United States Court of Appeals,

                                          Eleventh Circuit.

                                      Nos. 96-4931, 97-4238.

                          Patricia Gonzales LOPEZ, Plaintiff-Appellant,

                                                  v.

           FIRST UNION NATIONAL BANK OF FLORIDA, Defendant-Appellee.

                       Jose Daniel Ruiz CORONADO, Plaintiff-Appellant,

                                                  v.

                  BANKATLANTIC BANCORP, INC., Defendant-Appellee.

                                           Nov. 21, 1997.

Appeals from the United States District Court for the Southern District of Florida. (No. 95-2650-
CV-FAM and 96-7115-CV-JAG), Federico A. Moreno and Jose A. Gonzalez, Jr., Judges.

Before CARNES, Circuit Judge, and KRAVITCH and REAVLEY*, Senior Circuit Judges.

       CARNES, Circuit Judge:

       These cases, consolidated for purposes of this appeal, arise out of plaintiffs' claims that their

banks improperly disclosed information relating to their checking accounts to federal authorities.

The complaint in each case was dismissed on the ground that the safe harbor provisions of the

Annunzio-Wylie Anti-Money Laundering Act, 31 U.S.C. § 5318(g), immunized the banks from

liability. For the reasons set forth below, we reverse the judgments dismissing the complaints on

that ground.

                                      I. THE LOPEZ CASE

       We will discuss the two cases separately, beginning with the one Patricia Lopez brought


   *
    Honorable Thomas M. Reavley, Senior U.S. Circuit Judge for the Fifth Circuit, sitting by
designation.
against First Union National Bank ("First Union").

                          A. FACTS AND PROCEDURAL HISTORY

       Because this case is before us on appeal from a Federal Rules of Civil Procedure 12(b)(6)

dismissal for failure to state a claim, we limit ourselves to the allegations of the complaint, which

we are required to accept as true. Those allegations may turn out to be inaccurate, or there may be

additional facts which dictate a different result, but for now the factual boundary of this case is

marked by the metes and bounds of the complaint.

       The FedWire Fund Transfer System is an electronic funds transfer system which permits

large dollar fund transfers by computer-to-computer communications between banks. First Union

is a bank within the FedWire Fund Transfer System and uses "electronic storage" to maintain the

contents of an electronic funds transfer. On September 2, 1993, and November 30, 1993, First

Union received an electronic wire transfer of funds for credit to Lopez's account. On both occasions,

First Union provided United States law enforcement authorities with access to the contents of those

electronic transfers. First Union made these disclosures based solely on the "verbal instructions"

of federal law enforcement authorities.

       On February 3, 1994, a United States Magistrate Judge issued a seizure warrant directing

First Union to freeze Lopez's account and conduct an inventory of it. Pursuant to the seizure

warrant, First Union again provided United States law enforcement authorities access to the contents

of the electronic fund transfers sent to Lopez that were being held in electronic storage. On June

6, 1995, First Union surrendered the $270,887.20 balance of Lopez's First Union account to the

United States. The United States subsequently filed a civil forfeiture case against Lopez, which was

resolved by a stipulation that $108,359 of Lopez's account was forfeited to the United States while

$162,532.20 was returned to her.
       Following the resolution of the civil forfeiture case, Lopez filed suit against First Union

asserting claims under the Electronic Communications Privacy Act 18 U.S.C. §§ 2510 et seq.

(Counts I and II), the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq., (Count III), and

Florida law. (Count IV).

       First Union moved to dismiss the complaint pursuant to Rule 12(b)(6) for failure to state a

claim upon which relief can be granted. The district court granted the motion and dismissed Lopez's

complaint with prejudice. The district court's decision to dismiss the complaint was based

exclusively on its conclusion that the Annunzio-Wylie Anti-Money Laundering Act, 31 U.S.C. §

5318(g)(3), immunized First Union from liability. This appeal followed.

                                  B. STANDARD OF REVIEW

       We review de novo the dismissal of a complaint for failure to state a claim for relief,

accepting all allegations in the complaint as true and construing those allegations in the light most

favorable to the plaintiff. See Harper v. Thomas, 

, 103 (11th Cir.1993). A complaint

may not be so dismissed "unless it appears beyond doubt that the plaintiff can prove no set of facts

in support of his claim which would entitle him to relief." Pataula Elec. Membership Corp. v.

Whitworth, 

, 1240 (11th Cir.) (quoting Conley v. Gibson, 

, 45-46, 

, 102, 

(1957)).

                                          C. ANALYSIS

       As a preliminary matter, we first address First Union's arguments that Lopez's complaint fails

to state a claim under either the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510 et seq.,

("the ECPA") or the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq., ("the RFPA").1 We


   1
    Because the district court dismissed Lopez's complaint on the ground that the Annunzio-
Wylie Anti-Money Laundering Act immunized First Union from liability, it did not address
these issues. However, the parties have briefed them, and in view of our disagreement with the
will then address the additional issue of whether the Annunzio-Wylie Anti-Money Laundering Act,

31 U.S.C. § 5318(g)(3) immunizes First Union from liability.

                                1. Lopez's Claims Under the ECPA

        In 1986, Congress clarified the existence of privacy rights in electronic communications by

enacting the ECPA, which provides "protect[ion] against the unauthorized interception of electronic

communications." Sen. Rep. No. 99-541 at 3555. Among other things, the ECPA defines the

conditions in which an electronic communications service may divulge the contents of electronic

communications, see, e.g., 18 U.S.C. § 2702; 18 U.S.C. § 2711, defines the conditions in which the

government is entitled to access an individual's electronic communications, see 18 U.S.C. § 2703,

and provides a civil cause of action for anyone injured by a violation of the act's substantive

provisions, see 18 U.S.C. § 2707.

        In counts I and II of her complaint, Lopez alleges that First Union violated her rights under

the ECPA. In count I, she specifically alleges that First Union violated 18 U.S.C. § 2702(a)(1),

which provides that "a person or entity providing an electronic communication service to the public

shall not knowingly divulge to any person or entity the contents of a communication while in

electronic storage by that service." The complaint alleges that First Union provided an electronic

communication service and that First Union provided the United States access to "the contents of

information in electronic storage, including the contents of electronic communications pertaining

to ... Lopez."

        First Union contends that count I fails to state a viable claim under 18 U.S.C. § 2702(a)(1),

because it is not an electronic communication service. We reject that contention which amounts to




district court's dismissal of the complaint on Annunzio-Wylie grounds, judicial economy
counsels in favor of our addressing them.
nothing more than a denial of the allegations in Lopez's complaint. Accepting all allegations in the

complaint as true as we are required to do at this stage, we conclude that Count I states a violation

of 18 U.S.C. § 2702(a)(1).2

        In count II, Lopez alleges that First Union infringed her rights under the ECPA by violating

18 U.S.C. § 2703 and 18 U.S.C. § 2511(3)(a). Section 2703 defines the conditions in which an

electronic communication service may disclose electronic communications to the government. If

the electronic communication service has held the contents of an electronic communication in

electronic storage for one hundred eighty days or less, it may disclose that electronic communication

to the government only pursuant to a federal or state warrant. See 18 U.S.C. 2703(a). In Count II,

Lopez alleges that, on the same day funds were electronically transferred to her account, First Union

disclosed contents of those electronic funds transfers in electronic storage pursuant to "verbal

instructions" instead of a warrant. She also alleges that the disclosures were made on the same day

that funds were electronically transferred to her account, which means the communication disclosed

had been held in electronic storage for less than one hundred eighty days. Those allegations are

sufficient to state a prima facie claim under 18 U.S.C. § 2703.

        However, the allegations of Count II of the complaint are not sufficient to state a claim

under 18 U.S.C. § 2511(3)(a). That section provides that "an electronic communication service ...

shall not intentionally divulge the contents of any communication ... while in transmission on that

service to any person or entity other than an addressee or intended recipient of such

communication." 18 U.S.C. § 2511(3)(a) (emphasis added). That proscription is not violated unless



   2
    Nor does the fact that Congress amended the ECPA in 1996 to specifically exclude
electronic funds transfers from the definition of an "electronic communication," see 18 U.S.C. §
2510(15) (1996), prevent Count I from stating a claim under § 2702(a)(1). That amendment did
not take effect until 1996, well after the events giving rise to this case.
the communication is divulged "while in transmission." Neither Count II nor any other part of the

complaint alleges that First Union disclosed Lopez's electronic communications "while in

transmission." Instead, Count II alleges that First Union disclosed the contents of electronic

communications held in electronic storage.

       Alleging that First Union disclosed a communication held in "electronic storage," which

violates § 2702(a)(1), is not equivalent to alleging that First Union disclosed a communication in

"transmission," which would violate § 2511(3)(a). Because the complaint does not allege that First

Union disclosed communications while in transmission, it fails to state a claim under § 2511(3)(a).

                                 2. Lopez's Claim Under the RFPA

       In United States v. Miller, 

, 443, 

, 1623, 

(1976),

the Supreme Court held that individuals have no Fourth Amendment expectation of privacy in their

financial records while those records are in the hands of third parties. That decision prompted

Congress to enact the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq., ("the RFPA"),

which provides individuals with some privacy rights in financial records that are in the hands of

third parties. Among other things, the RFPA defines the conditions in which financial institutions

may disclose an individual's financial records, see 12 U.S.C. § 3403, defines the conditions in which

government officials may access an individual's financial records, see 12 U.S.C. § 3402, and

provides a civil cause of action for anyone injured by a violation of the act's substantive provisions,

see 12 U.S.C. § 3417.

        In count III of her complaint, Lopez alleges First Union violated her rights under the RFPA

by disclosing her financial records under conditions not authorized by the RFPA. First Union does

not argue that Lopez has failed to allege a prima facie violation of the RFPA. Instead, it contends

that count III should be dismissed because the alleged disclosures are protected by 12 U.S.C. §
3403(c), another section of the RFPA. Under § 3403(c), a financial institution possessing

information relevant to a possible violation of law involving one of its accounts is permitted to make

a disclosure of that information to law enforcement. However, the disclosure permitted is limited

to the name of the account holder and "the nature of any suspected illegal activity." 12 U.S.C. §

3403(c). Because the complaint alleges that First Union went beyond that and disclosed actual

financial records pertaining to Lopez's account (i.e., the electronic funds transfers communications,

the contents of which were held in electronic storage), First Union's alleged disclosures are not

protected by 12 U.S.C. § 3403(c). Accordingly, count III of Lopez's complaint states a claim under

the RFPA.

                        3. The Annunzio-Wylie Anti-Money Laundering Act

        The Annunzio-Wylie Anti-Money Laundering Act of 1992, 31 U.S.C. § 5318(g), provides

in relevant part:

        (g) Reporting of suspicious transactions.—

                (1) In general.—The [Treasury] Secretary may require any financial institution, and
        any director, officer, employee, or agent of any financial institution, to report any suspicious
        transaction relevant to a possible violation of law or regulation.

                (2) Notification prohibited.—A financial institution, and a director, officer,
        employee, or agent of any financial institution, who voluntarily reports a suspicious
        transaction, or that reports a suspicious transaction pursuant to this section or any other
        authority, may not notify any person involved in the transaction that the transaction has been
        reported.

                  (3) Liability for disclosures.—Any financial institution that makes [i.] a disclosure
        of any possible violation of law or regulation or [ii.] a disclosure pursuant to this subsection
        or [iii.] any other authority, and any director, officer, employee, or agent of such institution,
        shall not be liable to any person under any law or regulation of the United States or any
        constitution, law, or regulation of any State or political subdivision thereof, for such
        disclosure or for any failure to notify the person involved in the transaction or any other
        person of such disclosure.

The three safe harbors provided by § 5318(g)(3) supply an affirmative defense to claims against a
financial institution for disclosing an individual's financial records or account-related activity.

Financial institutions are granted immunity from liability for three different types of disclosures:

        (i.) A disclosure of any possible violation of law or regulation,

        (ii.) A disclosure pursuant to § 5318(g) itself, or

        (iii.) A disclosure pursuant to any other authority.

See 31 U.S.C. § 5318(g)(3).

        The district court dismissed Lopez's complaint after concluding that the safe harbor

provisions of § 5318(g)(3) protected First Union's disclosures of her account activity. Lopez

contends that the district court's holding is erroneous for two reasons. First, she contends that §

5318(g)(3)'s safe harbor provisions apply only to disclosures of currency transactions. If that is true,

First Union's disclosure of electronic transfers and the contents of transfers held in electronic storage

are not protected by any of the safe harbor provisions of § 5318(g)(3). Second, Lopez contends that

even if the Act does cover more than currency transactions, First Union's disclosures do not fall

within one of the three categories of disclosures for which § 5318(g)(3) grants immunity.

Addressing Lopez's contentions in turn, we disagree with the first one but agree with the second.

    a. Does § 5318(g)(3) Apply to Disclosures of Electronic Transfers and Contents Held in
Electronic Storage?

        Lopez's contention that § 5318(g)(3) protects disclosures of currency transactions only is

at odds with the text and purpose of the Annunzio-Wylie Act. The text of § 5318(g)(3) neither

explicitly nor implicitly suggests that Congress intended to limit the safe harbor to disclosures of

currency or to any specific kind of transaction. To the contrary, the text of that subdivision indicates

Congress deliberately did not limit the safe harbor to disclosure of any specific type of transaction.

For example, § 5318(g)(3) provides that a financial institution is entitled to immunity for a

disclosure of "any possible violation of law." 31 U.S.C. § 5318(g)(3) (emphasis added). As we have
recently had occasion to explain, when used in a statute, "the adjective "any' is not ambiguous; it

has a well-established meaning." Merritt v. Dillard Paper Company, 

, 1186 (11th

Cir.1997). "Read naturally, the word "any' has an expansive meaning, that is, one or some

indiscriminately of whatever kind." 

States v. Gonzales, --- U.S. ----, ----, 

, 1035, 

(1997) (citation and some quotation marks omitted). Thus §

5318(g)(3) protects disclosure of a violation of law regardless of whether it involves a cash

transaction, electronic transfers, or any other type of transaction. Section 5318(g)(3)'s scope is not

limited merely to disclosures of currency transactions.

       Moreover, we agree with the district court that the purpose underlying the Act is inconsistent

with Lopez's proposed construction. The district court reasoned as follows:

       [A]ccording to the comments of Congressman Neal regarding the enactment of 31 U.S.C.
       § 5318(g), banks have long been encouraged to report suspicious transactions to the
       appropriate authorities. See Cong.Rec. E57-02 (1993). Therefore, to ensure compliance
       from the banks, the safe harbor provision was added in order to protect a bank when it
       reports a suspicious transaction. 

of this new law is to have banks work with
       international efforts to stop the global movement of drug money. Money laundering is an
       international problem. Money knows no borders and flows freely from one country to
       another. The United States has long recognized that, and has worked hard to ensure
       cooperation from foreign governments and financial institutions to assure that money
       launderers have no place to hide." 

finds that if Congress intended to limit this statute solely to "currency
       transactions" as asserted by Plaintiff, it would severely restrict the ability of a bank to report
       suspicious transactions without the fear of liability. As Plaintiff notes in her response to
       Defendant's motion, "[i]n 1994, some 72 million fund transfers with a total value of $211
       trillion were moved over Fedwire." Plaintiff's Response Memorandum, p. 11 n. 8, citing
       Fedpoint 43. Thus, the effectiveness of the anti-money laundering act would be substantially
       limited if it applied only to cash transactions, since electronic fund transfers, the contents of
       which are held in electronic storage, are the means by which large dollar funds are
       transferred between the Federal Reserve and the service providers (i.e., originating banks,
       intermediary banks, and beneficiary banks)

Lopez v. First Union National Bank, 

, 864 (S.D.Fla.1996).

       Accordingly, we hold that electronic fund transfers and information held in electronic storage
are not outside the scope of the Annunzio-Wylie Anti-Money Laundering Act's safe harbor

provisions, 31 U.S.C. § 5318(g)(3).

     b. Are First Union's Disclosures Protected By § 5318(g)(3)'s Safe Harbor Provisions?

          The Annunzio-Wylie Act does not provide a financial institution blanket immunity for any

disclosure of an individual's financial records. Instead, a financial institution is entitled to immunity

only if its disclosure falls within one of the three safe harbors set forth in § 5318(g)(3). Lopez's

complaint alleges that First Union disclosed Lopez's financial records twice in response to nothing

more than "verbal instructions" of government officials and once pursuant to a seizure warrant.

Under the facts alleged in Lopez's complaint, First Union's two disclosures in response to "verbal

instructions" of government officials do not fit within any of § 5318(g)(3)'s three safe harbors.

However, its disclosure pursuant to the seizure warrant is protected by § 5318(g)(3)'s third safe

harbor.

          The first safe harbor provision protects a financial institution's "disclosure of any possible

violation of law or regulation." 31 U.S.C. § 5318(g)(3). As the use of the adjective "possible"

indicates, a financial institution's disclosure is protected even if it ultimately turns out there was no

violation of law. In order to be immune from liability, it is sufficient that a financial institution have

a good faith suspicion that a law or regulation may have been violated, even if it turns out in

hindsight that none was. By extending immunity to a financial institution's disclosure of a suspected

violation of law or regulation, the first safe harbor encourages financial institutions to voluntarily

play a role in combating money laundering and other crimes.

          The problem for First Union at this stage of the litigation is that it is stuck with the

allegations of the complaint. Those allegations do not show that First Union had a good faith

suspicion that a law or regulation may have been violated. None of the allegations indicate that the
transactions associated with Lopez's accounts were suspicious enough to suggest a possible violation

of law. First Union contends, however, that the first safe harbor should protect disclosures made

in response to "verbal instructions" of government officials. It argues that law enforcement's

demand for financial records should, by itself, be sufficient to give a financial institution a good faith

basis to suspect a possible violation of law or regulation. The hidden premise of that argument is

that Congress intended the first safe harbor to protect disclosures made pursuant to government

officials' unexplained request or unvarnished instructions for financial records. That premise is

flawed.

          As we will discuss below, the second and third safe harbors protect from liability in

situations where the government has and exercises the legal authority to demand disclosure of

financial records. If we accepted First Union's premise that Congress intended the first safe harbor

to protect disclosures made pursuant to any and all government demands, it would render the other

two safe harbor provisions superfluous. Following the basic principle of statutory construction "that

a statute should not be construed in such a way as to render certain provisions superfluous or

insignificant," Woodfork v. Marine Cooks & Stewards Union, 

, 970 (5th Cir.1981), we

reject First Union's contention that the first safe harbor protects disclosures made in response to

nothing more than "verbal instructions" of government officials.

          Having concluded that the first safe harbor provision does not protect First Union from

liability for the alleged disclosures, we turn now to the second. The second safe harbor provision

protects a financial institution's "disclosure pursuant to this subsection." 31 U.S.C. § 5318(g)(3).

Disclosures "pursuant to this subsection" are disclosures required by the Office of the Treasury

Secretary under the rule-making authority vested in the Treasury Secretary by 31 U.S.C. §

5318(g)(1), which provides:
        The [Treasury] Secretary may require any financial institution, and any director, officer,
        employee, or agent of any financial institution, to report any suspicious transaction relevant
        to a possible violation of law or regulation.

In February 1996, the Treasury Secretary issued regulations under this sub-section. See 31 C.F.R.

§ 103.21 (1996); see also 61 Fed.Reg. 4331 (1996). The second safe harbor protects any

disclosures required by those regulations.

        However, the complaint alleges that First Union's disclosures occurred in 1993 and 1994.

Because the Treasury Secretary's regulations under § 5318(g)(1) were not in effect at the time those

alleged disclosures were made, the second safe harbor provision cannot immunize First Union's

disclosures.

        The third safe harbor provision protects a financial institution's disclosure pursuant to "any

other authority." 31 U.S.C. § 5318(g)(3). Because the second safe harbor protects disclosures

pursuant to the legal authority of the Treasury Secretary's regulations, "other authority" means

authority other than the Treasury Secretary's regulations. The "other authority" must be legal

authority, because authority means "[r]ight to exercise powers," Black's Law Dictionary 133 (6th

Ed.1991), and in our system based on rule of law, the right to exercise power is derived from law,

e.g., statutes, regulations, court orders, etc. Hence, for a financial institution's disclosure to fall

within the confines of the third safe harbor, the financial institution must be able to point to a statute,

regulation, court order, or other source of law that specifically or impliedly authorized the

disclosure. If it cannot do so, the disclosure is not entitled to the protection of the safe harbor.

        The complaint alleges that First Union disclosed Lopez's financial records twice in response

to "verbal instructions" of government officials and once in response to a seizure warrant. Clearly,

a disclosure in response to a seizure warrant is protected by the third safe harbor. The seizure

warrant represented a judicial determination that the government had a legal right to obtain Lopez's
financial records. First Union was neither required nor permitted to sit in review of the court's legal

determination. It is immune from any liability for any disclosures made pursuant to the seizure

warrant, which was issued on February 3, 1994.

         However, First Union's earlier disclosures are a different matter, because disclosures in

response to nothing more than the "verbal instructions" of government officials are not protected by

the third safe harbor. They are not, because under existing law and regulations, a government

official's verbal instructions do not constitute legal authority. First Union fails to identify any statute

or regulation which gives a government official's verbal request to access an individual's financial

records the force of law. Nor does First Union point to a statute or regulation authorizing a financial

institution to release an individual's financial records in response to mere verbal instructions of

government officials. We can find nothing in the Annunzio-Wylie Act which entitles government

officials to gain access to financial records simply by verbal request. Therefore, because the facts

alleged in the complaint do not show First Union acted pursuant to any legal authority when it

released Lopez's financial records, the third safe harbor provision does not protect First Union's

disclosures.

        We also reject First Union's argument that its disclosures of Lopez's account activity were

made pursuant to "other authority" because there were regulations, see e.g. 12 C.F.R. § 21.11 (1989),

in effect at the time disclosures were made that required reporting suspicious transactions. That

argument simply overlooks the fact that on a motion to dismiss, we are bound to consider only the

facts alleged in the complaint. Lopez's complaint does not allege that Lopez's transactions were

suspicious or were viewed as suspicious by First Union.

        In sum, we hold that First Union's disclosures of Lopez's financial records in response to

nothing more than the "verbal instructions" of government officials are not protected by §
5318(g)(3)'s safe harbors, except that its disclosure pursuant to the seizure warrant is protected by

the third safe harbor. Because the district court erred in dismissing Lopez's complaint, we reverse

its judgment.

                                   II. THE CORONADO CASE

       We turn now to the case brought by Jose Daniel Ruiz Coronado and the approximately

eleven hundred account holders ("the Account Holders") he wants to represent in this attempted

class action lawsuit against BankAtlantic Bancorp Inc. ("BankAtlantic").3

                           A. FACTS AND PROCEDURAL HISTORY

       This case, like the Lopez case, is here on appeal from a Rule 12(b)(6) dismissal. As we

stressed in our discussion of the Lopez case, at this stage the facts are limited to the allegations in

Coronado's complaint, which we must accept as true.

       Again, the FedWire Fund Transfer System is an electronic funds transfer system which

permits large dollar fund transfers by computer-to-computer communications between banks.

BankAtlantic is a bank within the FedWire Fund Transfer System and uses "electronic storage" to

maintain the contents of the electronic funds transfer.

       In June 1995, BankAtlantic notified federal agents concerning the "unusual amounts" and

"unusual movements" of money at the bank. Thereafter, BankAtlantic provided federal agents

access to the "detailed contents of financial information in electronic storage, including the contents

of electronic communications, pertaining to the Account Holders." Federal agents subsequently

"seized the Account Holders' accounts upon allegations of money laundering." Eventually, the

federal agents released 400 to 600 of the Account Holders' accounts because they had "no




   3
    Coronado's complaint was dismissed before a hearing on class status could be held.
connection with money laundering."4

        Subsequently, Coronado, on behalf of himself and the Account Holders, filed a class action

suit against BankAtlantic, asserting claims under the Electronics Communications Act 18 U.S.C.

§§ 2510 et seq. (Counts I-IV), the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq., (Count

V), and Florida law. (Count VI). BankAtlantic moved to dismiss the complaint for failure to state

a claim upon which relief can be granted pursuant to Rule 12(b)(6). The district court granted the

motion and dismissed Coronado's complaint with prejudice. The decision to dismiss the complaint

was based exclusively on its conclusion that the Annunzio-Wylie Anti-Money Laundering Act, 31

U.S.C. § 5318(g), immunized BankAtlantic from liability. This appeal followed.

                                           B. ANALYSIS

        The sole issue we must decide is whether BankAtlantic's disclosure of information pertaining

to the Account Holders' accounts is protected by the safe harbor provisions of § 5318(g)(3).5

        BankAtlantic argues that its disclosure falls within § 5318(g)(3)'s first safe harbor—a

"disclosure of any possible violation of law." It asserts that the facts alleged in Coronado's

complaint indicate that BankAtlantic suspected a violation of law based on its detections of "unusual

amounts" and "unusual movements" of money in the bank and that it disclosed the information from

the Account Holders' accounts as a result of those detections. BankAtlantic maintains that under

those facts, its disclosures are protected by the first safe harbor.

        That argument sounds good, but we are required to construe the complaint in the light most

favorable to Coronado and not dismiss it unless there is no set of facts he could prove that would



   4
    The complaint does not specify whether Coronado's account was among those released.
   5
   BankAtlantic did not contend, either before the district court or on appeal, that the complaint
should be dismissed because it failed to state a claim under the ECPA or the RFPA.
entitle him to relief, i.e., which would deny BankAtlantic the immunity it seeks from the first safe

harbor. The complaint alleges that BankAtlantic disclosed the protected account information of

1,100 accounts after it detected "unusual amounts of money in the bank" and "unusual movements

of money at the bank" (emphasis added). Construed in the light most favorable to Coronado, the

allegations that BankAtlantic detected suspicious activity "in" and "at" the bank could mean that

BankAtlantic detected suspicious activity in only one account or a few accounts.                 But if

BankAtlantic detected suspicious activity in only one account, it may well not have had a good faith

basis to suspect a violation of law in the remaining 1,099 accounts, and the same is true if the

suspicious activity was in only a few accounts.

        Of course, we could continue this exercise and come up with any number of hypotheticals

in which the complaint's allegations do not show that BankAtlantic's disclosures of all the accounts

are protected by the first safe harbor. But the more important and generalizable point is this: the

allegations in the complaint, construed in the light most favorable to Coronado, do not show that

BankAtlantic determined in good faith that there was any nexus between the suspicious activity it

detected and the information it disclosed from more than a thousand accounts. In order for §

5318(g)(3)'s first safe harbor to protect a financial institution's disclosures, there must be some good

faith basis for believing there is a nexus between the suspicion of illegal activity and the account or

accounts from which information is disclosed. If it were otherwise, a bank would have free license

to disclose information from any and every account in the entire bank once it suspected illegal

activity in any account at the bank. We do not think Congress intended such a drastic result which

would needlessly strip away any right or expectation of privacy in financial records and effectively

undo virtually all of what Congress did when it enacted the Right to Financial Privacy Act and the

Electronic Communications Privacy Act. Therefore, BankAtlantic's disclosures, as they are
described in the complaint read in the light most favorable to Coronado, are not protected by §

5318(g)(3)'s first safe harbor provision.6

       We caution, however, that our holding should not be read to mean that the only accounts that

can be disclosed are those actually reflecting the unusual movements of money. There could be

instances in which unusual movements or other suspicious activity in an account provides a

reasonable basis for disclosing other accounts. We will not attempt to list circumstances in which

there could be a good faith basis for believing that a nexus existed between the suspicious activity

in one account and other accounts. It is enough for present purposes that no such basis is apparent

in the complaint.

        BankAtlantic also argues that its disclosure falls within § 5318(g)(3)'s third safe harbor—a

disclosure pursuant to "any other authority." Specifically, BankAtlantic claims its disclosures were

authorized by 12 C.F.R. § 563.180 (1994), which requires banks to "promptly notify appropriate law

enforcement authorities" after discovering "suspected criminal acts." Again, however, there must

be some good faith basis for believing there is a nexus between the suspicion of illegal activity and

the account or accounts from which information is disclosed. Thus, BankAtlantic's disclosures, as

they are described in the complaint read in the light most favorable to Coronado, are not clearly

within § 5318(g)(3)'s third safe harbor provision.

       Because we conclude that BankAtlantic's disclosures are not protected by § 5318(g)(3), the

district court's dismissal of Coronado's complaint is due to be reversed.



   6
    We note that if the allegations in the complaint specifically identified the accounts in which
BankAtlantic detected suspicious activity and any additional accounts with a nexus to them,
BankAtlantic would be entitled to partial Rule 12(b)(6) relief because a disclosure of those
accounts would be protected by the first safe harbor. However, the complaint does not so
identify the accounts, therefore this issue will have to be resolved at a later stage in the
proceedings.
                                   III. CONCLUSION

      The district court's dismissal of Lopez's complaint is REVERSED, and the case is

REMANDED for further proceedings consistent with this opinion.

      The district court's dismissal of Coronado's complaint is REVERSED, and the case is

REMANDED for further proceedings consistent with this opinion.