In privacy disclosure statements provided to customers of depository financial institutions such as credit unions, a casual reading suggests that privacy of one's assets and transactions is being protected from the eyes of nosey individuals, outside business employees and potential marketing companies.

However, the privacy statements typically indicate that there are third parties who may receive private information about customers. These third parties include insurance companies, mortgage service companies, consumer reporting agencies, data processors, card processors, government agencies and other organizations deemed necessary. To a certain extent, it is suggested in the disclosure statement that this is the limit of who has access to the information about customers of financial institutions.

But, there are two cases where credit unions are required to notify federal government agencies and are not declared on the privacy statements. These are Suspicious Activity Reports and Currency Transaction Reports. Suspicious activity takes several forms, including suspected violations of federal laws, criminal activity, money laundering, computer intrusions and the nebulous transaction where the customer has no business or apparent lawful purpose. If these activities are detected in the judgment of employees of a credit union, it is required to file a SAR to the appropriate office of the Internal Revenue Service.