17.3 Types of Law Enforcement Requests: Subpoenas, Court Orders, 314(a), and International Requests

CAFCA sub-topic 4.6 covers the types of law enforcement requests, such as requests for information and court orders, both domestic and international. Knowing the instrument tells you whether you must comply, what you may disclose, how quickly you must act, and whether the customer can be told.

United States

The Right to Financial Privacy Act of 1978 (RFPA) limits federal government access to the records of bank customers who are individuals or partnerships of five or fewer. Generally it requires legal process and notice to the customer, with exceptions that include grand jury subpoenas and SAR reporting. Legal teams check RFPA, the Gramm-Leach-Bliley Act and state rules before making any voluntary disclosure.

United Kingdom

Under the Proceeds of Crime Act 2002 (POCA), investigators can apply to court for:

• Production orders (section 345), requiring specified material to be produced.
• Customer information orders (section 363), requiring a firm to say whether a person holds accounts and to give details.
• Account monitoring orders (section 370), requiring transaction information for up to 90 days.
• Account freezing orders (section 303Z1, inserted by the Criminal Finances Act 2017), freezing funds in accounts pending forfeiture proceedings.
• Further information orders (section 339ZH), which the NCA can seek after a SAR.

Data protection law also allows voluntary disclosure to law enforcement where it is necessary for crime prevention and the exemption conditions are met. The firm documents its decision.

International requests

• Mutual legal assistance treaties (MLATs): formal government-to-government requests for evidence, such as bank records, for use in foreign proceedings. They are slow but provide admissible evidence.
• Letters rogatory: court-to-court requests where no treaty applies.
• FIU-to-FIU exchange: national FIUs share financial intelligence through the Egmont Group network. A firm reports to its own FIU, which may share abroad.
• Police cooperation channels, such as Interpol and Europol, for intelligence and urgent matters.
• Direct contact from foreign police: generally a foreign agency cannot compel a firm abroad. The firm should verify the request and take legal advice. It should consider local privacy and banking-secrecy law and usually direct the agency to the proper channel, such as an MLAT or its own country's FIU or police.

FATF Recommendations 37 to 40 require countries to provide mutual legal assistance and other international cooperation quickly and effectively.

A standard handling process

1. Log the request with its receipt time and deadline.
2. Verify its authenticity through official channels.
3. Get legal review of the authority, scope, deadlines and non-disclosure terms.
4. Preserve the relevant data at once.
5. Collect, quality-check and produce securely, sending only what is in scope.
6. Keep it confidential: restrict knowledge to those who need it, and do not alert the customer.
7. Review the customer for risk, without filing a SAR merely because a request arrived.
8. Keep records of everything provided.

Realistic exam scenario

A FinTech receives a FinCEN 314(a) list that includes one of its customers. The analyst wants to send the customer's full transaction history to FinCEN immediately. The correct response is to confirm the match and report it through FinCEN's secure system within 14 days, as the 314(a) process requires. Producing records needs separate legal process. The 314(a) request must stay confidential. The firm should also review the customer and consider whether a SAR is warranted based on its own facts.

Common exam traps

• Treating a 314(a) request as a subpoena for records.
• Notifying customers about orders that carry non-disclosure terms.
• Responding directly to foreign police requests without legal review.
• Filing a SAR solely because a subpoena arrived, with no independent review.