Lopez v. First Union National Bank

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS
FOR THE ELEVENTH CIRCUIT
________________________

No. 96-4931
________________________

D.C. Docket No. 95-CV-2650-CV-FAM

PATRICIA GONZALES LOPEZ,

Plaintiff-Appellant,

versus

FIRST UNION NATIONAL BANK
OF FLORIDA,

Defendant-Appellee.

________________________

No. 97-4238
________________________
D.C. Docket No. 96-7115-CV-JAG

JOSE DANIEL RUIZ CORONADO,

Plaintiff-Appellant,

versus

BANKATLANTIC BANCORP, INC.,

Defendant-Appellee.

________________________

Appeals from the United States District Court
for the Southern District of Florida
________________________
(November 21, 1997)
Before CARNES, Circuit Judge, and KRAVITCH and REAVLEY*, Senior
Circuit Judges.

*
Honorable Thomas M. Reavley, Senior U.S. Circuit Judge for
the Fifth Circuit, sitting by designation.
 CARNES, Circuit Judge:

These cases, consolidated for purposes of this appeal, arise

out of plaintiffs' claims that their banks improperly disclosed

information relating to their checking accounts to federal

authorities. The complaint in each case was dismissed on the

ground that the safe harbor provisions of the Annunzio-Wylie Anti-

Money Laundering Act, 31 U.S.C. § 5318(g), immunized the banks from

liability. For the reasons set forth below, we reverse the

judgments dismissing the complaints on that ground.
I. THE LOPEZ CASE

We will discuss the two cases separately, beginning with the

one Patricia Lopez brought against First Union National Bank

("First Union").

A. FACTS AND PROCEDURAL HISTORY

Because this case is before us on appeal from a Federal Rules

of Civil Procedure 12(b)(6) dismissal for failure to state a claim,

we limit ourselves to the allegations of the complaint, which we

are required to accept as true. Those allegations may turn out to

be inaccurate, or there may be additional facts which dictate a

different result, but for now the factual boundary of this case is

marked by the metes and bounds of the complaint.

The FedWire Fund Transfer System is an electronic funds

transfer system which permits large dollar fund transfers by

computer-to-computer communications between banks. First Union is

a bank within the FedWire Fund Transfer System and uses "electronic

storage" to maintain the contents of an electronic funds transfer.

2
On September 2, 1993, and November 30, 1993, First Union received

an electronic wire transfer of funds for credit to Lopez's account.

On both occasions, First Union provided United States law

enforcement authorities with access to the contents of those

electronic transfers. First Union made these disclosures based

solely on the "verbal instructions" of federal law enforcement

authorities.

On February 3, 1994, a United States Magistrate Judge issued

a seizure warrant directing First Union to freeze Lopez's account

and conduct an inventory of it. Pursuant to the seizure warrant,

First Union again provided United States law enforcement

authorities access to the contents of the electronic fund transfers

sent to Lopez that were being held in electronic storage. On June

6, 1995, First Union surrendered the $270,887.20 balance of Lopez's

First Union account to the United States. The United States

subsequently filed a civil forfeiture case against Lopez, which was

resolved by a stipulation that $108,359 of Lopez's account was

forfeited to the United States while $162,532.20 was returned to

her.

Following the resolution of the civil forfeiture case, Lopez

filed suit against First Union asserting claims under the

Electronics Communications Act 18 U.S.C. §§ 2501 et seq. (Counts

I and II), the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et

seq., (Count III), and Florida law. (Count IV).

First Union moved to dismiss the complaint pursuant to Rule

12(b)(6) for failure to state a claim upon which relief can be

3
granted. The district court granted the motion and dismissed

Lopez's complaint with prejudice. The district court's decision to

dismiss the complaint was based exclusively on its conclusion that

the Annunzio-Wylie Anti Money Laundering Act, 31 U.S.C. §

5318(g)(3), immunized First Union from liability. This appeal

followed.

B. STANDARD OF REVIEW

We review de novo the dismissal of a complaint for failure to

state a claim for relief, accepting all allegations in the

complaint as true and construing those allegations in the light

most favorable to the plaintiff. See Harper v. Thomas , 988 F.2d
101, 103 (11th Cir. 1993). A complaint may not be so dismissed

"unless it appears beyond doubt that the plaintiff can prove no set

of facts in support of his claim which would entitle him to

relief." Pataula Elec. Membership Corp. v. Whitworth , 951 F.2d

1238, 1240 (11th Cir.) (quoting Conley v. Gibson, 355 U.S. 41,

45-46, 78 S. Ct. 99, 102 (1957)).

C. ANALYSIS

As a preliminary matter, we first address First Union's

arguments that Lopez's complaint fails to state a claim under

either the Electronic Communication Privacy Act, 18 U.S.C. §§ 2501

et seq ., ("the ECPA") or the Right to Financial Privacy Act, 12
U.S.C. §§ 3401 et seq., ("the RFPA").2 We will then address the

2
Because the district court dismissed Lopez's complaint on the
ground that the Annunzio-Wylie Anti-Money Laundering Act immunized
First Union from liability, it did not address these issues.
However, the parties have briefed them, and in view of our
disagreement with the district court's dismissal of the complaint

4
additional issue of whether the Annunzio-Wylie Anti-Money

Laundering Act, 31 U.S.C. § 5318(g)(3) immunizes First Union from

liability.

1. Lopez's Claims Under the ECPA

In 1986, Congress clarified the existence of privacy rights

in electronic communications by enacting the ECPA, which provides

"protect[ion] against the unauthorized interception of electronic

communications." Sen. Rep. No. 99-541 at 3555. Among other things,

the ECPA defines the conditions in which an electronic

communications service may divulge the contents of electronic

communications, see, e.g. , 18 U.S.C. § 2702; 18 U.S.C. 2711,
defines the conditions in which the government is entitled to

access an individual's electronic communications, see 18 U.S.C.

2703, and provides a civil cause of action for anyone injured by a

violation of the act's substantive provisions, see 18 U.S.C. 2707.

In counts I and II of her complaint, Lopez alleges that First

Union violated her rights under the ECPA. In count I, she

specifically alleges that First Union violated 18 U.S.C. §

2702(a)(1), which provides that "a person or entity providing an

electronic communication service to the public shall not knowingly

divulge to any person or entity the contents of a communication

while in electronic storage by that service." The complaint

alleges that First Union provided an electronic communication

service and that First Union provided the United States access to

on Annunzio-Wylie grounds, judicial economy counsels in favor of
our addressing them.

5
"the contents of information in electronic storage, including the

contents of electronic communications pertaining to . . . Lopez."

First Union contends that count I fails to state a viable

claim under 18 U.S.C. § 2702(a)(1), because it is not an electronic

communication service. We reject that contention which amounts to

nothing more than a denial of the allegations in Lopez's complaint.

Accepting all allegations in the complaint as true as we are

required to do at this stage, we conclude that Count I states a

violation of 18 U.S.C. § 2702(a)(1).3

In count II, Lopez alleges that First Union infringed her

rights under the ECPA by violating 18 U.S.C. § 2703 and 18 U.S.C.

§ 2711(3)(a). Section 2703 defines the conditions in which an

electronic communication service may disclose electronic

communications to the government. If the electronic communication

service has held the contents of an electronic communication in

electronic storage for one hundred eighty days or less, it may

disclose that electronic communication to the government only

pursuant to a federal or state warrant. See 18 U.S.C. 2703(a). In

Count II, Lopez alleges that, on the same day funds were

electronically transferred to her account, First Union disclosed

contents of those electronic funds transfers in electronic storage

pursuant to "verbal instructions" instead of a warrant. She also

3
Nor does the fact that Congress amended the ECPA in 1996 to
specifically exclude electronic funds transfers from the definition
of an "electronic communication," see 18 U.S.C. § 2510(15) (1996),
prevent Count I from stating a claim under § 2702(1)(a). That
amendment did not take effect until 1996, well after the events
giving rise to this case.

6
alleges that the disclosures were made on the same day that funds

were electronically transferred to her account, which means the

communication disclosed had been held in electronic storage for

less than one hundred eighty days. Those allegations are

sufficient to state a prima facie claim under 18 U.S.C. § 2703.

However, the allegations of Count II of the complaint are not

sufficient to state a claim under 18 U.S.C. § 2711(3)(a). That

section provides that "an electronic communication service . . .

shall not intentionally divulge the contents of any communication

. . . while in transmission on that service to any person or entity

other than an addressee or intended recipient of such

communication." 18 U.S.C. § 2711(3)(a) (emphasis added). That

proscription is not violated unless the communication is divulged

"while in transmission." Neither Count II nor any other part of

the complaint alleges that First Union disclosed Lopez's electronic

communications "while in transmission." Instead, Count II alleges

that First Union disclosed the contents of electronic

communications held in electronic storage.

Alleging that First Union disclosed a communication held in

"electronic storage," which violates § 2702(a)(1), is not

equivalent to alleging that First Union disclosed a communication

in "transmission," which would violate § 2711(3)(a). Because the

complaint does not allege that First Union disclosed communications

while in transmission, it fails to state a claim under §

2711(3)(a).

7
 2. Lopez's Claim Under the RFPA

In United States v. Miller, 425 U.S. 435, 443, 96 S.Ct. 1619,

1623 (1976), the Supreme Court held that individuals have no Fourth

Amendment expectation of privacy in their financial records while

those records are in the hands of third parties. That decision

prompted Congress to enact the Right to Financial Privacy Act, 12

U.S.C. §§ 3401 et seq., ("the RFPA"), which provides individuals

with some privacy rights in financial records that are in the

hands of third parties. Among other things, the RFPA defines the

conditions in which financial institutions may disclose an

individual's financial records, see 12 U.S.C. § 3403, defines the
conditions in which government officials may access an individual's

financial records, see 12 U.S.C. § 3402, and provides a civil cause

of action for anyone injured by a violation of the act's

substantive provisions, see 12 U.S.C. § 3417.

In count III of her complaint, Lopez alleges First Union

violated her rights under the RFPA by disclosing her financial

records under conditions not authorized by the RFPA. First Union

does not argue that Lopez has failed to allege a prima facie

violation of the RFPA. Instead, it contends that count III should

be dismissed because the alleged disclosures are protected by 12

U.S.C. § 3403(c), another section of the RFPA. Under § 3403(c), a

financial institution possessing information relevant to a possible

violation of law involving one of its accounts is permitted to make

a disclosure of that information to law enforcement. However, the

disclosure permitted is limited to the name of the account holder

8
and "the nature of any suspected illegal activity." 12 U.S.C. §

3403(c). Because the complaint alleges that First Union went

beyond that and disclosed actual financial records pertaining to

Lopez's account (i.e., the electronic funds transfers

communications, the contents of which were held in electronic

storage), First Union's alleged disclosures are not protected by 12

U.S.C. § 3403(c). Accordingly, count III of Lopez's complaint

states a claim under the RFPA.

3. The Annunzio-Wylie Anti-Money Laundering Act

The Annunzio-Wylie Anti-Money Laundering Act of 1992, 31

U.S.C. § 5318(g), provides in relevant part:

g) Reporting of suspicious transactions.--

(1) In general.--The [Treasury] Secretary may
require any financial institution, and any director,
officer, employee, or agent of any financial institution,
to report any suspicious transaction relevant to a
possible violation of law or regulation.

(2) Notification prohibited.--A financial
institution, and a director, officer, employee, or agent
of any financial institution, who voluntarily reports a
suspicious transaction, or that reports a suspicious
transaction pursuant to this section or any other
authority, may not notify any person involved in the
transaction that the transaction has been reported.

(3) Liability for disclosures.--Any financial
institution that makes [i.] a disclosure of any possible
violation of law or regulation or [ii.] a disclosure
pursuant to this subsection or [iii.] any other
authority, and any director, officer, employee, or agent
of such institution, shall not be liable to any person
under any law or regulation of the United States or any
constitution, law, or regulation of any State or
political subdivision thereof, for such disclosure or for
any failure to notify the person involved in the
transaction or any other person of such disclosure.

9
The three safe harbors provided by § 5318(g)(3) supply an

affirmative defense to claims against a financial institution for

disclosing an individual's financial records or account-related

activity. Financial institutions are granted immunity from

liability for three different types of disclosures:

(i.) A disclosure of any possible violation of law or
regulation,
(ii.) A disclosure pursuant to § 5318(g) itself, or
(iii.) A disclosure pursuant to any other authority.

See 31 U.S.C. § 5318(g)(3).

The district court dismissed Lopez's complaint after

concluding that the safe harbor provisions of § 5318(g)(3)

protected First Union's disclosures of her account activity. Lopez

contends that the district court's holding is erroneous for two

reasons. First, she contends that § 5318(g)(3)'s safe harbor

provisions apply only to disclosures of currency transactions. If

that is true, First Union's disclosure of electronic transfers and

the contents of transfers held in electronic storage are not

protected by any of the safe harbor provisions of § 5318(g)(3).

Second, Lopez contends that even if the Act does cover more than

currency transactions, First Union's disclosures do not fall within

one of the three categories of disclosures for which § 5318(g)(3)

grants immunity. Addressing Lopez's contentions in turn, we

disagree with the first one but agree with the second.

a. Does § 5318(g)(3) Apply to Disclosures of Electronic
Transfers and Contents Held in Electronic Storage?

Lopez's contention that § 5318(g)(3) protects disclosures of

currency transactions only is at odds with the text and purpose of

10
the Annunzio-Wylie Act. The text of § 5318(g)(3) neither

explicitly nor implicitly suggests that Congress intended to limit

the safe harbor to disclosures of currency or to any specific kind

of transaction. To the contrary, the text of that subdivision

indicates Congress deliberately did not limit the safe harbor to

disclosure of any specific type of transaction. For example, §

5318(g)(3) provides that a financial institution is entitled to

immunity for a disclosure of "any possible violation of law." 31

U.S.C. § 5318(g)(3) (emphasis added). As we have recently had

occasion to explain, when used in a statute, "the adjective 'any'

is not ambiguous; it has a well-established meaning." Merritt v.
Dillard Paper Company, 120 F.3d 1181, 1186 (11th Cir. 1997). "Read

naturally, the word 'any' has an expansive meaning, that is, one or

some indiscriminately of whatever kind." Id., quoting United

States v. Gonzales, 117 S.Ct. 1032, 1035 (1997) (citation and some

quotation marks omitted). Thus § 5318(g)(3) protects disclosure of

a violation of law regardless of whether it involves a cash

transaction, electronic transfers, or any other type of

transaction. Section 5318(g)(3)'s scope is not limited merely to

disclosures of currency transactions.

Moreover, we agree with the district court that the purpose

underlying the Act is inconsistent with Lopez's proposed

construction. The district court reasoned as follows:

[A]ccording to the comments of Congressman Neal regarding
the enactment of 31 U.S.C. § 5318(g), banks have long
been encouraged to report suspicious transactions to the
appropriate authorities. See Cong.Rec. E57-02 (1993).
Therefore, to ensure compliance from the banks, the safe
harbor provision was added in order to protect a bank

11
 when it reports a suspicious transaction. Id. "The goal
of this new law is to have banks work with international
efforts to stop the global movement of drug money. Money
laundering is an international problem. Money knows no
borders and flows freely from one country to another.
The United States has long recognized that, and has
worked hard to ensure cooperation from foreign
governments and financial institutions to assure that
money launderers have no place to hide." Id.

The Court finds that if Congress intended to limit this
statute solely to "currency transactions" as asserted by
Plaintiff, it would severely restrict the ability of a
bank to report suspicious transactions without the fear
of liability. As Plaintiff notes in her response to
Defendant's motion, "[i]n 1994, some 72 million fund
transfers with a total value of $211 trillion were moved
over Fedwire." Plaintiff's Response Memorandum, p. 11 n.
8, citing Fedpoint 43. Thus, the effectiveness of the
anti-money laundering act would be substantially limited
if it applied only to cash transactions, since electronic
fund transfers, the contents of which are held in
electronic storage, are the means by which large dollar
funds are transferred between the Federal Reserve and the
service providers (i.e., originating banks, intermediary
banks, and beneficiary banks)

Lopez v. First Union National Bank, 931 F.Supp. 860, 864 (S.D. Fla.

1996).

Accordingly, we hold that electronic fund transfers and

information held in electronic storage are not outside the scope of

the Annunzio-Wylie Anti-Money Laundering Act's safe harbor

provisions, 31 U.S.C. § 5318(g)(3).

b. Are First Union's Disclosures Protected By § 5318(g)(3)'s
Safe Harbor Provisions?

The Annunzio-Wylie Act does not provide a financial

institution blanket immunity for any disclosure of an individual's

financial records. Instead, a financial institution is entitled

to immunity only if its disclosure falls within one of the three

safe harbors set forth in § 5318(g)(3). Lopez's complaint alleges

12
that First Union disclosed Lopez's financial records twice in

response to nothing more than "verbal instructions" of government

officials and once pursuant to a seizure warrant. Under the facts

alleged in Lopez's complaint, First Union's two disclosures in

response to "verbal instructions" of government officials do not

fit within any of § 5318(g)(3)'s three safe harbors. However, its

disclosure pursuant to the seizure warrant is protected by §

5318(g)(3)'s third safe harbor.

The first safe harbor provision protects a financial

institution's "disclosure of a possible violation of law or

regulation." 31 U.S.C. § 5318(g)(3). As the use of the adjective

"possible" indicates, a financial institution's disclosure is

protected even if it ultimately turns out there was no violation of

law. In order to be immune from liability, it is sufficient that

a financial institution have a good faith suspicion that a law or

regulation may have been violated, even if it turns out in

hindsight that none was. By extending immunity to a financial

institution's disclosure of a suspected violation of law or

regulation, the first safe harbor encourages financial institutions

to voluntarily play a role in combating money laundering and other

crimes.

The problem for First Union at this stage of the litigation is

that it is stuck with the allegations of the complaint. Those

allegations do not show that First Union had a good faith suspicion

that a law or regulation may have been violated. None of the

allegations indicate that the transactions associated with Lopez's

13
accounts were suspicious enough to suggest a possible violation of

law. First Union contends, however, that the first safe harbor

should protect disclosures made in response to "verbal

instructions" of government officials. It argues that law

enforcement's demand for financial records should, by itself, be

sufficient to give a financial institution a good faith basis to

suspect a possible violation of law or regulation. The hidden

premise of that argument is that Congress intended the first safe

harbor to protect disclosures made pursuant to government

officials' unexplained request or unvarnished instructions for

financial records. That premise is flawed.

As we will discuss below, the second and third safe harbors

protect from liability in situations where the government has and

exercises the legal authority to demand disclosure of financial

records. If we accepted First Union's premise that Congress

intended the first safe harbor to protect disclosures made pursuant

to any and all government demands, it would render the other two

safe harbor provisions superfluous. Following the basic principle

of statutory construction "that a statute should not be construed

in such a way as to render certain provisions superfluous or

insignificant," Woodfork v. Marine Cooks & Stewards Union, 642 F.2d

966, 970 (5th Cir. 1981), we reject First Union's contention that

the first safe harbor protects disclosures made in response to

nothing more than "verbal instructions" of government officials.

Having concluded that the first safe harbor provision does not

protect First Union from liability for the alleged disclosures, we

14
turn now to the second. The second safe harbor provision protects

a financial institution's "disclosure pursuant to this subsection."

31 U.S.C. § 5318(g)(3). Disclosures "pursuant to this subsection"

are disclosures required by the Office of the Treasury Secretary

under the rule-making authority vested in the Treasury Secretary by

31 U.S.C. § 5318(g)(1), which provides:

The [Treasury] Secretary may require any financial
institution, and any director, officer, employee, or
agent of any financial institution, to report any
suspicious transaction relevant to a possible violation
of law or regulation.

In February 1996, the Treasury Secretary issued regulations under

this sub-section. See 12 C.F.R. § 21.11 (1996); see also 61 Fed.

Reg. 4326 (1996); 61 Fed. Reg. 4338 (1996); 61 Fed. Reg. 6100

(1996); 61 Fed. Reg. 6095 (1996). The second safe harbor protects

any disclosures required by those regulations.

However, the complaint alleges that First Union's disclosures

occurred in 1993 and 1994. Because the Treasury Secretary's

regulations under § 5318(g)(1) were not in effect at the time those

alleged disclosures were made, the second safe harbor provision

cannot immunize First Union's disclosures.

The third safe harbor provision protects a financial

institution's disclosure pursuant to "any other authority." 31

U.S.C. § 5318(g)(3). Because the second safe harbor protects

disclosures pursuant to the legal authority of the Treasury

Secretary's regulations, "other authority" means authority other

than the Treasury Secretary's regulations. The "other authority"

must be legal authority, because authority means "[r]ight to

15
exercise powers," Black's Law Dictionary 133 (6th Ed. 1991), and

in our system based on rule of law, the right to exercise power is

derived from law, e.g., statutes, regulations, court orders, etc.

Hence, for a financial institution's disclosure to fall within the

confines of the third safe harbor, the financial institution must

be able to point to a statute, regulation, court order, or other

source of law that specifically or impliedly authorized the

disclosure. If it cannot do so, the disclosure is not entitled to

the protection of the safe harbor.

The complaint alleges that First Union disclosed Lopez's

financial records twice in response to "verbal instructions" of

government officials and once in response to a seizure warrant.

Clearly, a disclosure in response to a seizure warrant is protected

by the third safe harbor. The seizure warrant represented a

judicial determination that the government had a legal right to

obtain Lopez's financial records. First Union was neither required

nor permitted to sit in review of the court's legal determination.

It is immune from any liability for any disclosures made pursuant

to the seizure warrant, which was issued on February 3, 1994.

However, First Union's earlier disclosures are a different

matter, because disclosures in response to nothing more than the

"verbal instructions" of government officials are not protected by

the third safe harbor. They are not, because under existing law

and regulations, a government official's verbal instructions do not

constitute legal authority. First Union fails to identify any

statute or regulation which gives a government official's verbal

16
request to access an individual's financial records the force of

law. Nor does First Union point to a statute or regulation

authorizing a financial institution to release an individual's

financial records in response to mere verbal instructions of

government officials. We can find nothing in the Annunzio-Wylie

Act which entitles government officials to gain access to financial

records simply by verbal request. Therefore, because the facts

alleged in the complaint do not show First Union acted pursuant to

any legal authority when it released Lopez's financial records, the

third safe harbor provision does not protect First Union's

disclosures.

We also reject First Union's argument that its disclosures of

Lopez's account activity were made pursuant to "other authority"

because there were regulations, see e.g. 12 C.F.R. § 21.11 (1989),

in effect at the time disclosures were made that required reporting

suspicious transactions. That argument simply overlooks the fact

that on a motion to dismiss, we are bound to consider only the

facts alleged in the complaint. Lopez's complaint does not allege

that Lopez's transactions were suspicious or were viewed as

suspicious by First Union.

In sum, we hold that First Union's disclosures of Lopez's

financial records in response to nothing more than the "verbal

instructions" of government officials are not protected by §

5318(g)(3)'s safe harbors, except that its disclosure pursuant to

the seizure warrant is protected by the third safe harbor. Because

17
the district court erred in dismissing Lopez's complaint, we

reverse its judgment.
II. THE CORONADO CASE

We turn now to the case brought by Jose Daniel Ruiz Coronado

and the approximately eleven hundred account holders ("the Account

Holders") he wants to represent in this attempted class action

lawsuit against BankAtlantic Bancorp Inc. ("BankAtlantic").4

A. FACTS AND PROCEDURAL HISTORY

This case, like the Lopez case, is here on appeal from a Rule

12(b)(6) dismissal. As we stressed in our discussion of the Lopez
case, at this stage the facts are limited to the allegations in

Coronado's complaint, which we must accept as true.

Again, the FedWire Fund Transfer System is an electronic funds

transfer system which permits large dollar fund transfers by

computer-to-computer communications between banks. BankAtlantic is

a bank within the FedWire Fund Transfer System and uses "electronic

storage" to maintain the contents of the electronic funds transfer.

In June 1995, BankAtlantic notified federal agents concerning

the "unusual amounts" and "unusual movements" of money at the bank.

Thereafter, BankAtlantic provided federal agents access to the

"detailed contents of financial information in electronic storage,

including the contents of electronic communications, pertaining to

the Account Holders." Federal agents subsequently "seized the

Account Holders' accounts upon allegations of money laundering."

4
Coronado's complaint was dismissed before a hearing on class
status could be held.

18
Eventually, the federal agents released 400 to 600 of the Account

Holders' accounts because they had "no connection with money

laundering."5

Subsequently, Coronado, on behalf of himself and the Account

Holders, filed a class action suit against BankAtlantic, asserting

claims under the Electronics Communications Act 18 U.S.C. §§ 2501

et seq . (Counts I-IV), the Right to Financial Privacy Act, 12

U.S.C. §§ 3401 et seq., (Count V), and Florida law. (Count VI).

BankAtlantic moved to dismiss the complaint for failure to state a

claim upon which relief can be granted pursuant to Rule 12(b)(6).

The district court granted the motion and dismissed Coronado's

complaint with prejudice. The decision to dismiss the complaint

was based exclusively on its conclusion that the Annunzio-Wylie

Anti Money Laundering Act, 31 U.S.C. § 5318(g), immunized

BankAtlantic from liability. This appeal followed.

B. ANALYSIS

The sole issue we must decide is whether BankAtlantic's

disclosure of information pertaining to the Account Holders'

accounts is protected by the safe harbor provisions of §

5318(g)(3).6
BankAtlantic argues that its disclosure falls within §

5318(g)(3)'s first safe harbor -- a "disclosure of any possible

5
The complaint does not specify whether Coronado's account was
among those released.
6
BankAtlantic did not contend, either before the district
court or on appeal, that the complaint should be dismissed because
it failed to state a claim under the ECPA or the RFPA.

19
violation of law." It asserts that the facts alleged in Coronado's

complaint indicate that BankAtlantic suspected a violation of law

based on its detections of "unusual amounts" and "unusual

movements" of money in the bank and that it disclosed the

information from the Account Holders' accounts as a result of those

detections. BankAtlantic maintains that under those facts, its

disclosures are protected by the first safe harbor.

That argument sounds good, but we are required to construe

the complaint in the light most favorable to Coronado and not

dismiss it unless there is no set of facts he could prove that

would entitle him to relief, i.e., which would deny BankAtlantic

the immunity it seeks from the first safe harbor. The complaint

alleges that BankAtlantic disclosed the protected account

information of 1,100 accounts after it detected "unusual amounts of

money in the bank" and "unusual movements of money at the bank"

(emphasis added). Construed in the light most favorable to

Coronado, the allegations that BankAtlantic detected suspicious

activity "in" and "at" the bank could mean that BankAtlantic

detected suspicious activity in only one account or a few accounts.

But if BankAtlantic detected suspicious activity in only one

account, it may well not have had a good faith basis to suspect a

violation of law in the remaining 1,099 accounts, and the same is

true if the suspicious activity was in only a few accounts.

Of course, we could continue this exercise and come up with

any number of hypotheticals in which the complaint's allegations do

not show that BankAtlantic's disclosures of all the accounts are

20
protected by the first safe harbor. But the more important and

generalizable point is this: the allegations in the complaint,

construed in the light most favorable to Coronado, do not show that

BankAtlantic determined in good faith that there was any nexus

between the suspicious activity it detected and the information it

disclosed from more than a thousand accounts. In order for §

5318(g)(3)'s first safe harbor to protect a financial institution's

disclosures, there must be some good faith basis for believing

there is a nexus between the suspicion of illegal activity and the

account or accounts from which information is disclosed. If it

were otherwise, a bank would have free license to disclose

information from any and every account in the entire bank once it

suspected illegal activity in any account at the bank. We do not

think Congress intended such a drastic result which would

needlessly strip away any right or expectation of privacy in

financial records and effectively undo virtually all of what

Congress did when it enacted the Right to Financial Privacy Act and

the Electronic Communications Privacy Act. Therefore,

BankAtlantic's disclosures, as they are described in the complaint

read in the light most favorable to Coronado, are not protected by

§ 5318(g)(3)'s first safe harbor provision.7

7
We note that if the allegations in the complaint specifically
identified the accounts in which BankAtlantic detected suspicious
activity and any additional accounts with a nexus to them,
BankAtlantic would be entitled to partial Rule 12(b)(6) relief
because a disclosure of those accounts would be protected by the
first safe harbor. However, the complaint does not so identify the
accounts, therefore this issue will have to be resolved at a later
stage in the proceedings.

21
 We caution, however, that our holding should not be read to

mean that the only accounts that can be disclosed are those

actually reflecting the unusual movements of money. There could be

instances in which unusual movements or other suspicious activity

in an account provides a reasonable basis for disclosing other

accounts. We will not attempt to list circumstances in which

there could be a good faith basis for believing that a nexus

existed between the suspicious activity in one account and other

accounts. It is enough for present purposes that no such basis is

apparent in the complaint.

BankAtlantic also argues that its disclosure falls within §

5318(g)(3)'s third safe harbor -- a disclosure pursuant to "any

other authority." Specifically, BankAtlantic claims its

disclosures were authorized by 12 C.F.R. § 563.180 (1994), which

requires banks to "promptly notify appropriate law enforcement

authorities" after discovering "suspected criminal acts." Again,

however, there must be some good faith basis for believing there is

a nexus between the suspicion of illegal activity and the account

or accounts from which information is disclosed. Thus,

BankAtlantic's disclosures, as they are described in the complaint

read in the light most favorable to Coronado, are not clearly

within § 5318(g)(3)'s third safe harbor provision.

Because we conclude that BankAtlantic's disclosures are not

protected by § 5318(g)(3), the district court's dismissal of

Coronado's complaint is due to be reversed.

22
 III. CONCLUSION

The district court's dismissal of Lopez's complaint is

REVERSED, and the case is REMANDED for further proceedings

consistent with this opinion.

The district court's dismissal of Coronado's complaint is

REVERSED, and the case is REMANDED for further proceedings

consistent with this opinion.

23