31.2 Financial Privacy: Government Requests, Certificates and Exceptions

Right to Financial Privacy Act of 1978 (RFPA)

The Right to Financial Privacy Act of 1978 (RFPA), codified at 12 U.S.C. § 3401 et seq., was enacted in direct response to the Supreme Court's decision in United States v. Miller (1976), which held that bank customers possess no legitimate expectation of privacy under the Fourth Amendment regarding financial records maintained by depository institutions. Congress established the RFPA to create statutory privacy protections and formal legal procedures that federal government departments and agencies must satisfy before obtaining access to customer financial information.

Jurisdictional Scope & Key Definitions (12 U.S.C. § 3401)

Compliance managers must precisely define the jurisdictional reach and boundaries of the RFPA:

• Covered Financial Institutions: Commercial banks, savings banks, savings and loan associations, trust companies, credit unions, consumer finance lenders, and credit card issuers.
• Covered Customers: The RFPA protects only natural persons (individuals) and small commercial partnerships consisting of five (5) or fewer individual partners.
• Excluded Entities: The RFPA does not protect corporations, limited liability companies (LLCs), partnerships with more than five partners, trusts, associations, or governmental bodies. A federal agency may obtain records belonging to a commercial corporation without complying with RFPA procedures.
• Federal Government Agency Restriction: The RFPA applies strictly and exclusively to federal departments, agencies, and instrumentalities of the United States (e.g., DOJ, FBI, DEA, SEC, ATF, IRS, Department of Defense). It does not apply to state or local law enforcement agencies, state taxing authorities, state court civil litigants, or municipal regulatory bodies.

The Five Lawful Access Mechanisms under RFPA

Under 12 U.S.C. § 3402, a federal agency may access customer financial records from a financial institution only through one of five statutory mechanisms:

The Mandatory Certificate of Compliance (12 U.S.C. § 3403(b))

A financial institution is legally prohibited from releasing customer financial records to any federal department or agency until the requesting agency provides a written Certificate of Compliance:

• Substantive Certification: The certificate must be signed by an authorized agency official, certifying that the agency has fully complied with all applicable statutory provisions of the RFPA (including customer notice windows and challenge timelines).
• Good-Faith Reliance Immunity (12 U.S.C. § 3417(c)): The RFPA provides financial institutions, their directors, officers, and employees with absolute statutory immunity from civil liability to the customer for releasing records in good-faith reliance on a Certificate of Compliance.

Regulation S Cost Reimbursement (12 CFR Part 219)

Under Section 3415 of the RFPA and Federal Reserve Regulation S (12 CFR Part 219), federal agencies reimburse financial institutions subject to the rule’s exceptions for reasonable and necessary costs directly incurred in assembling and producing requested financial records:

• Search and Processing Costs: Reimbursed at standardized hourly personnel rates prescribed by the Federal Reserve Board (differentiated by clerical/technical labor vs. management/supervisory labor);
• Reproduction Costs: Reimbursed on a standardized per-page rate for paper photocopies and actual cost for electronic storage media (CDs, flash drives, secure electronic data transfers);
• Transportation and Delivery Costs: Actual costs incurred for postal shipping, courier services, or freight delivery.

Statutory Exceptions to RFPA Notice and Procedures

Under 12 U.S.C. § 3413, several vital operational activities are completely exempt from RFPA customer notice and challenge requirements:

• Bank Supervisory Examinations: Record disclosures to federal banking regulators (OCC, FRB, FDIC, CFPB) exercising supervisory, regulatory, or monetary functions;
• Bank Secrecy Act (BSA) & SAR Reporting: Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) filed under 31 U.S.C. § 5318(g);
• Federal grand jury subpoenas: Special Section 3420 provisions apply, including limits on use and maintenance of records. A subpoena does not automatically impose Rule 6(e) secrecy on every bank recipient; determine whether an applicable nondisclosure order or other law prohibits notice. Preserve the remaining applicable RFPA requirements.
• Internal Revenue Service Tax Inquiries: Administrative summonses issued under the Internal Revenue Code (governed separately by 26 U.S.C. § 7609).

---

Comparison: 31 CFR Part 212 Garnishment vs. RFPA Legal Access