RFPA Compliance for Subpoena Response

This Safari SOP support guide explains the Right to Financial Privacy Act of 1978 (RFPA) and its state equivalents for financial institutions that respond to subpoenas, and shows how Safari SOP tracks RFPA certificates and compliance. It is written for attorneys responsible for RFPA compliance and for subpoena process managers who set up Safari SOP. The guide is not legal advice; each company is responsible for deciding which laws apply to its business.

Key points

• The RFPA restricts government access to the records of financial institution customers. It allows federal government access in only five ways: customer authorization, an administrative summons or subpoena, a search warrant, a judicial subpoena, or a formal written request (used only if no administrative summons or subpoena authority is available).
• The government, not the financial institution, must notify the customer. In certain cases the agency does not have to notify the customer, but it must still certify to the financial institution that it has complied with all applicable provisions.
• That certificate shields the financial institution from civil liability for disclosing customer information, and financial institutions are subject to regulatory audit of their RFPA compliance.
• The federal RFPA does not apply to state agencies, but several states have RFPA-equivalent statutes or provisions in their state constitutions.

Common questions

Is a financial institution reimbursed for responding to RFPA requests?

The guide states that the Federal Reserve Board entitles the financial institution to reimbursement of its response costs and sets the rates for RFPA reimbursement. Current rates are in the Code of Federal Regulations. Many state statutes also provide for reimbursement; the guide cites Utah Code Sec. 7-1-1004 as an example.

How does Safari SOP track RFPA compliance for audits?

The guide notes that a financial institution benefits from tracking its own RFPA compliance: were covered records produced, was a certificate received, and if not, why not? In Safari SOP, RFPA compliance is turned on by Subtype. When a matter triggers the analysis, each Subject gets an RFPA Certificate field with five values (N/A - Out of scope, N/A - Exception applies, N/A - No covered documents produced, Certificate Required, Certificate Received) and an RFPA Notes field. Both fields are available in reports, so teams can build custom reports for federal and state regulators.

When does Safari SOP require an RFPA analysis before documents go out?

When RFPA compliance is on for the matter's Subtype, the Subject type is Individual, and the subpoena comes from a federal agency or from a state agency in a state with an RFPA statute, users must record the analysis before any documents can be delivered. Response documents cannot be delivered while the certificate field says Certificate Required; it must be changed to Certificate Received.

What should teams consider before turning the RFPA workflow on?

The guide lists three points. Do not create a separate Subtype just for RFPA matters, because a user who forgets to switch Subtypes would skip the required analysis. The workflow applies only to matters whose documents have not yet been delivered. And turning the RFPA fields off later permanently deletes the data entered in them.