Responding to Subpoenas and Law Enforcement Requests

1. Why This Topic Matters

Financial institutions sit at the intersection of private commerce and public law enforcement. Because they hold detailed records of who moves money, when, where, and to whom, they are one of the most valuable sources of evidence in money laundering, terrorist financing, fraud, sanctions and corruption cases. Regulators and law enforcement agencies therefore rely on compulsory legal process (subpoenas, court orders, search warrants, production orders) and on formal and informal information requests to obtain that evidence.

For the CAMS candidate, this topic matters for three reasons:

Legal exposure. Mishandling a subpoena can result in contempt of court, obstruction charges, regulatory penalties, or civil liability. Over-disclosing can breach bank secrecy, data privacy, and suspicious activity report (SAR) confidentiality rules. Under-disclosing can be obstruction.

Investigative value. A subpoena is a signal. Law enforcement does not request records on a customer at random. Receipt of legal process should trigger the institution's own review of the customer relationship and may itself be grounds for filing a SAR.

Exam weight. This area appears in the CAMS domain covering Controls, Investigations and the AFC Organization. Questions typically present a scenario (a grand jury subpoena arrives, an agent calls the branch, a customer asks why their records were requested) and ask for the most appropriate action. Understanding the principles behind the correct answer is essential.


2. What It Is: The Types of Requests an Institution Receives

Subpoena. A legal order compelling a person or institution to produce documents (subpoena duces tecum) or to testify (subpoena ad testificandum). Subpoenas may be issued by a grand jury, a court, or an administrative agency (for example a regulator or tax authority). A grand jury subpoena is especially sensitive: grand jury proceedings are secret, the investigation is at a criminal stage, and the institution generally must not disclose the existence of the subpoena to the customer.

Court order / production order. An order signed by a judge compelling production of records, often used in jurisdictions where subpoenas are not the standard instrument. Many countries use the term production order or disclosure order under their proceeds-of-crime legislation.

Search warrant. Authorizes law enforcement to enter premises and seize evidence. Unlike a subpoena, which gives the institution time to compile and produce records, a search warrant is executed immediately and on-site.

National security letter (NSL). In the United States, an administrative demand issued by the FBI in national security and terrorism investigations, carrying strict non-disclosure requirements.

Section 314(a) request. Under the USA PATRIOT Act, FinCEN transmits lists of persons and entities under investigation to financial institutions, which must search their records and report matches within a set time (generally two weeks). Institutions report only whether a match exists; they do not send underlying documents at this stage. 314(a) lists are confidential and must not be used for general screening or shared outside the institution.

Keep-open (or keep-active) letters. Law enforcement may ask an institution to keep a suspicious account open so that activity can be monitored. Because the institution would normally close such an account, best practice is to require the request in writing, from an authorized official, with a defined duration (often renewable), and to continue filing SARs on the activity.

Informal requests. A telephone call or email from an agent, an in-person visit to a branch, or a request for a voluntary interview with an employee. These are not compulsory, and the institution must be careful not to breach privacy or secrecy laws by volunteering customer data without legal process.

Cross-border requests. Mutual legal assistance treaty (MLAT) requests, letters rogatory, and requests routed through the Egmont Group of financial intelligence units. Foreign authorities generally cannot compel a domestic institution directly; requests must flow through the appropriate domestic channel.

Regulatory examination requests. Supervisors have broad statutory access to records. These are distinct from law enforcement process but should be handled through the same centralized, documented channel.


3. How It Works: The Institutional Response Process

Step 1 - Centralize receipt. Every subpoena or request, regardless of where it arrives (a branch, the mail room, an employee's inbox), must be routed immediately to a designated unit, usually Legal or the AML/Compliance function. Front-line staff should be trained to accept the document, log it, and escalate, not to respond on their own. A single point of contact prevents inconsistent responses and accidental tipping off.

Step 2 - Verify authenticity and authority. Confirm that the issuing body exists, that the signatory is authorized, that the request is properly served, and that the institution is the correct recipient. Fraudulent subpoenas and impostor agents are a real risk. Call the agency back using an independently sourced number, not one printed on the document.

Step 3 - Review scope with counsel. Legal counsel determines what is actually requested, the deadline, the relevant time period, and whether any part is overbroad, unduly burdensome, privileged, or inconsistent with applicable secrecy or data protection laws. If appropriate, counsel negotiates scope or seeks to quash or modify. Produce what is requested, no less and no more.

Step 4 - Issue a preservation (litigation) hold. Suspend normal record destruction for all potentially responsive material. Destroying records after receipt of legal process, even under a routine retention schedule, can constitute obstruction.

Step 5 - Collect, review and produce. Gather account opening documents, CDD/KYC files, statements, transaction records, wire details, signature cards, correspondence, and electronic data as specified. Review for completeness and for information outside scope. Maintain chain of custody. Produce in the requested format, with a cover letter or certification of records, and keep an exact copy of everything produced along with a log of the date, recipient and method of delivery.

Step 6 - Protect confidentiality / do not tip off. Do not inform the customer that their records have been subpoenaed unless the law expressly permits or requires notice and counsel confirms it is appropriate. Grand jury subpoenas, NSLs and 314(a) requests carry explicit secrecy obligations. Limit internal knowledge to those with a need to know. If a customer asks whether the institution has received a request, employees should be trained to neither confirm nor deny and to refer the inquiry to Compliance or Legal.

Step 7 - Conduct your own review and consider a SAR. Receipt of a subpoena naming a customer is a red flag. The institution should review the customer's full relationship and transaction history. If the review reveals suspicious activity, a SAR should be filed. Many institutions treat the subpoena itself, combined with the account review, as the trigger for enhanced monitoring. The SAR narrative may reference that the review was prompted by a law enforcement inquiry.

Step 8 - Do not unilaterally close the account. Closing an account immediately after receiving a subpoena can alert the subject and destroy the investigation's ability to follow the money. Best practice is to consult law enforcement before exiting the relationship. If law enforcement asks the institution to keep the account open, obtain the request in writing.

Step 9 - Handle SAR confidentiality separately. A SAR and any information that would reveal the existence of a SAR must never be disclosed in response to a subpoena from a private party, and generally not even in response to a subpoena from a court unless the appropriate FIU and regulator have been consulted. If an institution receives a subpoena demanding a SAR, it should decline to produce it, notify the FIU (in the U.S., FinCEN) and consult counsel. The underlying transaction records can be produced; the SAR itself and the fact of its filing cannot. This distinction is a frequent exam point.

Step 10 - Document everything. Maintain a central log of all legal process received, actions taken, decisions made, productions delivered, and communications with law enforcement. This log is itself evidence of the institution's good-faith compliance program and will be reviewed by examiners.


4. Special Situations

Search warrants on the premises. Staff should remain calm and cooperative, not obstruct, request and copy the warrant and the agents' identification, immediately contact Legal and senior management, observe and note what is searched and seized, request an inventory of seized items, avoid volunteering statements beyond identifying the location of items named in the warrant, and never destroy or hide anything. Employees are not required to answer substantive questions without counsel present but must not interfere.

Agents approaching employees. Law enforcement may contact employees directly, at work or at home. Institutions should have a policy informing employees of their rights and obligations: they may speak with agents, they may ask for counsel, and they should promptly notify Legal or Compliance of the contact. The institution should not instruct employees to refuse cooperation, as that can appear obstructive.

Informal telephone requests for customer information. Politely explain that the institution will cooperate upon receipt of appropriate legal process, verify the caller's identity, and escalate. Releasing customer data on an unverified phone call can breach privacy law and bank secrecy.

Foreign law enforcement. Direct requests from a foreign agency should be referred to Legal; the proper channel is typically an MLAT request executed through the domestic competent authority, or FIU-to-FIU exchange through Egmont. Branches and subsidiaries abroad must comply with local law, which may conflict with head office obligations; conflicts are resolved by counsel, not by local staff acting alone.

Voluntary cooperation and 314(b). In the U.S., Section 314(b) permits voluntary information sharing between financial institutions under safe harbor, for the purpose of identifying and reporting money laundering or terrorist financing, after registering with FinCEN. This is institution-to-institution sharing, not a law enforcement request, but questions sometimes blend the two.

Data protection and bank secrecy. Where privacy laws restrict disclosure, a valid domestic court order or statutory provision typically provides the legal basis. Counsel must confirm the basis before releasing data, particularly for cross-border transfers.


5. Governance and Controls

A sound program includes: a written policy on responding to legal process; a designated subpoena compliance unit; training for front-line and operations staff on recognition, escalation and the prohibition on tipping off; a tracking system with deadlines; a litigation hold procedure; a link between the subpoena unit and the SAR investigation team so that every subpoena triggers an account review; a protocol for keep-open letters; a protocol for search warrants and agent visits; and periodic audit of the process. Management information on the volume and nature of legal process received should reach the AML officer and, where significant, the board.


6. Exam Tips: Answering Questions on Responding to Subpoenas and Law Enforcement Requests

Tip 1 - Look for the 'first step' trap. When asked what the institution should do first upon receiving a subpoena, the answer is usually to route it to Legal/Compliance, verify authenticity and preserve records, not to immediately pull records, contact the customer, or close the account.

Tip 2 - Never tip off. Any answer choice involving notifying the customer of a grand jury subpoena, an NSL, a 314(a) match or a law enforcement inquiry is almost always wrong. The same applies to telling the customer the account is being closed because of a law enforcement request.

Tip 3 - Subpoena equals red flag. If the question asks what the institution should do beyond producing documents, the expected answer is to review the customer's account activity and consider filing a SAR. The exam wants you to connect legal process to the investigative function.

Tip 4 - Do not close the account unilaterally. If an option says 'immediately close the account' following receipt of a subpoena, reject it. The correct approach is to consult law enforcement, and if asked to keep it open, obtain a written, time-limited keep-open letter and continue to monitor and file SARs.

Tip 5 - SAR confidentiality overrides a subpoena. If a question involves a subpoena (especially from a private litigant or a defense attorney) demanding a SAR or any reference to one, the answer is to refuse to produce the SAR, notify the FIU/FinCEN, and consult counsel. Transaction records may be produced; the SAR may not.

Tip 6 - Produce only what is requested. Over-production breaches privacy and may expose unrelated customers. Under-production risks obstruction. The right answer respects scope and involves counsel in any negotiation.

Tip 7 - Informal requests require legal process. If an agent calls and asks for account details, the correct action is to verify identity and request formal process, while escalating internally. Voluntarily handing over customer data on a phone call is wrong.

Tip 8 - Know the 314(a) mechanics. Institutions search records and report only matches to FinCEN within the deadline; they do not send documents, do not add names to watch lists for ongoing screening, and must keep the list confidential.

Tip 9 - Search warrant behavior. Cooperate, do not obstruct, call counsel, obtain a copy of the warrant and an inventory, do not destroy anything, and do not volunteer information beyond the warrant's scope.

Tip 10 - Cross-border means proper channels. A foreign agency's direct request should be referred to counsel and handled through MLAT or FIU channels, not satisfied directly by local staff.

Tip 11 - Documentation is always a correct element. Any answer that includes logging the request, retaining copies of what was produced, and recording decisions is consistent with best practice.

Tip 12 - Read for the role. Questions may ask what a teller, a compliance officer, or senior management should do. The teller escalates; the compliance officer coordinates with Legal, reviews the account and considers a SAR; management ensures policy, resources and board reporting. Choose the answer that fits the role described.


7. Quick Review Summary

Centralize and verify every request. Involve Legal. Preserve records. Produce only within scope. Keep it confidential; never tip off. Treat the subpoena as a red flag; review the account and consider a SAR. Do not close the account without consulting law enforcement; get keep-open requests in writing. Never disclose a SAR in response to a subpoena; notify the FIU. Cooperate fully but carefully with search warrants. Route foreign and informal requests through proper legal channels. Document everything. Master these principles and you will be able to reason through virtually any scenario the CAMS exam presents on this topic.