Confidentiality in Banking: Rights, Disclosures, and Penalties

Bank confidentiality rules require your bank to keep your personal financial information private by default, but federal law carves out specific situations where it can, or must, share that information anyway. Three statutes do most of the work: the Gramm-Leach-Bliley Act (GLBA) governs sharing with private third parties, the Right to Financial Privacy Act (RFPA) restricts government access, and the Bank Secrecy Act (BSA) forces banks to report certain transactions to federal authorities without telling you. Knowing where each rule stops is how you know what your bank actually owes you.

What Your Bank Has to Keep Private

The protected category is broad. Under GLBA, any “nonpublic personal information” (NPI) you give your bank falls under confidentiality protections: name, address, Social Security number, income, account balances, transaction history, loan applications, and payment records. It also covers the simple fact that you have a relationship with that bank at all.¹

The duty also has roots in common law and in the account agreement you signed. Courts treat the bank-customer relationship as one of trust. In practice, your bank cannot release your information just because someone asks. A specific legal exception has to apply.

The Privacy Notice and Your Opt-Out Right

GLBA is the core federal privacy law for banks, credit unions, and similar institutions. It requires each of them to explain its information-sharing practices and to protect sensitive data.²

Before your bank can disclose your NPI to a nonaffiliated third party, it must give you a privacy notice and a chance to opt out. The notice has to spell out what information the bank collects, who it shares that information with, and how you can tell the bank not to share.¹

You get this notice when you open the account. Annual notices used to be mandatory, but the FAST Act of 2015 loosened that. If your bank shares information only in ways that don’t require opt-out rights and hasn’t changed its privacy practices since the last notice, it no longer has to mail you an annual update.³

One protection sits above the opt-out: even where another exception applies, your bank cannot share your account numbers with unaffiliated companies for telemarketing or direct mail marketing purposes.¹

When Your Bank Can Share Without Asking You

The opt-out right has significant carve-outs, and they cover most of the routine data-sharing banks do every day. Under 15 U.S.C. § 6802(e), a bank can share your NPI without giving you the chance to object when the sharing falls into one of these categories:¹

Servicing and processing your transactions or maintaining an account or product you signed up for.
Joint marketing with another financial company, if a contract restricts how that company uses the data.
Fraud prevention, including protecting against unauthorized transactions or other liability.
Reporting to or receiving data from a credit bureau under the Fair Credit Reporting Act.
Complying with federal, state, or local law, or responding to a subpoena, court order, or regulatory investigation.

Read the list carefully. It means your privacy notice is really telling you about the narrower slice of sharing where you actually have a choice.

When the Government Can See Your Records

GLBA mostly deals with sharing between your bank and other private companies. A separate statute, the RFPA, governs when the government can look at your bank records. No government authority can access your financial records unless one of five conditions is met: you authorized the disclosure, the government obtained an administrative subpoena or summons, a search warrant was issued, a judicial subpoena was served, or a formal written request meeting the statute’s requirements was submitted.⁴

You generally have the right to be notified of the request and to challenge it in court before the records change hands. Exceptions exist for pending criminal investigations and situations where notice could jeopardize collection of a tax debt.⁴

The RFPA also has structural exceptions. It does not apply when a banking supervisory agency examines records as part of its regulatory work, when records are sought under federal tax procedures, when the government and the customer are both parties to the same litigation, or when law enforcement is only requesting basic identifying information such as your name, address, and account type.⁵ Bank regulators like the OCC, FDIC, and Federal Reserve can pull individual records in normal examination and enforcement work without going through the notice-and-challenge process.

The IRS has its own summons authority. Under 26 U.S.C. § 7602, it can require anyone with custody of relevant books or records to produce them and testify under oath. If the IRS plans to contact a third party like your bank, it generally must notify you at least 45 days before the contact period begins. That notice is skipped when you authorized the contact, when notice would jeopardize collection, or when a criminal investigation is pending.⁶

Reports Your Bank Files Without Telling You

The Bank Secrecy Act inverts the confidentiality default for a defined set of transactions. Instead of protecting the information, the BSA requires your bank to send it straight to the federal government.

Currency Transaction Reports

Your bank must file a Currency Transaction Report (CTR) with FinCEN for cash transactions above $10,000 in a single day. That covers deposits, withdrawals, currency exchanges, and other cash movements at that threshold.⁷ It is automatic and routine. A CTR does not mean you are suspected of anything. Deliberately breaking up transactions to stay under the threshold, though, is a federal crime.

Suspicious Activity Reports

Suspicious Activity Reports (SARs) are the tougher category. Banks must file a SAR when they detect transactions that may involve money laundering, terrorism financing, tax evasion, or other illegal activity. Insider abuse triggers a filing at any amount; other suspicious activity generally requires transactions at $5,000 or more when a suspect can be identified, or $25,000 or more regardless.⁸

Here the confidentiality direction flips again, this time against you. Federal law flatly prohibits any director, officer, employee, or agent of the bank from telling you a SAR was filed, or from revealing any information that would indicate one was made. Government employees who know about the SAR face the same prohibition. This is the “no-tipping-off” rule, and it is specific to SARs.⁹ If you ask your bank whether one has been filed on you, expect no answer.

How Your Bank Must Protect Your Data

Confidentiality is not just about who your bank shares with; it also covers how well it locks the data up. GLBA’s Safeguards Rule requires every covered institution to build and maintain an information security program with administrative, technical, and physical protections.¹⁰ The FTC strengthened the rule in 2023. Institutions must designate a qualified individual to oversee the program, run regular risk assessments, enforce access controls, encrypt customer data, use multi-factor authentication, and test their safeguards through penetration testing and vulnerability assessments.

When a breach affects at least 500 consumers, the institution has to notify the FTC within 30 days of discovering the unauthorized access.¹¹ Direct notice to affected customers is governed by state law, and most states set the window at 30 to 60 days after discovery. The notice should describe what happened, what information was exposed, and what the bank is doing to protect you going forward.

Penalties When a Bank or Someone Else Breaks These Rules

GLBA violations carry real consequences. Institutions face fines of up to $100,000 per violation. Officers and directors who bear personal responsibility can be fined up to $10,000 and sentenced to up to five years in prison.¹²

The law also reaches outsiders. Anyone who obtains customer financial information through fraud or deception faces up to five years in prison, or up to ten years when the conduct is part of a pattern of illegal activity involving more than $100,000 in a 12-month period.¹² Pretexting, where someone impersonates you or uses a false identity to pry loose your records, is a federal crime under GLBA.

What to Do If You Think Your Bank Disclosed Something It Shouldn’t Have

Start with the bank. File a written complaint with the compliance department. Document what was disclosed, when you discovered it, and any harm you experienced. The bank has to investigate and respond.

If that response falls short, escalate to a federal regulator. The Consumer Financial Protection Bureau accepts complaints online and by phone, forwards them to the institution, and tracks the response. Companies generally have to respond within 15 days, with a final response due within 60 days in more complex cases.¹³ Depending on how your bank is chartered, you can also file with the OCC (national banks), the FDIC (state-chartered banks that are not Federal Reserve members), or your state banking regulator.

When a privacy breach causes real financial harm or identity theft, civil litigation becomes an option. Suits typically allege breach of contract, negligence in protecting NPI, or violations of specific statutory protections. The hard part is proof: courts want a direct link between the bank’s disclosure and the loss you are claiming, not another compromise that could have caused it.

A Note on Foreign Accounts

If you hold accounts outside the United States, separate reporting rules apply, but they run through you, not your bank. You are the one who files the FBAR with FinCEN when combined foreign account values exceed $10,000 at any point in the year,¹⁴ and you are the one who files Form 8938 under FATCA at higher thresholds tied to your filing status and residence.¹⁵ Domestic bank confidentiality rules do not shield you from those obligations.

1
Office of the Law Revision Counsel. United States Code Title 15 Section 6802 – Obligations With Respect to Disclosures of Personal Information
2
Federal Trade Commission. Gramm-Leach-Bliley Act
3
Federal Register. Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act Regulation P
4
Office of the Law Revision Counsel. United States Code Title 12 Section 3402 – Access to Financial Records by Government Authorities
5
Office of the Law Revision Counsel. United States Code Title 12 Chapter 35 – Right to Financial Privacy
6
Office of the Law Revision Counsel. United States Code Title 26 Section 7602 – Examination of Books and Witnesses
7
FinCEN. The Bank Secrecy Act
8
FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Suspicious Activity Reporting
9
Office of the Law Revision Counsel. United States Code Title 31 Section 5318 – Compliance, Exemptions, and Summons Authority
10
Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
11
Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
12
Office of the Law Revision Counsel. United States Code Title 15 Section 6823 – Criminal Penalty
13
Consumer Financial Protection Bureau. Submit a Complaint
14
Internal Revenue Service. Report of Foreign Bank and Financial Accounts (FBAR)
15
Internal Revenue Service. Summary of FATCA Reporting for US Taxpayers