OFAC Subpoenas and Bank Records: A Counsel-Guided Response Playbook
At 4:47 on a Friday afternoon, an information request from the Office of Foreign Assets Control lands in the legal department inbox. It is addressed to the bank, references several account relationships, and asks for transactional records, wire details, and correspondence covering a defined lookback period. The general counsel forwards it to compliance with a single line: “We need a plan by Monday.” What follows in the next seventy-two hours often determines whether the bank responds as a cooperative institution or becomes a subject of the inquiry itself.
This playbook is written from the perspective of a bank records manager who has coordinated with outside and in-house counsel through regulatory requests. It focuses on the mechanics that matter in the first week: document preservation, privilege architecture, and a defensible production process. Firms that handle cross-border exposure, including Avvocati Blu Notice Interpol, routinely see how parallel international requests can complicate a domestic response, which is why coordination between counsel and records teams should begin immediately rather than after the first draft response is circulated.
First 24 Hours: Stabilizing the Record Before Anything Moves
The instinct to start pulling documents right away is understandable but risky. Before any search begins, the bank should issue a litigation hold that is broad enough to cover the obvious custodians and specific enough to be actionable. Counsel typically drafts the hold notice; records management executes it. The hold should identify the relevant time period, the account relationships named in the request, and the categories of records likely to be responsive, including wire transfer logs, SWIFT messages, account opening files, beneficial ownership documentation, and internal escalations.
Preservation is not only about paper and PDFs. It includes structured data in core banking systems, case management notes, sanctions screening alerts and dispositions, and email or chat communications among relationship managers, compliance analysts, and BSA officers. If the bank uses ephemeral messaging tools, counsel should assess whether retention settings need to be adjusted to prevent automatic deletion. A preservation gap discovered later is far more damaging than a slow production, because it can be characterized as intentional or negligent spoliation.
One practical step is to appoint a single records coordinator who owns the hold and serves as the bridge to counsel. That person maintains a preservation log, tracks which custodians have acknowledged the hold, and documents any technical limitations, such as legacy systems that cannot be queried by date. This log becomes an exhibit if the bank ever needs to demonstrate good faith.
Engaging Counsel and Structuring the Privilege Perimeter
The moment an OFAC request arrives, the bank should assume that its response may be reviewed by regulators, prosecutors, or private litigants. Counsel’s role is not just to draft a cover letter. It is to design the workflow so that privileged analysis stays on the privileged side of the line. Factual records, such as wire confirmations and account statements, are generally not privileged. Legal advice about what those records mean, whether they indicate a sanctions nexus, and how to frame the response usually is.
A common structure is to have the records team collect and index documents, while counsel reviews and annotates them for legal significance. If outside counsel is engaged, the engagement letter should define scope, staffing, and the handling of third-party vendors. Vendors performing document review or data processing should be retained under a written agreement that includes confidentiality and, where appropriate, a Kovel-style arrangement so that their work is covered by the privilege.
Privilege can be lost through carelessness. Circulating draft legal analyses to business units without a clear need to know, copying compliance staff on attorney-client communications, or storing privileged memos in shared drives accessible to the whole department are all avoidable errors. Counsel should establish a separate repository for privileged work product and label it clearly. Oral briefings are sometimes preferable to written ones when the analysis is sensitive.
Scoping the Request Without Narrowing It Unilaterally
OFAC requests vary in precision. Some identify specific transactions and counterparties; others describe categories and leave the bank to determine what is responsive. Counsel should review the language carefully and, where ambiguity exists, seek clarification in writing rather than guessing. A unilateral decision to interpret a broad request narrowly can look like evasion, while an overbroad production can expose unrelated customer information and create privacy or data protection issues.
In cross-border situations, the bank may face conflicting obligations. A request from a U.S. regulator may seek records located in a jurisdiction with blocking statutes or data protection laws that restrict transfer. Counsel should map these conflicts early and document the analysis. Where an international element is present, it can be useful to consult practitioners experienced in international cooperation and notice-related matters, such as those who advise on Avvocati Blu Notice Interpol issues, because the interaction between regulatory requests and international frameworks is often where delays and missteps occur.
The scoping memo prepared by counsel should list each category in the request, the systems that may contain responsive records, the proposed search methodology, and any limitations. This memo serves as the blueprint for the production and as evidence of a reasonable, documented process.
Document Handling and Production Checklist
A disciplined checklist keeps the production defensible and reduces the risk of inadvertent disclosure. The following steps reflect practices that counsel and records managers can adapt to their institution.
First, confirm the preservation hold is in place and acknowledged by all identified custodians. Second, inventory data sources, including core banking, wire systems, screening platforms, email archives, and shared drives. Third, define search terms and date ranges in consultation with counsel, and test them against a sample before running them broadly. Fourth, collect data in a forensically sound manner, maintaining chain of custody and hash values where practicable.
Fifth, deduplicate and de-NIST the collection to remove system files and duplicates that add cost without adding value. Sixth, apply privilege review using a documented protocol, and log every withholding with a reason code. Seventh, redact personal data that is not responsive, using consistent standards. Eighth, perform a quality control review on a sample of the production before it leaves the bank. Ninth, prepare a cover letter or declaration that describes the process, the sources searched, and any limitations. Tenth, retain a complete copy of the production and the supporting documentation for the bank’s own records.
Throughout this process, the records manager should maintain a single source of truth, usually a production tracker, that counsel can review at any time. When multiple regulators or parallel investigations are involved, the tracker should note which documents have been produced to whom, to avoid inconsistent representations.
Managing Parallel Proceedings and International Dimensions
OFAC matters rarely exist in isolation. A sanctions inquiry may overlap with a suspicious activity report, a state or federal criminal investigation, or a foreign regulatory request. Counsel should assess whether the bank is a witness, a subject, or a target, because that designation affects strategy, including whether to seek a tolling agreement or to make a voluntary disclosure.
International dimensions add complexity. If the request touches accounts held by non-U.S. persons or entities, the bank may need to consider foreign blocking statutes, mutual legal assistance treaties, and data transfer restrictions. In some cases, the bank may receive parallel requests from foreign authorities that appear to seek the same records. Counsel should coordinate responses so that the bank does not inadvertently violate one jurisdiction’s laws while complying with another’s.
Practitioners who work at the intersection of international notices and extradition defense, including the team behind Avvocati Blu Notice Interpol, often emphasize that early coordination prevents inconsistent positions across jurisdictions. A bank that tells one authority it has no responsive records and another that it has many can create credibility problems that are difficult to unwind.
Common Pitfalls and How to Avoid Them
The most frequent mistake is treating an information request as a routine customer service task. It is not. It is a legal process with potential enforcement consequences. Another pitfall is allowing business units to communicate directly with the regulator without counsel’s involvement. Well-intentioned explanations can become admissions if they are inaccurate or incomplete.
Over-collection is another risk. Pulling every record for every account related to a counterparty can sweep in data that is irrelevant and protected, increasing the cost and the chance of a data incident. Counsel should insist on proportionality and document why certain sources were excluded.
Finally, banks sometimes fail to document their own decision-making. A contemporaneous memo explaining why a particular search was run, why a custodian was omitted, or why a document was withheld as privileged can be the difference between a routine closing letter and a prolonged dispute. The records manager should treat documentation as part of the deliverable, not as an afterthought.
Frequently Asked Questions
Does an OFAC information request require the bank to produce documents immediately?
No. The bank should preserve records immediately but production timelines are usually negotiable. Counsel can request a reasonable schedule, seek clarification on scope, and propose a rolling production. The key is to show good faith and avoid unexplained delays.
Can the bank communicate directly with OFAC without a lawyer?
It can, but it is rarely advisable. Counsel helps frame responses accurately, protects privilege, and ensures that statements do not inadvertently expand the scope of the inquiry. Direct communication by business staff can create inconsistent or inaccurate representations.
What should the bank do if the request conflicts with foreign data protection laws?
Counsel should analyze the conflict and document it. Options may include seeking consent, using legal process channels such as mutual legal assistance, or negotiating a narrowed request. The bank should not unilaterally refuse to respond without a documented legal basis.
How long should the bank retain the production file?
Retention periods vary by jurisdiction and by the nature of the matter. As a general practice, the bank should retain the production, the supporting collection log, and the privilege log for the duration of the investigation plus any applicable limitations period, and longer if litigation is reasonably anticipated.
A Friday afternoon request does not have to become a Monday morning crisis. With a preservation hold, a clear privilege structure, and a documented production process, the bank can respond to OFAC in a way that is timely, accurate, and defensible. Counsel’s guidance is not a formality; it is the framework that keeps the records team focused on the right tasks and the institution on solid ground.