal investigation and documents, including policies, generally related to U.S. Bank’s internal monitoring and investigations to detect money laundering. U.S. Bank resisted the discovery on grounds that the SAR privilege protects general and specific internal investigation documents from civil discovery. The Washington appellate court agreed and reversed the trial court’s denial of the privilege.

SAR Privilege

The SAR privilege arises from the Bank Secrecy Act, 31 U.S.C. § 5318, and its implementing regulations. The confidentiality provisions of 12 CFR § 21.11(k) constitute an “unqualified discovery and evidentiary privilege.” The SAR privilege covers not only the Suspicious Activity Report, but also any information that would reveal whether such a report exists.


In Norton, the state appellate court held that simply redacting explicit references to the existence of a SAR is insufficient to enforce the privilege. The court interpreted the SAR privilege broadly, finding that federal statutes require banks to establish internal policies, procedures, and controls to detect and report money laundering, and that these policies are intertwined with banks’ obligation to report suspicious activity. As such, the court ruled that “discovery into these matters will produce documents suggesting” that the bank either filed or considered filing a Suspicious Activity Report.

The court did not require U.S. Bank to produce its internal investigation policies and procedures generally or with specific reference to its former employee’s Ponzi scheme. According to the court, “internal reports and methods used to investigate suspicious activity are precisely the type” of supporting documentation that the SAR privilege covers.