Maryland Legal Alert for Financial Services

In This Issue

FinCEN Issues SAR Guidance 

CFPB Issues New Interpretive Rule on FCRA Preemption

FinCEN Issues SAR Guidance 

On October 9, 2025, the Financial Crimes Enforcement Network (FinCEN), jointly with the primary federal financial institution regulators, issued updated Frequently Asked Questions (FAQs) concerning Suspicious Activity Reporting (SAR) and account review requirements. The FAQs reinforce a risk-based approach, such that a financial institution’s anti-money laundering (AML) program should be tailored to the financial institution’s products, services, account holder base, and geographic footprint – rather than applying blanket rules. The updated FAQs make clear that the decision concerning whether or not to file a SAR should be focused on account holder intent, not just transaction amount. FinCEN indicated that a SAR filing is not required solely because a transaction or series of transactions is at or near the $10,000 currency transaction reporting (CTR) threshold. Instead, a SAR is only required if there is knowledge, suspicion, or reason to suspect that the transaction is designed to evade Bank Secrecy Act (BSA) reporting (i.e., structuring). The guidance suggests that financial institutions can emphasize pattern recognition and intent over mechanical triggers (to cut down on unnecessary filings and increased focus on genuinely suspicious activity).   

Other takeaways include: 

• No regulatory requirement to conduct a separate review of an account or account holder after filing a SAR to determine if suspicious activity has continued;
   
• The previously interpreted “90-day rule” for continuing SAR filings is not mandatory and financial institutions may file SARs for ongoing activity as appropriate (provided regulatory deadlines are met – initial SAR within 30 days of activity, up to 60 days if subject of SAR is unidentified); and
   
• No requirement to document the decision not to file a SAR (but if a financial institution elects to document such a decision, in most cases a concise summary is appropriate). 

Practice Pointer: Financial institutions should review current SAR and AML policies to consider adjustments to language that conflicts with FinCEN’s latest clarifications.

For more information, contact Christopher R. Rahl.

Contact Christopher R. Rahl | 410-576-4222

Back to In This Issue

CFPB Issues New Interpretive Rule on FCRA Preemption

On October 28, 2025, the Consumer Financial Protection Bureau (CFPB) issued an interpretive rule under the Fair Credit Reporting Act (FCRA) declaring that federal law generally preempts state laws governing the content of consumer credit reports. CFPB’s action formally replaces and withdraws the July 2022 interpretive rule issued under the prior administration, which had taken the opposite view and concluded that the FCRA’s preemption provisions were limited in scope.  

The 2022 interpretive rule analyzed section 1681t(b)(1) of the FCRA and asserted that it had a “narrow sweep,” allowing for substantial state regulation of consumer reports and consumer reporting agencies. CFPB reasoned that the statute did not preempt all state laws “relating to the content or information contained in consumer reports,” but only those that specifically imposed requirements covered by the enumerated FCRA provisions.  

However, on May 12, 2025, CFPB announced the withdrawal of numerous guidance documents, including the 2022 interpretive rule. The October 2025 rule confirms that withdrawal and provides a new interpretation—one emphasizing that the FCRA broadly preempts state laws that touch on key areas of credit reporting.

CFPB explained that the 2022 interpretation was inconsistent with the plain text of section 1681t(b)(1) and contrary to both legislative history and longstanding judicial precedent. CFPB now asserts that when a state law regulates the same subject matter addressed by the FCRA’s preemption clause, such as information included in credit reports, federal law controls.  

CFPB’s latest interpretive rule marks a significant policy reversal from the Bureau’s 2022 stance and is likely to have immediate practical and legal implications. Multiple states have recently enacted laws restricting the inclusion of medical debt and other sensitive information in consumer credit reports. Under the CFPB’s new interpretation, these laws may now be viewed as preempted by federal law.

Practice Pointer: Financial institutions should promptly review multi-state compliance frameworks to assess where state consumer-reporting requirements may conflict with the CFPB’s interpretation of the FCRA. Financial institutions should also monitor forthcoming litigation and potential state–federal conflicts, particularly as courts test the CFPB’s emphasis on federal preemption. 

For more information, contact Tamia J. Morris.

Contact Tamia J. Morris | 410-576-4021

Back to In This Issue