15.1 Talking to Customers During Investigations and Offboarding: Financial Crime Risk vs Policy Breach
Key Takeaways
Customers can be asked about payment purpose, counterparties and source of funds, framed as routine account checks.
US law prohibits disclosing a SAR or any information that would reveal one; UK law creates tipping-off and prejudicing-an-investigation offences.
FinCEN 314(a) requests are confidential and must not be disclosed to the customer or any third party.
A policy breach can be explained to the customer; an exit driven by suspected financial crime uses neutral contractual wording and no hints about suspicion.
CAFCA sub-topic 4.1 covers appropriate customer communication: what questions can be asked, and what can be disclosed during investigations and offboarding. Sub-topic 4.7 covers communicating for financial crime risk versus violation of company policy. Front-line staff, support agents and investigators all talk to customers, so one careless sentence can ruin an investigation and expose the firm to criminal liability.
What you can ask
Requests for information (RFIs) are a normal part of CDD and investigations. Typical lawful questions:
- What was the purpose of a payment, and what is the relationship with the counterparty?
- Where did these funds come from? Can you provide a contract, invoice, payslip, sale agreement or bank statement?
- What does your business sell, to whom, and through which channels? Is this level of activity expected to continue?
- Please confirm or update your identity and address details.
How to ask:
- Frame it as routine: "As part of our regular account reviews, we need some information about recent activity."
- Be specific about what you need, but do not say why you are asking.
- Do not lead the customer towards an answer ("Was this money from your parents?").
- Set a deadline and explain what happens if the information is not provided, for example restrictions under the terms.
- Record the request and the response in the case file.
What you must never disclose
| Do not disclose | Why |
|---|---|
| That a SAR or STR has been, or may be, filed | Tipping off: US 31 U.S.C. 5318(g)(2); UK POCA section 333A; EU AML rules |
| That an internal investigation or alert review is under way, where that could prejudice it | UK POCA section 342 (prejudicing an investigation) and similar laws elsewhere |
| That law enforcement or FinCEN has made an inquiry (including a 314(a) request or a subpoena with non-disclosure terms) | Confidentiality of the request; risk of evidence destruction |
| Internal risk scores, monitoring rules or the source of any intelligence | Helps criminals evade controls |
Phrases to avoid include "our AML team flagged you", "we're required to report this", "the police asked about your account" and "your transactions look like money laundering".
Offboarding communication
When a relationship ends:
- Follow the contract and the law. Give the notice required by the terms and any applicable consumer or payment-services rules, unless immediate termination is permitted, for example where fraud is suspected.
- Use neutral wording: "We have decided to close your account in line with section X of our terms." Many jurisdictions allow firms not to give a detailed reason where giving one would be unlawful or would tip off.
- Handle the remaining balance lawfully. Funds may be returned to the customer or to the source. They may need to be frozen if they are blocked under sanctions, subject to a court or law enforcement order, or, in the UK, suspected criminal property needing a DAML before release.
- Keep scripts consistent. Support agents should have approved wording and an escalation route for customers who ask "Is this because of a report?". An appropriate answer is: "We can't discuss our internal reviews, but here is how to collect your funds and make a complaint."
- Coordinate with law enforcement. If law enforcement has asked the firm to keep an account open (a "keep open" request), the firm may comply under its policy, but the decision remains the firm's. Get the request in writing, as FinCEN guidance recommends.
Financial crime risk versus a breach of company policy (4.7)
| Situation | Example | What to tell the customer |
|---|---|---|
| Policy or terms breach only | Using a personal account for a business; a prohibited merchant category; excessive chargebacks; acceptable-use violations | The specific breach, the clause concerned, and any remedy (open a business account, stop the activity) |
| Suspected financial crime | Possible mule activity, laundering, scam proceeds, sanctions evasion | Neutral contractual exit or restriction message, with no reference to suspicion or reporting |
| Both | A prohibited merchant type that also looks like transaction laundering | Rely only on the true, non-sensitive reason, worded carefully, or the neutral clause. Never invent a false reason |
Even where only a policy breach is involved, consider whether it also raises suspicion before explaining it in detail. A detailed explanation might reveal the detection logic. Escalate unclear cases to the MLRO or legal team before contacting the customer.
Realistic exam scenario
A wallet customer whose outbound transfers are restricted calls support and demands to know whether "the bank reported me to the government". The agent should not confirm or deny anything about reporting. Instead the agent should explain that the account is under review in line with the terms, list any information requested and the deadline, and give the complaint route. The call note goes into the case file. Saying "we can't confirm a SAR" in a way that implies one exists would also be risky. Stick to approved wording.
Common exam traps
- Explaining the real reason for a suspicion-driven exit "to be transparent". This can be tipping off.
- Refusing to ask the customer anything for fear of tipping off. Neutral RFIs are allowed and useful.
- Inventing false reasons for an exit. Use the neutral contractual basis instead.
- Forgetting that 314(a) and law enforcement requests are confidential.
Which request for information is most appropriate during an open investigation?
"As part of a routine review, please describe the purpose of the payments on 3-5 May and send any invoices."
"Our AML team thinks these payments are suspicious and may need to be reported. Please explain them."
"The police contacted us about you last week. What exactly were these payments for?"
"Please confirm whether you are laundering money through this account."
A customer is exited only because they used a personal account to run a high-volume business, which the terms forbid, and there is no suspicion of crime. What should the communication do?
Tell the customer that a SAR was filed, to discourage the same behaviour at other banks
Avoid giving any reason at all, because every exit must be kept confidential
Freeze all of the customer's funds indefinitely
Explain the specific terms breach and offer a remedy such as a business account
Law enforcement asks a FinTech in writing to keep a suspect's account open to support an investigation. What is the correct understanding?
The FinTech must keep the account open indefinitely, whatever its own risk view
The request overrides the FinTech's SAR obligations while the account stays open
It may keep it open under its own policy; the decision stays with the firm
The FinTech must tell the customer about the request so they can respond
Sections you finish are checked off in the contents.