Right to Financial Privacy Act of 1978
RFPA
Financial · Government records
The RFPA limits federal government access to individuals' financial records held by financial institutions. Agencies generally need customer authorization, a subpoena, a search warrant, or a formal written request with notice to the customer, and institutions may not release records until the agency certifies compliance.
- Where
- Federal
- Citation
- 12 U.S.C. 3401-3423
- Status
- In force
- In force since
- 1979-03-10
- Last amended
- 2010-07-21
- Enforced by
- Courts (private civil actions); federal agencies' own compliance
- People can sue
- Yes
- Penalties
- Agencies or financial institutions that obtain or disclose records in violation are liable for $100 per violation regardless of volume, actual damages, punitive damages for willful violations, and fees.
- Applies to
- Financial institutions (banks, savings associations, card issuers, credit unions, consumer finance institutions)
- Federal government authorities seeking customer financial records
What a privacy notice must say
- Government authorities must generally give customers notice and an opportunity to challenge a subpoena or formal request.12 U.S.C. 3405, 3408
Practices it requires
- Financial institutions may not release a customer's records to a federal authority until it certifies compliance with the Act.12 U.S.C. 3403(b)
Other duties
- Liability for unlawful disclosure: $100 per violation plus damages.12 U.S.C. 3417(a)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Sections 3403, 3405 and 3408 were cited without being fetched | Effective date computed as 120 days after Nov. 10, 1978 from the statutory note
Research reference, not legal advice.